Do I Need an SBC or Firewall?
Make sure you consider this question as part of your SIP deployment plan.
The question of session border controller (SBC) or firewall is one that many IT managers find annoying. Why? First and foremost, isn't the new era of communications supposed to be better, faster, cheaper, and easier to use?
The transition to IP and adoption of SIP hasn't been easy for many businesses. The root causes stem from reluctance to change, remorse over having changed over to hosted or premises-based SIP solutions, and disdain for the technology. Key issues in adoption range from poor implementation practices, improper configurations, and unrealistic expectations.
Whether firewalls are or are not SIP-aware doesn't absolve service providers from responsibility. The real gap is enforcement, since having to invest in new or additional infrastructure will scare some customers away. Which providers mandate that customers use either a session border controller (SBC) and or SIP/UC-aware firewall for their voice or UC deployments? While some do, many don't -- and hence contribute to the unnecessary churn rate that occurs. According to some providers, half of the churn is due to business failures (not that this excuses the other half, which are due to misgivings over the services delivered).
Service providers can point to customer premises issues, as they so often did back in the Bell System days. While this remains an issue, overall -- yes, definitively -- service has improved as have the opportunities (benefits and enhancements). Still, our industry cannot remain static; providers must continue to improve service since the reality of convergence is no longer in question. Singular silos and islands will not fare well in the coming age of software-defined networking (SDN) and network functions virtualization (NFV). In part, SDN/NFV will become the answer to my initial question (as the norm).
As stated in recent documentation from firewall vendor SonicWall:
"To overcome many of the hurdles introduced by the complexities of VoIP and NAT, vendors are offering Session Border Controllers (SBCs). An SBC sits on the Internet side of a firewall and attempts to control the border of a VoIP network by terminating and re-originating all VoIP media and signaling traffic. In essence, SBCs act as a proxy for VoIP traffic for non-VoIP enabled firewalls. Dell SonicWALL network security appliances are VoIP enabled firewalls that eliminate the need for an SBC on your network."
When it comes to using a firewall capable of supporting SIP trunks, there is an element of effort and due diligence that goes into properly configuring any appliance or service. My intention isn't to debate the technologies, but rather relate the management issues that businesses face and think about how to get them over the proverbial hump.
This is where expectations fall into the discussion -- as in, many businesses do not expect having to make additional investments after their initial IP/SIP deployments. While service providers might present these as, "Oh, by the way," to customers that translates to, "I didn't know."
Can firewalls support SIP and UC? The first key area to look into in answering this is traffic: by volume and application type. Does the appliance have enough processing power to handle all traffic without introducing impactful latency? Is the firewall licensed in such a way that there aren't any operational deficiencies? Does the appliance interoperate with other infrastructure elements as required in your implementation? How much would it cost to use both an SBC and a firewall vs. only using a firewall? And, again, will the standalone firewall meet all needs or will it be deficient in an area that could either be service impacting or leave holes in security?
Communications service providers anticipate that virtual CPE deployments will garner cost benefits and substantial return on investments over three or four years. Until then, many businesses will face market pressures to move to an IP solution that meets their firm's communications needs. Not all perceive that UC is a value-add, and not all think that an all-IP network is reality. Even so, businesses need to still communicate and their solutions must be effective.
Service providers that are proactive and drive the configurations, including premises requirements, will retain customers and improve customer experience. Those that continue to act as if in the The Wild Wild West show will continue to churn customers and damage the industry through negative perceptions about IP/SIP and UC.