Cisco ASA 5505 - Manual (Page 1091)

52-3
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 52 Configuring Cisco Intercompany Media Engine Proxy
Information About Cisco Intercompany Media Engine Proxy
On successful verification, the terminating side creates a ticket that grants permission to the call
originator to make a Cisco IME call to a specific number. See
Tickets and Passwords, page 52-3 for
information.
Figure 52-1 Interaction of the UC-IME Proxy with the PSTN
Tickets and Passwords
Cisco Intercompany Media Engine utilizes tickets and passwords to provide enterprise verification.
Verification through the creation of tickets ensures an enterprise is not subject to denial-of-service
(DOS) attacks from the Internet or endless VoIP spam calls. Ticket verification prevents spam and DOS
attacks because it introduces a cost to the VoIP caller; namely, the cost of a PSTN call. A malicious user
cannot set up just an open source asterisk PBX on the Internet and begin launching SIP calls into an
enterprise running Cisco Intercompany Media Engine. Having the Cisco Intercompany Media Engine
Proxy verify tickets allows incoming calls from a particular enterprise to a particular number only when
that particular enterprise has previously called that phone number on the PSTN.
To send a spam VoIP call to every phone within an enterprise, an organization would have to purchase
the Cisco Intercompany Media Engine and Cisco Unified Communications Manager and have called
each phone number within the enterprise over the PSTN and completed each call successfully. Only then
can it launch a VoIP call to each number.
The Cisco Intercompany Media Engine server creates tickets and the ASA validates them. The ASA and
Cisco Intercompany Media Engine server share a password that is configured so that the ASA detects
the ticket was created by a trusted Cisco Intercompany Media Engine server. The ticket contains
information that indicates that the enterprise is authorized to call specific phone numbers at the target
enterprise. See
Figure 52-2 for the ticket verification process and how it operates between the originating
and terminating-call enterprises.
Note Because the initial calls are over the PSTN, they are subject to any national regulations regarding
telemarketing calling. For example, within the United States, they would be subject to the national
do-not-call registry.
Public
Internet
Enterprise B Enterprise A
24
8
906
IP
IP
IP
IP
M M
ASA ASA
UC-IME
Server
UC-IME
Server
Cisco UCM Cisco UCM
PSTN