Voice over IP (VoIP) Software Blade
Overview
The Check Point security family enables you to deploy VoIP applications such as telephony or video conferencing without introducing new security threats or needing to redesign your network. Because worms and VoIP-specific Denial of Service attacks can take IP phone services down, the Check Point family delivers an evolving solution that understands and protects against existing and new threats that may disrupt business continuity. Check Point solutions also reduce the complexity of VoIP deployment by eliminating such common pain points as incompatibility between VoIP and Network Address Translation.
Key Benefits
- Increases protection and availability of VoIP against worms and attacks on a converged network
- Decreases likelihood of fraud and theft of VoIP services
- Reduces costs of VoIP deployment by enabling it to work with NAT and other existing network elements
- Simplifies extension of VoIP to remote offices and workers
- Provides preemptive protection for both the VoIP network and the underlying infrastructure
Features
- Enabling complex, diverse VoIP protocols
- Protecting the converged network
- Delivering high voice quality
- Solving the NAT problem
Enabling complex, diverse VoIP protocols
Companies can choose from among a host of VoIP protocols—all which function completely differently and interact with security in ways that traditional firewalls cannot handle. Voice over IP Software Blade delivers the most intelligent security for the widest variety of VoIP protocols available in a perimeter security solution. The intelligent security of the Voice over IP Software Blade delivers two benefits that other perimeter solutions do not. First, it enables complete inspection of both the network layer and the payload—where additional VoIP data is placed. Second, because Check Point Security Gateways were developed to be aware of how VoIP sessions should work, it can detect and stop malicious VoIP activity without administrator interaction.
Protecting the converged network
Placing voice traffic on the data network exposes it to traditional data attacks. The Voice over IP Software Blade goes beyond simple support for VoIP protocols to an awareness of how VoIP works, providing preemptive protection for both the VoIP network and the underlying infrastructure.
Delivering high voice quality
A major concern for VoIP deployments is maintaining the high level of voice quality people are used to from traditional phone services. The Voice over IP Software Blade integrates Quality of Service (QoS) mechanisms to ensure that the quality of voice traffic is not reduced while still maintaining a high level of security.
Solving the NAT problem
Network address translation (NAT) is a common security function that is often incompatible with VoIP deployment. The Voice over IP Software Blade provides the greatest range of deployment options for VoIP in a NAT environment without the use of third-party products.
Specifications
| Feature | Details |
|---|---|
| Signaling protocols | H.323 |
| Media protocols | Real-time Transport Protocol (RTP) |
| SIP | RFC 3261 - Latest SIP RFC, RFC 3372 - SIP-T, RFC 3311 - UPDATE message, RFC 2976 - INFO message, RFC 3515 - REFER message , RFC 3265 - SIP Events, RFC 3266 – IPv6 in SDP, RFC 3262 - Reliability of Provisional responses, RFC 3428 - MESSAGE message, MSN messenger over SIP, SIP over TCP, SIP over UDP, SIP early media |
| H.323 | H.323 V.2, V.3, V.4 , H.225 V.2, V.3, V.4 , H.245 V.3, V.5, V.7 |
| SCCP | Supported |
| MGCP | RFC 3435 – MCGP v1, J.171 – TGCP |
| Quality of Service (QoS) methods | |
| Low Latency Queuing (LLQ) | LLQ enables highly sensitive traffic such as VoIP to be given the highest priority for security processing, including setting a maximum delay |
| Guaranteed bandwidth | A portion of bandwidth can be set aside specifically for VoIP transmissions |
| Weighted priorities | Different types of traffic can be assigned different priorities. For example, VoIP traffic may be given a weight of 50 compared to a weight of 5 for file sharing. During congested network conditions, the ratio between VoIP and file sharing traffic will be 10:1. |
| Differentiated Service (DiffServ) | Integrated DiffServ support allows service providers to identify and prioritize VoIP traffic as it travels across the corporate wide area network (WAN). |
| NAT support for SIP networks | |
| Endpoints can be installed with static NAT or hide NAT in the internal network, external network, or DMZ | |
| Incoming calls to hide endpoints that are behind a gateway using hide NAT are supported | |
| SIP-PSTN gateways with hide NAT can be installed in the internal network, external network, or DMZ | |
| SIP-PSTN gateways with static NAT can be installed in the internal network, external network, or DMZ | |
| NAT support for H.323 networks | |
| Gatekeepers can be installed in the external network, internal network, or DMZ using static NAT | |
| Gateways/PBXes can be installed in the external network, internal network, or DMZ using static NAT | |
| Endpoints can be installed everywhere using static NAT | |
| Endpoints can be installed everywhere using hide NAT | |
| Incoming calls to hide NAT are supported | |
| H.323-PSTN gateways can be installed everywhere with static NAT | |
| H.323-PSTN gateways can be installed everywhere with hide NAT | |
| SIP security | H.323 advanced security |
|---|---|
Stateful Inspection of SIP messages
Use of streaming mechanism in SIP over TCP
Restricting the following fields
Special syntax control of the following SIP messages
Handover domain
|
Stateful Inspection of H.323 messages
Use of streaming mechanism for H.225 and H.245
Special treatment for the following H.323 messages
Restricting the following fields
Handover domain
|
Support
Threats to networks are constantly evolving and becoming more sophisticated. To maintain continuity and productivity, defenses must advance as quickly to deliver the technology and features that protect the business. Check Point Services protect against emerging threats with critical hot software fixes, service packs, and major software upgrades.
Benefits
- Ensure continuous security with access to critical hot fixes and service packs
- Maximize ROI and investment with access to major upgrades and enhancements
- Increase security with the latest applications, features, and technologies
- Products A-Z
- Appliances
- Appliances Overview
- 2200 Appliances
- 4000 Appliances
- 12000 Appliances
- 21000 Appliance
- 61000 Security System
- DDoS Protector Appliances
- SecurityPower
- Secure Web Gateway Appliance
- Threat Prevention Appliance
- Series 80
- UTM-1 Edge
- IP Appliances
- Virtual Systems
- Safe@Office
- Smart-1
- Smart-1 SmartEvent
- Integrated Appliance Solution
- IAS Bladed Hardware
- Software Blades
- Software Blades Overview
- Security Gateway
- Firewall
- IPSec VPN
- IPS
- Mobile Access
- Application Control
- Identity Awareness
- DLP
- Web Security
- URL Filtering
- Anti-Bot
- Antivirus
- Anti-Spam & Email Security
- Advanced Networking & Clustering
- Voice over IP (VoIP)
- Threat Prevention
- ThreatCloud™
- Security Management
- Compliance
- Network Policy Management
- Endpoint Policy Management
- Logging & Status
- SmartWorkflow
- Monitoring
- Management Portal
- User Directory
- SmartProvisioning
- SmartReporter
- SmartEvent
- Multi-Domain Security Management
- Virtualization Security
- Security Gateway Virtual Edition
- Cloud Security
- Virtual Appliance for Amazon Web Services
- Security Systems
- Security Systems Overview
- Endpoint Security
- Endpoint Security
- Full Disk Encryption
- Media Encryption
- Anti-Malware & Program Control
- Remote Access VPN
- Firewall & Compliance
- Check Point WebCheck
- Check Point GO
- Solutions
- Remote Access
- Consumer Products
- ZoneAlarm Antivirus
- ZoneAlarm ForceField
- ZoneAlarm Internet Security Suite
-
Next Steps
- Find a Partner
- Call US sales: 1-866-488-6691
- Contact Us Online
Resources
Check Point Software Blade Architecture Brochure- Software Blade Architecture White Paper
- Voice over IP Security Solutions
Software Blades
Security Gateway Software Blades