SIP messaging can be encrypted between the endpoint and the PBX node it is interacting with by using TLS (Transport Layer Security). Using SIP over TLS allows you to bypass ALG's (Application Layer Gateways) and ISP Blocking. ALG works by inspecting the SIP messages and replacing local IPs with the Public IP of the Network, the local network equipment is no longer able to read the packets and therefore cannot inspect or make changes to them. Most industry standards do not require SIP over TLS at this point in time, however it may be possible in the future.
Enabling SIP TLS support
As we roll out TLS Support, we will be activating the required DNS records in a controlled manner. Support will communicate with you once your records have been provisioned.
- To enable SIP TLS support on a per domain or per device basis make a request to SkySwitch support by using the following Form:
SIP over TLS Request Form - Our team will create the proper DNS records for your supported phones to be able to use TLS.
- You will need to add appropriate overrides (as shown below) to the device or as domain wide overrides in NDP. These will only work once TLS has been enabled.
Phone Overrides
We will only Support SIP over TLS on supported phone models that have overrides listed below
Yealink Tx series phones running firmware version 66.83.0.65 and above. (Where X is the line number)
account.1.sip_server.1.transport_type="2"
static.security.default_ssl_method="5"
Poly VVX series phones running firmware version 5.8.0.12848 and above. (Where X is the line number)
reg.1.server.1.port="0"
reg.1.server.1.transport="TLS"
voIpProt.SIP.outboundProxy.transport="TLS"
voIpProt.server.1.transport="TLS"
sec.TLS.SIP.strictCertCommonNameValidation="0"
Grandstream: All firmware.
1- Using aliases (For models that support aliases: GRPs, WP8X0)
account.1.sip.transport="TlsOrTcp"
Substitute X for the account number.
2- Using P codes: (Applicable to all Grandstream models including the ones that support aliases)
Account (line):1
P130="2"
Account (line):2
P448="2"
Account (line):3
P548="2"
The number in quotes is the SIP Transport method. 0 - UDP, 1 - TCP, 2 - TLS/TCP. Default is 0.
If more Pcode overrides are needed for the rest of the accounts (lines), please download the config-templates from: http://www.grandstream.com/support/tools
Snom:
You can enable TLS in 2 ways:
- Adding the string ";transport=tls" to the outbound proxy. Note: However, this is not an override but a string that is added to the information inside of the outbound proxy field.
Example: user_outbound1=99999.hpbx.outboundproxy.com;transport=tls - Via DNS. For this, you need to use DNS/NAPTR(Name Authority Pointer).
- The phone will make a NAPTR request to the outbound proxy
- The NAPTR record will return the SRV record
- The phone will make a request to the SRV record to get the IP address
Further information here:
http://www.traud.de/voip/snom.htm
https://andersbrownworth.com/cms/264/sip/dns/naptr/srv/dnscache/tinydns
Important Notes:
- This early SIP TLS support will move devices to an NMS node in our Atlanta data center and is currently not be able to provide failover to another node / data center should the Atlanta node / data center become unavailable.
- In order to enable this support, Engineering will be creating a new TLS SRV record for the reseller.
- Some devices may prefer SIP TLS over TCP as a transport option and may automatically move once the new TLS SRV record is detected. If this behavior is not desired manual action will need to be taken to reconfigure those devices. A list of currently known devices that will prefer TLS transport is below.
- ALGO 8301 Paging Adapter.
- While the NDP device overrides are domain / device specific the TLS SRV record that will be created applies to the entire reseller. Meaning that devices in all the reseller's domains that prefer the TLS SRV record may be affected.