IMSG Architecture Overview

Figure 20 shows the main components of the IMSG architecture.

• BGF
• BSG
• SPDF
• IPS and FW Applications
• IPsec
• IMSG Scalability

BGF

In the IMSG architecture, the BGF controls VoIP signaling and media based on instructions that it receives from the Service Policy Decision Function (SPDF). The BGF process runs on a data PIC.

BSG

The Border Signaling Gateway (BSG) is the component that controls VoIP media resources on the router and is responsible for all SIP processing.

The BSG acts as a Session Initiation Protocol (SIP) back-to-back user agent (B2BUA) that fully terminates incoming signaling sessions and then starts a new signaling session on its other side.

You can define up to four BSG instances on a router. Each instance must be defined on a separate control services PIC. The multiple BSG capability provides both scalability and the flexibility to define different business rules for each instance.

SPDF

Each BSG instance has an embedded SPDF that is a standard TISPAN component defined by TISPAN. (See Figure 19.)

The SPDF is responsible for:

• Implementing media resource allocation
• Authorizing media resource requests
• Load balancing between BGFs
• Mapping of media type and service class for:
  • Quality of service (DSCP marking)
  • Rate limiting

How the SPDF Works

The SPDF configuration uses service classes that classify media sessions and then specify the actions to take on the media session: marking, dropping, or applying DSCP marking and rate-limiting parameters.

The SPDF coordinates resource reservation requests that it receives from the application function (in this case the B2BUA in the BSG) as follows:

1. The B2BUA sends to the SPDF a summary of any new media session that is signaled through SIP (for example, a gold-class, 256 Kbps, audio/video call is about to start between IP1 and IP2).
2. The SPDF determines whether the request received from the BSG is consistent with the policies defined in the SPDF.
3. If the request is consistent with defined policies, the SPDF maps the session information into:
   • The BGF to be used.
   • The gates and gate parameters to be installed on the BGF.

Related Topics

• Configuring QoS and Rate Limiting

IPS and FW Applications

You can use the Junos OS intrusion prevention system (IPS) technology and stateful firewall features to provide security services to SIP signaling traffic before the traffic reaches the BSG. This feature uses a service-chaining model where the IPS is linked through the use of services to the BSG service interface.

Related Topics

• Configuring Firewall and Intrusion Prevention System Services for SIP Signaling Traffic

IPsec

IPsec is an optional software feature supported by the MultiServices PIC and MS-DPC. The IPsec feature supports Data Encryption Standard (DES), triple Data Encryption Standard (3DES), and Advanced Encryption Standard (AES). You can send media traffic through IPsec and the IMSG can use IPsec to establish mutual authentication between the signaling agents and to negotiate keys used during the session to protect flows and assets.

IMSG Scalability

You can configure up to four BSG instances on separate control services PICs. Each BSG can support up to eight virtual BGFs.