SIP rate limiting

Configurable threshold for SIP message rates per request method. Protects SIP servers from SIP overload and DoS attacks.

 

SIP rate limiting

INVITE REGISTER

SUBSCRIBE

• SIP message rate limitation
• Individually configurable per SIP

method

• When threshold is hit additional messages with this method will be

 

SIP

NOTIFY REFER UPDATE OPTIONS MESSAGE ACK

PRACK INFO

SIP

• Prevents SIP server from getting overloaded by flash crowds or Denial-of-Service attacks.
• May block some methods at all

• Can be disabled (unlimited rate)

 

FortiGate units support rate limiting for the following types of VoIP traffic:

• Session Initiation Protocol (SIP)
• Skinny Call Control Protocol (SCCP) (most versions)
• Session Initiation Protocol for Instant Messaging and Presence Leveraging Extensions (SIMPLE).

You can use rate limiting of these VoIP protocols to protect the FortiGate unit and your network from SIP and SCCP Denial of Service (DoS) attacks. Rate limiting protects against SIP DoS attacks by limiting the number of SIP REGISTER and INVITE requests that the FortiGate unit receives per second. Rate limiting protects against SCCP DoS attacks by limiting the number of SCCP call setup messages that the FortiGate unit receives per minute.

You configure rate limiting for a message type by specifying a limit for the number of messages that can be received per second. The rate is limited per security policy. When VoIP rate limiting is enabled for a message type, if the a single security policy accepts more messages per second than the configured rate, the extra messages are dropped and log messages are written when the messages are dropped.

Use the following command to configure a VoIP profile to limit the number of INVITE messages accepted by each security policy that the VoIP profile is added to 100 INVITE messages a second:

config voip profile edit VoIP_Pro_Name

config sip

set invite-rate 100 end

end

If you are experiencing denial of service attacks from traffic using these VoIP protocols, you can enable VoIP rate limiting and limit the rates for your network. Limit the rates depending on the amount of SIP and SCCP traffic that you expect the FortiGate unit to be handling. You can adjust the settings if some calls are lost or if the amount of SIP or SCCP traffic is affecting FortiGate unit performance.

The table below lists all of the VoIP profile SIP rate limiting options. All of these options are set to 0 so are disabled by default.

Blocking SIP OPTIONS messages may prevent a redundant configuration from oper- ating correctly. See Supporting geographic redundancy when blocking OPTIONS mes- sages on page 2822 for information about resolving this problem.

Options for SIP rate limiting

SIP request mes- sage

Rate Limiting CLI Option

ACK                           ack-rate

BYE                           bye-rate

Cancel                       cancel-rate

INFO                          info-rate

SIP request mes- sage

 

Rate Limiting CLI Option

INVITE                       invite-rate

Message                   message-rate

Notify                        notify-rate

Options                     options-rate

PRACK                      prack-rate

Publish                     publish-rate

Refer                         refer-rate

Register                    register-rate

Subscribe                 subscribe-rate

Update                      update-rate

 

Limiting the number of SIP dialogs accepted by a security policy

In addition to limiting the rates for receiving SIP messages, you can use the following command to limit the number of SIP dialogs (or SIP calls) that the FortiGate unit accepts.

config voip profile edit VoIP_Pro_Name

config sip

set max-dialogs 2000 end

end

This command sets the maximum number of SIP dialogs that can be open for SIP sessions accepted by any security policy that you add the VoIP profile to. The default setting of 0 does not limit the number of dialogs. You can add a limit to control the number of open dialogs and raise and lower it as required. You might want to limit the number of open dialogs for protection against SIP-based attackers opening large numbers of SIP dialogs.

Every dialog takes memory and FortiGate CPU resources to process. Limiting the number of dialogs may improve the overall performance of the FortiGate unit. Limiting the number of dialogs will not drop calls in progress but may prevent new calls from connecting.