SRTP

[oJo]

I am trying to get encrypted telephony working on my snom phones. The guide at https://www.3cx.com/docs/secure-sip/ is horribly outdated. Searching around, I found out that I would probably have to edit the SRTP Section in the template in order to set the settings on the 3CX. I also added the client settings to my template, which even tho it's unsupported is a necessity, considering the stock snom templates contain several errors.

Alas, SRTP does not work, if I set SAVP to mandatory, any connection is immediately closed, in any other case it's just a plain RTP connection, so even though I am using TLS for SIP, my calls can be happily listened in on.

 

[Evolute IT]

I am trying to get encrypted telephony working on my snom phones. The guide at https://www.3cx.com/docs/secure-sip/ is horribly outdated. Searching around, I found out that I would probably have to edit the SRTP Section in the template in order to set the settings on the 3CX. I also added the client settings to my template, which even tho it's unsupported is a necessity, considering the stock snom templates contain several errors.

Alas, SRTP does not work, if I set SAVP to mandatory, any connection is immediately closed, in any other case it's just a plain RTP connection, so even though I am using TLS for SIP, my calls can be happily listened in on.

First, what version of 3CX are you using? You must be using v15.5 SP6 or v16 to use SRTP since the SSL certificate wasn't working great before that.

Once your sure, you can enable SRTP on the extension and the phone and it should work. I had it working in a few test environments.

 

[oJo]

I am using 16.0.910. The option to enable SRTP on the extension is set to mandatory and same on the phone. It does not work.

 

[JohnS_3CX]

Hi oJo

Currently there is no official support for deskphones to use SRTP and we do not recommend it.

It possible to do though, if you enable it in the extension, by the provisioning of the 3CX App (applies to whole extension). And then enter the phone UI you can change your SIP transport to TLS with port 5061*, and your media transport set to SRTP.

This relies on your phone model also supporting Lets Encrypt, and PBX certificate being generated via 3CX allocated FQDN. I can confirm it works when testing on V16SP2 and a Yealink T46G phone.


What model Snom are you using, and are you using a 3CX certificate or custom?

 

[oJo]

Hi oJo

Currently there is no official support for deskphones to use SRTP and we do not recommend it.

It possible to do though, if you enable it in the extension, by the provisioning of the 3CX App (applies to whole extension). And then enter the phone UI you can change your SIP transport to TLS with port 5061*, and your media transport set to SRTP.

This relies on your phone model also supporting Lets Encrypt, and PBX certificate being generated via 3CX allocated FQDN. I can confirm it works when testing on V16SP2 and a Yealink T46G phone.


What model Snom are you using, and are you using a 3CX certificate or custom?

Gotcha, there's the problem "if you enable it in the extension, by the provisioning of the 3CX App (applies to whole extension)".
You guys really need to get better at documenting limitations like this. I have not found this information anywhere.
Works fine now.

 

[JohnS_3CX]

Yes this is indeed an old guide, it has been marked to be updated

 

[AWS2P]

Try to include a refresh one also for Snom M700 with firmware related to 2 years old