STIGQter: STIG Summary: Voice/Video over Internet Protocol (VVoIP) STIG Version: 3 Release: 14 Benchmark Date: 26 Apr 2019:

The Customer Edge Router (CE-R) must filter inbound AS-SIP-TLS traffic addressed to the local Session Border Controller (SBC) based on the source address of the signaling messages.

DISA Rule

SV-21805r4_rule

Vulnerability Number

V-19664

Group Title

VVoIP 6215

Rule Version

VVoIP 6215

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Implement the CE-R to filter inbound SIP and AS-SIP traffic addressed to the local SBC based on the source address of the signaling messages.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from Cloud Service Providers.

Check Contents

Review site documentation to confirm the CE-R filters inbound SIP and AS-SIP traffic addressed to the local SBC based on the source address of the signaling messages. This supports the VVoIP system connecting to the DISN WAN for VVoIP transport between enclaves and the system providing Assured Services to any Command and Control (C2) user (Special-C2, C2, or C2-R). Permit inbound signaling messages sourced as follows:
- When the enclave contains one or more Local Session Controllers (LSCs), filter on the IP addresses of the SBCs fronting the primary and secondary MFSSs associated with the enclave.
- When the enclave contains an MFSS filter based on IP addresses of SBCs fronting the LSCs associated with the SS.

If the CE-R does not filter inbound SIP and AS-SIP traffic addressed to the local SBC based on the source address of the signaling messages, this is a finding.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from Cloud Service Providers.

Vulnerability Number

V-19664

Documentable

False

Rule Version

VVoIP 6215

Severity Override Guidance

Review site documentation to confirm the CE-R filters inbound SIP and AS-SIP traffic addressed to the local SBC based on the source address of the signaling messages. This supports the VVoIP system connecting to the DISN WAN for VVoIP transport between enclaves and the system providing Assured Services to any Command and Control (C2) user (Special-C2, C2, or C2-R). Permit inbound signaling messages sourced as follows:
- When the enclave contains one or more Local Session Controllers (LSCs), filter on the IP addresses of the SBCs fronting the primary and secondary MFSSs associated with the enclave.
- When the enclave contains an MFSS filter based on IP addresses of SBCs fronting the LSCs associated with the SS.

If the CE-R does not filter inbound SIP and AS-SIP traffic addressed to the local SBC based on the source address of the signaling messages, this is a finding.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from Cloud Service Providers.

Check Content Reference

M

Target Key

3407

Comments