cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Walkthrough Wednesdays
292
Views
0
Helpful
2
Replies

I need to remove the "a=crypto:" part from my SDP header to my ISP (cannot move it so I am opening a discussion in security section)

I need to remove the "a=crypto:" part from my SDP header to my ISP

 

SDP header from PureCloud via TLS

Content-Type: application/sdp
User-Agent: ININ-EDGE/1.0.0.9458
Content-Length: 351

v=0
o=- 2580238779 3812407684 IN IP4 172.24.22.90
s=-
c=IN IP4 172.24.22.90
t=0 0
m=audio 21970 RTP/SAVP 8 0 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:KF2wFSwIE66sdkLz+xXOrcI6EWCJe6YkIdHBLrbh
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:pII/UErAVu99wbWSL/EjlLjhdmV2pFgKFIrV4j4D
a=sendrecv

 

I apply the following SIP manipulation rule on the outbound dial peer to the ISP
request ANY sdp-header Audio-Attribute modify "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

Then it removes the a=crypto but leaves to blank spaces between a=fmtp and a=sendrecv (I just filled it in with the words blank spaces but in the debug it is 2 blank spaces then the a=sendrecv part)

Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 184

v=0
o=- 2580238779 3812407684 IN IP4 10.80.14.230
s=-
c=IN IP4 10.80.14.230
t=0 0
m=audio 12392 RTP/SAVP 8 0 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
(blank space)
(blank space)
a=sendrecv

 

if I change the modify to remove
request ANY sdp-header Audio-Attribute remove "(a=crypto:.*inline:[A-Za-z0-9+/=]+)"

all a= values gets removed.

Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 184

v=0
o=- 2580238779 3812407684 IN IP4 10.80.14.230
s=-
c=IN IP4 10.80.14.230
t=0 0
m=audio 12392 RTP/SAVP 8 0 101

 

How can I get rid of just the a=crypto part in my SDP header to my ISP as they do not allow or accept it.

 

I have tested this numerous ways on https://cway.cisco.com/tools/SipProfileTest/ SIP-Profile Test Tool

 

I have also tried with:

request INVITE sdp-header Audio-Attribute modify "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

equest INVITE sdp-header Audio-Attribute remove "(a=crypto:.*inline:[A-Za-z0-9+/=]+)" ""

 

same result

Best Regards
1 ACCEPTED SOLUTION

Accepted Solutions

Issue was resolved by adding and removing the following commands:

 

voice service voip

no srtp fallback

!

dial-peer voice xx voip (incoming from PureCloud)

srtp fallback

 

dial-peer voice XX voip (outgoing to ITSP it was UDP but just to make sure added the below)

session transport udp

!

sip-ua

connection-reuse

Best Regards

View solution in original post

2 REPLIES 2

To answer myself, the cube should automatically do interworking between rtp and srtp as the ISP dial-peer is set to UDP and the CC dial-peer is TLS, but for some reason my CUBE keeps on sending crypto to the ISP over the UDP dial-peer. 

Best Regards

Issue was resolved by adding and removing the following commands:

 

voice service voip

no srtp fallback

!

dial-peer voice xx voip (incoming from PureCloud)

srtp fallback

 

dial-peer voice XX voip (outgoing to ITSP it was UDP but just to make sure added the below)

session transport udp

!

sip-ua

connection-reuse

Best Regards

View solution in original post

Content for Community-Ad

Spotlight Awards 2021