Self Hosting VOIP server getting SIP attack

Hi VSA Support 

Could you please PM me the service request number raised with support? It would help us to check the history of the case and allow us to assist you better.

Hi Keyur,

Here is one of the caseID
9202926
9567224

8956841

Hi VSA Support 

Thank you for providing service request numbers, I will check them, meanwhile could you please provide a network diagram or packet flow of SIP traffic.

Hi Keyur,

Unfortunately i don't have the packet flow for the SIP traffic.

But as for the Network Diagram, you could refer below.

Video Call -> L1 Switch -> Firewall -> ISP

Hi VSA Support 

As per my understanding, you have LAN to WAN firewall rule for Outbound SIP Connection and WAN to LAN for Inbound connection and as you have opened the connection for ANY for WAN zone, the firewall will allow the traffic, if you have specific IPs detected, you can ask your ISP to block them.

For complete security, you have applied recommended settings in the SIP server as well or host-based security, IPS policy on LAN to WAN and WAN to LAN firewall rule in the firewall. You have to restrict the incoming traffic by specifying networks for WAN.

Apply DOS setting for UDP flood based on your SIP traffic.

Hi Keyur,

sorry for the late reply, So far we are just dropping the attacker's IP from firewall.

Keyur said:

Apply DOS setting for UDP flood based on your SIP traffic.

Are you referring to the IPS side?

Hi Keyur,

sorry for the late reply, So far we are just dropping the attacker's IP from firewall.

Keyur said:

Apply DOS setting for UDP flood based on your SIP traffic.

Are you referring to the IPS side?