I'm working on the security part of some telephony projects, and in the architecture, there are some Session Border Controller. In a security point of view, we don't know how to consider this equipment: are they some kind of telephony firewalls or more like some telephony proxy/reverse proxy?

Do we need to put them behind firewalls, or consider them as firewall and expose them directly to untrusted networks?

I've read some articles and studies on it, some say it's a reverse proxy, others say it's a firewall...


Great question.

The SBC is actually intended to be both a firewall and a reverse proxy. In modern days however, it's essentially just a reverse proxy and a middleman server to allow different varieties of SIP applications/codecs/devices to all work together.

In the days of old, public IP addresses were assigned to most machines, and the SBC would get a public IP. It would then essentially act as the firewall for the VoIP phone system in place, using whatever software was built into the OS or the SBC stack to act as a firewall and do basic packet inspection.

However, in modern architectures we usually see a firewall placed on the network perimeter. This firewall is usually a lot better than the one on the SBC and receives a lot more attention, updates etc; so it'd be a best practice to use your main firewall. In this case, the SBC should be behind this firewall and ports limited to those necessary to forward through.

The SBC may also carry additional layer-7 packet inspection; such as validating the VoIP traffic and getting rid of packets that might carry known exploits or other tricks such as spoofed caller ID. Still, the layer 2/3 stateful firewall should be elsewhere and traffic forwarded to the SBC so it can do its layer-7 validation and inspection.

In the modern day and age I wouldn't recommend exposing an SBC to untrusted networks without a firewall in front of it; and if necessary I would do so within a DMZ or other isolated VLAN for the VoIP environment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.