In my environment, I have the following (simplified) setup:

FS1  ----  FS SBC ---  FS2

Phones registered to FS1 (100x) use TLS/SRTP and phones registered to FS2 (200x) use SIP/RTP

FS1 has inbound-bypass-media set to true to allow SRTP peer to peer and direct to the SBC.

If I make an inbound call (eg: 1000 to 2000), SRTP is correctly established between the phone and SBC with RTP on the other side of the SBC to the internal phone.

However, when I try it the other way, I can't get SRTP established from the SBC to the external phone.

I've been using https://wiki.freeswitch.org/wiki/Secure_RTP as a guide.

I've even tried explicitly setting sip_secure_media to true on the SBC and FS1.

The dialplan on the SBC has:

  <extension name="outgoing">
        <condition field="destination_number" expression="^(10[0-9][0-9])$">
            <action application="set" data="sip_secure_media=true"/>
            <action application="bridge" data="sofia/external/${destination_number}@10.1.1.204"/>
        </condition>
  </extension>

And on FS1, the dialplan has:

   <extension name="Local-Numbers">
      <condition field="destination_number" expression="^(10[01][0-9])$">
        <action application="export" data="dialed_extension=$1"/>
        <action application="set" data="sip_secure_media=true"/>
        <action application="bridge" data="user/${dialed_extension}@${domain_name}"/>
      </condition>
    </extension>

Note that I've been testing this against two phones with SRTP enabled, but only one that is using TLS.  I get the same result calling each phone.

On a related point, what it the step required for a TLS connection from the SBC to the phone?   I'm assume the phone just needs the CA cert from the SBC.  Correct?

Any information as to where I'm going wrong will be gratefully accepted.

Thanks

Peter
 

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org