Ranch Networks CarrierClass VoIP Security and More

1
(No Transcript)
2
Ranch Networks manufactures Network appliances
built to advance VoIP telephony deployments. The
RN series of products provide security,
reliability, and scalability to VoIP
applications, specifically Asterisk. Features
include NAT traversal, per call bandwidth
allocation, security, 11 HA redundancy, media
bridging, per call firewall control and QoS.
3
About My background

• Ranch Networks Since March
• VoIP Veteran 6yrs
• Built Quintums global sales channel and strategy
  from 2000-2006
• Spent 7 years as Group Director of Corporate
  Sales for MicroWarehouse

4
About us

• Started in 1999 in Morganville, NJ
• Veterans with 150 years of successful Data
  networking and VoIP experience
• Privately held Venture Capital backed

5

• RN Series Overview

6
Product Line
Increasing Performance and Functionality
7
RN Series

• A series of multi-function devices designed to
  simplify networks resulting in
• Increase
• Security
• Performance
• Reliability
• Decrease
• Operating costs
• Points of failure
• Administration complexity

8
RN Series - Features

• Zone based policy enforcement
• Supports 5 30 Zones
• Security Features
• Stateful Firewall
• VPN- IPSEC Gateway
• User Authentication
• QoS Features
• Bandwidth Guarantees
• Accounting
• Policing
• Rate Limiting
• Server Load Balancing
• Server Health Monitoring
• High Availability

9
RN Series Features

• DHCP Client / Server / Relay
• PPPoE client
• Web browser based configuration
• Same GUI look feel for the entire product line
• No learning curve for product line upgrades

10

• Ranch Asterisk solution

11
VoIP Deployment Objectives

• Seamless Connectivity
• Call should succeed irrespective of the locations
  of caller called party
• High Call Quality
• No Voice Clipping call drops
• Security
• Prevent attacks on Asterisk, phones and the rest
  of the network
• Prevent Eavesdropping of VoIP signaling / media
• High Availability
• Minimal downtime
• Scalability
• Dynamically increase capacity with minimal
  changes

12
Ranch VoIP solution

• Unique PBX controlled VoIP Appliances
• The only integrated Asterisk security / QoS
  solution
• All Asterisk downloads contain Netsec module, the
  Ranch Networks agent code
• Netsec module interacts with the Asterisk SIP
  signaling module on a per call basis
• Asterisk business edition with Ranch agent

13
Ranch VoIP solution

• Enforce real-time policies set by Asterisk to
  provide
• Per-call Security
• Per call QoS rate limiting BW guarantee
• NAT traversal
• RTP bridging
• Provide Security to Asterisk
• Provide 1 1 redundancy to Asterisk
• Clustering August 2006

14
SIP issues in a Typical Enterprise Configuration
Internal VoIP phones
Enterprise Network
MIDCOM
L2 Switch
Asterisk IP PBX and Media Gateway
Corporate firewall
SIP is NAT unfriendly
Internet
Media is firewall unfriendly
Bandwidth contention with data
Residential VoIP phone
15
SIP call flow in Ranch - Asterisk
PSTN

• Default SIP allow with rate limit RTP deny

• Call Setup SIP Invite Authenticate

• Forward invite, Receive 200 OK and finish call
  setup

• Asterisk (NetSec) applies real-time POLICIES to
  RN
• Security policies what pin holes to open
• NAT policies how to provide NAT
• Bandwidth policies what Pipe width to use
• Bridging policies how to connect the phones

• Call in progress.

• Call tear down

16
Central Office
11 High Availability (HA) with RN
RN20
SIP based health check will initiate switchover
Single public IP address for Asterisk servers
Internet
ALL SIP messages forwarded to current Active PBX
Switchover does not terminate current
conversations
Firewall
Seamless switchover between active/standby
Branch Office
17
Asterisk Clustering

• Allows one or more Asterisk IP PBXs to be grouped
  (Cluster) as a single IP PBX
• Cluster visible to the user as a single public IP
  and PBX have private IPs
• A PBX can be added or removed from a cluster at
  any time
• When a PBX is removed from the cluster current
  active calls should not be dropped, at a minimum
  conversations should go on
• Health checks determine if a PBX should handle
  new calls
• New calls should be sent to a PBX if-and-only-if
• PBX is accessible (ex SIP based pings)
• PBX has access to critical resources such as an
  data base, external auth server such as
  RADIUS/LDAP
• Should scale linearly

18
Proxies-B
Proxies-A
Registrars-A
Registrars-B
Large Scale PBX Clusters
Low cost Asterisk Proxies
SIP based health check
Ranch RN40
Redundant, Carrier Class
Gigabit interfaces
Heartbeat

• Highly scalable solution
• SIP based health check determines if an Asterisk
  within a cluster is active or not
• Each Asterisk cluster is accessible using single
  public IP address
• Supports multiple Asterisk clusters
• Making a server inactive server does not
  terminate current conversations
• Each registrar and proxy cluster share a single
  public IP
• Asterisk proxies handles the calls

19

• VoIP deployments using Ranch

20
Enterprise with Remote branch
Asterisk IP PBX and Media Gateway

• Ranch benefits
• Security
• NAT traversal
• QoS
• Local Media Bridging

Enterprise Network
Ranch RN 20/40
Internet
Mobile VoIP phone
Ranch 300
Remote Branch
L2 Switch
VoIP phones
21
VoIP solution for Enterprise with legacy phones
Asterisk IP PBX and Media Gateway

• Ranch benefits
• Security
• NAT traversal
• QoS
• Media Bridging

Ranch RN 20/40
VoIP Service Provider
Internet
Mobile VoIP phone
Ranch RN300
Asterisk
Enterprise Network
Future expansion
VoIP phones
TDM phones
22
Hosted PBX
Asterisk IP PBX and Media Gateway

• Ranch benefits
• QoS
• Local Media Bridging
• Does not consume WAN bandwidth
• Significant improvement in voice quality
• Handle phones behind multiple NAT device in the
  enterprise

VoIP Service Provider
Ranch RN 20/40
Internet
Mobile VoIP phone
Ranch RN300
Enterprise Network
VoIP phones
23
Hosted PBX with local fail over to PSTN
Asterisk IP PBX and Media Gateway

• Ranch benefits
• Security
• NAT traversal
• QoS
• Media Bridging
• Fail over to local Asterisk using Ranch 11 HA

VoIP Service Provider
Ranch RN 20/40
Internet
Ranch RN300
Asterisk
Enterprise Network
VoIP phones
24
Ranch VoIP benefits

• Tighter Security
• Per-call firewall control with authorization
• Per-call rate limiting
• DoS Protection
• Improved Voice quality
• Per-call Bandwidth Management
• Increase Scaling
• RTP Traffic Bridging
• Patent pending technology bridges media in kernel
• Simpler VoIP deployment
• NAT Traversal
• Data and Voice segmentation
• High Availability