In this section:
The Datagram Transport Layer Security (DTLS) protocol provides authentication, data integrity, and confidentiality for communications between two applications over User Datagram Protocol (UDP). The Secure Real-time Transport Protocol (SRTP) provides encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications. DTLS-SRTP is an extension to the DTLS protocol, where DTLS acts as the key management protocol. DTLS protocol is also extended to negotiate the SRTP crypto suites and parameters for use with those keys. WebRTC is a signaling protocol defined for real-time communication between Web browsers. WebRTC has assigned DTLS-SRTP protocol for the media exchange between the browsers. The SBC includes the following DTLS functionality: The SBC includes DTLS crypto suites that define a set of ciphers (algorithms used for encrypting data) which allow the selection of an appropriate level of security. When a TLS connection is established, the client and server exchange information about which cipher suites they have in common.
Use the TLS Profile to configure a profile for implementing the TLS protocol for SIP over TLS. The TLS profile is associated with a SIP Signaling Port.
The settings within the default TLS Profile may be modified. Also, the supported transport protocols must be set to allow SIP over TLS.
If a zone's sipSigPort
is configured for transportProtocolsAllowed
= sip-tls-tcp
, the SBC increments the configured portNumber
by 1 and uses it as the new port number for SIP over TLS signaling. The SBC then opens a TCP socket for SIP over TLS for the new TCP port number.
Example: When sipSigPort
is configured with a portNumber
of 5060 and transportProtocolsAllowed
= sip-tls-tcp
, the SBC listens on TCP port 5061 for SIP over TLS.
% set profiles security tlsProfile <profile name> acceptableCertValidationErrors <invalidPurpose | none> allowedRoles <clientandserver | server> appAuthTimer <1-60 seconds> authClient <false | true> cipherSuite1 <cipher suite> cipherSuite2 <cipher suite> cipherSuite3 <cipher suite> clientCertName <name> handshakeTimer <1-60 seconds> ocspProfileName <name> peerNameVerify <disabled | enabled> serverCertName <name> sessionResumpTimer <0-86400 seconds> suppressEmptyFragments <disabled | enabled> v1_0 <disabled | enabled> v1_1 <disabled | enabled> v1_2 <disabled | enabled>
The TLS Profile Parameters are as shown below:
TLS Profile Parameters
Parameter | Length/Range | Description |
---|---|---|
| 1-23 |
|
acceptableCertValidationErrors | N/A | Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate.
|
| N/A | Allowed TLS roles for this TLS profile.
|
| 1-60 | The higher layer authentication timer in seconds. (default = 5). |
| N/A | Indicates whether or not a TLS client is forced to authenticate itself within TLS. If set to false, the client is not required to authenticate itself at the TLS layer, but must complete authentication within a higher-level protocol after the TLS connection is established (that is, SIP registration).
|
| N/A | Use this parameter to specify the first TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
| N/A | Use this optional parameter to specify the second TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
| N/A | Use this optional parameter to specify the third TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
| 1-23 | The name of the default Client Certificate to be used by this TLS profile, created using the |
| 1-60 | The time (in seconds) in which the TLS handshake must be completed. The timer starts when the |
ocspProfileName | 1-23 | Name of OCSP profile object referenced by TLS profile. |
peerNameVerify | N/A | This flag is used to verify the authenticity of a client certificate. When enabled, the SBC validates the TLS peer name of the SIP peer against either a Common Name (CN) present in the subject or the DNS names or IP addresses in the Subject Alternate Name Extension (SAN) field in the certificate presented by the peer. For example, if the SBC establishes a TLS session with "sonus.customer.net", this feature verifies the CN in the subject (or a DNS entry in the SAN field) of the certificate contains "sbc.customer.net" as the value.
NOTE: This flag is used in conjunction with the trunk group parameter, |
| 1-23 | Specifies the name of the Server Certificate to be used by this TLS profile, created using the |
| 0-86400 | The TLS session resumption period (in seconds) for which cached sessions are retained. TLS allows successive connections to be created within one TLS session (and the resumption of a session after a TLS connection is closed or after a server card failover) without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. (default = 3600) |
suppressEmptyFragments | N/A | Enable flag to prevent the SBC from inserting empty fragments when sending packets on TLS over TCP connection in support of older versions of TLS implementation.
|
v1_0 | N/A | TLS protocol version 1.0 (see note below)
|
v1_1 | N/A | TLS protocol version 1.1 (see note below)
|
v1_2 | N/A | TLS protocol version 1.2 (see note below)
|
Supported DTLS Crypto Suites Authentication Mechanism Confidentiality Cipher and Mode Integrity Cipher RSA-WITH-NULL-SHA The integrity cipher used for the TLS Record protocol. RSA-WITH-AES-128-CBC-SHA (default) Confidentiality cipher and mode for the TLS Record protocol. AES-128-CBC SHA-1 RSA-WITH-AES-128-CBC-SHA-256 Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function. RSA-WITH-AES-256-CBC-SHA Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. RSA AES-256-CBC SHA-1 RSA-WITH-AES-256-CBC-SHA-256* Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function. RSA AES-256-CBC SHA-256 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 CBC and SHA384 as the hash function. ECDH-ECDSA AES-256-CBC SHA-384 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as the hash function. TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function. TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function. TLS_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function. TLS_RSA_WITH_AES_256_GCM_SHA384 Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function. * To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. When FIPS-140-2 mode is enabled, do not use the SBC releases 5.1, 6.2 and 7.2 are officially FIPS-compliant.Public/Private Key Pair RSA NULL SHA-1 RSA RSA AES-128-CBC SHA-256 ECDH-ECDSA AES-256-GCM SHA-384 ECDHE-RSA AES-128-CBC SHA-1 ECDHE-RSA AES-256-CBC SHA-384 ECDHE-RSA AES-128-GCM SHA-256 ECDHE-RSA AES-256-GCM SHA-384 RSA AES_128_GCM SHA256 RSA AES_256_GCM SHA384 rsa-with-null-sha
option.
> show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; v1_0 enabled; v1_1 enabled; v1_2 enabled; % set profiles security tlsProfile defaultTlsProfile ocspProfileName myOcspProfile % commit > show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; ocspProfileName myOcspProfile; v1_0 enabled; v1_1 enabled; v1_2 enabled;
% set profiles security tlsProfile TLS-1 v1_2 enabled % set profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384 % commit > show profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384; v1_2 enabled;