The Messaging network and data networks should be logically separated using virtual LANs (VLANs). VLANs can be set up to isolate devices in the network from other devices, but also can be set up to allow communication between devices in different VLANs for only specifically-designated protocols.
For network separation to be effective, several different protected VLANs must be established. First, all network devices not specifically used to support telephony should be placed on data VLANs. Data VLANs support PCs, file servers, email servers, and domain controllers. Messaging server should be placed on different VLANs depending on their role in the network. Limiting each VLAN to like devices and protocols makes the development, implementation, and management of security features much easier. All standalone IP telephones should be placed in their own IP telephone VLAN(s). The Messaging server itself should be placed in a different VLAN, depending on the VoIP protocol the customer implements. A Messaging sever, which is an H.323 server, should be on an H.323-only VLAN. A SIP server, if any, should be placed on a SIP VLAN.
The telephony and data VLANs should have their own servers for standard network services such as DNS and NTP. This is necessary because traffic from these services should not have to cross the perimeter between the telephony network and data VLANs.
To prevent an attacker who has physical access to the network from bypassing any VLAN separation by simply unplugging the IP phone’s network cable and attaching an attack computer, switch port level security must also be implemented. The customer should implement 802.1x authentication on any IP telephones, Ethernet switches, G250 or G350 Media Gateways, or IG550 Integrated Gateways.
The Messaging server VLAN typically should contain the Messaging server and other authentication and authorization devices such as the Radius server, a DNS server, and an NTP server. The IP telephone VLAN contains IP phones, IP interfaces to the IP telephones, the access controller gateway, and the connecting media gateway. The gateway VLAN would normally contain gateways to external network such as the PSTN. However, since the media gateways typically connect to both lines and trunks, the line ports can be assigned to the IP telephone VLAN and the trunks can be assigned to a separate trunk VLAN.