SIP - Encrypted trunk to Unencrypted trunk fails

[mzajeski]

We have a voice PRI connected to an ISR 4451.  The ISR is configured in CallManager using encryption/tls as a SIP Trunk (5061).  We also have an IVR configured using SIP, but without encryption (5060).

When calling the IVR directly, the call proceeds.  When calling a did on the PRI that translates to the IVR, it fails.  I've tried fronting with a MTP to no avail.  The call is completely G711.  Any suggestions for troubleshooting?

[mzajeski]

I forgot to mention - when I turn off encryption on the ISR 4451, the call works.  So the issue has something to do with the scenario -

PSTN -- 4451 (SIP TLS/5061) -- CallManager -- IVR (SIP/5060)

[gmgarrian]

Are you doing SRTP as well or just TLS?

If so, you'll need to configure srtp fallback since the IVR is not secure:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/sip/configuration/15-mt/sip-config-15-mt-book/voi-sip-srtp.html#GUID-707A5070-4311-4A78-959E-D5F8B246188A