User`s manual

Mediant 2000 & TP-1610 & TP-260
SIP User's Manual 294 Document #: LTRT-68805
When a user connects to the secure Web server:
 If the user has a client certificate from a CA listed in the Trusted Root Certificate file,
the connection is accepted and the user is prompted for the system password.
 If both the CA certificate and the client certificate appear in the Trusted Root
Certificate file, the user is not prompted for a password (thus providing a single-sign-
on experience - the authentication is performed using the X.509 digital signature).
 If the user doesn’t have a client certificate from a listed CA, or doesn’t have a client
certificate at all, the connection is rejected.
Notes:
• The process of installing a client certificate on your PC is beyond the
scope of this document. For more information, refer to your Web browser
or operating system documentation, and/or consult your security
administrator.
• The root certificate can also be loaded via ini file using the parameter
‘HTTPSRootFileName’.
13.3 SRTP
The gateway supports Secured RTP (SRTP) according to RFC 3711. SRTP is used to
encrypt RTP and RTCP transport since it is best-suited for protecting VoIP traffic.
SRTP requires a Key Exchange mechanism that is performed according to <draft-ietf-
mmusic-sdescriptions-12>. The Key Exchange is executed by adding a ‘Crypto’ attribute to
the SDP. This attribute is used (by both sides) to declare the various supported cipher
suites and to attach the encryption key to use. If negotiation of the encryption data is
successful, the call is established.
Use the parameter MediaSecurityBehaviour (described in Section
6.9 on page 145) to
select the gateway’s mode of operation: Must or Prefer. These modes determine the
behavior of the gateway if negotiation of the cipher suite fails.
 Must = the call is terminated. Incoming calls that don’t include encryption information
are rejected.
 Prefer = an unencrypted call is established. Incoming calls that don’t include
encryption information are accepted.
To enable SRTP set the parameter EnableMediaSecurity to 1 (described in Section
6.9 on
page 145).
Notes:
• When SRTP is used the channel capacity is reduced (refer to the
parameter EnableMediaSecurity).
• The gateway only supports the AES 128 in CM mode cipher suite.
Figure 13-11: Example of crypto Attributes Usage
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:PsKoMpHlCg+b5X0YLuSvNrImEh/dAe
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:IsPtLoGkBf9a+c6XVzRuMqHlDnEiAd