<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
text-align:right;
direction:rtl;
unicode-bidi:embed;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:.5in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
text-align:right;
direction:rtl;
unicode-bidi:embed;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1960335554;
mso-list-type:hybrid;
mso-list-template-ids:-382157944 -1845601286 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:6;
mso-level-number-format:bullet;
mso-level-text:\F0D8;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:20.25pt;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:Arial;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:56.25pt;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:92.25pt;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:128.25pt;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:164.25pt;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:200.25pt;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:236.25pt;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:272.25pt;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:308.25pt;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Hi,<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>I would like to setup FS1 as a 'ZRTP gateway' to a none-zrtp sip client.<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Here is my net setup: <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Client1 (without ZRTP)-> LAN -> FS1 (Gateway: register to FS2) -> NAT -> Internet-> Public IP (not NAT) FS2 -> CSipSimple (ZRTP enabled).<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Client1:<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Ex#1000, Registered over LAN to FS1.<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>FS1:<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Being NAT with dynamic IP address<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Registered as a Gateway to FS2 (in Internal profile). So FS1 is extended on FS2.<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Setup as 'Proxy-Media = false' && <span style='font-size:10.0pt;font-family:Consolas;color:#3F5FBF'>zrtp_enrollment=true</span> (trusted MITM).<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>FS2:<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Connected with static public IP address (not behind NAT)<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Setup as 'Proxy-Media = true' && <i><span style='font-size:10.0pt;font-family:Consolas;color:#2A00FF'>inbound-late-negotiation</span></i>=true. <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>CSipSimple:<o:p></o:p></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:20.25pt;margin-bottom:.0001pt;text-align:left;text-indent:-.25in;mso-list:l0 level1 lfo1;direction:ltr;unicode-bidi:embed'><![if !supportLists]><span style='font-family:Wingdings'><span style='mso-list:Ignore'>Ø<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span dir=LTR></span>Behind NAT (remote WiFi/3G) and is registered on FS2 (Internal profile).<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'> <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>FS2 is successfully serving multiple CSipSimple ZRTP clients with end-to-end ZRTP secure calls.<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>The problem:<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>When calling from Client1/FS1 to FS2/CSipSimple, <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>then FS1 shows ' WARNING! Incoming ZRTP CRC validation fails' <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>and FS2 shows ' ZRTP not negotiated on both sides; disabling ZRTP passthr…'.<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>I have tested FS1 locally with CSipSimple and it manages to connect with ZRTP/MITM so it is capable of ZRTP.<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>I follow up what have been recommended on the forum to extend FS1 and to verify matching codecs (I forced PCMU only on all devices) and to check RTP/UDP ports flow (SIP trace).<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>I would appreciate any help on how to setup end-to-end ZRTP calls between FS1 and remote CsipSimple (FS2).<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Regards<o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'>Assaf <o:p></o:p></p><p class=MsoNormal style='text-align:left;direction:ltr;unicode-bidi:embed'><o:p> </o:p></p></div></body></html>