Re: [Freeswitch-dev] SIP Over TCP/TLS
Thanks Brian I am going to use sangoma modules for PSTN connectivity. I think I don't need asterisk in this scenario. Microsoft Mediation server <---------->FreeSwitch with Sangoma Modules installed. SIP over TCP/TLS <--------------->TDM That works right ? Thanks Imthiyaz
I have never tested Microsoft Mediation Server so I can't say. /b On Jan 29, 2008, at 5:38 AM, Imthiyaz Ahmed wrote:
Thanks Brian I am going to use sangoma modules for PSTN connectivity. I think I don't need asterisk in this scenario. Microsoft Mediation server <---------->FreeSwitch with Sangoma Modules installed. SIP over TCP/TLS <--------------->TDM
That works right ?
Thanks Imthiyaz
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
Hi, I have added the below lines in /usr/local/freeswitch/conf/sip_profiles/default.xml. <!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/> I also copied cafile.pem and agent.pem to /usr/local/freeswitch/conf/ssl/ But I am seeing SIP siganlling going on UDP still. Am i missing some link here???? BR, Irshad. On Jan 29, 2008 7:34 PM, Brian West <brian.west@mac.com> wrote:
I have never tested Microsoft Mediation Server so I can't say.
/b
On Jan 29, 2008, at 5:38 AM, Imthiyaz Ahmed wrote:
Thanks Brian I am going to use sangoma modules for PSTN connectivity. I think I don't need asterisk in this scenario. Microsoft Mediation server <---------->FreeSwitch with Sangoma Modules installed. SIP over TCP/TLS <--------------->TDM
That works right ?
Thanks Imthiyaz
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
What phone do you have? /b On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
I have SNOM 300 and Grandstream GXP2000 with me. BR, Irshad. On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote:
What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
In first place, I should get my Freeswitch UA signalling on TLS. But I am seeing my Freeswitch UA signalling going on UDP. BR, Irshad. On Jan 31, 2008 12:22 PM, Irshad Ahamed <irshad.fswitch@gmail.com> wrote:
I have SNOM 300 and Grandstream GXP2000 with me.
BR, Irshad.
On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote:
What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
What do you mean? FreeSWITCH will use UDP unless you tag on a transport=tls to the bridge data. This isn't something that is fully supported or well documented yet. The only phone I have that has done TLS correct is Polycom 650 running 2.2 or 3.0 firmware. /b On Jan 31, 2008, at 12:59 AM, Irshad Ahamed wrote:
In first place, I should get my Freeswitch UA signalling on TLS. But I am seeing my Freeswitch UA signalling going on UDP.
BR, Irshad.
On Jan 31, 2008 12:22 PM, Irshad Ahamed <irshad.fswitch@gmail.com> wrote: I have SNOM 300 and Grandstream GXP2000 with me.
BR, Irshad.
On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote: What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/ conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
Well for the snom its easy: http://wiki.snom.com/Old/ FAQ#Q:_How_can_I_setup_snom3xx_phones_for_TLS_support.3F Be warned you'll need to have var sip-force-contact set to NDLB-tls- connectile-dysfunction on the user. set so we watch for the correct port. As for the grandstream no clue. I don't have one that actually works. Snom is fixing this TLS but in up coming firmware releases as it reports the wrong contact in the register. /b On Jan 31, 2008, at 12:52 AM, Irshad Ahamed wrote:
I have SNOM 300 and Grandstream GXP2000 with me.
BR, Irshad.
On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote: What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/ conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
im not familiar with TLS,can someone please explain? On 31/01/2008, at 6:04 PM, Brian West wrote:
Well for the snom its easy:
http://wiki.snom.com/Old/ FAQ#Q:_How_can_I_setup_snom3xx_phones_for_TLS_support.3F
Be warned you'll need to have var sip-force-contact set to NDLB-tls- connectile-dysfunction on the user. set so we watch for the correct port. As for the grandstream no clue. I don't have one that actually works.
Snom is fixing this TLS but in up coming firmware releases as it reports the wrong contact in the register.
/b
On Jan 31, 2008, at 12:52 AM, Irshad Ahamed wrote:
I have SNOM 300 and Grandstream GXP2000 with me.
BR, Irshad.
On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote: What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/ conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
Well it stands for Transport Layer Security... in this use it means the sip traffic is encrypted which is perfect for exchanging SRTP keys via SDES in the SDP since the signaling channel is encrypted too. /b On Jan 31, 2008, at 1:19 AM, Karl Kloppenborg wrote:
im not familiar with TLS,can someone please explain?
Please go through this article on wiki.... http://en.wikipedia.org/wiki/Transport_Layer_Security Hope it may help you understand better. BR, Irshad. On Jan 31, 2008 12:49 PM, Karl Kloppenborg <karl@dragnet.com.au> wrote:
im not familiar with TLS,can someone please explain? On 31/01/2008, at 6:04 PM, Brian West wrote:
Well for the snom its easy:
http://wiki.snom.com/Old/ FAQ#Q:_How_can_I_setup_snom3xx_phones_for_TLS_support.3F
Be warned you'll need to have var sip-force-contact set to NDLB-tls- connectile-dysfunction on the user. set so we watch for the correct port. As for the grandstream no clue. I don't have one that actually works.
Snom is fixing this TLS but in up coming firmware releases as it reports the wrong contact in the register.
/b
On Jan 31, 2008, at 12:52 AM, Irshad Ahamed wrote:
I have SNOM 300 and Grandstream GXP2000 with me.
BR, Irshad.
On Jan 31, 2008 12:03 PM, Brian West <brian.west@mac.com> wrote: What phone do you have?
/b
On Jan 31, 2008, at 12:21 AM, Irshad Ahamed wrote:
Hi,
I have added the below lines in /usr/local/freeswitch/conf/ sip_profiles/default.xml.
<!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> Which phones you mean will not work???? <param name="tls-version" value="tlsv1"/>
I also copied cafile.pem and agent.pem to /usr/local/freeswitch/ conf/ ssl/
But I am seeing SIP siganlling going on UDP still. Am i missing some link here????
BR, Irshad.
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
_______________________________________________ Freeswitch-dev mailing list Freeswitch-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
participants (4)
-
Brian West
-
Imthiyaz Ahmed
-
Irshad Ahamed
-
Karl Kloppenborg