TLS and SRTP Device Guide - 14IP

TLS and SRTP Device Guide

TLS / SRTP Configuration Guide

Supported Manufacturers

IP Phones

Analog Gateways

E1/T1 Gateways

Configuration

Overview

To use TLS and SRTP successfully, both must be enabled and configured on the end device. Additionally, a new DNS record must be used which is set up to support SIPS (SIP Secure).

Secure SBC Addresses

  • us-sbc-secure.14ip.net

  • eu-sbc-secure.14ip.net

  • apac-sbc-secure.14ip.net

The Secure SBC DNS record tells the phone to use TRANSPORT=TLS and PORT=5061.

%SBC_ADDRESS%

  • Addresses provided above

%ENABLE_SRTP%

  • 0 — Disabled

  • 1 — Optional; the phone will negotiate with the other phone what type of encryption to use for the session

  • 2 — Compulsory; the phone must use SRTP during a call

Polycom

The Secure SBC DNS record tells the phone to use TRANSPORT=TLS and PORT=5061.

%SBC_ADDRESS%

  • Addresses provided above

%ENABLE_SRTP%

  • 1 — The phone accepts SRTP offers

  • 0 — The phone declines SRTP offers

%SRTP_OFFER%

  • 0 — The secure media stream is not included in the SDP of a SIP invite

  • 1 — The phone includes the secure media stream alongside the non-secure media description in the SDP of a SIP invite

%SRTP_REQUIRE%

  • 0 — Secure media streams are not required

  • 1 — The phone is only allowed to use secure media streams

Snom

%SBC_ADDRESS% – Must append transport type to the end of the address.

  • us-sbc-secure.14ip.net;transport=tls

  • eu-sbc-secure.14ip.net;transport=tls

  • apac-sbc-secure.14ip.net;transport=tls

%USER_SAVP% (Use Mandatory with SRTP unless otherwise told)

  • off – Since some SIP proxies cannot handle RTP/SAVP profiles or multiple m= lines this setting may also be turned off.

  • optional – The phone will offer SDPs containing two m= lines, one with an audio profile of RTP/SAVP the other with an audio profile of RTP/AVP and it will accept SDPs containing m= lines with either profile. The RTP/SAVP profile, being the preferred one, is listed first.

  • mandatory – The phone will offer and accept only SDPs that contain m= lines with an audio profile of RTP/SAVP

%USER_SRTP%

  • on

  • off

EV Gateway

%SBC_ADDRESS%

  • Addresses provided above

%SIP_PORT%

  • 5061

%TRANSPORT%

  • TLS

%SRTP_MODE%

  • 0 = Off

  • 1 = AUTO

  • 2 = Force

%SIPS_URL%

  • 0

Adtran

Enable TLS and SRTP

Wildcards: $GROUP_DOMAIN, $SBC_ADDRESS

end
config terminal
voice trunk T00
sip-server primary $GROUP_DOMAIN tls 14IP 5061 srv sips tcp
registrar primary $GROUP_DOMAIN tls 14IP 5061 srv sips tcp
outbound-proxy primary $SECURE_SBC_ADDRESS tls 14IP 5061 srv sips tcp
srtp optional avp-savp SRTP
end

Disable TLS and SRTP

Wildcards: $GROUP_DOMAIN, $SBC_ADDRESS

end
config terminal
voice trunk T00
sip-server primary $GROUP_DOMAIN
registrar primary $GROUP_DOMAIN
outbound-proxy primary $SBC_ADDRESS
no srtp optional avp-savp SRTP
end