The leader

in session border control

for trusted, first class

interactive communications

Comparison of SBCs
to SIP firewall/ALGs

Summary comparison:
SBCs vs. Firewalls with SIP ALGs
SBC

Firewall with SIP ALG

Back-to-back user agent

Maintains single session

Fully state-aware at
layers 2-7

Fully state-aware at
layers 3 & 4 only

Inspects and modifies any

application layer header info
(SIP, SDP, etc.)

Inspects and modifies only

application layer addresses
(SIP, SDP, etc.)

Can terminate, initiate,

re-initiate signaling & SDP

Unable to terminate, initiate,

re-initiate signaling & SDP

Static & dynamic ACLs

Static ACLs only

Data center
SIP trunking

Data center
SIP trunking

IP PBX
UC server

Acme Packet

IP PBX
UC server

SBC vs. firewall w/ SIP ALG comparison

Security scenarios
Use case
scenario

Business challenge

Technical requirements

SBC/FW
DoS/DDoS
self-protection

Prevent malicious or
non-malicious SIP
signaling or media
attacks & overloads
from making the SBC
or FW non-responsive

* Dynamically block attacks

* Detect/reject non-compliant

Prevent unauthorized
or fraudulent network
usage

* Control number & bandwidth

Network abuse
control

(signaling, protocol, traffic

levels) SIP sessions
* Initiate SIP BYEs to tear
down core-side sessions
* Statefully control legitimate
SIP registrations during
overloads
of simultaneous sessions
* Strip unauthorized codecs
from SDP headers
* Scan SIP header
attachments for
unauthorized content

Acme Packet

SBC FW w/
ALG

SBC vs. firewall w/ SIP ALG comparison

Application reach, regulatory scenarios
Use case
scenario

Business challenge

Technical requirements

IP PBX and
UC protocol
interworking

Translate dissimilar
signaling (SIP, H.323),
transport (UDP, TCP,
SCTP) & encryption
(none, TLS, SRTP,
IPsec)

* Terminate SIP sessions

and translate layer 2-7

protocol information
* Fix protocol anomalies &
inconsistencies

Enable users behind

Remote site
NAT traversal FW/NATs to originate

* Keep FW pinholes open by

Session
replication
for recording

* Replicate all SIP signaling

and receive VoIP calls

and UC sessions
Comply with regulatory
requirements and
maximize customer
service quality

resetting SIP registration

interval to less than FW
port TTL and caching SIP
registrations by FW IP/port

and media to recording

server(s) in addition to
intended recipient
* Replicate selective or all
sessions

Acme Packet

SBC FW w/
ALG

SBC vs. firewall w/ SIP ALG comparison

Availability scenarios
Use case
scenario

Business challenge

Technical requirements

Data center
disaster
recovery

Assure constant service

availability and quality

* Network SBC detect

Remote site
survivability

Provide alternative path

for VoIP/UC traffic when
primary path becomes
unavailable

* Monitor link and routing

Ensure no loss of active

sessions or session state
during failover

* Checkpointing of SIP

High
availability
operation

failure of datacenter SIP

session agents and reroute SIP sessions
* Datacenter SBC translate
phone numbers in SIP
headers for SIP trunk
geo-redundancy
state of upstream router &
SIP registration state of
remote IP PBX/UC server
* Re-route SIP signaling and
media to alternative
trunking provider, PSTN
media gateway or Internet
signaling, media and
configuration state between
active & standby elements

Acme Packet

SBC

FW w/
ALG

SBC vs. firewall w/ SIP ALG comparison

SLA assurance scenarios
Use case scenario

Business
challenge

Technical requirements

QoE-based
routing

Maximize voice
quality and reliability
of services and
applications

* Actively monitor voice QoS

Ensure continuous
service availability
and quality, even
under adverse traffic
loads and/or attack

* Dynamically monitor server

IP PBX/UC server
session
admission &
overload control

thresholds and ASR

* Re-route or redistribute
traffic as needed
* Release media within
access network to optimize
quality
status and control SIP
signaling flows to IP
PBX/UC servers accordingly

Acme Packet

SBC FW w/
ALG

The leader
in session border control

for trusted, first class

interactive communications