Ipsec Support and Volte Components Updates: by Aleksandar Yosifov
Uploaded by
datura098cIpsec Support and Volte Components Updates: by Aleksandar Yosifov
Uploaded by
datura098cIPSec Support And
VoLTE Components
Updates
by Aleksandar Yosifov
About Me
C/C++ developer since 2005
Previous experience
Parking & Access control systems
Gambling industry
Current – Telecom industry since 2013
Leading Core Network team since March 2019
Integrating VoLTE using Kamailio SIP server
Myself
VoIP engineer
QA/Telecom engineer
New features
IPSec supported algorithms:
Sha1(default) and md5 - parsed from
REGISTER msg
Encapsulating Security Payload
IPv6
Improvements in ims_registrar/usrloc_pcscf
modules
TCP support
IPv4 and/or IPv6 listen interfaces
4 SAs and policies
New features
Extended P-CSCF location table
New match key – received_port column – because of Re-Registration
New columns – port_pc, port_ps, t_port_pc, t_port_ps
Improvements
S-CSCF
Single NOTIFY to the subscribers after Re-Registration
Single Contact in 200OK reply for UE Re-Registration
List all contacts in NOTIFY body when a contact expires
Delete expired contact from the DB after expiration
NOTIFY body with terminated contact
IPSec in Kamailio IMS deployments
kamailio.cfg
…
tcp_reuse_port=yes
…
#ims registrar pcscf module is bound to the ims ipsec pcscf module.
loadmodule "ims_ipsec_pcscf"
loadmodule "ims_registrar_pcscf"
…
modparam("ims_ipsec_pcscf", "ipsec_listen_addr6", "fd14::211:2eff:feec:d4be")
modparam("ims_ipsec_pcscf", "ipsec_listen_addr", "192.168.1.11")
modparam("ims_ipsec_pcscf", "ipsec_client_port", 5100) # Send from this port to UE server port
modparam("ims_ipsec_pcscf", "ipsec_server_port", 6100) # Receive on this port from UE client port
modparam("ims_ipsec_pcscf", "ipsec_reuse_server_port", 1) # by default is 1, can be skipped here
modparam("ims_ipsec_pcscf", "ipsec_max_connections", 2)
modparam("ims_ipsec_pcscf", "ipsec_spi_id_start", 100) # by default is 100, can be skipped here
modparam("ims_ipsec_pcscf", "ipsec_spi_id_range", 4) # by default is 1000, can be skipped here
…
IPSec in Kamailio IMS deployments
tcp_reuse_port=yes
Must be always set to “yes” when TCP is used
https://www.kamailio.org/wiki/cookbooks/5.3.x/core#tcp_reuse_port
Allows reuse of TCP ports. This means, for example, that the same TCP ports on
which Kamailio is listening on, can be used as source ports of new TCP connections
when acting as an UAC. Kamailio must have been compiled in a system
implementing SO_REUSEPORT (Linux > 3.9.0, FreeBSD, OpenBSD, NetBSD, MacOSX).
This parameter takes effect only if also the system on which Kamailio is running on
supports SO_REUSEPORT.
ipsec_reuse_server_port
If set to 1 – reuse the old P-CSCF server port during Re-Registration. Only a new P-
CSCF client port will be distributed.
IPSec in Kamailio IMS deployments
ipsec_forward()
IPSEC_SEND_FORCE_SOCKET(0x01) - Useful for IPSec and TCP. If set to 1 - send requests
through an existing IPSec tunnel when TCP is used. In combination with
tcp_reuse_port=yes
IPSEC_REVERSE_SEARCH(0x02)– helps to use the newest SAs for Requests to the UE
(contact aliases are disabled)
onreply_route[REGISTER_reply] & onreply_route[MO_reply]
ipsec_forward(“location”,”1”);
route[REQINIT]
ipsec_forward(“location”,”3”);
ipsec_create()
IPSEC_CREATE_DELETE_UNUSED_TUNNELS(0x01) - delete unused tunnels before each
registration – is a must to be used when contact aliases are disabled.
onreply_route[REGISTER_reply]
if (t_check_status("401")) { ipsec_create("location","1") }
IPSec in Kamailio IMS deployments
Exclude contact alias
kamailio.cfg
route {
...
} else {
force_rport();
#!ifdef WITH_CONTACT_ALIAS
if(is_method("INVITE|SUBSCRIBE|UPDATE|REGISTER")) {
add_contact_alias();
}
#!endif
...
}
...
# Handle requests within SIP dialogs
route[WITHINDLG] {
if (has_totag()) {
#!ifdef WITH_CONTACT_ALIAS
if(!isdsturiset()) {
handle_ruri_alias();
}
#!endif
...
IPSec in Kamailio IMS deployments
76 route[NATMANAGE] {
Exclude contact alias ...
if ((is_reply() && ($T_req($tt) != $null)) || (is_request() && has_totag())) {
rtp.cfg if(!check_route_param("rm=") && !isflagset(FLT_RTP)) {
return;
}
#!ifdef WITH_CONTACT_ALIAS
if (is_request()) {
if (isflagset(FLT_MOBILE_ORIG) && is_direction("downstream")) {
add_contact_alias();
} else if (!isflagset(FLT_MOBILE_ORIG) && is_direction("upstream")) {
add_contact_alias();
}
} else {
if (!isflagset(FLT_MOBILE_ORIG) && is_direction("downstream")) {
add_contact_alias();
} else if (isflagset(FLT_MOBILE_ORIG) && is_direction("upstream")) {
add_contact_alias();
}
}
#!endif
}
#!ifdef WITH_CONTACT_ALIAS
else {
if (is_reply() && !isflagset(FLT_MOBILE_ORIG)) {
add_contact_alias();
}
}
#!endif
...
IPSec with TCP and 2 connections
tcp 0 0 192.168.1.11:5100 0.0.0.0:* LISTEN 14626/kamailio
tcp 0 0 192.168.1.11:5101 0.0.0.0:* LISTEN 14626/kamailio
tcp 0 0 192.168.1.11:6100 0.0.0.0:* LISTEN 14626/kamailio
tcp 0 0 192.168.1.11:6101 0.0.0.0:* LISTEN 14626/kamailio
tcp 0 0 192.168.1.11:5060 0.0.0.0:* LISTEN 14626/kamailio
tcp6 0 0 fd14::211:2eff:fee:5100 :::* LISTEN 14626/kamailio
tcp6 0 0 fd14::211:2eff:fee:5101 :::* LISTEN 14626/kamailio
tcp6 0 0 fd14::211:2eff:fee:6100 :::* LISTEN 14626/kamailio
tcp6 0 0 fd14::211:2eff:fee:6101 :::* LISTEN 14626/kamailio
tcp6 0 0 fd14::211:2eff:fee:5060 :::* LISTEN 14626/kamailio
Thank you for your attention!
Q&A
