SIP over TLS via NAT/Firewall/SIP-ALG

Hi All,

I am Sunil developing a SIP-ALG which will coexist with NAT/Firewall on =
the edge of a trusted network. Aparting from NATting functionality which =
ALG will perform, we want to provide support for SIP Security as well =
because there could be lot many possible Attacks on the SIP messages =
e.g. like Eavesdropping, Session hijacking, DOS Attacks, Sessions tear =
down, Impersonnating a server, Registration hijacking etc and as a =
solution SIP RFC 3261 suggests that TLS can be a good way to provide =
security, which strictly offers hop-by-hop security and this security we =
want to provide at SIP-ALG itself sitting along with NAT/Firewall on the =
edge.

TLS features are:

1.      TLS strictly offers hop-by-hop security

2.   TLS only allows SIP entities to authenticate servers to which they =
are adjacent.

3.      TLS does not allow clients to authenticate proxy servers to whom =
they cannot form a direct TCP connection.

And hence   TLS-encrypted message cannot be intercepted by a NAT or =
firewall
device because SIP-ALG/NAT/Frewall is NOT a SIP Entity (like =
proxy/redirect/UA etc).

But since I am planning to provide support for TLS at SIP-ALG/NAT so =
that we can provide SIP Security from various possible Attacks discussed =
above, which means that I should have a SIP Proxy that will co-exist =
with SIP-ALG/NAT/Firewall so that it can be on the path of any SIP =
Message
> > in-coming to or outgoing from the trusted network and I shall be =
able to intercept SIP Messages recieved through TLS. Please let us know =
whether it'll be an advantageous solution else any suggestion on other =
solutions would be of great help.

In future I am planning High Avalability support as well for SIP ALG.

Regards,

Sunil