IP Signaling Security

MGU supports Internet Protocol Security (IPsec) that can be used to secure IP communication between MGU and a remote IPsec peer (a remote Service Node or Gateway/ Firewall). For example, IPsec may be used in a branch node scenario where Service Nodes are located in a head office and MGUs in branch offices while signaling over the Internet. IPsec is supported for MGU signaling over IPv4 networks.

The IPsec protocol suite is an open standard described in RFC 2401. IPsec is based on the following protocols:

• Authentication Header (AH) to provide connectionless integrity, data origin authentication, and an optional anti-replay service.
• Encapsulating Security Payload (ESP) to provide confidentiality (encryption), and limited traffic flow confidentiality. It also may provide connectionless integrity, data origin authentication, and an anti-replay service.
• Internet Key Exchange protocol (IKE) to provide automatic establishing of Security Associations (SA) and peer authentication. MGU supports IKE version 1 (IKEv1). IKE is only used in automatic key management procedures.

AH and ESP may be used in combination, but usually only one of them is used. When only ESP is used it is usually in combination with authentication. By default MGU enables ESP with authentication. Most importantly, ESP will protect the confidentiality of the SRTP keys exchanged between Service Node and MGU for secure RTP. For some installations it might make sense to only use AH.

IPsec may be used in tunnel (a.k.a VPN tunnel) or transport mode. In tunnel mode, the entire IP packet is protected by IPsec. This means IPsec wraps the original packet, encrypts it, adds a new IP header and sends it to the IPsec peer. In transport mode, only the IP payload is protected by IPsec. Tunnel mode is usually used between networks or host-to-networks, and transport mode is usually used end-to-end between two hosts. MGU creates a transport if a destination address is specified or a tunnel if destination network is specified.

MGU allows automatic IPsec SA establishment and peer authentication through IKE/ISAKMP using either pre-shared keys or RSA signed digital certificates. It is also possible to use manually configured SAs, but is usually not recommended.

It is possible to setup multiple IPsec tunnels/transports between MGU and remote peers.

For more information about how to setup IPsec, see Operational Directions MGU SECURITY CONFIGURATION.