Security issues

Last Updated : Jun 05, 2019 |
Prolog information
Metadata
Keywords:
Important:
After you modify the DTLS settings of a cluster, you must stop and start the tps and csv services. Stopping and starting these services results in a brief outage interval because the nodes change operation and the UNIStim sets are re-registered. This might have an impact on endpoint registration and call handling. For more information, see Maintenance commands.
Avaya recommends that you stop and start these services during the maintenance period to minimize endpoint registration and call handling problems.
  1. SIP TLS:
    1. Confirm there is a separate SIP Entity of type Endpoint Concentrator. Verify in System Manager by selecting ElementsRoutingSIP Entities from the menu and viewing the information.
    2. Confirm there is a TLS link configured between the SIP entity and Session Manager. The Connection Policy should be endpt conc.
    3. Confirm the Avaya Breeze® platform server has a valid SIP identity certificate. Verify in System Manager by selecting ServicesInventoryManage Elements from the menu and selecting the element. Select More ActionsManage Identity Certificates.
  2. DTLS:
    1. Confirm DTLS settings have been propagated to TPS. Check /opt/Avaya/da/shared/config/config.ini.
      ADDITIONAL INFORMATION: [UNIStimDTLS] 
      TPS_DTLS=1                                       // 0 – Off, 1 – Best effort, 2 - Always 
      DTLSClientAuthentication=0
      Note:
      The TPS and CSV applications must be stopped and started again after changing the attribute.
    2. Confirm DTLS ports are open for CSV and TPS.
      ADDITIONAL INFORMATION: netstat -unap | grep -E "4101|5101|8301"
      udp 0 0 192.168.96.115:8301 0.0.0.0:* 9190/tps
      udp 0 0 192.168.96.115:4101 0.0.0.0:* 15320/csv
      udp 0 0 192.168.96.115:5101 0.0.0.0:* 9190/tps
    3. If you have made keystore and truststore certificate changes after snap-in installation, the following commands should be executed from the Avaya Breeze® platform CLI as root.
      ADDITIONAL INFORMATION: cd /opt/Avaya/da/ 
      ./avaya_securitymodule_pki_toolinitda dausersm_pki_descriptor_da.txt
    4. If no other issues are found, reset the endpoint to factory defaults to delete the previous CA certificate on it. Reinstall the current root CA certificate again.
    5. The CA certificate for an i2050 software endpoint must be installed in Trusted Root Certification AuthoritiesLocal Machine. The Certificate Manager attempts to install it in Trusted Root Certification AuthoritiesRegistry by default.