RedMax EXtreme EX-LRT Průvodce řešením problémů stáhnout pdf (Strana 60)

Oracle SBC Security Guide

avalanche from untrusted sources, temporary promotion based on the initial REGISTER request sent from

a specific source helps minimize the amount of time it will take to promote the collective untrusted

sources, to trusted sources, effectively restoring service in the event of an outage as quickly as possible.

This is also referred to as: minimizing the convergence time. The addition of any SIP option relevant to

DDoS, including reg-overload-protect, would require additional testing. For customers with specific

convergence requirements, additional research must be conducted to arrive at an appropriate DDoS

configuration prior to deployment.

A limitation of the configuration parameters described in this appendix is the handling of SIP message

spoofing. When a trusted user is “spoofed" by another user or a defective trusted user sends many SIP

messages, the CPU utilization of the SBC may spike to 100%. One safe-guard implemented as part of this

appendix is the establishment of a setting for maximum-signaling-threshold, defined in the realm-

configuration object. When set, this provides an entry level amount of protection by removing a violating

source from the trusted queue once the defined threshold is exceeded. To further handle this scenario,

there are additional advanced DDoS configurations that can be set. For example: if the desired outcome is

to deny violating sources from the hardware level, the access-control-trust-level should be set to “low”

in the realm-configuration object. This also requires the configuration of the untrusted-signal-threshold

to properly demote offending untrusted users to the deny list. If one wishes to move an endpoint back into

the untrusted queue the access-control-trust-level of “medium” should be used.

The DDoS configuration recommendations in this appendix are meant as a general baseline to help

protect the SBC from DDoS. For more complete protection, DDoS configurations should be determined

by the examining the applicable environment and customizing based on the environment driven traffic

flows and load levels.

1 2 ... 55 56 57 58 59 60 61 62 63 64 65 ... 141 142

Žádné komentáře

RedMax EXtreme EX-LRT Průvodce řešením problémů Strana 60