Details of a PBX Firewall Implementation

The PBX firewall, located between the demarc and the PBX, can look at the traffic going through every trunk in the voice network. After installing a firewall, an organization could specify that any modem traffic other than what is authorized for specific lines (i.e., modem numbers) will be shut down. This eliminates the problem of unknown analog lines and unknown modem traffic. Initially, the organization would set up the logic rules in log or alert mode only and then lock down the network after the environment has been fully "discovered."

A policy screen that allows modem calls for the IT staff and recognized PBX vendors and employees dialing in through the authorized RAS server. If the call falls through these logic rules, it reaches the final "terminate call" action rule. Like the IP firewall, rules, groups, and actions must be set up for the enterprise based on business and security needs.

Because the PBX firewall has access to all the inbound and outbound traffic, including telephone numbers, type of traffic, duration, etc., it can create a plethora of reports showing both security and operationally related information. If it has a large storage capacity, trending reports can be generated. Some examples of possible reports include:

• Source, date, and duration of modem calls into maintenance ports on PBXs, routers, and other network equipment
• Non-fax calls on fax lines
• Number of unanswered calls sorted by phone station, department, office, or enterprise, which can help flag war dialing
• Percent of voice trunk infrastructure consumed by unauthorized modem calls to ISPs from inside the enterprise
• Call volume by source or destination numbers
• War-dialing attacks
• Utilization rates for remote access and fax resources
• Unused, orphaned phone lines showing no traffic activity
• Summary of calls terminated or flagged based on execution of particular rules; for example, the number of calls terminated due to unauthorized call type (e.g., modem or voice on a fax line) over several months can be listed