Let me correct my last email.

If I use rtp_secure_media instead of sip_secure_media, the outgoing call uses RTP and not SRTP.

rtp_secure_media was supposed to have been introduced in 1.2.9, so I wonder what the difference is?

On Thu, Aug 15, 2013 at 3:52 PM, Peter <eidevm5@gmail.com> wrote:

Finally got it going.  I don't know how many combinations I tried.

All I needed was the sip_secure_media (or rtp_secure_media, which is the new name) set to true in the dialplan on the SBC.

On Wed, Aug 14, 2013 at 11:42 AM, Peter <eidevm5@gmail.com> wrote:

Hi Carlos.

Didn't realise rtp_secure_media existed.  After searching I saw:

https://wiki.freeswitch.org/wiki/Release_Notes#rtp_secure_media_.28was_sip_secure_media.29

which says it was introduced in 1.2.9

However, it's a little ambiguous as to whether sip_secure_media was deprecated.

Anyway, I tried using rtp_secure_media instead, but I still can't get SRTP working.

I did some testing with some other SIP clients.   In particular, csipsimple.  On the client, if I set SRTP to be optional, the media stream uses RTP.   However, if I set SRTP to be mandatory, when I try to call it, Freeswitch receives:

   SIP/2.0 488 Not Acceptable Here

Which seems to indicate that something is not is not right with the SRTP setup.

There's a full debug from the FS1 (the freeswitch server where the csipsimple client is registered to) at:

http://pastebin.freeswitch.org/21295

Note in the debug I have sdp_secure_savp_only set to true.   I've tried disabling this setting, but get the same result.

Thanks

Peter

 

On Tue, Aug 13, 2013 at 11:06 PM, Carlos Flor <jackal@cybershroud.net> wrote:

Try using rtp_secure_media=true instead of sip_secure_media.  If you are trying to set it on the b-leg, you probably want to use export instead of set, or use nolocal:rtp_secure_media.

Hope that helps.

On Mon, Aug 12, 2013 at 10:26 PM, Peter <eidevm5@gmail.com> wrote:

In my environment, I have the following (simplified) setup:

FS1  ----  FS SBC ---  FS2

Phones registered to FS1 (100x) use TLS/SRTP and phones registered to FS2 (200x) use SIP/RTP

FS1 has inbound-bypass-media set to true to allow SRTP peer to peer and direct to the SBC.

If I make an inbound call (eg: 1000 to 2000), SRTP is correctly established between the phone and SBC with RTP on the other side of the SBC to the internal phone.

However, when I try it the other way, I can't get SRTP established from the SBC to the external phone.

I've been using https://wiki.freeswitch.org/wiki/Secure_RTP as a guide.

I've even tried explicitly setting sip_secure_media to true on the SBC and FS1.

The dialplan on the SBC has:

  <extension name="outgoing">
        <condition field="destination_number" expression="^(10[0-9][0-9])$">
            <action application="set" data="sip_secure_media=true"/>
            <action application="bridge" data="sofia/external/${destination_number}@10.1.1.204"/>
        </condition>
  </extension>

And on FS1, the dialplan has:

   <extension name="Local-Numbers">
      <condition field="destination_number" expression="^(10[01][0-9])$">
        <action application="export" data="dialed_extension=$1"/>
        <action application="set" data="sip_secure_media=true"/>
        <action application="bridge" data="user/${dialed_extension}@${domain_name}"/>
      </condition>
    </extension>

Note that I've been testing this against two phones with SRTP enabled, but only one that is using TLS.  I get the same result calling each phone.

On a related point, what it the step required for a TLS connection from the SBC to the phone?   I'm assume the phone just needs the CA cert from the SBC.  Correct?

Any information as to where I'm going wrong will be gratefully accepted.

Thanks

Peter
 

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org