Secure SRST: Questions regarding need for DSP if no conferencing is needed

[Nadav]

Hi everyone,

I have a set of 29xx ISR2 routers, and PVDM3 cards. These routers are used today as an SRST when the CUCMs are inaccessible by the local phones on-site. At present the PVDM3 cards are unused because no transcoding or conferencing is taking place.

The CUCM cluster is in Mixed-Mode.

If I'm interested in securing the calls with SRTP for these SRSTs, and secure SIP to the SRST and from the SRST to the CUCM, I've read documentation which suggests that a DSP is necessary. The codec used for these SRST calls is G.729. 

Is a DSP necessary? I've used the DSP calculator on the Cisco Tools website with the following parameters:

Router version, IOS version, no DSP sharing, using secure voice, no H.320, Motherboard DSP type as PVDM3.

Under Secure IP Services I'd like to set up to 35 secure calls via SRST, so I wouldn't expect transcoding to be necessary since they are all the same codec. If I don't configure a number larger than zero for transcoding or conferencing, the calculator decides that no DSP is necessary. However, if I were to choose 35 calls under "Medium Complexity" for Secure Transcoding, it tells me that I need a PVDM3-64.

Which would be the correct way to calculate my PVDM3 requirements?

Thanks!

[Dennis Mink]

Can you quote where tyou read this about DSP being a requirement for sRTP?

the way I have done it in the past, is to use IPSEC between gateway and CUCM.

[Nadav]

Hi Dennis,

Here is one reference for PVDM2:

https://www.cisco.com/c/en/us/products/collateral/routers/2600-series-multiservice-platforms/prod_qas0900aecd8016c49f.html

"Because media encryption occurs in the DSPs, the number of secure calls that can be supported are dictated by the type and number of  DSPs on the interface."

If you know differently for PVDM3, I'd be happy to hear it :)

[Dennis Mink]

Are you using TDM (ISDN) or have you got a SIP provider for your in and outbound calls?

cheers

[Nadav]

This is an on-premise, entirely IP, separate network. No SIP provider. All calls will be between phones registered to the secure SRST, and via the secure SIP trunk between SRST and CUCM.

[R0g22]

Secure SRST comes with some restriction. You have SIP so I assume you are not using SCCP. With Secure SIP SRST, transcoding and hardware conferencing are not supported. Read below -

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cusrst/admin/sccp_sip_srst/configuration/guide/SCCP_and_SIP_SRST_Admin_Guide/srst_secure_sccp_and_sip.html

The DSP calculator does not take into account whether your query is for SRST or non-srst transcoding.

[Nadav]

Hi Nipun,

I'm not interested in using the SRST for transcoding or conferencing. I would like to use it solely for secure SIP calls as a fallback plan for the CUCM. 

Any idea how I can use the DSP calculator to calculate the number of secure SIP calls? Is a DSP even necessary?

[R0g22 · Accepted solution]

Got it. Your post was a ted confusing.
You should not need a DSP if all you have to do is IP-IP. If you plan everything correctly in terms of codec usage etc, there should not be a need for DSP here.