The EBC is NOT configured to filter inbound AS-SIP-TLS traffic based on the IP addresses of the internal LSC(s) (or MFSS) OR the IP addresses of the EBCs fronting its authorized signaling partners as part of a layered defense.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19665	VVoIP 6300 (DISN-IPVS)	SV-21806r1_rule	ECSC-1	Medium

Description
The EBC is in the VVoIP signaling between the LSC and MFSS. To limit its exposure to compromise and DOS, it must only exchange signaling messages using the designated protocol (AS-SIP-TLS) with the LSC(s) within the enclave and the EBC fronting the MFSS (and its backup) to which the LSC is assigned. Similarly, an EBC fronting an MFSS must only exchange signaling messages with the MFSS and LSC(s) within the enclave and the EBCs fronting other MFSSs and the LSCs that are assigned to it. While the EBC is also required to authenticate the source and integrity of the signaling packets it receives, filtering on source IP address adds a layer of protection for the MFSS. This is also a backup measure in the event this filtering is not done on the CER. Internal to the enclave, filtering signaling traffic based on the IP address(es) of the LSC(s) within the enclave limits the ability of rogue EIs attempting to establish calls or cause a DOS.

Description

The EBC is in the VVoIP signaling between the LSC and MFSS. To limit its exposure to compromise and DOS, it must only exchange signaling messages using the designated protocol (AS-SIP-TLS) with the LSC(s) within the enclave and the EBC fronting the MFSS (and its backup) to which the LSC is assigned. Similarly, an EBC fronting an MFSS must only exchange signaling messages with the MFSS and LSC(s) within the enclave and the EBCs fronting other MFSSs and the LSCs that are assigned to it. While the EBC is also required to authenticate the source and integrity of the signaling packets it receives, filtering on source IP address adds a layer of protection for the MFSS. This is also a backup measure in the event this filtering is not done on the CER. Internal to the enclave, filtering signaling traffic based on the IP address(es) of the LSC(s) within the enclave limits the ability of rogue EIs attempting to establish calls or cause a DOS.

STIG	Date
Voice/Video over Internet Protocol (VVoIP) STIG	2017-01-04

Details

Check Text ( C-24038r1_chk )
Interview the IAO to confirm compliance with the following requirement: Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to only communicate as follows: > Within the enclave, ensure the EBC only establishes an AS-SIP-TLS session with the primary or backup LSC or the MFSS and its backup LSC within the enclave. >If the EBC is at a site without a MFSS: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with the EBC at the enclave’s assigned primary and secondary (backup) MFSS sites. > If the EBC is at a MFSS site: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with EBCs located at other MFSS sites and the LSC sites assigned to it. Determine the following: > If the enclave contains LSCs, determine the IP address of EBCs fronting the primary and backup MFSSs to which the enclave is assigned or with which the LSC is to exchange signaling messages. > If the enclave contains a MFSS, determine the IP addresses of the EBCs fronting the LSCs with which it is to signal. Additionally determine the IP addresses of the EBCs fronting the other MFSSs.

Check Text ( C-24038r1_chk )

Interview the IAO to confirm compliance with the following requirement:

Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to only communicate as follows:
> Within the enclave, ensure the EBC only establishes an AS-SIP-TLS session with the primary or backup LSC or the MFSS and its backup LSC within the enclave.
>If the EBC is at a site without a MFSS: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with the EBC at the enclave’s assigned primary and secondary (backup) MFSS sites.
> If the EBC is at a MFSS site: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with EBCs located at other MFSS sites and the LSC sites assigned to it.

Determine the following:
> If the enclave contains LSCs, determine the IP address of EBCs fronting the primary and backup MFSSs to which the enclave is assigned or with which the LSC is to exchange signaling messages.
> If the enclave contains a MFSS, determine the IP addresses of the EBCs fronting the LSCs with which it is to signal. Additionally determine the IP addresses of the EBCs fronting the other MFSSs.

Fix Text (F-20371r1_fix)
Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to only communicate as follows: > Within the enclave, ensure the EBC only establishes an AS-SIP-TLS session with the primary or backup LSC or the MFSS and its backup LSC within the enclave. >If the EBC is at a site without a MFSS: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with the EBC at the enclave’s assigned primary and secondary (backup) MFSS sites. > If the EBC is at a MFSS site: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with EBCs located at other MFSS sites and the LSC sites assigned to it.

Fix Text (F-20371r1_fix)

Ensure the DISN NIPRNet IPVS firewall (EBC) is configured to only communicate as follows:
> Within the enclave, ensure the EBC only establishes an AS-SIP-TLS session with the primary or backup LSC or the MFSS and its backup LSC within the enclave.
>If the EBC is at a site without a MFSS: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with the EBC at the enclave’s assigned primary and secondary (backup) MFSS sites.
> If the EBC is at a MFSS site: External to the enclave (across the WAN), ensure the EBC only establishes an AS-SIP-TLS session with EBCs located at other MFSS sites and the LSC sites assigned to it.