Force TLS on all clients

[tschuring]

Hello,

I have 3 extensions configured and am using 0001 and 0002 for a test.
I’ve setup both extensions to use TLS as the “SIP Transport” in the “Phone provisioning” and RTP is set to “Only Secure”


I use the 3cx iphone app for the 0002 extension (used the QR code to configure it) and a generic VoIP client for the 0001 extension (using TLS)

The call is successful but how can i check that it really used TLS or if it dropped back to a non-secure channel ?

I am skeptical it works because when I push the comms through my mac and sniff the traffic using Wireshark I can re-play the audio conversation in Wireshark.
Which is sort of not what I expected with TLS configured. Or is only the SIP call setup encrypted ?

Is there any logging available that can tell me what encryption was used ?

• 3CX Version, currently hosted by 3CX
• Server OS, urrently hosted by 3CX
• Is the 3CX Server Hosted and where? : AU

Kind Regards,
tom

 

[cobaltit]

Wireshark

 

[JohnS_3CX]

Hi Tom,

Please also note that the client should be using our tunnel for encryption (SIP+RTP) even without enabling those features.

To know if the tunnel is active, you will see a lock icon appearing during your call. If this is visible then you have end-to-end encryption between to the device and the PBX.
https://www.3cx.com/blog/releases/update-3-alpha/

 

[tschuring]

Thanks John !

the tunnel is a very 3cx client specific feature though isn't it ?
One side will not be a 3cx client so to encrypt that part SIP over TLS and SRTP is the standard way of encrypting traffic.

I can find a call log of all made calls but there is not much detail about the selected transport layer.
Just wondering if there is a 'raw' log that i can see, or is that only available on self hosted systems ?

kind regards,
tom

 

[JohnS_3CX]

Hi Tom,

Understood, in this case you cannot use the tunnel.

Go to the Activity log and set it to Verbose mode from the settings button. You will see more details regarding your calls.

You can also run a capture from there to see whether the traffic is TLS or visible.