In my environment, I have the following (simplified) setup:
FS1 ---- FS SBC --- FS2
Phones registered to FS1 (100x) use TLS/SRTP and phones registered to FS2 (200x) use SIP/RTP
FS1 has inbound-bypass-media set to true to allow SRTP peer to peer and direct to the SBC.
If I make an inbound call (eg: 1000 to 2000), SRTP is correctly established between the phone and SBC with RTP on the other side of the SBC to the internal phone.
However, when I try it the other way, I can't get SRTP established from the SBC to the external phone.
I've been using
https://wiki.freeswitch.org/wiki/Secure_RTP as a guide.
I've even tried explicitly setting sip_secure_media to true on the SBC and FS1.
The dialplan on the SBC has:
<extension name="outgoing">
<condition field="destination_number" expression="^(10[0-9][0-9])$">
<action application="set" data="sip_secure_media=true"/>
<action application="bridge" data="sofia/external/${
destination_number}@10.1.1.204"/>
</condition>
</extension>
And on FS1, the dialplan has:
<extension name="Local-Numbers">
<condition field="destination_number" expression="^(10[01][0-9])$">
<action application="export" data="dialed_extension=$1"/>
<action application="set" data="sip_secure_media=true"/>
<action application="bridge" data="user/${dialed_extension}@${domain_name}"/>
</condition>
</extension>
Note that I've been testing this against two phones with SRTP enabled, but only one that is using TLS. I get the same result calling each phone.