SIP crossing supported firewall implementing method

Abstract

It is a firewall implementation method that supports the session startup protocol crossover in the field of network security technique. The content is: the firewall analyses the IP division that enters the system. After the IP division enters the system through network interface, the firewall analyses the IP heading information, judges whether the data load is SIP signal information or voice division; the SIP ALG processes the SIP message, SIP ALG analyses SIP message heading to make sure this message belongs to which calling connection. The SIP ALG uses one calling connection state table to track all the calling connection state and modify the content of SIP message heading and / or SDP message according to the information of state table; the firewall processes the down-transferred SIP message from SIP ALG, or performs the instruction issued by SIP ALG, and returns the result to the SIP ALG; according to the result of instruction performing by firewall, the SIP ALG sets or modifies the calling connection table, and sends the SIP message to the firewall, or performs the clearing of calling connection table.

Description

technical field [0001] The invention relates to a method for implementing a firewall, in particular to a method for implementing a firewall that supports session initiation protocol traversal. Used in the field of network security technology. Background technique [0002] In order to solve the problem of network security and lack of IP address resources, many enterprise networks adopt the private addresses stipulated in RFC1918, and access the public network through firewalls with NAT (Network Address Translation) functions. Unless otherwise specified, the firewalls mentioned below refer to firewalls with NAT functions. [0003] Ordinary firewalls do not have application layer protocol knowledge and the ability to analyze and modify data payloads. For applications using fixed TCP / UDP ports such as HTTP, the firewall only needs to modify the address and port content of the IP / TCP / UDP header to achieve firewall penetration. But for VoIP (Voice over IP) applications based on...

AI Technical Summary

Problems solved by technology

But in essence, A can never receive the voice from B

Therefore, for telephone terminals using private IP addresses, due to the limitation of address translation functions, ordinary firewalls are obstacles for VoIP communication based on SIP protocol to traverse

[0006] After searching the existing technical documents, it is found that the Chinese patent publication number is: CN1440172A, and the patent titled "Method for Firewall Packet Filtering Dynamically Switching H.323 Protocol Communication Channel" proposes a firewall implementation method, but this method only Support H.323 protocol, and this method works at the data link layer and network layer, it is difficult to expand to support protocols such as SIP

Images