topic Re: Securing VCS Expressway in Collaboration Applications

Securing VCS Expressway

pbzijerveld — Mon, 17 Sep 2012 12:10:33 GMT

Hi All,

Our customers are reporting more and more hack attempts on their VCS expressways, untill now unsuccessfull. But to be on the extra safe side i would like to check every installation if its still secure.

To check this i have a few questions:

1. Is there a way that the VCS expressway can hide its identity in the SIP messages? If i do a Trace on the packetflow i see in clear text, "VCS expressway version X7.1" . Can we hide this announcement?

2. Is there a way to set the TLS/HTTPS cipher to high instead of medium? Or can we use TLS version 1.2? (Patch for BEAST attack)

4. Does the advanced account security license solve DDOS attacks or brute force attacks?

5. Can i lower the connection established timer of the VCS expressway? e.g: If i build a session and then force to break the connection without a proper BYE message, its possible to fillup all the call licenses because the established connections don't timeout very fast.

6. Is there documentation about a high security installations and considerations? the VCS deployment guides don't show very high security designs.

Thank you for your time and answers!

Re: Securing VCS Expressway

rdahl — Mon, 17 Sep 2012 14:01:40 GMT

Have you looked at the X.7.2 guide for VCS? A lot of security measures are outlined there.

http://tools.cisco.com/search/JSP/search-results.get?strQueryText=x7.2&SearchAllcisco.com=cisco.com&language=en&country=US&thissection=f&accessLevel=Guest

Thank you,

Rick Dahl

Cisco - CSE - Business Video

video or email: rdahl@cisco.com

Phone: 408.894.5112

Partner Communities is a great resource for reference, if you don't find, please ask!

https://communities.cisco.com/community/partner/collaboration/bizvideo

Call me on video – download Jabber for free https://www.ciscojabbervideo.com/rdahl@cisco.com

Re: Securing VCS Expressway

Michael Boscia — Mon, 17 Sep 2012 14:08:08 GMT

When customers have asked questions at Cisco Live! about concens like this, the short answer is introduce an IPS into the ASA/FW solution that protects the outside interface of the VCS-E.

Re: Securing VCS Expressway

pbzijerveld — Mon, 17 Sep 2012 14:32:26 GMT

Hi Richard,

Thank you for your answer. I have read the admin guide and have read about the general concepts of security and dual network interface but the real threads like DDOS are not discussed. It would like to know how Cisco sees the best and secure possible setup. Maybe with searchrules and transforms.

Re: Securing VCS Expressway

pbzijerveld — Mon, 17 Sep 2012 14:33:40 GMT

Hi Michel,

That is an answer, but does it solve the weakness in TLS 1.0 and 1.1 for example?

Re: Securing VCS Expressway

rdahl — Mon, 17 Sep 2012 16:12:13 GMT

Does this help?

http://blogs.cisco.com/security/beat-the-beast-with-tls/

Re: Securing VCS Expressway

admin11111 — Mon, 17 Sep 2012 18:06:59 GMT

DDoS is really a concern. If someone intentionally wants to do a DDoS it can.

The VCS has the Loop Detection mechanism, but if the DDoS change source and destination at each attempt and send for example 100 attempts concurrently, this will cause a DDoS and up to now i couldn´t found a way to deny this directly on VCS config. Note that a license is granted after a search rule matches, so, for the most part of attempts, you can block it using CPLs.

The DDoS problem happen if a destination matches a valid destination range and so, the license will be in use during call processing (most part is very quickly but in some enviroments not).

I was thinking to send a feature request to Cisco developers. If someone knows how to send this to developers or product manager to cover this issue and speed up the sporcess would be great.

Regards

Re: Securing VCS Expressway

rdahl — Mon, 17 Sep 2012 18:10:00 GMT

Best thing is to open TAC support case and have them enter this in as a feature request.

Re: Securing VCS Expressway

admin11111 — Mon, 17 Sep 2012 21:04:39 GMT

I will open a TAC case then, and share the results.

@rdal, the artical is solving the problem "ish" but its up to TAC to implement it in the VCS. I cannot compile their code..i wish!