3CX: SRTP and SIPS offloading

[Ab Abych]

Hello.
Unfortunately, audio recording in 3CX isn't perfect (no playback without download, not convenient interface).
Therefore, we are trying to connect another software solution (based on passive SIP recording technology) to 3CX. This solution analyzes all incoming SIP and RTP traffic and records all detected audio conversations, but this solution have limitation - it cannot decrypt SRTP and SIPS, even if I provide an SSL private key for it.
Therefore, I have a dumb question - does 3CX have the ability to redirect all unencrypted SIP and RTP traffic to another destination (for example, to an additional network interface)?

 

[JohnS_3CX]

Hi @Ab Abych

Before you go down that path, have tried using the Webclient for playback without download, using a convenient and searchable interface?



You can enable this in your extension like so, by going to the Phone Provisioning tab, selecting the 3CX App (which also affects the web client):

 

[Ab Abych]

Hello, @JohnS_3CX

Yes, this web client looks good (good UI, ok), but
- there is no options to add access to any extension audio records directly, only for group.
- there is no options to restrict download of audio records
- there is no options to audit - what user and when listens records (and what records it was)

Maybe, audit is available by examing nginx logs (not easy way, but possible). But what about other limitations?

 

[JohnS_3CX]

I understand. There is something that may interest you coming at a later stage.

We will be adding some audit logs for admin access, so you will know who did what.

When that feature arrives, you can grant access to specific users and at least know what actions they performed. No ETA yet, we will publish it on our blog when it is ready.

 

[cobaltit]

Don't use TLS/SRTP then?

 

[Ab Abych]

If we don't use SIPS/SRTP, then we can't use Android/iOS applications due to security reasons(traffic flow over unsecured network(internet) must be encrypted). This is most pleasing feature for my chiefs.

 

[cobaltit]

The Android/iOS application uses 3CX tunnel which is not the same as SIPS/SRTP which is where your issue lies. If you don't require internal calls to be recorded you should be able to record on the trunk side.

 

[TurabG]

does 3CX have the ability to redirect all unencrypted SIP and RTP traffic to another destination (for example, to an additional network interface)

If it did, what would be your solution to record them? Asking just out of curiosity, if you don't mind.

 

[Ab Abych]

The Android/iOS application uses 3CX tunnel which is not the same as SIPS/SRTP which is where your issue lies. If you don't require internal calls to be recorded you should be able to record on the trunk side.

It's terrible news. I'll check it, thanks.

If it did, what would be your solution to record them? Asking just out of curiosity, if you don't mind.

Answered to PM - I’m not sure, that advertising third-party products here is respectably. To understand the essence of the problem, it is not so important which manufacturer and product is used.

Anyway, question is actual -

does 3CX have the ability to redirect all unencrypted SIP and RTP traffic to another destination (for example, to an additional network interface)?

 

[cobaltit]

It's an excellent question for this use case, and 3CX unfortunately doesn't support that scenario. But it also begs the question that if you need encryption on the endpoints, wouldn't having unencrypted audio affect your security posture if that's why you are encrypting in the first place?

 

[Ab Abych]

It's an excellent question for this use case, and 3CX unfortunately doesn't support that scenario. But it also begs the question that if you need encryption on the endpoints, wouldn't having unencrypted audio affect your security posture if that's why you are encrypting in the first place?

the trick is that I need unencrypted traffic on the local network (where the PBX, audio recording server and phones are located) and encrypted traffic on the external, unsecured network.
Maybe, one of possible solutions for me is 3CX Recording Manager - this addon fixes most disadvantages of internal 3CX recordings, but this software have no trial, only paid version. So i can test it only when (and if) my company buy it.