Category: Networking

We all are familiar with the term ‘firewall’ but majority of us don’t know the source of its origination. It is actually a terminology used for describing a part of automobile that separated the automobile’s interior from the compartment of engine. In the world of network this term is used metaphorically to show the way internal networks are separated from the hazards of external world. With the help of firewalls the networks are divided into various physical networks and as a result of this the occurrence of potential damages can be controlled otherwise these damages can spread to different subnets.

This works in the same way as the original firewalls worked to stop the spreading of a fire.

Internet standard MIME is able to extend the e-mail format for the purpose to support the following things as text, non-text attachment, a message organization with manifold parts and non-ASCII header information. The existence of MIME protocol has become very important because SMTP as basic e-mail transmission protocol can support only 7-bit of ASCII characters set. But MIME as Presentation layer protocol can hold up 8-bit binary content by describing the ways of sending certain types of data via an electronic mail.

We can protect our voice network with simple Auxiliary VLAN but sometimes to be more secure Auxiliary VLAN are not enough. In this case we can use Security appliances such firewalls or VPN termination devices or both.

Firewall maybe seems like very clean and simple mechanism to protect RTP protocols transmitted voice packets but there’s a problem. Protecting voice networks with a firewall is not so simple because we are not sure what UDP port will be used by the RTP voice packets flow.

If we look at some Cisco network architecture and Cisco device environment, a UDP port for an RTP stream is an random port selected from the pool of 16,384 to 32,767. We surely don’t want to open all those ports on firewall just to be sure that the VoIP will function well. So many open ports may be seen from other side like a bunch of security holes.

Ways to ensure the voice network security are many. In this article we will se the first of them that must be configured in every serious network. Implementing Auxiliary VLANs will make VoIP Networks more secure using separated VLANS for data traffic and voice.

Voice and data traffic will be transferred in the same way across the same cable and same switch by default. That means that calls and all other network traffic will be transferred in the same time in the same way and every user on the network will be able to see that data using some network sniffing tool like Wireshark. This default network setting may be used to capture call packets that are crossing the network and attacker can reproduce the call in .mp3 or some other sound format. We need to separate voice network from data network completely in order to make impossible to sniff call packets from user computer. 

We mentioned earlier all different attacks that can be focused to our VoIP network. Now is the time to see how we can apply different protection methods to avoid VoIP quality mitigation that can be started by all those attacks.

Separating voice traffic from data traffic with voice VLANs or by use of VPNs and firewall to protect voice traffic can easily prevent basically all most common attacks. One more thing that is important and often ignored is the security of voice endpoints and servers that can be increased with some simple configuration changes.