Previous Thread:
https://www.3cx.com/community/threa...4x-sip-over-tls-srtp-using-remote-stun.74747/
Update:
Due to COVID-19 many of our employees are working from their home offices where it'd be impractical to deploy an SBC. The best solution is "Direct SIP (STUN Remote)". The catch is that all SIP signaling and RTP audio is sent in the clear for anyone to intercept. The stock Yealink T4x template does not yet support SIPS/SRTP in 3CX v18.
It's trivial to create a custom template for Yealink T4x that sets the phone to use SIP over TLS (SIPS) and SRTP. What I would really like is built-in template support.
I have attached my custom template to this post if anyone is interested in using it. The stock template was taken from 3CX Build 18.0.2.302. All non-cosmetic changes are commented with "CSTM". The template uses a y-file index of 5, make sure you don't have a conflicting template. The template assumes that the phone is being provisioned via RPS and has been reset to factory defaults.
Read this before using it:
https://www.3cx.com/docs/custom-ip-phone-templates/
Your 3CX server should already be TLS enabled with a valid certificate signed by a public CA e.g. Let's Encrypt. Your Yealink phones should be running the latest firmware to prevent CA trust issues.
You will need to enable SRTP under "3CX App" provisioning for the extension, "Normal" RTP Mode will cause call failure:
RTP Mode: "Only Secure" or "Allow Secure"
IMO, the best settings to use under "3CX App" extension provisioning:
SIP Transport: TLS
RTP Mode: "Only Secure"
Under extension options: Unchecked "Disallow use of extension outside the LAN (Remote extensions using Direct SIP or STUN will be blocked)"
I have tested the custom template with a Yealink SIP-T46S and a SIP-T48S. You may have to factory reset the phone to clear out the settings that this custom template modifies. Use at your own risk.
https://www.3cx.com/community/threa...4x-sip-over-tls-srtp-using-remote-stun.74747/
Update:
Due to COVID-19 many of our employees are working from their home offices where it'd be impractical to deploy an SBC. The best solution is "Direct SIP (STUN Remote)". The catch is that all SIP signaling and RTP audio is sent in the clear for anyone to intercept. The stock Yealink T4x template does not yet support SIPS/SRTP in 3CX v18.
It's trivial to create a custom template for Yealink T4x that sets the phone to use SIP over TLS (SIPS) and SRTP. What I would really like is built-in template support.
I have attached my custom template to this post if anyone is interested in using it. The stock template was taken from 3CX Build 18.0.2.302. All non-cosmetic changes are commented with "CSTM". The template uses a y-file index of 5, make sure you don't have a conflicting template. The template assumes that the phone is being provisioned via RPS and has been reset to factory defaults.
Read this before using it:
https://www.3cx.com/docs/custom-ip-phone-templates/
Your 3CX server should already be TLS enabled with a valid certificate signed by a public CA e.g. Let's Encrypt. Your Yealink phones should be running the latest firmware to prevent CA trust issues.
You will need to enable SRTP under "3CX App" provisioning for the extension, "Normal" RTP Mode will cause call failure:
RTP Mode: "Only Secure" or "Allow Secure"
IMO, the best settings to use under "3CX App" extension provisioning:
SIP Transport: TLS
RTP Mode: "Only Secure"
Under extension options: Unchecked "Disallow use of extension outside the LAN (Remote extensions using Direct SIP or STUN will be blocked)"
I have tested the custom template with a Yealink SIP-T46S and a SIP-T48S. You may have to factory reset the phone to clear out the settings that this custom template modifies. Use at your own risk.
