SIP message inspection and filtering
SIP ALG provides users with security features to inspect and control SIP messages that are transported through FortiOS devices, including:
l Verifying the SIP message syntax. l Blocking particular types of SIP requests. l Restricting the rate of particular SIP requests.
These features are configured in the VoIP profile:
config voip profile edit <voip_profile_name> config sip set …
The VoIP profile can then be applied to a firewall policy to process the SIP call traffic.
SIP message syntax inspection
For syntax verification, the following attributes are available for configuration in the VoIP profile to determine what action is taken when a specific syntax error or attack based on invalid syntax is detected. For example, the action can be set to pass or discard it.
malformed-request-line malformed-header-via malformed-header-from malformed-header-to malformed-header-call-id malformed-header-cseq malformed-header-rack malformed-header-rseq malformed-header-contact malformed-header-record-route malformed-header-route malformed-header-expires malformed-header-content-type malformed-header-content-length malformed-header-max-forwards malformed-header-allow
malformed-header-p-asserted-identity malformed-header-sdp-v malformed-header-sdp-o malformed-header-sdp-s malformed-header-sdp-i malformed-header-sdp-c malformed-header-sdp-b malformed-header-sdp-z malformed-header-sdp-k malformed-header-sdp-a malformed-header-sdp-t malformed-header-sdp-r malformed-header-sdp-m
SIP message blocking
The following options are available in the VoIP profile to block SIP messages:
block-long-lines block-unknown block-ack block-bye block-cancel block-info block-invite block-message block-notify block-options block-prack block-publish block-refer block-register block-subscribe block-update block-geo-red-options
SIP message rate limiting
The rate of certain types of SIP requests that are passing through the SIP ALG can be restricted :
register-rate invite-rate subscribe-rate message-rate notify-rate refer-rate update-rate options-rate ack-rate prack-rate info-rate publish-rate bye-rate cancel-rate