SBC tunnel encryption vs softphone tunnel?

[treefiddy]

Hi,

I was reading the SBC documentation and it specifically states that encryption can be enabled. Is this true? I was under the impression that the tunnel didn't actually do any encryption, though I really wish it did.

 

[leejor]

It does, when using an SBC. Encryption was not originally offered when using the Tunnel, this changed a while ago.

https://www.3cx.com/community/threads/3cx-tunnel.57009/

see...

https://www.3cx.com/blog/change-log/phone-system-change-log/

In version...

3CX Phone System v15, BETA, Build 55450, June 2016

 

[cobaltit]

Also, this is not some super encryption like TLS. It's a basic obfuscation. If you need security, you want SIP-TLS + SRTP or VPN.

 

[treefiddy]

In the system changelog posted above it mentions SSL. "Basic obfuscation" sounds terrible...

 

[cobaltit]

It sounds terrible because it is. It was stated at least once here in the forums by a member of the 3CX team that if you really needed encryption not to rely on the tunnel encryption. The primary purpose of the tunnel is easier NAT traversal.

 

[treefiddy]

Okay. Thanks for clarifying cobalt.

 

[YiannisH_3CX]

Actually the SBC encryption uses TLS 1.2 so its quite capable. I believe @cobaltit refers to using the tunnel without encryption that only encapsulates packets and helps with NAT traversal.

 

[cobaltit]

@YiannisH_3CX I seem to remember when the encryption was first released nb said it wasn't that strong but I may be wrong. Does 3CX have the specs listed anywhere for that because anyone who needs it would need to know the specifics.

Thanks for the update/correction.

 

[treefiddy]

@

Actually the SBC encryption uses TLS 1.2 so its quite capable. I believe @cobaltit refers to using the tunnel without encryption that only encapsulates packets and helps with NAT traversal.

Thanks for this.

Am I correct that the client tunnels are not TLS though? That would be great.

 

[YiannisH_3CX]

Does 3CX have the specs listed anywhere for that because anyone who needs it would need to know the specifics.

I am afraid the TLS version of the SBC encryption is not documented currently but you can see the handshake using wireshark.

 

[YiannisH_3CX]

Thanks for this.

Am I correct that the client tunnels are not TLS though? That would be great.

Yes that is correct. The clients do not have this option.