Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
All Customer Edge Routers (CE-R) implemented as the DISN access circuit termination point for the DISN NIPRNet IP Voice Services (IPVS) must be listed on the DoD Approved Products List (APL).
Description
Discussion Text
DISA has developed the DISN IPVS to support C2 Assured Service reliability and availability. As such, the worldwide availability and effectiveness of this service is dependent upon the components of the overall system that are located in each interconnected enclave. These components must be interoperable and support the needed quality of service. Therefore, if the VVoIP system in an enclave is to utilize the DISN IPVS to communicate with other enclaves across the NIPRNet, the system must be designed with equipment that has specific capabilities. Additionally, the implementation of VVoIP across the enclave boundary must not degrade the security or protection of the enclave.
The CE-R provides the following functionality:
- Provides minimally four expedited forwarding queues (eight may be required in the future)
- Places traffic within expedited forwarding queues based on the DSCP markings carried by the traffic
- Routes AS-SIP-TLS packets and SRTP/SRTCP packets to the SBC function. (VVoIP firewall)
- Routes all other traffic to the data firewall
- Provides all of the filtering and security required by the Network Infrastructure STIGs
Use of the DISN IPVS network requires the following equipment to assure interoperability across the DISN service:
- At least one CE-R on which the DISN access circuits terminates
- At least one Local Session Controller (LSC), Enterprise Session Controllers (ESC), or Multi-Function Soft Switch (MFSS) within the enclave for session management
- A Session Border Controller (SBC) or data firewall having specific functionality as defined in the UCR will separate the CE-R from the LSC, ESC, and/or MFSS equipment.
NOTE: Proper DSCP marking of VVoIP packets is required to provide appropriate QoS for C2 priority calls in support of Assured Service.
The CE-R provides the following functionality:
- Provides minimally four expedited forwarding queues (eight may be required in the future)
- Places traffic within expedited forwarding queues based on the DSCP markings carried by the traffic
- Routes AS-SIP-TLS packets and SRTP/SRTCP packets to the SBC function. (VVoIP firewall)
- Routes all other traffic to the data firewall
- Provides all of the filtering and security required by the Network Infrastructure STIGs
Use of the DISN IPVS network requires the following equipment to assure interoperability across the DISN service:
- At least one CE-R on which the DISN access circuits terminates
- At least one Local Session Controller (LSC), Enterprise Session Controllers (ESC), or Multi-Function Soft Switch (MFSS) within the enclave for session management
- A Session Border Controller (SBC) or data firewall having specific functionality as defined in the UCR will separate the CE-R from the LSC, ESC, and/or MFSS equipment.
NOTE: Proper DSCP marking of VVoIP packets is required to provide appropriate QoS for C2 priority calls in support of Assured Service.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.