You may want to check out my tls patch at:
it features the option for tls_only forcing only the encrypted port to
be open: http://jira.freeswitch.org/browse/FS-3071 in your dialplan
for calls you can set sip_secure_media to true to force it to SRTP.
~Mitch