CHAPTER15 Media
Mediant 1000 Gateway & E-SBC | User's Manual
● Set the IPmediaChannels parameter to the number of DSP channels that you want to
“borrow” (use) from each PRI module. The setting below shows an example of borrowing
DSP channels from PRI modules #1 and #2:
[IPMediaChannels]
FORMAT IPMediaChannels_Index = IPMediaChannels_ModuleID,
IPMediaChannels_DSPChannelsReserved;
IPMediaChannels 1 = 1, 15;
IPMediaChannels 2 = 2, 10;
[\IPMediaChannels]
● The value of IPMediaChannels_DSPChannelsReserved must be in multiples of 5.
● By default, the MPM module is set to the maximum number of IP media channels.
Therefore, there is no need to define it with the IPmediaChannels parameter.
● By default, the IPMediaChannels_DSPChannelsReserved parameter for all PRI
modules is set to 0 (i.e., no "borrowing" of IP media channels).
Configuring Media (SRTP) Security
The device supports Secured RTP (SRTP) according to RFC 3711. SRTP is used to encrypt RTP
and RTCP transport for protecting VoIP traffic. SRTP requires a cryptographic key exchange
mechanism to negotiate the keys. To negotiate the keys, the device supports the Session
Description Protocol Security Descriptions (SDES) protocol (according to RFC 4568). The key
exchange is done by adding the 'a=crypto' attribute to the SDP. This attribute is used (by both
sides) to declare the various supported cipher suites and to attach the encryption key. If negotiation
of the encryption data is successful, the call is established.
SRTP supports the following cipher suites (all other suites are ignored):
■ AES_CM_128_HMAC_SHA1_32
■ AES_CM_128_HMAC_SHA1_80
■ AES_256_CM_HMAC_SHA1_32 (RFC 6188)
■ AES_256_CM_HMAC_SHA1_80 (RFC 6188)
When the device is the offering side (SDP offer), it can generate a Master Key Identifier (MKI). You
can configure the MKI size globally (using the SRTPTxPacketMKISize parameter) or per SIP entity
(using the IP Profile parameter, IpProfile_MKISize). The length of the MKI is limited to four bytes. If
the remote side sends a longer MKI, the key is ignored.
● Gateway application: The device only initiates the MKI size.
● SBC application: The device can forward MKI size transparently for SRTP-to-
SRTP media flows or override the MKI size during negotiation (inbound or outbound
leg).
The key lifetime field is not supported. However, if it is included in the key it is ignored and the call
does not fail. For SBC calls belonging to a specific SIP entity, you can configure the device to
remove the lifetime field in the 'a=crypto' attribute (using the IP Profile parameter, IpProfile_
SBCRemoveCryptoLifetimeInSDP).
For SDES, the keys are sent in the SDP body ('a=crypto') of the SIP message and are typically
secured using SIP over TLS (SIPS). The encryption of the keys is in plain text in the SDP. The
device supports the following session parameters:
■ UNENCRYPTED_SRTP
- 186 -
To Next Page
Loading...
Need help?
General
