- Joined
- May 2, 2018
- Messages
- 39
- Reaction score
- 5
So we've been testing with a Pro version on ver 15.5.0(Professional Annual 15.5.15502.6) and I noticed a few things that aren't clearly documented and thus have a couple questions and observations.
SRTP works well with our SIP trunk provider and on our Grandstream desk phones. I've tested several calls and the pcap files show the SRTP flow after the SIP session has been established. So this is great, we want to encrypt our voice traffic, and it would be nice to do the same for the SIP traffic but I found issues with this. It appears SIP over TLS is an offering, but I found it doesn't work as documented at 3CX. Reading through this thread I see some discussion about this. The specific issue was that when I enabled it with my SIP trunk provider, the provider was expecting TLS traffic over TCP port 6061, but the pcap files from my firewall and the 3cx server show the 3CX server is attempting to connect over UDP 6061, which of course gets dropped by my provider. This happens during the registration of the SIP Trunk provider process on the 3CX server, so No, the phones(deskphones, mobile clients, etc) aren't involved yet. I do have Secure SIP/TLS enabled and have applied the valid public cert (issued by Starfield Technologies, Inc.) and key in the Secure SIP/TLS tab along with confirming this is the same cert used by NGINX on the 3CX server. So SIP over TLS doesn't appear to work, so I moved on to the bare minimums and that is to use SRTP. And again once enabled, the desk phones work well and I confirmed from packet captures that this voice data is encrypted. Since I want all my client extensions to use SRTP, I went ahead and set RTP mode to "Only Secure", "Use 3CX Tunnel for remote connections, left SIP Transport to UDP since SIP over TLS doesn't appear to work for my SIP trunk, no "Restrictions" selected under Options, and "PBX Delivers Audio" enabled. After doing this I found the following:
- Calls between desk phones(Grandstream GXP 2140 and 2160) - both use SRTP, so this is good.
- Calls from mobile clients to desk phones - Session between PBX and mobile client uses TCP 5090 (3CX tunnel) and the session between PBX and desk phone uses SRTP.
- Calls from desk phones to mobile clients - same result as above.
- Calls from mobile clients to mobile clients - both use 3CX tunnels
So looking at the pcap files for the tests with the mobile clients it looks like both the SIP session and the RTP traffic are combined within this tunnel. However it doesn't appear the traffic within this tunnel is encrypted, at least the RTP traffic. I'd like to know:
1) Is the traffic within a 3CX tunnel to/from the 3CX mobile client app secured by encryption? And specifically with my settings as stated above, is the RTP traffic within this tunnel using SRTP?
2) If the answer to question 1 above is NO, then how would one encrypt this traffic and at a minimum the RTP traffic?
Oh and a side note. To get the desk phones to actually use SRTP, I found I had to login to each phone UI and enable it under Accounts > Audio Settings > SRTP Mode set to Enabled and Forced. And for good measures I added the trusted Root CA of Starfield Technologies Inc. No need to reboot the phone.
SRTP works well with our SIP trunk provider and on our Grandstream desk phones. I've tested several calls and the pcap files show the SRTP flow after the SIP session has been established. So this is great, we want to encrypt our voice traffic, and it would be nice to do the same for the SIP traffic but I found issues with this. It appears SIP over TLS is an offering, but I found it doesn't work as documented at 3CX. Reading through this thread I see some discussion about this. The specific issue was that when I enabled it with my SIP trunk provider, the provider was expecting TLS traffic over TCP port 6061, but the pcap files from my firewall and the 3cx server show the 3CX server is attempting to connect over UDP 6061, which of course gets dropped by my provider. This happens during the registration of the SIP Trunk provider process on the 3CX server, so No, the phones(deskphones, mobile clients, etc) aren't involved yet. I do have Secure SIP/TLS enabled and have applied the valid public cert (issued by Starfield Technologies, Inc.) and key in the Secure SIP/TLS tab along with confirming this is the same cert used by NGINX on the 3CX server. So SIP over TLS doesn't appear to work, so I moved on to the bare minimums and that is to use SRTP. And again once enabled, the desk phones work well and I confirmed from packet captures that this voice data is encrypted. Since I want all my client extensions to use SRTP, I went ahead and set RTP mode to "Only Secure", "Use 3CX Tunnel for remote connections, left SIP Transport to UDP since SIP over TLS doesn't appear to work for my SIP trunk, no "Restrictions" selected under Options, and "PBX Delivers Audio" enabled. After doing this I found the following:
- Calls between desk phones(Grandstream GXP 2140 and 2160) - both use SRTP, so this is good.
- Calls from mobile clients to desk phones - Session between PBX and mobile client uses TCP 5090 (3CX tunnel) and the session between PBX and desk phone uses SRTP.
- Calls from desk phones to mobile clients - same result as above.
- Calls from mobile clients to mobile clients - both use 3CX tunnels
So looking at the pcap files for the tests with the mobile clients it looks like both the SIP session and the RTP traffic are combined within this tunnel. However it doesn't appear the traffic within this tunnel is encrypted, at least the RTP traffic. I'd like to know:
1) Is the traffic within a 3CX tunnel to/from the 3CX mobile client app secured by encryption? And specifically with my settings as stated above, is the RTP traffic within this tunnel using SRTP?
2) If the answer to question 1 above is NO, then how would one encrypt this traffic and at a minimum the RTP traffic?
Oh and a side note. To get the desk phones to actually use SRTP, I found I had to login to each phone UI and enable it under Accounts > Audio Settings > SRTP Mode set to Enabled and Forced. And for good measures I added the trusted Root CA of Starfield Technologies Inc. No need to reboot the phone.
