A Session Border Controller (SBC) is a system component evolved to add security and interoperability between SIP endpoints and call servers like IP Office. In addition to security and interoperability, SBCs like Avaya’s Session Border Controller for Enterprise (Avaya SBCE) add further features such as resilience and edge proxy services.

IP Office supports many SBC features; it is important to understand the differences between Avaya SBCE and IP Office when designing a deployment. For the strongest security posture, implementation of the Avaya SBCE is recommended as a best practice.

The following table summarizes the differences between IP Office and Avaya SBCE:

Notes

1. IP Office does not have sufficient port/service separation for DMZ placement.

2. External firewall should always be used.

3. Limited IP Office Linux firewall.

4. IP Office does not support AES-256 SRTP.

5. IP500 V2 does not support TLS GCM ciphers.

6. IP Office brute force login resistance should be disabled when routing via an SBC. ASBCE Call Walking feature may provide some resistance in certain situations.

   • If an SBC or SIP Application Level Gateway (ALG) is deployed, you must move some security measures from the IP Office to the SBC/ALG. The IP Office source IP address blacklisting should be disabled with the No User Source Number 'B_DISABLE_SIP_IPADDR'. The SBC/ALG black/white listing must be activated to compensate.

7. IP Office Subscription provides HTTP reverse proxy for management only (RSS feature).