Understanding SAFE IP Telephony Network Designs
The next sections discuss the deployment considerations for IP telephony in each of the SAFE network blueprints: the small, medium-sized, and enterprise networks. In each of these blueprints, adding IP telephony into the network infrastructure required some modification of devices that provide an interface between modules in the blueprint. Not all modules were affected by the incorporation of IP telephony into the network infrastructure; therefore, those modules were omitted from the discussion.
Branch Versus Headend Considerations
You can use the designs in small and medium-sized network configurations in one of two ways. In the first configuration, the design is acting as a branch of a larger enterprise. In the second configuration, the larger network design is considered the headend of the organization's network, and the smaller network designs can be considered the branch or satellite offices.
IP Telephony Deployment Models
Three general models primarily exist for the deployment of IP telephony services throughout a network. The following deployment models are influenced by both the size and the distribution of the network (multiple branches, private networks, and so on):
Single-site campus—This model is the most basic deployment model. All the IP telephony devices reside in a single, physically contiguous campus
WAN centralized call-processing—In this model, multiple sites deploy IP telephony. These sites might be connected to a central campus over a private WAN or through the use of VPNs. The headend site, or campus, contains the only call-processing manager cluster; however, remote sites can have local voice services, such as voice mail.
WAN distributed call-processing—This is the most complex design of the three models. In this model, multiple sites are connected through either a private WAN or over a VPN, and one or more of the sites contains a call-processing manager cluster. Many, although not all, of the sites have local voice services, such as voice mail. Some of the sites rely on others for their voice-mail services.
Small IP Telephony Network Design
The small IP telephony network design is based on the SAFE small network blueprint. This design is shown in Figure 19-2 and includes several minor modifications to the small blueprint design.
)
Figure
19-2 Small IP Telephony Network Design
As shown in Figure 19-2, the small IP telephony network design consists of the Corporate Internet module, the Campus module, and the ISP Edge module. The SAFE IP telephony modifications made to this blueprint focus only on the Corporate Internet and Campus modules. No modifications were made to the ISP Edge module because the service provider is not providing IP telephony services to the network.
Corporate Internet Module
The Corporate Internet module provides connectivity to the Internet for the small SAFE blueprint. The key device here is the voice-enabled edge firewall/router, which provides protection of network resources, stateful filtering, and voice services. The firewall/router mitigates toll fraud by limiting only known telephony devices from communicating with one another, as well as other attacks such as unauthorized access, DoS attacks, and IP spoofing attacks.
The voice-enabled firewall/router provides not just the typical security services, such as NAT, VPN, stateful firewall inspection of traffic, and IDS, but also voice services, including VLAN segmentation. In one VLAN reside the call-processing manager, the proxy server, and the IP phones. The user, management, and voice-mail/e-mail systems reside in the other VLAN.
Campus Module
The Campus module contains the end-user systems and the corporate servers, such as voice-mail servers, e-mail servers, management servers, IP phones, and the Layer 2 infrastructure. VLANs are enabled on the Layer 2 switch to provide segmentation between the voice and data traffic. Host IDS (HIDS) is deployed across all critical servers. The role of HIDS is more important in this design because of the lack of a Layer 3 router within the Campus module to provide access control between the VLANs.
Design Alternatives for the Small IP Telephony Network
One alternative design is to provide two completely separate VLANs, with a Layer 3 access device providing traffic filtering between the VLANs. Another alternative is to place the voice-mail/e-mail server in the voice segment; however, this design is not recommended because the voice-mail/e-mail server is running additional services that are required in the data segment.
Medium-Sized IP Telephony Network Design
The medium-sized IP telephony network design shown in Figure 19-3 is based on the SAFE medium-sized network blueprint. No changes have been made except to the Campus module to support IP phones, PC-based IP phones, voice services, proxy services, PSTN for WAN backup and local calls, and VLANs for voice and data segmentation.
)
Figure
19-3 Medium-Sized IP Telephony Network Design
The Campus module and possible design alternatives are described in the next sections.
Campus Module
The key IP telephony devices in the campus module are provided in Table 19-3.
Table 19-3 Key Devices in Campus Module
|
Key Device |
Functions |
|
Layer 3 switch |
Routes and switches voice and data traffic within the module. |
|
Layer 2 switch (with VLAN support) |
Provides network connectivity to endpoint user workstations and IP phones. |
|
Corporate servers |
Provide e-mail and voice-mail services to internal users, and file, print, and DNS resolution to workstations. |
|
User workstation |
Provides data services and voice services (through PC-based IP phones) to end users. |
|
NIDS appliance |
Provides Layer 4 to Layer 7 packet inspection. |
|
IP phones |
Provides voice services to end users. |
|
Call-processing manager |
Provides voice services to IP telephony devices in the module. |
|
Proxy server |
Provides data services to IP phones. |
|
Stateful firewall |
Provides network-level filtering for the call-processing manager and the proxy server. |
The primary function of the Campus module is to switch data, voice, and management traffic while enforcing the network and voice VLAN separation. The VLAN separation is augmented by the use of filtering on the Layer 3 switch and also a stateful firewall. HIDS are used to protect both key voice services and the PC-based IP phone hosts. The stateful firewall and the Layer 3 switch control the traffic flows between the data and voice VLANs. The proxy server provides data services to IP phones; it also is located on the same VLAN as the call-processing manager. Private VLANs are used to mitigate local trust-exploitation attacks between the proxy server and the call-processing manager. For secure management, Layer 3 and Layer 4 filtering limits administration of key systems to authorized administration hosts. In addition, application-level security provides user authenti-cation and confidentiality.
Performance is not a limitation in this design because all devices are situated on a Fast Ethernet network. The only limitation to this design is the number of IP telephony devices that the call-processing manager can support. If the number of IP telephony devices exceeds the capacity of the call-processing manager, additional call-processing managers are required.
Design Alternatives for the Medium-Sized IP Telephony Network
One possible alternative is to redesign the IP telephony network to take advantage of high-availability capabilities. This redesign would require the addition of another call-processing manager and another firewall in the Campus module, to provide resiliency. Another possibility is to move the voice-mail system off an additional demilitarized zone (DMZ) segment on the stateful firewall.
Large IP Telephony Network Design
The large IP telephony network design is based on the SAFE Enterprise network blueprint. This design already took IP telephony requirements into account. However, certain changes were made to this design in the "SAFE: IP Telephony Security in Depth" whitepaper. These changes include the following additions:
PC-based IP phones
Voice segment for the voice-mail system
PSTN for local calls at the Edge Distribution module
HIDS on all voice-related servers
Call-processing manager and stateful firewall to provide resiliency in the design
This section focuses on the Building and Server modules, where the preceding changes were made.
Building Module
The Building and Building Distribution modules of the SAFE enterprise design are shown in Figure 19-4. The Building module provides switching functions for data and voice traffic, while at the same time enforcing segmentation between the two. This is done through stateless Layer 3 filtering and VLANs.
)
Figure
19-4 Large IP Telephony Building and Building Distribution Modules
The key devices in the Building module are listed in Table 19-4.
Table 19-4 Key Devices in Large IP Telephony Building Module
|
Key Device |
Functions |
|
Layer 2 switch (with VLAN support) |
Provides network connectivity to endpoint user workstations and IP phones. |
|
User workstation |
Provides data services and voice services (through PC-based IP phones) to end users. |
|
IP phones |
Provide voice services to end users. |
Server Module
The primary function of the Server module, shown in Figure 19-5, is to provide voice and data services throughout the design to end users and devices.
The Server module contains all the voice services needed for IP telephony in this design. The key devices in this module are provided in Table 19-5.
)
Figure
19-5 Large IP Telephony Network Design
Table 19-5 Key Devices in Server Module
|
Key Device |
Functions |
|
Layer 3 switch |
Routes and switches voice and data traffic within the module. |
|
Corporate servers |
Provide e-mail and voice-mail services to internal users, and provide file, print, and DNS resolution to workstations. |
|
Call-processing manager |
Provides voice services to IP telephony devices in the module. |
|
Proxy server |
Provides data services to IP phones. |
|
Stateful firewall |
Provides network-level filtering for the call-processing manager and the proxy server. |
Although the call-processing manager, the proxy server, the voice-mail system, and the e-mail systems each reside in the same module, they are separated through VLAN segmentation. In addition, internally to the VLANs, servers can be separated further through the use of private VLANs to mitigate trust-exploitation attacks. All servers in this module have HIDS installed, and all traffic flows within the module are inspected by the on-board IDS blades in the Layer 3 switches. High availability is ensured through the use of multiple call-processing managers and multiple firewalls configured in high-availability mode. To support the secure management model in the SAFE Enterprise design and the use of an out-of-band management network, all key servers in this module have multiple network interfaces to support the out-of-band access.
Design Alternative for the Large IP Telephony Network
As in the medium-sized network design, you can place the voice-mail server on an additional DMZ interface off the firewall, to further isolate this server and stateful inspection and the filtering of the traffic between the IP telephony devices and the voice-mail server. However, this increases the complexity of the design.