Solved Secure SIP Trunk

[slapster]

Hello there, I'm just evaluating a move to 3CX. We're a small but growing business in healthcare, so the main reasons for the move are scalability (ticked), user simplicity (mostly ticked - please support Safari for web conferencing) and security.

It's great that the hosted solution is secure enough for GDPR. We're not subject to HIPAA, but I feel we should be aiming somewhere between the two, so I would have an ambition to self-host. We do take credit cards over the phone, and currently do this with a minimal PCI DSS exposure: No use of unencrypted VOIP, standalone 3G card terminal and no recording. I'd like our next solution to at least allow us to take cards over VOIP, with the eventual option of PCI DSS recording. I'm happy that in principle 3CX will allow this.

Similarly, support for TLS and SRTP on the user leg between the PBX and browser/softphone/fixedphone is great.

What I'm more concerned about is the trunk leg, and the UK trunk providers list is not a lot of help, with just 2 providers said to support TLS, and no mention of SRTP. From what I understand generally, we will not be PCI DSS compliant if both the user and trunk legs are not either encrypted or on a private network.

If correct, this suggests that a solution from the following should be chosen:
(a) SIP trunk provider must offer TLS and SRTP for the 3CX or self-hosted solution;
(b) SIP trunk provider must host the instance for us with a private connection; or
(c) for a self-hosted option, SIP trunk provider must also provide a private broadband link that is fast enough for a significant number of video streams.

I am not keen on replacing our existing BT FTTC with 4G Assure, which while far from perfect, at least fails over to the same IP, so our VPN users can easily connect to our VPN server and back again, quite seamlessly. Behind our BT hub, I run a pfSense, so I'm pretty sure I could set up something which directed all 3CX traffic over a second FTTC connection if necessary.

So my questions to all you lovely wise people are:

1. Are all theses understandings correct?
2. Which UK SIP trunk providers can help implement (a) for a small business?
3. Which UK SIP trunk providers can help implement (b) for a small business?
4. Would a BT trunk necessarily fulfil requirement (c) for BT Business FTTC over BT Openreach lines?
5. If not, what would you recommend?

Many thanks.

 

[cobaltit]

So PCI only requires encrypted VoIP if sent over a public or open network, it needs to be encrypted. Having a private circuit or VPN from your provider to your site would accomplish that and it's a lot easier from the sense that it's done a lot more than encrypted VoIP.

 

[slapster]

Great. That's what I assumed, and yes I have been speaking with a number of people who prefer to install a new, separate private circuit to us.

But that always seemed like a sledgehammer to crack a nut, and in the end I have got TLS/SRTP encryption working with Telnyx (the 3CX instructions and cert were not, in fact correct). I was looking in the wrong place, as I hadn't seen there were non-specific/worldwide trunk providers at the bottom of the list who had that capability. Particularly for small scale PBXs, that has to be the way forward.

Now with an encrypted connection, I have a lot more options with regards to hosting, and no need to change my existing broadband connection, which just works. I slightly thought I was being steered into more cost and complexity than was strictly necessary.

If I have to allocate a VM to a SBC instance, I might just as well host the whole thing. We will see, as we're short on server space at the moment.

 

[YiannisH_3CX]

HI @slapster

What was wrong with our instructions so we can correct it? Did you have to use a different certificate? Any details you provide to help us improve the guide?

 

[slapster]

Yes, I couldn't make your cert work. In the end I found another cert on this page https://support.telnyx.com/en/articles/4404575-tls-srtp-zrtp (search for "crt.sh")
Even then, I was a bit bamboozled by the lack of prominence of the download on that page. The download link is at the bottom of the left hand column. Then you have to rename it to *.pem to get 3CX to recognise it and upload.

Another issue is that secure trunking is not switched on by default at Telnyx. That needs to be addressed in two places in SIP Connection Options: both for inbound and outbound, under Expert Settings. I can't claim to fully understand the difference between SRTP and ZRTP. ZRTP seems to work except when SRTP Is enforced in 3CX Trunk options, which suggests it is not supported by 3CX, so selecting SRTP for inbound and outbound, and Enforced in 3CX trunk options seems to be the right approach.

Finally, the template for setting up Telnyx seemed to miss out the outbound proxy. I think both "Registrar/Server/Gateway Hostname or IP" and "Outbound Proxy" should contain the appropriate geographic SIP Signaling Addresses, given this is a worldwide provider. In my case, this was sip.telnyx.eu (visit that address to see the other options), and auto discovery should be set to on.

I hope that helps. I may of course have misunderstood something, but it seems to be working.

 

[YiannisH_3CX]

Thank you for your feedback. I cross-referenced the certificate from the Telnyx website and our own and they are identical (same content and same serial number) so I don't think that was the issue. The only reason we give you a download link is to avoid having to convert it to .pem.

Secure SIP Trunking is switched on by default in Telnyx and the TLS connection works without doing anything in the Telnyx portal. What optionally needs to be enabled is SRTP (ZRTP is not supported) for inbound calls. If you enable it for inbound calls then its automatically enabled for outbound calls. I guess we can add this in our user guide.

If the "Registrar/Server/Gateway Hostname or IP" and "Outbound Proxy" values are the same then the "Outbound Proxy" value is not needed. You should only populate the "Outbound Proxy" if the provider gives you a host name for a registrar and an IP for a proxy. Auto discovery is enabled by default in the template.

We will add the SRTP details in our user guide to avoid confusion in the future. Again thank you for the feedback.