1. Configuration Guide
  2. Security
  3. Secure Real-Time Transport Protocol
  4. ACLI Example Configurations
  5. Security Policy

Security Policy

A Security Policy enables the Oracle® Enterprise Session Border Controller to identify inbound and outbound media streams that are treated as SRTP/SRTCP. The high-priority Security Policy, p1, (shown below) allows signaling traffic from source 172.16.1.3 to destination 172.16.1.10:5060. The lower-priority Security Policy, p2, (also shown below) matches media traffic with the same source and destination, but without any specific ports. Consequently, SIP signaling traffic (from local port 5060) go through, but the media stream will be handled by appropriate SRTP SA. 

security-policy
     name                              p1
     network-interface                 private:0
     priority                          0
     local-ip-addr-match               172.16.1.3
     remote-ip-addr-match              172.16.1.10
     local-port-match                  5060
     remote-port-match                 0
     trans-protocol-match              UDP
     direction                         both
     local-ip-mask                     255.255.255.255
     remote-ip-mask                    255.255.255.255
     action                            allow
     ike-sainfo-name
     outbound-sa-fine-grained-mask
          local-ip-mask                255.255.255.255
          remote-ip-mask               255.255.255.255
          local-port-mask              0
          remote-port-mask             0
          trans-protocol-mask          0
          valid                        enabled
          vlan-mask                    0xFFF
     last-modified-by                  admin@console
     last-modified-date                2009-11-09 15:01:55

security-policy
     name                              p2
     network-interface                 private:0
     priority                          10
     local-ip-addr-match               172.16.1.3
     remote-ip-addr-match              172.16.1.10
     local-port-match                  0
     remote-port-match                 0
     trans-protocol-match              UDP
     direction                         both
     local-ip-mask                     255.255.255.255
     remote-ip-mask                    255.255.255.255
     action                            ipsec
     ike-sainfo-name
     outbound-sa-fine-grained-mask
          local-ip-mask                0.0.0.0
          remote-ip-mask               255.255.255.255
          local-port-mask              0
          remote-port-mask             65535
          trans-protocol-mask          255
          valid                        enabled
          vlan-mask                    0xFFF
     last-modified-by                  admin@console
     last-modified-date                2009-11-09 15:38:19