AudioCodes Mediant 4000 SBC, Руководство пользователя

Страница: 431 / 1037

CHAPTER 19 Coders and Profiles
Mediant 4000 SBC | User's Manual
Parameter Description
■ [1] Enforce = Device changes the MKI length
according to the settings of the IP Profile parameter,
MKISize.
'SBC Media Security Method'
sbc-media-security-
method
[IpProfile_
SBCMediaSecurityMethod]
Defines the media security protocol for SRTP, for the SIP
entity associated with the IP Profile.
■ [0] SDES = (Default) The device secures RTP using
the Session Description Protocol Security Descriptions
(SDES) protocol to negotiate the cryptographic keys
(RFC 4568). The keys are sent in the SDP body
('a=crypto') of the SIP message and are typically
secured using SIP over TLS (SIPS). The encryption of
the keys is in plain text in the SDP. SDES implements
TLS over TCP.
■ [1] DTLS = The device uses Datagram Transport Layer
Security (DTLS) protocol to secure UDP-based media
streams (RFCs 5763 and 5764). For more information
on DTLS, see
SRTP using DTLS Protocol .
■ [2] Both = SDES and DTLS protocols are supported.
Note:
■ To support DTLS, you must also configure the following
for the SIP entity:
✔
TLS Context for DTLS (see Configuring TLS
Certificate Contexts ). The server cipher ('Cipher
Server') must be configured to All.
✔
IpProfile_SBCMediaSecurityBehaviourMedia
configured to SRTP or Both.
✔
IpProfile_SBCRTCPMux configured to Supported.
The setting is required as the DTLS handshake is
done for the port used for RTP. Therefore, RTCP
and RTP should be multiplexed over the same port.
■ The device does not support forwarding of DTLS
transparently between endpoints (SIP entities).
■ As DTLS has been defined by the WebRTC standard
as mandatory for encrypting media channels for SRTP
key exchange, the support is important for deployments
implementing WebRTC. For more information on
WebRTC, see
WebRTC .
'Reset SRTP Upon Re-key'
reset-srtp-upon-re-key
[IpProfile_
ResetSRTPStateUponRekey]
Enables synchronization of the SRTP state between the
device and a server when a new SRTP key is generated
upon a SIP session expire. This feature ensures that the
roll-over counter (ROC), one of the parameters used in the
SRTP encryption/decryption process of the SRTP packets
is synchronized on both sides for transmit and receive
packets.
■ [0] Disable = (Default) ROC is not reset on the device
side.
- 398 -