AudioCodes Mediant 3000, User Manual

Page: 672 / 872

User's Manual 672 Document #: LTRT-89729
Mediant 3000
Parameter Description
RTP parameters:

If the remote SIP UA does not support SRTP, it uses RTP and
ignores the crypto lines.

In the opposite direction, if the device receives an SDP offer with
a single media (as shown above), it responds with SRTP
(RTP/SAVP) if the EnableMediaSecurity parameter is set to 1. If
SRTP is not supported (i.e., EnableMediaSecurity is set to 0), it
responds with RTP.
Notes:

Before configuring this parameter, set the EnableMediaSecurity
parameter to 1.

If this parameter is set to Preferable [3] and two 'm=' lines are
received in the SDP offer, the device prefers the SAVP (secure audio
video profile) regardless of the order in the SDP.

Option [2] Disable is applicable only to IP Profiles.

This parameter can also be configured per IP Profile, using the
IPProfile parameter (see 'Configuring IP Profiles' on page
263 ).
Web: Master Key
Identifier (MKI) Size
EMS: Packet MKI Size
[SRTPTxPacketMKISize
]
Defines the size (in bytes) of the Master Key Identifier (MKI) in SRTP Tx
packets.
The range is 0 to 4. The default is 0 (i.e., new keys are generated without
MKI).
Notes:

For the GW/IP-to-IP application, the device only initiates the MKI size.

You can also configure MKI size in an IP Profile.

For the SBC application, the device can forward MKI size as is for
SRTP-to-SRTP flows or override the MKI size during negotiation,
using IP Profiles. This can be done on the inbound or outbound leg.
Web:Symmetric MKI
Negotiation
EMS: Enable Symmetric
MKI
[EnableSymmetricMKI]
Enables symmetric MKI negotiation.

[0] Disable = (Default) The device includes the MKI in its 200 OK
response according to the SRTPTxPacketMKISize parameter (if set
to 0, then it is not included; if set to any other value, it is included with
this value).

[1] Enable = The answer crypto line contains (or excludes) an MKI
value according to the selected crypto line in the offer. For example,
assume that the device receives an INVITE containing the following
two crypto lines in SDP:
a=crypto:2 AES_CM_128_HMAC_SHA1_80
inline:TAaxNnQt8/qLQMnDuG4vxYfWl6K7eBK/ufk04pR4|2^31
|1:1
a=crypto:3 AES_CM_128_HMAC_SHA1_80
inline:bnuYZnMxSfUiGitviWJZmzr7OF3AiRO0l5Vnh0kH|2^31
The first crypto line includes the MKI parameter "1:1". In the 200 OK
response, the device selects one of the crypto lines (i.e., '2' or '3').
Typically, it selects the first line that supports the crypto suite.
However, for SRTP-to-SRTP in SBC sessions, it can be determined
by the remote side on the outgoing leg. If the device selects crypto
line '2', it includes the MKI parameter in its answer SDP, for example:
a=crypto:2 AES_CM_128_HMAC_SHA1_80
inline:R1VyA1xV/qwBjkEklu4kSJyl3wCtYeZLq1/QFuxw|2^31
|1:1
If the device selects a crypto line that does not contain the MKI
parameter, then the MKI parameter is not included in the crypto line in