Network segmentation for people who run phones
Segmentation projects start with a sensible goal: a device should reach only what it needs. Then someone writes the rules for the phones, allows them to reach the call server, and enforces the policy. Calls connect. Nobody can hear anything.
The rule that was missed is the one that surprises people who do not work with voice every day: phones talk to each other. The call server sets the call up, and then the audio usually flows directly from one phone to the other. A policy that allows phones to reach only the server permits the ring and blocks the conversation.
What a phone needs to reach
- Address and name services. DHCP for its address and settings, DNS, and a time source.
- Provisioning. The server it downloads its configuration and firmware from.
- Call control. The call servers it registers to, on the signaling ports they use.
- Other phones. Audio between phones, in both directions, on the range of ports the system uses for media. This includes phones at other sites.
- Gateways and conference resources. Calls to outside numbers and conference calls send audio to these, not to another phone.
- Services. Directory lookup, voicemail, and any applications on the phone's screen.
The cases that complicate it
- Soft clients. A calling app on a laptop lives in the user network, not the voice network, and needs the same audio paths. Rules written only for the voice network will break it.
- Cloud calling. Phones registered to a cloud service need to reach the provider's published addresses on the internet, and audio may go there or directly to another phone. Use the provider's current list and review it when they change it.
- Devices that share a port. A computer plugged into the back of a phone belongs to a different segment than the phone.
- Analog adapters, paging and door systems. They behave like phones and are often forgotten until they stop working.
Write rules from what happens, not from what should
Before enforcing anything, record what the phones actually talk to for a week or two. The record will contain flows nobody listed: a firmware server in another data center, an old paging controller, a service someone enabled years ago. Decide about each one. Then write the policy.
Enforce in stages
- Apply the policy in a mode that logs what it would block, without blocking it.
- Review the log. Anything a phone was doing that the policy would stop is either a missing rule or something to shut down on purpose.
- Enforce at one site. Test an internal call, a call between sites, an outside call, a conference call and a soft client.
- Then the rest.
If calls connect and there is no audio, look for the rule that should allow phones to reach each other.
Segmentation makes a voice network safer, and phones are worth protecting: they sit on every desk and are rarely updated. The projects that go badly are the ones where the people who know how calls flow were asked after the rules were written.