Access Control List Configuration

To configure access control lists:

Access the access-control configuration element.

ACMEPACKET# configure terminal
ACMEPACKET(configure)# session-router
ACMEPACKET(session-router)# access-control
ACMEPACKET(access-control)#

Type select to choose and configure an existing object.

ACMEPACKET(access-control)# select
<src-ip>:
1: src 0.0.0.0; 0.0.0.0; realm01; ; ALL

realm-id—Enter the ID of the host’s ingress realm.
source-address—Enter the source IPv4 address and port number for the host in the following format:
```
<IP address>[/number of address bits>][:<port>][/<port bits>]
```
For example:
```
10.0.0.1/24:5000/14
10.0.0.1/16
10.0.0.1/24:5000
10.0.0.1:5000
```
You do not need to specify the number of address bits if you want all 32 bits of the address to be matched. You also do not need to specify the port bits if you want the exact port number matched. If you do not set the port mask value or if you set it to 0, the exact port number will be used for matching. The default value is 0.0.0.0.
destination-address—(Is ignored if you configure an application protocol in step 7.) Enter the destination IPv4 address and port for the destination in the following format:
```
<IP address>[/number of address bits>][:<port>[/<port bits>]]
```
You do not need to specify the number of address bits if you want all 32 bits of the address to be matched. You also do not need to specify the port bits if you want the exact port number matched. If you do not set the port mask value or if you set it to 0, the exact port number will be used for matching. The default value is 0.0.0.0.
application-protocol—Enter the application protocol type for this ACL entry. The valid values are:
- SIP | H.323 | None
  
  Note:
  If application-protocol is set to none, the destination-address and port will be used. Ensure that your destination-address is set to a non-default value (0.0.0.0.)
transport-protocol—Select the transport-layer protocol configured for this ACL entry. The default value is ALL. The valid values are:
- ALL | TCP | UDP
access—Enter the access control type or trusted list based on the trust-level parameter configuration for this host. The default value is permit. The valid values are:
- permit—Puts the entry into the untrusted list. The entry is promoted or demoted according to the trust level set for this host.
- deny—Puts the entry in the deny list.
average-rate-limit—Indicate the sustained rate in bytes per second for host path traffic from a trusted source within the realm. The default value is 0. A value of 0 means policing is disabled. The valid range is:
- Minimum—0
- Maximum—999999999
trust-level—Indicate the trust level for the host with the realm. The default value is none. The valid values are:
- none—Host is always untrusted. It is never promoted to the trusted list or demoted to the deny list.
- low—Host can be promoted to the trusted list or demoted to the deny list.
- medium—Host can be promoted to the trusted list but is only demoted to untrusted. It is never added to the deny list.
- high—Host is always trusted.
invalid-signal-threshold— Enter the number of invalid signaling messages that trigger host demotion. The value you enter here is only valid when the trust level is low or medium. Available values are:
- Minimum—Zero (0) is disabled.
- Maximum—999999999
  
  If the number of invalid messages exceeds this value based on the tolerance window parameter, configured in the media manager, the host is demoted.
  
  The tolerance window default is 30 seconds. Bear in mind, however, that the system uses the same calculation it uses for specifying "recent" statistics in show commands to determine when the number of signaling messages exceeds this threshold. This calculation specifies a consistent start time for each time period to compensate for the fact that the event time, such as a user running a show command, almost never falls on a time-period's border. This provides more consistent periods of time for measuring event counts.
  
  The result is that this invalid signal count increments for two tolerance windows, 60 seconds by default, within which the system monitors whether or not to demote the host. The signal count for the current tolerance window is always added to the signal count of the previous tolerance window and compared against your setting.
maximum-signal-threshold—Set the maximum number of signaling messages the host can send within the tolerance window. The value you enter here is only valid when the trust level is low or medium. The default value is 0, disabling this parameter. The valid range is:
- Minimum—0
- Maximum—999999999
  
  If the number of messages received exceeds this value within the tolerance window, the host is demoted.
untrusted-signal-threshold—Set the maximum number of untrusted messages the host can send within the tolerance window. Use to configure different values for trusted and un-trusted endpoints for valid signaling message parameters. Also configurable per realm. The default value is 0, disabling this parameter. The valid range is:
- Minimum—0
- Maximum—999999999
deny-period—Indicate the time period in seconds after which the entry for this host is removed from the deny list. The default value is 30. The valid range is:
- Minimum—0
- Maximum—999999999

nat-trust-threshold—Enter the number of endpoints behind a NAT that must be denied for the Oracle® Enterprise Session Border Controller to demote the NAT device itself to denied (dynamic demotion of NAT devices). The default is 0, meaning dynamic demotion of NAT devices is disabled. The range is from 0 to 65535.

The following example shows access control configured for a host in the external realm.

access-control
        realm-id                       external
        source-address                 192.168.200.215
        destination-address            192.168.10.2:5000
        application-protocol           SIP
        transport-protocol             ALL
        access                         permit
        average-rate-limit             3343
        trust-level                    low
        invalid-signal-threshold       5454
        maximum-signal-threshold       0
        untrusted-signal-threshold     0
        deny-period                    0

The following example of how to configure a black-list entry:

access-control
        realm-id                       external
        source-address                 192.168.200.200
        destination-address            192.168.10.2:5000
        application-protocol           SIP
        transport-protocol             ALL
        access                         deny
        average-rate-limit             0
        trust-level                    none
        invalid-signal-threshold       0
        maximum-signal-threshold       0
        untrusted-signal-threshold     0
        deny-period                    0