Overview
The
Unable to show "metadata-from": No such page "_space_variables"
supports the exchange of SIP signaling over the Transport Layer Security (TLS), an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections. Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol. The TLS operates just above the transport layer (Layer 4) and provides peer authentication, confidentiality and message integrity.
The
Unable to show "metadata-from": No such page "_space_variables"
supports TLS versions 1.0, 1.1 and 1.2 with server-only authentication (in which only the server is authenticated at the TLS layer) and mutual authentication (in which both the TLS client and server are authenticated at the TLS layer). TLS is an effective measure to a number of threats including theft of service, disruption of service, compromise of confidentiality, and compromise of service integrity.
Configure SIP over TLS independently on each hop between SIP devices. Configure SIP transport type selection via the IP Signaling Profile, and provision it on the SIP trunk group. You can also identify it via a DNS lookup.
Usage Scenarios and TLS Roles
The
Unable to show "metadata-from": No such page "_space_variables"
uses SIP over TLS in several scenarios as illustrated in the figure below.
SIP over TLS Usage Scenarios
The table below describes the interrelationship between each of these scenarios, the TLS role (server or client/server), and the authentication requirements.
Usage Scenario | Usage Description | TLS Role | Authentication Requirements |
---|
Residential Access | Between a subscriber SIP User Agent (UA) and an SBC. | Server | Server-only authentication. This is intended for use in conjunction with authenticated SIP registration. A peer is blocked from using any services until a successful SIP registration is performed. A separate registrar is deployed to challenge and authenticate the registration; this is a Ribbon ASX or another device. The registrar is configured to require authentication on the registration; however the Unable to show "metadata-from": No such page "_space_variables" does not check or enforce this. |
Enterprise Access | Between an enterprise PBX and an SBC. | Server | Mutual TLS authentication for static (non-registering) IP PBX. Server-only Authentication for registering PBX. |
Inter-Carrier Peering | Between a SIP proxy or Back-to-Back User Agent (B2B UA) belonging to another administrative domain and an SBC. | Client or Server | Mutual TLS authentication. |
Intra-Carrier Peering | Between an SBC and a SIP proxy or a B2B UA belonging to the same administrative domain. | Client or Server | Mutual TLS authentication |
Deployments may involve two or more of the above scenarios and include different transports (SIP over TLS, SIP over TCP, or SIP over UDP) simultaneously on separate legs of the same signaling path.
Crypto Suites
Supported TLS/DTLS Crypto Suites
Authentication Mechanism | Public/Private Key Pair | Confidentiality Cipher and Mode | Integrity Cipher |
---|
RSA-WITH-NULL-SHA The integrity cipher used for the TLS Record protocol. | RSA | NULL | SHA-1 |
RSA-WITH-AES-128-CBC-SHA (default) Confidentiality cipher and mode for the TLS Record protocol. | RSA | AES-128-CBC | SHA-1 |
RSA-WITH-AES-128-CBC-SHA-256 Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function. | RSA | AES-128-CBC | SHA-256 |
RSA-WITH-AES-256-CBC-SHA Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. | RSA | AES-256-CBC | SHA-1 |
RSA-WITH-AES-256-CBC-SHA-256* Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function. | RSA | AES-256-CBC | SHA-256 |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 CBC and SHA384 as the hash function. | ECDH-ECDSA | AES-256-CBC | SHA-384 |
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. | ECDH-ECDSA | AES-256-GCM | SHA-384 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as the hash function. | ECDHE-RSA | AES-128-CBC | SHA-1 |
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as the hash function. | ECDHE-RSA | AES-256-CBC | SHA-384 |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function. | ECDHE-RSA | AES-128-GCM | SHA-256 |
TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function. | ECDHE-RSA | AES-256-GCM | SHA-384 |
TLS_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function. | RSA | AES_128_GCM | SHA256 |
TLS_RSA_WITH_AES_256_GCM_SHA384 Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function. | RSA | AES_256_GCM | SHA384 |
* To use this cipher, you must enable TLS version 1.2 in the TLS Profile.
** To use this cipher, you must enable TLS version 1.2 in the TLS Profile and create SSL certificates using ECC keys.
The
Unable to show "metadata-from": No such page "_space_variables"
and its peer devices use X.509 digital certificates to authenticate themselves for the TLS. Install local certificates in PKSC # 12 format (attesting to the identity of the
Unable to show "metadata-from": No such page "_space_variables"
) and remote Certificate Authority (CA) certificates on the
Unable to show "metadata-from": No such page "_space_variables"
in a common area (/opt/sonus/external/) where they are available to the TLS.