ProSBC Configuration for STIR/SHAKEN with Transnexus ClearIP service
(Redirected from FreeSBC:SHAKEN)
Introduction
This document provides instructions on how to configure ProSBC to operate with the TransNexus ClearIP server. ClearIP is a SIP redirect server that provides advanced Least Cost Routing (LCR), fraud control and STIR (Secure Telephony Identity Revisited) / SHAKEN (Secure Handling of Asserted information using toKENs) features.
ProSBC 3.0.90 or a later version is needed to support secure caller ID using STIR/SHAKEN.
Note: STIR/SHAKEN is only supported on ProSBC.
Network Diagram and Call Scenarios
This section provides the simplified network diagram containing two telephone service providers, and the call scenarios.
- Source of ServiceProvider-A sends a call to ProSBC-A.
- ProSBC-A forwards the call to ClearIP-A, which is a SIP redirect server providing LCR, fraud control, SHAKEN AS (Authentication Service) and other features.
- ClearIP-A performs LCR, fraud control and SHAKEN AS logic, then sends one of the following responses to ProSBC-A
- SIP 404 Not Found: No fraud or SHAKEN AS error is detected, and routing information is unavailable.
- SIP 603 Decline: Fraud is detected or SHAKEN AS request fails.
- SIP 3xx Redirect: Destination information (ProSBC-B of ServiceProvider-B) and a SIP Identity header including a digitally signed token that includes the calling number (secure caller ID).
- ProSBC-A processes the response
- SIP 404 Not Found: ProSBC-A tries the next destination configured in its local routing policy.
- SIP 603 Decline: Proxies the response back to Source to block the call.
- SIP 3xx Redirect: Forwards the call to ProSBC-B with the Identity header.
- ProSBC-B forwards the call to ClearIP-B, which is a SIP redirect server providing fraud control, SHAKEN VS (Verification Service) and other features.
- ClearIP-B performs fraud control and SHAKEN VS logic, and then sends one of the following SIP responses to ProSBC-B.
- SIP 404 Not Found: No fraud or SHAKEN VS error is detected, and routing information is unavailable.
- SIP 603 Decline: Fraud is detected or SHAKEN VS request fails.
- SIP 3xx Redirect: Destination information (Destination of ServiceProvider-B) is attached.
- ProSBC-B processes the response
- SIP 404 Not Found: ProSBC-B tries the next destination configured in its local routing policy.
- SIP 603 Decline: Proxies the response back to ProSBC-A to block the call.
- SIP 3xx Redirect: Forwards the call to Destination.
Note: A variant scenario is that Destination of ServiceProvider-B is configured as the next destination in the local routing policy of ServiceProvider-B, ClearIP-B returns SIP 404 Not Found, then ProSBC-B does failover to Destination.
ProSBC Configuration
This section provides ProSBC configuration for the solution.
Configure Routing Script
ProSBC is configured to use routing script to handle SIP 3xx Redirect response.
- 1. Enable routing script
Gateway->Use script
- 2. Load routing scripts
Gateway->Routes->Routing Script->Import Script File File->txnx_shaken.rb ScriptType->TxNx Load on startup->unchecked Gateway->Routes->Routing Script->Import Script File File->txnx_routing.rb ScriptType->Txnx Load on startup->checked
Click here to download txnx_shaken.rb and txnx_routing.rb Routing Scripts
Configure NAP (Network Access Point)
ClearIP-A and ClearIP-B are configured as NAP on ProSBC-A and ProSBC-B respectively. A general SIP endpoint, NAP-ANY, is configured on both ProSBC’s.
- On ProSBC-A
NAPs->Create New NAP Name->NAP_ClearIP_A Proxy address->x.x.x.x (IP of ClearIP-A) NAPs->Create New NAP Name->NAP_ANY Use Proxy Address->Unchecked
- On ProSBC-B
NAPs->Create New NAP Name->NAP_ClearIP_B Proxy address->x.x.x.x (IP of ClearIP-B) NAPs->Create New NAP Name->NAP_ANY Use Proxy Address->Unchecked
Note: To configure local routing policy with other destination NAPs, ClearIP NAPs should have the highest priority alone all destination NAPs.
Configure NAP Column
NAP column is used to mark ClearIP as redirect server.
Gateway->Routes->NAP Column->Create New NAP Column Name: server_type Type Attributes: NORMAL|REDIRECT Default: NORMAL
- Both NAP_ClearIP-A and NAP_ClearIP-B are configured with NAP column server_type REDIRECT.
- NAP_ANY are configured with NAP column server_type NORMAL.
Configure Static Route
A static route to NAP_ANY should be configured on both ProSBC’s to allow ProSBC to try the destination in the SIP 3xx response.
Gateway->Routes->Create New Static Route Name->ToEndpoints NAP->any Remapped_NAP->NAP_ANY
Enable SIP Custom Header
Enable SIP Custom Headers must be checked to pass SHAKEN Identity header and several other headers used by the solution.
Profiles->SIP->Enable SIP Custom Headers
Disable Legacy Redirection Mode
Use legacy redirection mode must be unchecked to allow ProSBC to use routing script to handle SIP 3xx response.
SIP->Editing SIP Configuration->Header Parameters->Use legacy redirection mode [uncheck]
Configure Route Retry Action
Route retry action of 3xx, 404 and 603 must be configured to allow ProSBC to perform failover, fraud control and SHAKEN AS/VS request.
Profiles->Edit Reason Cause Mapping 300 Multiple Choices->Route retry action->Process call routing 302 Moved temporarily->Route retry action->Process call routing 404 Not found->Route retry action->Continue call 603 Decline->Route retry action->Stop call
Notes:
- The default route retry action of 404 is Stop call.
- The default route retry action of 603 is Continue call.