Solved How can I ascertain whether my SIP provider is sending 2 media streams (encrypted and unencrypted) for SRTP?

[patrickc]

According to this article, your SIP provider should send you 2 streams for inbound calls, one for encrypted traffic (SRTP) and one for unencrypted traffic. When SRTP on the SIP trunk is set to enabled, it will try the encrypted channel but if it is not there or does not work it will fall back to the unencrypted channel. If it is set to enforced, it will only try the encrypted channel and if it is not there or not working there will be no call audio.

I am using TLS with SRTP for my SIP trunk. I have managed to establish a connection using TLS and a trusted root certificate. My issue is that when I set the SRTP setting to enforced, outbound calls work perfectly but incoming calls do not. We do receive the incoming call on our deskphone, but when when we pick it up, the call disconnects but only on the deskphone side. Very strangely, the caller's phone keeps dialing as if the deskphone never answered the call. When we set the SRTP to enabled instead of enforced, incoming calls work as expected. I suspect this is because it is falling back to the unencrypted channel on the "enabled" setting whereas it cant fall back on the "enforced" setting. I need to establish whether this is happening because my SIP provider is not sending the encrypted stream at all for incoming calls or because the handshake between 3CX and their server is failing for the encrypted stream. I don't think it's a handshake issue because outgoing calls work when SRTP is set to enforced, which suggests 3CX and the SIP provider's server are able to engage in a successful SRTP handshake.

Can someone let me know how I can inspect the incoming and outgoing calls so that I can ascertain this or suggest another solution to the above problem? Thanks.

 

[YiannisH_3CX]

Hello @patrickc

There are 2 ways to determine that. The first is by using the Activity Log of the PBX. Set the logging level to Verbose and then make an inbound call. Filter via the last call in the list and scroll to the bottom to find the Invite from the provider. You should see 2 Media Descriptions in the SDP.

The second way is by running a packet capture and looking for the Invite there.
You should see 2 Media Descriptions in the SDP.

 

[patrickc]

Thanks. I can confirm the method using the activity log worked for me. I was able to ascertain that the SIP provider was not sending the encrypted channel and that was the cause of the issue. If anyone has the same symptoms it is worth doing this check.

You may want to include these symptoms in the guide I linked to because that said the result of having SRTP set to enforced and there being no encrypted channel would be 'no audio'. In my case, the call disconnected immediately on the receiving end and appeared to have never been answered on the dialing end.

 

[YiannisH_3CX]

Glad to see we were able to assist. The guide you referenced explains the various options and what they do. Its not meant to aid with troubleshooting.
The fact that your call disconnected immediately could mean that your provider declined the 200 OK because there was no supported media. It may not apply to everyone.
Having said that a new guide is coming explaining TLS and SRTP and will contain some troubleshooting tips.

Thank you for your feedback.

 

[cobaltit]

Thanks. I can confirm the method using the activity log worked for me. I was able to ascertain that the SIP provider was not sending the encrypted channel and that was the cause of the issue. If anyone has the same symptoms it is worth doing this check.

You may want to include these symptoms in the guide I linked to because that said the result of having SRTP set to enforced and there being no encrypted channel would be 'no audio'. In my case, the call disconnected immediately on the receiving end and appeared to have never been answered on the dialing end.

3CX has training and videos on troubleshooting, No audio is no audio, regardless of TLS/SRTP and as such, troubleshooting it is the same.

 

[patrickc]

People with my issue will not search for "no audio", they will search for "call disconnect on pickup" or something similar, without necessarily knowing SRTP has anything to do with the problem. My point is that it will help others troubleshoot if the link between the symptom and cause is made somewhere in the documentation.

 

[YiannisH_3CX]

As I mentioned a new specific guide for TLS and SRTP is coming which will contain a lot more info.