IP Office Platform Media Security

Last Updated : Mar 05, 2024 |

IP Office supports both SRTP and IPsec for VoIP media security.

  • IP Office's IPsec feature can be utilized, but it is not recommended as it limited to the IP500 V2 platform and uses a legacy key exchange mechanism (IKEv1).

  • VoIP media security using SRTP is supported on IP Office in Standard Edition, Server Edition, Select and hosted, without the need for extra licensing, for the connections:

    • IP Office , SIP and SM lines

    • Avaya H.323 extensions: 9608, 9611, 9621, 9641

    • Avaya SIP extensions: 9608, 9611, 9621 and 9641 (in centralized branch deployments), 1100 Series, 1200 Series, B179, E129, H175, J100 Series, K100 Series (Vantage), Scopia XT series

    • 3rd Party SIP extensions that support SRTP

The following configurable SRTP options are supported by IP Office:

SRTP feature

Options

Support

Default

Notes

SRTP Operation

Disabled

✓

✓

All SRTP settings are per system with a per line and per extension override

On: Best Effort

✓

–

On: Enforce

✓

–

RTP Encryption

Off

✓

–

On: AES128-CTR

✓

✓

On: AES128-F8

–

–

RTP Authentication

Off

✓

–

RTP Authentication should not be disabled

On: SHA-1/32

✓

–

On: SHA-1/80

✓

✓

SHA-1/80 provides stronger authentication for a small bandwidth increase

RTCP Encryption

Off

✓

✓

On: AES128-CTR

✓

–

Some Avaya and 3rd party endpoints do not support encrypted RTCP

On: AES128-F8

–

–

RTCP Authentication

On: SHA-1/32

✓

–

RTCP Authentication always active

On: SHA-1/80

✓

✓

SHA-1/80 provides stronger authentication for a small bandwidth increase.

IP Office supports a per-system SRTP set of controls, with a per-line and extension overrides, including encryption and authentication settings. The SRTP operation control has the following values:

Option

Description

Disabled

SRTP is not available

Preferred

Always offer both SRTP and RTP and given a choice, choose SRTP.

Enforced

RTP is not available on that call leg. Note: This doesn't enforce end-to-end SRTP, only SRTP on the call leg configured as Enforce.

Notes

  • For calls using Dial Emergency, the Enforce setting is ignored if SRTP connection cannot be established.

  • Where SIP soft clients connect to IP Office in simultaneous-registration mode (that is, another device is registered for the same user), they do not have a per-extension override of media security settings. IP Office will handle calls of these devices according to its system-level Media Security settings

  • Each leg of a call is regarded independently by IP Office for SRTP control; the appropriate SRTP Line or Extension setting will determine the support by each leg. Conferencing or recording of calls with SRTP legs by IP Office will retain SRTP wherever possible.

  • In order to provide complete call security, the SRTP key exchange also requires to be secured.

Related information
VoIP Security