How to configure Secure SIP and Secure RTP on a SIP Trunk

[10m]

Hello Everyone.

I would like to configure secure SIP and secure RTP for a client whose security policies dictate that we have it configured on the SIP trunk to the provider and to the endpoints connected to 3CX. We will be using the 3CX endpoints (WebClient, Desktop App, Windows client, and mobile apps). I know I can enable Secure SIP and Secure RTP in the phone provisioning tab on the extension by changing SIP transport to TLS and RTP mode to Only secure. For the SIP trunk, when I go to options, SRTP Mode should either be enabled or enforced and Transport Protocol should be TLS. But what about the TLS Root Certificate? And what is the provider supposed to do at their own end to enable secure SIP and secure RTP? Is there any other thing that I need to do to ensure we are using secure SIP and secure RTP between the user's endpoints and the SIP trunk provider?

Thank you very much for your contributions.

 

[YiannisH_3CX]

Hello @10m

Here is the guide on TLS and SRTP. It should include everything you need to have this working.
https://www.3cx.com/docs/sip-trunk-tls-srtp/

Not many providers support TLS and SRTP so make sure you are using one that does and will work within the supported parameters of 3CX.

You could also look at our supported providers list for providers that do support TLS

 

[10m]

Hello @YiannisH_3CX

Thank you very much for your response.This article really helped getting a better understand of how to setup Secure SIP and SRTP. I see that I need to have a certificate from my provider installed on my 3CX in order to have secure SIP. I am exploring that possibility but in the meantime, we have turned on SRTP while using the trunk without secure SIP. However, the audio is not going across. This is what I set on the SIP trunk in the options tab.


Any suggestions why this may be happening?

Thanks

 

[YiannisH_3CX]

If you used enforced and your provider does not support SRTP then your calls will not have audio. I suggest using the "Enabled" option and check the activity log of the PBX to see that is negotiated. Also there might be an option on the providers side to enable SRTP.
Some providers do not support SRTP unless TLS is also enabled. So this is something you need to sort out with your provider.

 

[10m]

Hello @YiannisH_3CX

I think my problem is SRTP without TLS. I will work with the providers to see what we can do. Does enabling TLS mean we must use secure SIP? Because right now signalling is done using SIP on port 5060.

 

[YiannisH_3CX]

Does enabling TLS mean we must use secure SIP? Because right now signalling is done using SIP on port 5060.

TLS is used for secure SIP and it usually runs on an different port (5061 in most cases).

 

[10m]

Got it. When we use the SBC and the Apps (desktop, iOS and Android) are both signalling and media encrypted by default or do we have to enable it?

 

[YiannisH_3CX]

The SBC has TLS enabled by default but you can remove it for troubleshooting purposes. Our desktop app uses WebRTC with is encrypted and our mobile apps use the tunnel which is also encrypted.