Hello,
I'm quite new to Cisco world, so my apologies for my lack of knowledge on the matter.
I'd like to consult the community to check whether there is any existing security best practices providing some guidance on how to best segregate at network level the "call control" components, in particular the Unified Communication Managers (aka Call Managers), from the VoIP Endpoints. I've found some documentation about the Cisco Preferred Architecture showing the figure below where we can see that indeed those two components are separated from each other:
Source: Preferred Architecture for Cisco Collaboration 14 On-Premises Deployments, Design Overview - Cisco
However, there is no details about how best to segregate those two components in practice.
I'm asking that question because we have currently both the call managers and the VoIP endpoints residing into the same VRF behind a firewall within a bigger network itself having its head firewall and still behind a DMZ with its own firewall but we do have concern about a compromised endpoints (that are disseminated somehow everywhere - quite large organisation with 10k+ employees and a bunch of locations - and hence potentially easily accessible for a malicious user) being able to easily reach the call managers and compromise their vital function. I could not find any recommendation or guidance about that.
I've thought about some options, would be glad to receive your opinion on those or a better alternative:
- option1= simply creating a dedicated vlan for the call managers and a dedicated vlan for the endpoints still within this VRF.
- option2= same as option1 but with an extra firewall for each vlan?
-option3= moving the endpoints to another existing VRF containing all endpoints, and creating a new vlan within this endpoints VRF dedicated to the VoIP endpoints
-option4= same as option3 but again with an extra firewall for each vlan for better security and traffic monitoring/filtering.
-option5= creating a totally new VRF behind a firewall where to move all the VoIP endpoints (could be with vlan per location/site).
In advance, many thanks for your help!
Cheers,
Not a complete answer to all of your questions, but at a minimum you should have your endpoints in a different VLAN than your UC servers. This is because the operating system on the UC servers has a very limited number for how many MAC addresses they can handle in their ARP cache, 2000 is the last number I’ve heard about this. If you have more endpoints than that in the same network as the servers they will be flushed from the cache periodically and this could cause issues for the endpoints.
