1. What does an SBC do? Speaker Notes/Script:
Read the title and subtitles.

2. Carrier SBC’s Enterprise Network SP Network IP PBX IntranetFW
Intranet
Carrier SBC
Carrier SBC
Historically designed to sit at the SP’s edge to protect the carrier.
Complex to use command-line devices
Provides a distinct separation between networks while providing a means of transporting signaling and media
Perform topology hiding for the SP
Tracking calls (CDR) for billing
Act as a Network Address Translator (NAT) for the SP
Provides admission control to limit calls from customer (and insure SLA)
Protocol Internetworking for H.323 and SIP
11/26/2012

3. Enterprise SBC Enterprise Network DMZ Mobile Users, Telecommuters
IP PBX
DMZ
SRTP/ RTP
Internal FW
Avaya
SBCE
External
FW/NAT
Remote Worker
Intranet
Internet
SIP Trunking
Avaya SBCE
Encryption
TLS proxy
SRTP proxy
Enablement
FW / NAT traversal
Call admission control
Signaling and media firewall
Security
Floods and fuzzing prevention
Spoofing prevention (fingerprint verification)
Media anomaly prevention
Stealth attack prevention
Tollfraud Prevention
Anti-spam
Whitelist/Blacklist
Behavior learning
© 2012 Avaya, Inc. All Rights Reserved.
06/01/2012

4. Avaya SBCE: SIP Trunking Architecture
Use Case: SIP Trunking to Carrier
Carrier offering SIP trunks as lower-cost alternative to TDM
Heavy driver for Enterprise adoption of SBC
Support Aura, IPO and CS1K
From a SECURITY Stand Point, it is recommended the SBCE be in the DMZ
Firewall
Firewall
Enterprise
CS1000
DMZ
Internet
SIP Trunks
Carrier
Avaya SBCE
DMZ is recommended not required. From a Security standpoint, this is the recommended architecture.
Parallel Architectures are common
Y Configurations
Carrier SIP trunks to the Avaya Session Border Controller for Enterprise
Avaya SBCE is located in a DMZ behind the Enterprise firewall
Services: security and demarcation device between the IP-PBX and the Carrier
NAT traversal,
Securely anchors signaling and media, and can
Normalize SIP protocol

5. NAT Traversal
SBC External IP Address
IP PBX
FW IP Address
Enterprise
Internet or Provider Network
At a basic level think of it this way: If the SBC sends an INVITE message to the carrier, can the carrier reply and reach IP address ? No.
The SBC facilitates NAT Traversal by making sure all signaling messages have a REACHABLE return address. In this example, the INVITE would have a source address of
When a reply is sent it reaches the firewall which forwards to external IP Address.

6. Understanding Toll Fraud
Toll fraud can only be prevented by a holistic approach involving best practice configuration of many elements in a UC environment.
Examples include:
Customized tuning of SBC to set intelligent call thresholds for outbound and inbound traffic (based on time of day for optimal fine-tuning)
Enable short-call toll fraud duration
Limit international calls to only valid destinations for needed countries

7. DoS and Toll Fraud Protection
Single Source DoS
Any type of DoS attack that is directed against one or more enterprise endpoints that originate from a single source (normally spoofed).
Stealth DoS/DDoS
A type of low‐volume DoS attack that is directed against an endpoint where the source of the call is constantly changed.
Call Walking
A type of DoS attack whereby serial calls originating from a single source (normally spoofed) are directed against a sequential group of end‐points.
Toll Fraud
Refers to internal or external users using the corporate phone system to place unauthorized toll calls.
Phone DoS/DDoS
A type of DoS attack that is directed against a single enterprise end‐point.

8. DoS and Toll Fraud Protection
DoS settings can be customized
Time-of-Day can be used to refine DoS settings
Specific protection exist for ‘Short Duration Toll Fraud’ as well:
Short call duration toll fraud is where a large number of short calls (less than 1-2 seconds) are made to make money on the ‘connect’ fees.

11. Avaya SBCE: Remote Worker Architecture
Use Case: Remote Worker
Extend UC to SIP users remote to the Enterprise
Solution not requiring VPN for UC/CC SIP endpoints
From a SECURITY Stand Point, it is recommended the SBCE be in the DMZ
Firewall
Firewall
Enterprise
DMZ
Internet
Remote Workers
Avaya SBCE
Remote Worker are external to the Enterprise firewall
Avaya Session Border Controller for Enterprise
Authenticate SIP-based users/clients to the enterprise
Securely proxy registrations and client device provisioning
Securely manage communications without requiring a VPN

12. Remote Worker: VPN vs VPNless Endpoints
VPN Endpoint
VPNless Endpoint
VPN Headers add additional size to traffic. In aggregate reduces bandwidth.
Encrypts traffic, yet does not validate it. (Encrypting and distributing a virus isn’t helpful)
No ability at VPN head-end to distinguish between voice and data traffic. Ultimately voice quality suffers.
Cumbersome user experience for real-time communication application
TLS/SRTP encrypts the traffic with a smaller bandwidth footprint than VPN
Signaling and media are unencrypted at the SBC and inspected at Layer 7 to validate the traffic before it is allowed through
Numerous policies allow Enterprise control of endpoints.
Consistent user experience for applications

13. Session Manager is NOT required for SIP Trunking
Call Servers
For SIP Trunking, an accepted architecture is:
Call Server + SBC
Call Server + SM + SBC
A valid call server is
CS1k 7.5
CM 5.2.1
IPO 8.x
SM must be 6.x
Session Manager is NOT required for SIP Trunking
For SIP Trunking if these basic requirements are not met there is no opportunity with this customer UNTIL these elements are there.

14. Avaya SBCE 4.0.5 and 6.2 Interoperability Matrix
All Tests performed in the SIL Labs
Platform
No SM
SM 6.1
SM 6.2
CS1K R7.5
R4.0.5/R6.2
IPO R8.0 NA
CM R5.2.1
CM 6.0.1
CM R6.2
Supported - Tested
Not Supproted or Tested.

15. IPO 8.x ONLY supports SIP Trunking
ONLY certified with AT&T at the moment
A generic app note is in the works to accommodate additional carriers

16. Carriers Tested as of November 10th, 2013.
Alestra AT&T AT&T Puerto Rico Belgacom Bell Canada Broad-Connect Broadview BT Global Services BT HIPCOM BT Italia BT Wholesale Cable & Wireless CenturyLink
Colt
Etisalat
Fastweb SPA
Frontier
Gamma
IntelePeer
KPN
Level 3
MTSAllStream
PAETEC
Phonect
QSC
Sprint
Swisscom
Tele2
Telefonica del Peru
Telenor
Teliasonera
TELUS
T-Mobile NL
UPC
Vamoin1/KPN
Verizon Business
Virgin Media
Vodafone DE
Vodafone NL
VoicePulse
Windstream
Worldnet P. Rico XO
Find App Notes Here:

17. SIP Trunking Qualification
Must include supported call servers (CS1, CM, SM, IPO)
Must be explicitly tested with that given configuration with the carrier.
Example: If CMSBC->Service Provider ‘A’ is tested, that does NOT mean CMSM->Service Provider “A’ is tested. Make sure the specific configuration is documented with an App Note.
If the architecture is valid, but it is not tested, then escalate through Jack Rynes

18. SIP Trunking with AACC
AACC – If this is a basic SIP Trunking deployment involving:
Service Provider - SBC SMCM
There may be a valid solution for the SBC but all call flows should be vetted with the CSE’s.

19. SIP Trunking with Call Center Elite
CC Elite – If this is a basic SIP Trunking deployment involving:
Service Provider - SBC SMCM
-and-
Avaya Experience Portal is NOT part of the call flow
There may be a valid solution for the SBC but all call flows should be vetted with the CSE’s.

20. Avaya SBCE Key Features
Speaker Notes/Script:
Read the title and subtitles.

21. The Unique Avaya Solution for UC Application Security
Authenticated Endpoints
Allow supporting protocols with full NAT
Giving you Full Features
Enterprise
Remote
Avaya Session Manager (SIP)
Internal Phone (RTP)
Enterprise DMZ
Firewalls
Encrypted
Sessions
Remote NAT & Firewall
Avaya SBCAE
Intranet
Internet
Remote Phone Configuration (HTTPS)
Certificate Authority (SCEP)
Personal Profile Manager (SOAP)
Directory Server (LDAP)
Web Server (HTTP)
Presence and IM (XMPP)
Security
UC Policy, Access control, & Authentication
Privacy (encryption) with TLS, SRTP
UC Threat protection
Comprehensive Services
Directory, Web applications, Login profiles
Remote Management
Configuration management,
Certificate, PKI management Hi

22. ASBCE 6.2 System Capacity
Session Border Controller capacities are rated in Simultaneous Sessions
A simultaneous session = a communication session between 2 SIP endpoints
Can think of it as analogous to a DSO in the ‘old world’
Key for engineering is to understand the numbers of sessions required in the solution
For Secure SIP trunking, look at the number of TDM DSOs required
For Remote Worker, calculate required call volumes
Capacity in Simultaneous Sessions
Max Capacity
W/out Encrypt
Max Capacity
With Encrypt HA
2000
1000 SA
2000
1000
RW BOX
ST Box
Portwell CAD-0208 SA
500
250
‘Rules of Thumb’
SIP trunking usually 5 users per ‘SS’
Must account for higher ratio in small
Remote Worker must consider both
On-net and off-net requirements
Remember, in Dell configs, Encryption
Services impact capacity