ZXSEC US IM P2P VoIP Technical Note
ZXSEC US IM P2P VoIP Technical Note
Version 3.6
ZTE CORPORATION
ZTE Plaza, Keji Road South,
Hi-Tech Industrial Park,
Nanshan District, Shenzhen,
P. R. China
518057
Tel: (86) 755 26771900 800-9830-9830
Fax: (86) 755 26772236
URL: http://support.zte.com.cn
E-mail: [email protected]
LEGAL INFORMATION
The contents of this document are protected by copyright laws and international treaties. Any reproduction or
distribution of this document or any portion of this document, in any form by any means, without the prior written
consent of ZTE CORPORATION is prohibited. Additionally, the contents of this document are protected by
contractual confidentiality obligations.
All company, brand and product names are trade or service marks, or registered trade or service marks, of ZTE
CORPORATION or of their respective owners.
This document is provided “as is”, and all express, implied, or statutory warranties, representations or conditions
are disclaimed, including without limitation any implied warranty of merchantability, fitness for a particular purpose,
title or non-infringement. ZTE CORPORATION and its licensors shall not be liable for damages resulting from the
use of or reliance on the information contained herein.
ZTE CORPORATION or its licensors may have current or pending intellectual property rights or applications
covering the subject matter of this document. Except as expressly provided in any written license between ZTE
CORPORATION and its licensee, the user of this document shall not acquire any license to the subject matter
herein.
The contents of this document and all policies of ZTE CORPORATION, including without limitation policies related to
support or training are subject to change without notice.
Revision History
Document
ZXSEC US IM/P2P/VoIP Technical Note
Name
Document Revision
Product Version V3.6 R1.0
Number
Equipment
Serial No. sjzl20084111
Installation Date
Presentation:
(Introductions, Procedures, Illustrations, Completeness, Level of Detail, Organization,
Appearance)
Good Fair Average Poor Bad N/A
Intelligibility:
(Language, Vocabulary, Readability & Clarity, Technical Accuracy, Content)
Good Fair Average Poor Bad N/A
Please check the suggestions which you feel can improve this documentation:
Improve the overview/introduction Make it more concise/brief
Improve the Contents Add more step-by-step procedures/tutorials
Improve the organization Add more troubleshooting information
Include more figures Make it less technical
Your Add more examples Add more/better quick reference aids
suggestions for Add more detail Improve the index
improvement of
this Other suggestions
documentation __________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
# Please feel free to write any comments on an attached sheet.
If you wish to be contacted regarding your comments, please complete the following:
Name Company
Postcode Address
Telephone E-mail
This page is intentionally blank.
Contents
Chapter 1.......................................................................... 1
Chapter 2.......................................................................... 9
Chapter 3........................................................................ 13
Figures............................................................................ 17
Tables .............................................................................19
About this Manual
Chapter Summary
Chapter 1, Instant Included Firewall Control,IM Aware
Messenger Protocols Firewalls,Anti-Virus Control,Detecting New
IM Applications,Blocking Older Versions of
IM Applications,IM/P2P Applications
Covered by IPS in ZXSEC US OS 3.6
Chapter Summary
Chapter 2, Peer to Peer The ZXSEC US firewall does have protocol
Protocols decoders for most popular P2P protocols
including Skype, Gnutella, eDonkey, Bit
Torrent, KaZaa and WinNY. However at
this time it only provides allow, block, or
rate limiting capabilities since file transfers
are normally encrypted by the individual
protocol, which prevents the ZXSEC US
from being able to analyze or scan the
content for viruses
Chapter 3, Voice over Describe the two VoIP protocols which
Internet Protocol ZXSEC US OS supports
Conventions
Typographical ZTE documents employ the following typographical conventions.
Conventions
TABLE 2 TYPOGRAPHICAL CONVENTIONS
Typeface Meaning
Italics References to other Manuals and documents.
“Quotes” Links on screens.
Bold Menus, menu options, function names, input
fields, radio button names, check boxes, drop-
down lists, dialog box names, window names.
CAPS Keys on the keyboard and buttons on screens
and company name.
Constant width Text that you type, program code, files and
directory names, and function names.
[] Optional parameters.
{} Mandatory parameters.
| Select one of the parameters that are delimited
by it.
Note: Provides additional information about a
certain topic.
Typeface Meaning
Refers to clicking the secondary mouse button
Right-click
(usually the right mouse button) once.
Refers to pressing and holding a mouse button and
Drag
moving the mouse.
Instant Messenger
Protocols
Overview
Many IM protocols are in use today. The ones most widely used
include:
AOL Instant Messenger (AIM)
Introduced by AOL as way to allow members to communicate
with one another in real-time to avoid the delay of standard
email. Latest versions of AIM allow users to not only text
chat, but also voice and video chat without using expensive
long distance metered services such as the public switched
telephone network (PSTN). AIM service is now free to non-
paying members as long as they register with AOL.
Yahoo Instant Messenger (YIM)
Yahoo, wanting to entice users to sign up for its advertiser
paid services, offers this popular free IM service which
provides all of the same chat capabilities of AIM and provides
a nimble client that is capable of discovering holes in
firewalls in order to get around blocked ports.
MSN Messenger
Microsoft offers a similar service to both AOL and Yahoo. In
addition to text message exchange, MSN Messenger offers
voice and video conferencing with multiple simultaneous
users as a way to entice business users to improve
communications, display presentations, and reduce travel
expense. MSN Messenger is SIP protocol-based which is a
well known IP telephony standard.
ICQ (abbreviated for "I Seek You")
A popular international IM protocol, ICQ is available on many
platforms and operating systems to provide the popular IM
features offered by AOL, YIM, and MSN Messenger, and is
now owned by AOL TimeWarner. Claiming to be the most
widely used chat protocol in the world, ICQ offers video chat,
dating, lists, and people search capabilities.
The following topics are included in this section:
Firewall Control
IM Aware Firewalls
Anti-Virus Control
Detecting New IM Applications
Blocking Older Versions of IM Applications
IM/P2P Applications Covered by IPS in ZXSEC US OS 3.6
Firewall Control
Firewalls can be used in many cases to block or rate limit certain
IM protocols.
The ZXSEC US firewall has predefined services used to block or
allow common IM protocols. For example, AIM uses ports 5190-
5194, and MSN Messenger uses port 1863 as standard ports for
default communications. These IM clients can easily be blocked
by closing these ports. Most firewalls are only effective in
blocking specific predefined ports so some IM protocols are
designed to find other open ports or can be configured to use
well known ports such as port 80 to get around the blocked
ports.
It is very difficult to block these protocols with standard firewall
technology.
Because of this, a more effective way of identifying and
controlling IM protocols is needed.
Note:
If virtual domains are enabled on the ZXSEC US unit, IM/P2P
features are configured globally. To access these features, select
Global Configuration on the main menu.
IM Aware Firewalls
The ZXSEC US Unified Threat Management System, an advanced
next generation firewall, is IM application aware and uses special
protocol decoders to track IM traffic. The ZXSEC US firewall can
block or allow AIM, YIM, MSN, and ICQ individually per protocol
by using the Intrusion Prevention System module.
In ZXSEC US V3.0 MR5 and earlier releases, go to Intrusion
Protection > Signatures > Predefined to set the IPS action on
each of the IM protocols.
FIGURE 3 EXAMPLE OF IM USER LIST UNDER IM, P2P&VOIP > USER > USER
LIST
Using the USLA system, you can even generate usage reports by
IM username in order to track usage over time. You can log IM
chat information and its limitations by enabling Archive full IM
chat info to USLA in the protection profile. You can also generate
a variety of different report types, including:
IM activity by date and action
Top permitted sources by date
Top blocked sources by date
Top permitted destinations by date
Top blocked destinations by date
IM activity by month and action
Top permitted sources by month
Top blocked sources by month
Top permitted destinations by month
Top blocked destinations by month
IM activity by day of week and action
IM activity by hour of day and action
For more information, see the USLA documentation.
Note:
IM users who are already logged on before changes are made to
the IM protection profile, will not be affected until their next
login. You cannot disconnect users who have already logged on
by enabling logon blocking.
Anti-Virus Control
Virus writers are constantly adapting to get around common
antivirus defense methods. IM protocols are becoming a new
vehicle for spreading viruses. Another benefit of having IM
protocol decoders is the ability to proxy the protocol though the
ZXSEC US antivirus engine. This allows any IM file transfers to
be scanned in real-time to prevent the spread of these new
viruses. The ZXSEC US firewall can now be used to configure IM
scanning per protection profile.
Detecting New IM
Applications
New versions of current IM/P2P applications are constantly being
produced. In some cases, new applications are readily available.
Although most IM/P2P controls are under Firewall > Protection
Profile, the detection of IM/P2P applications is done by IPS. To
detect new IM/P2P applications or new versions of the existing
applications, users only need to update the IPS package. No
firmware upgrade is needed.
Note:
Applications marked as bold can connect to multiple P2P
networks.
IPS Applications
AIM (Protection Profile > IM/P2P) AIM, AIM Triton
ICQ (Protection Profile) ICQ
MSN (Protection Profile > IM/P2P) MSN Messenger
im_decoder:qq QQ
Yahoo! (Protection Profile > IM/P2P Yahoo Messenger
IPS predefined signature: MSN web
msn_web_messenger Messenger
Google Instant
IPS predefined signature: google_talk
Messenger
Rediff Instant
IPS predefined signature: rediff
Messenger
Note:
If you encounter an IM/P2P applications that is not listed above,
make sure that you have the latest upgrade for the IPS.If you
have the latest upgrade and the IM/P2P application is still
unrecognized, use Custom Signatures.
Overview
Peer to Peer (P2P) protocols also have some of the same
capabilities as IM protocols, such as live text chat and file
transfers. P2P differs from IM however in that instead of having
a sponsor controlled central server system, you can set up as
many servers as you want independent of the sponsor. P2P is
typically used to set up file sharing networks, where the files can
be hosted by anyone willing to install the P2P server software.
Skype is a popular new P2P protocol which can be used for text
message and voice chat over the Internet for free. The ZXSEC
US firewall does have protocol decoders for most popular P2P
protocols including Skype, Gnutella, eDonkey, Bit Torrent, KaZaa
and WinNY. However at this time it only provides allow, block, or
rate limiting capabilities since file transfers are normally
encrypted by the individual protocol, which prevents the ZXSEC
US from being able to analyze or scan the content for viruses.
In ZXSEC US OS version 3.6 MR5 and earlier releases, go to
Intrusion Protection > Signatures > Predefined to configure the
P2P IPS predefined signatures.
Starting from ZXSEC US OS version 3.6 MR6, go to Intrusion
Protection > IPS Sensor to configure the predefined signatures
in a sensor. For details, see the ZXSEC US Administration Guide.
In ZXSEC US OS 3.6, the ZXSEC US firewall can also monitor
statistics on P2P usage. For each protocol, you can view average
bandwidth consumption in bytes per second.
Note:
Note that due to the encrypted nature of Skype, the ZXSEC US
firewall is unable to monitor usage for that particular protocol.
FIGURE 6 P2P USAGE STATISTICS UNDER IM, P2P&VOIP > STATISTICS >
SUMM ARY
Note:
If virtual domains are enabled on the ZXSEC US unit, IM/P2P
features are configured globally. To access these features, select
Global Configuration on the main menu.
Rate Limiting
Another advanced capability of ZXSEC US firewalls is P2P rate
limiting. Rate limiting can be used to block or limit the amount
of bandwidth consumed by P2P protocols and more effectively
manage limited Internet resources.
Rate limiting is also done in the firewall policy protection profile
so that it can be enabled on a per-policy basis. You can limit
each protocol to a maximum amount of bandwidth consumed in
kilobytes per second.
Note:
Due to the encrypted nature of Skype, the ZXSEC US firewall is
unable to rate-limit for that protocol. Only the Block and Pass
options are available for that protocol.
Note:
Applications marked as bold can connect to multiple P2P
networks.
IPS Applications
BitComet
Bitspirit
BitTorrent (Protection Profile > IM/P2P)
Azureus
Shareaza
eMule
Overnet
Edonkey2K
eDonkey (Protection Profile > IM/P2P) Shareaza
BearShare
MLdonkey
iMesh
IPS Applications
BearShare
Shareaza
LimeWire
Xolox
Swapper
iMesh
MLdonkey
Gnucleus
Gnutella (Protection Profile > IM/P2P)
Morpheus
Openext
Mutella
Qtella
Qcquisition
Acquisition
NapShare
gtk-gnutella
KaZaA (Protection Profile > IM/P2P) KaZaA
Skype (Protection Profile > IM/P2P) Skype
WinNY (Protection Profile > IM/P2P) WinNY
IPS predefined signature: ares Ares Galaxy
IPS predefined signature:direct_connect DC++
Note:
If you encounter an IM/P2P applications that is not listed above,
make sure that you have the latest upgrade for the IPS.
If you have the latest upgrade and the IM/P2P application is still
unrecognized, use Custom Signatures.
Overview
Starting from ZXSEC US V3.0 MR4 release, you can control and
monitor the usage of VoIP protocols.
The VoIP menu provides statistics for network VoIP usage.
ZXSEC US OS supports two VoIP protocols: Session Initiation
Protocol (SIP) and Skinny Client Control Protocol (SCCP).
The following topics are included in this section:
Firewall Controls
Statistics
CLI Commands
Firewall Controls
In the Firewall Protection Profiles, you are able to control two
functions within the VoIP protocols: logging and rate limiting.
Logging allows you to enable tracking of information available in
the Statistics section.
The VoIP options allow you to set the rate limiting for each of
the VoIP protocols supported by the ZXSEC US unit.
VoIP Logging
You can log VoIP calls.
To enable VoIP logs
Statistics
You can view the VoIP statistics to gain insight into how the
protocols are being used within the network. Overview statistics
are provided for all supported VoIP protocols.
Note:
If virtual domains are enabled on the Instant Messanging, Peer
to Peer, and Voice over Internet Protocols unit, IM, P2P and VoIP
CLI commands
The CLI commands to configure SIP and SCCP settings are under:
config firewall profile For details, see the config firewall chapter
of the ZXSEC US CLI Guide.