WIXLIB

SIP Trunking –Customer OverviewAN ALLSTREAM WHITE PAPER

Table of ContentsWelcome. 1SIP Security Recommendations. 1Prepare Your LAN for VoIP . 2Environment Setup for SIP Trunking Over Internet(Allstream or Third-Party) . 2PBX Connectivity Set-Up . 3Firewall Set-Up . 4Environment Setup for SIP Trunking Over MPLS VPN . 4PBX Connectivity Set-Up . 4DHCP Considerations . 4Programming the IP PBX . 5SIP Specifications . 5RTP Media Specifications . 6About Allstream.7

SIP TRUNKING CUSTOMER OVERVIEWAN ALLSTREAM WHITE PAPERWelcomeWe are confident that our service will help increaseyour organization’s performance and productivitywhile keeping a lid on your costs.Summarized below is some important technicalinformation that you or your integrator must knowregarding how SIP Trunking works, and parametersthat your equipment needs to adhere to in order toeffectively work with the service. Please ensure thatyour equipment is configured to support theseparameters. If you have any further questions orrequire assistance, please contact your AccountRepresentative and again, Welcome to Allstream!Administration Remove any direct external (public/internet)access to administration features Internet Access Enable firewall features on PBX if available SIP SecurityRecommendationsA VoIP switch is a crucial component of yourbusiness that much like a server with critical datarequires attention to ensure its operation andavailability is not impacted by hackers, hacktivists,competitors and others attempting to gain accessto free services or impact the services you have.It’s essential that the PBX manufacturer’s hardeningrecommendations be followed when connectingyour PBX to public or Internet resources such as SIPtrunks or phones. Included are some initialrecommendations. Suffice it to say that connectingyour PBX directly to the Internet without a firewall orSBC (Session Border Controller) is not manufacturerrecommended except for the very few PBX’s thatcome equipped with such capabilities. Doing so willmost likely result in possible fraudulent longdistance charges as well as costly professionalservices to properly re-configure orre-install and harden the PBX.Use complex non-dictionary passwordsChange passwords every quarterEnsure external/public admin access is onlyavailable via secure (IPSec, SSL-VPN, etc)authenticated connection to the firewall orother security device Add or connect to the Internet via a statefulfirewall or SBCChange passwords every quarterAdd filters to only allow connectivity to andfrom SIP providerSystem Disable unused services where applicable If Wireless is available used WPA2 with complexpasswordMonitor system regularly for fraudOperations Upon deployment, scan your Internet presence(i.e. IP range) for vulnerabilities Repeat vulnerability scans every quarterPatch and secure the PBX as recommended bythe manufacturerRemote Users Cell phones/tablets to have automatic lockoutsto prevent fraudulent use if lost or stolen Laptops are to have screen lockout and driveencryption where possibleLimit remote user capabilities such asforwarding featuresWhere possible encrypt voice connections toreduce unauthorized monitoring1

SIP TRUNKING CUSTOMER OVERVIEWAN ALLSTREAM WHITE PAPERPrepare Your LAN for VoIPWhen moving to a converged environment running both voice and data over IP, your LAN environmentmust be prepared to carry real-time voice traffic. This preparation typically focuses on two key areas: Establishment of Virtual LANs (VLANs) for voice traffic, andEstablishment of Class of Service (CoS) handling for voice trafficIt is highly recommended that voice and datapackets be separated into distinct VLANs withinthe LAN environment. This improves utilizationof system resources by reducing broadcasttraffic and prevents possible congestionconditions of one traffic type from affectingother traffic. Not utilizing VLANs may result inpoor voice quality, high packet loss, client toserver communication issues, and lost callcontrol.VLAN & QOSVLAN & QOSENABLED LINKALLSTREAM CPEENABLED SWITCHPRIORITY VLANALLSTREAMVOICE VLANSERVERS VLANUSERS VLANLAN environment using VirtualLANs and Class of ServiceUse of Class of Service (CoS) marking for traffic in the LAN is also recommended when preparing for a VoIPimplementation. Layer 2 Ethernet switches must support the IEEE 802.1p standard to provide CoS. Thisstandard is part of the IEEE 802.1Q (IEEE, 2005) which defines the architecture of virtual bridged LANs(VLANs). CoS allows switches to distinguish packets and packet flows from each other assigning labels toindicate the priority of packets. CoS enables packets to comply with configured resource limits andprovides preferential treatment in situations where resource contention occurs. Without CoS enabled inthe Lan switch, bandwidth contention may contribute to packet loss and latency resulting in poor voiceperformance.Environment Setup for SIP TrunkingOver Internet (Allstream or Third-Party)For Canada Customers connecting over InternetSBC Signaling & Media IPMarkhamCalgary74.216.209.100172.110.72.60For US Customers connecting over InternetPortland SBCSalt Lake SBCFQDNFQDN2

SIP TRUNKING CUSTOMER OVERVIEWAN ALLSTREAM WHITE PAPERPBX Connectivity Set-UpThe following three configurations are supported for Customer LAN deployment with Allstream SIPTrunking:Configuration 1: PBX Connectivity using Public IP – no NATIn this scenario, the PBX or VoIP equipment is accessible via the public Internet. The customer is not usingNAT for VoIP traffic, so no NAT compensation occurs between the Allstream SBC cluster and the customerPBX. The following diagram is an illustration of this scenario.The public IP address used by the customer must be static, and the subnet is assigned by the ISP. The IPaddress and subnet information of the Allstream-facing VoIP equipment must be provided as part of theSIP Trunking Internet order.74.13.23.1/30STATIC & PUBLIC IPADDRESS 74.13.23.2INTERNETROUTERALLSTREAMSBCsPBX Connectivity using Public IP – no NATConfiguration 2: PBX Connectivity using NATwith Application Layer Gateway (ALG)Some customers may deploy an Application LayerGateway (ALG). The primary purpose of an ALG is tomanipulate or translate IP address information inthe application layer. More specifically, the functionof the ALG would replace the private IP address inthe SIP Invite and SDP message with the NAT’dpublic IP address for any outgoing traffic. Similarly,for any incoming traffic from the PSTN to thecustomer network, the ALG would replace thepublic IP address informationin the SIP Invite and SDP with the private IP addressinformation. In this configuration, the static public IPaddress of the Allstream-facing router (in thisexample 74.13.23.1) must be provided to Allstreamwith the SIP Trunking Internet order.STATIC & PRIVATE IPADDRESSPRIVATE SUBNETASSIGNED BY NATROUTER.3574.13.23.1/30.15.16EXAMPLE: 192.168.1.0/24PRIVATE IP:192.168.1.1INTERNETALLSTREAMSBCsROUTER WITH NAT & ALG(MODIFIES LAYER 3 & 7INFORMATION)PBX Connectivity using NAT with ALGConfiguration 3: PBX Connectivity using NATwithout ALGIn this configuration, the customer does not havetheir own ALG, and uses a router that performs NATat layer three. All outgoing (private) traffic is NAT’dto a public IP address assigned by the customer’sISP (typically the IP of the WAN Interface on therouter, or an unused IP address in the providedblock). For this configuration, the private IP of thecustomer PBX (in this example 192.168.1.35) mustalso be provided to Allstream in order for theAllstream SBC to communicate with the PBX.Therefore, both the static public IP address of theAllstream-facing router (in this example 74.13.23.1)AND the static private IP address of the VoIPequipment must be provided as part of the SIPTrunking Internet order.STATIC & PRIVATE IPADDRESSPRIVATE SUBNETASSIGNED BY NATROUTER.3574.13.23.1/30.15.16EXAMPLE: 192.168.1.0/24PRIVATE IP:192.168.1.1INTERNETALLSTREAMSBCsROUTER WITH NAT ANDNO ALG (MODIFIESLAYER 3 INFORMATION ONLY)PBX Connectivity using NAT without ALG3

SIP TRUNKING CUSTOMER OVERVIEWAN ALLSTREAM WHITE PAPERFirewall Set-UpIf your environment is protected from the Internet by a firewall, settings must be configured on yourfirewall to allow for SIP Trunking signaling and media to pass through: Adjust firewall to allow signaling and media to be received from the Allstream Session BorderController at the IP address ranges provided in section aboveAllow for SIP signaling utilizing TCP/UDP on port 5060Allow for RTP media utilizing UDP on ports 16384 to 64000Environment Setup for SIP TrunkingOver MPLS VPNAllstream’s SIP Trunking platform comprises oftwo fully redundant pairs of SBCs located atgeographically diverse locations (Markham andCalgary) and dedicated for SIP Trunksestablished over MPLS VPN. This architectureprovides unparalleled robustness, reliability andsecurity. Each SBC appears like another site inthe customer VPN. Public IP addresses assignedfor the SBC SIP interface are not advertised andare not accessible over public Internet. Eachcustomer’s SIP traffic over MPLS stays totallyprivate through dedicated VRFs / VLANs.For Customers connecting over MPLSSBC Signaling & Media IPMarkhamCalgary172.110.64.132172.110.73.228PBX Connectivity Set-UpPBX Connectivity via Private IP VPN NetworkIn this configuration, the PBX communicateswith the Allstream SBC over a private MPLS VPN.This arrangement is similar to Configuration 1above, since no NAT is required, and alladdressing is contained in a private customerVPN. Customer LAN addressing may be staticallyassigned or assigned via DHCP.STATIC & PRIVATE IPADDRESSPRIVATE SUBNETASSIGNED BYCE ROUTER.35.15.16EXAMPLE: 10.10.1.0/24MPLS WAN10.10.1.1ALLSTREAMSBCsALLSTREAMROUTERPBX Connectivity via Private IP VPN NetworkDHCP ConsiderationsVoIP requires that all endpoints including phones are assigned unique IP addresses. When using NAT,customer must ensure that all endpoints are assigned either static IP addresses or addresses via DynamicHost Configuration Protocol (DHCP) within the LAN environment. Allstream does not provide DHCPservices from the CE router. If customer is not using NAT (using public addresses for the VoIP network),ensure that all SIP endpoints which will communicate directly with Allstream SBCs are assigned static IPaddresses within the subnet provided by the ISP.4