Hello Experts,
We are running our head office on CUBE with 100session sip calls with UCM environment..Recently discovered that there is no security at sip provider side and hackers are hitting lot of traffic on CUBE interface so I was wondering what is the best practice security configuration to prevent rest of traffic on interface other than SIP traffic.
Any sugguestions and sample configuration will be great help and appricatiated please.
We tested by telnet public IP and ports and it is quite very open though.
CUBE is not behind firewall.10Meg Internet straight from provider to CUBE.
Device details:
Model:Cisco CISCO3925
code:c3900-universalk9-mz.SPA.152-4.M1.bin
Interface:
interface GigabitEthernet0/2
description *** SIP Interface To Provider ***
ip address 2XX.XXX.XX.XX 255.255.255.XXX PUBLIC IP
ip flow ingress
ip flow egress
standby delay minimum 30 reload 60
standby version 2
standby 1 ip 2XX.XXX.XX.XX
standby 1 timers 2 6
standby 1 priority 50
standby 1 preempt
standby 1 track 1 decrement 10
ip traffic-export apply TAC size 5000000
duplex auto
speed auto
We have no access list configured.
Thank you.
