I need to remove the "a=crypto:" part from my SDP header to my ISP (cannot move it so I am opening a discussion in security section)

[Hermanus Janse van Vuuren]

I need to remove the "a=crypto:" part from my SDP header to my ISP

SDP header from PureCloud via TLS

Content-Type: application/sdp
User-Agent: ININ-EDGE/1.0.0.9458
Content-Length: 351

v=0
o=- 2580238779 3812407684 IN IP4 172.24.22.90
s=-
c=IN IP4 172.24.22.90
t=0 0
m=audio 21970 RTP/SAVP 8 0 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:KF2wFSwIE66sdkLz+xXOrcI6EWCJe6YkIdHBLrbh
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:pII/UErAVu99wbWSL/EjlLjhdmV2pFgKFIrV4j4D
a=sendrecv

I apply the following SIP manipulation rule on the outbound dial peer to the ISP
request ANY sdp-header Audio-Attribute modify "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

Then it removes the a=crypto but leaves to blank spaces between a=fmtp and a=sendrecv (I just filled it in with the words blank spaces but in the debug it is 2 blank spaces then the a=sendrecv part)

Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 184

v=0
o=- 2580238779 3812407684 IN IP4 10.80.14.230
s=-
c=IN IP4 10.80.14.230
t=0 0
m=audio 12392 RTP/SAVP 8 0 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
(blank space)
(blank space)
a=sendrecv

if I change the modify to remove
request ANY sdp-header Audio-Attribute remove "(a=crypto:.*inline:[A-Za-z0-9+/=]+)"

all a= values gets removed.

Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 184

v=0
o=- 2580238779 3812407684 IN IP4 10.80.14.230
s=-
c=IN IP4 10.80.14.230
t=0 0
m=audio 12392 RTP/SAVP 8 0 101

How can I get rid of just the a=crypto part in my SDP header to my ISP as they do not allow or accept it.

I have tested this numerous ways on https://cway.cisco.com/tools/SipProfileTest/ SIP-Profile Test Tool

I have also tried with:

request INVITE sdp-header Audio-Attribute modify "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

equest INVITE sdp-header Audio-Attribute remove "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

same result

[Hermanus Janse van Vuuren]

To answer myself, the cube should automatically do interworking between rtp and srtp as the ISP dial-peer is set to UDP and the CC dial-peer is TLS, but for some reason my CUBE keeps on sending crypto to the ISP over the UDP dial-peer. 

[Hermanus Janse van Vuuren · Accepted solution]

Issue was resolved by adding and removing the following commands:

voice service voip

no srtp fallback

!

dial-peer voice xx voip (incoming from PureCloud)

srtp fallback

dial-peer voice XX voip (outgoing to ITSP it was UDP but just to make sure added the below)

session transport udp

!

sip-ua

connection-reuse