Version 6.6
203
Mediant 3000
User's Manual
13. Media
13.9 Configuring Media Security
The device supports Secured RTP (SRTP) according to RFC 3711. SRTP is used to
encrypt RTP and RTCP transport for protecting VoIP traffic. SRTP requires a key
exchange mechanism that is performed according to RFC 4568 – “Session Description
Protocol (SDP) Security Descriptions for Media Streams”. The key exchange is done by
adding a 'crypto' attribute to the SDP. This attribute is used (by both sides) to declare the
various supported cipher suites and to attach the encryption key. If negotiation of the
encryption data is successful, the call is established.
SRTP supports the following cipher suites (all other suites are ignored):
AES_CM_128_HMAC_SHA1_32
AES_CM_128_HMAC_SHA1_80
ARIA_CM_128_HMAC_SHA1_80
ARIA_CM_192_HMAC_SHA1_80
When the device is the offering side, it generates an MKI of a size configured by the
'Master Key Identifier (MKI) Size' parameter. The length of the MKI is limited to four bytes.
If the remote side sends a longer MKI, the key is ignored. The key lifetime field is not
supported. However, if it is included in the key it is ignored and the call does not fail.
The device supports the following session parameters (as defined in RFC 4568, SDP
Security Descriptions for Media Streams):
UNENCRYPTED_SRTP
UNENCRYPTED_SRTCP
UNAUTHENTICATED_SRTP
Session parameters should be the same for the local and remote sides. When the device is
the offering side, the session parameters are configured by the following parameter -
'Authentication On Transmitted RTP Packets', 'Encryption On Transmitted RTP Packets,
and 'Encryption On Transmitted RTCP Packets'. When the device is the answering side,
the device adjusts these parameters according to the remote offering. Unsupported
session parameters are ignored, and do not cause a call failure.
Below is an example of crypto attributes usage:
a=crypto:1 AES_CM_128_HMAC_SHA1_80
inline:PsKb5X0YLuSvNrImEh/dAe
a=crypto:2 AES_CM_128_HMAC_SHA1_32
inline:IsPtLc6XVzRuMqHlDnEiAd
The device also supports symmetric MKI negotiation, whereby it can be configured to
forward the MKI size received in the SDP offer crypto line in the SDP answer crypto line.
To configure the device's mode of operation if negotiation of the cipher suite fails, use the
'Media Security Behavior' parameter. This parameter can be set to enforce SRTP, whereby
incoming calls that don’t include encryption information are rejected.
Notes:
•
For a detailed description of the SRTP parameters, see SRTP
Parameters on page
•
When SRTP is used, the channel capacity may be reduced.
Summary of Contents for Mediant 3000
Page 2: ......
Page 26: ...User s Manual 26 Document LTRT 89729 Mediant 3000 Reader s Note...
Page 27: ...Part I Getting Started with Initial Connectivity...
Page 28: ......
Page 40: ...User s Manual 40 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 41: ...Part II Management Tools...
Page 42: ......
Page 44: ...User s Manual 44 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 80: ...User s Manual 80 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 98: ...User s Manual 98 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 103: ...Part III General System Settings...
Page 104: ......
Page 113: ...Part IV General VoIP Configuration...
Page 114: ......
Page 144: ...User s Manual 144 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 164: ...User s Manual 164 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 222: ...User s Manual 222 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 224: ...User s Manual 224 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 275: ...Part V Gateway and IP to IP Application...
Page 276: ......
Page 278: ...User s Manual 278 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 399: ...Part VI Session Border Controller Application...
Page 400: ......
Page 402: ...User s Manual 402 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 464: ...User s Manual 464 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 465: ...Part VII Stand Alone Survivability Application...
Page 466: ......
Page 474: ...User s Manual 474 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 494: ...User s Manual 494 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 497: ...Part VIII IP Media Capabilities...
Page 498: ......
Page 501: ...Part IX High Availability System...
Page 502: ......
Page 515: ...Part X Maintenance...
Page 516: ......
Page 522: ...User s Manual 522 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 524: ...User s Manual 524 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 552: ...User s Manual 552 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 562: ...User s Manual 562 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 565: ...Part XI Status Performance Monitoring and Reporting...
Page 566: ......
Page 578: ...User s Manual 578 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 609: ...Part XII Diagnostics...
Page 610: ......
Page 624: ...User s Manual 624 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 626: ...User s Manual 626 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 638: ...User s Manual 638 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 639: ...Part XIII Appendix...
Page 640: ......
Page 864: ...User s Manual 864 Document LTRT 89729 Mediant 3000 Reader s Notes...
Page 871: ...Version 6 6 871 Mediant 3000 User s Manual 55 Selected Technical Specifications Reader s Notes...