1. Application-Layer Policy Enforcement at SIP Firewalls ( draft-jfp-sipfw-policy-00.txt) SIP WG 48th IETF Jon Peterson Level(3) Communications

2. SIP WG - 48th IETF - JFP L3 Enterprise Network (w/ SIP) Public Internet FW PS One-Edged Network

3. SIP WG - 48th IETF - JFP L3 Carrier Network (w/ SIP) Peer Carrier A ASP Peer Carrier B Public Internet FW Multi-edge Network PS AS

4. SIP WG - 48th IETF - JFP L3 “Inside” Network “Outside” Network FW ALG PS Typical Firewall with ALG see: draft-rosenberg-sip-firewalls-00.txt Signaling Media

5. SIP WG - 48th IETF - JFP L3 FW ALG PS Policy 1 Policy 2 Policies might intervene (logically) between the PS and the ALG Inbound Signaling

6. SIP WG - 48th IETF - JFP L3 “Inside” Network “Outside” Network FW ALG PS INVITE A simple policy example: One-way edge Blocked! Calls allowed in this direction POL

7. SIP WG - 48th IETF - JFP L3 In Summary There may be reasons why it would be important for a SIP session to traverse a particular network edge on its way to its final destination Some application-layer policies are best enforced at an edge Know of any other examples?