Secure Calling (TLS)

Solution Integration > PBXs > BT Call Server > Example Configurations

This guide provides step-by-step instructions for configuring secure calling on BT Call Server (Asterisk PBX) using TLS encryption.

BT Call Server Configuration

Transport Configuration

In addition to the default TCP and UDP transports under "Web UI > Configuration > Transport", you must add an additional transport configured for secure (TLS) calling.

In this example, an additional transport [transport-tls] is configured to use the TLS (v1.2) protocol on port 5061, with the appropriate certificate and key files defined for secure communication.

[transport-tcp]

type=transport ; Must be of type 'transport'.

protocol=tcp ; Protocol to use for SIP traffic

bind=0.0.0.0:5060 ; IP and port to bind to for this transport

;tos=cs3 ; Sets TOS for SIP Signalling

;cos=3 ; Sets COS for SIP Signalling

[transport-udp]

type=transport ; Must be of type 'transport'.

protocol=udp ; Protocol to use for SIP traffic

bind=0.0.0.0:5060 ; IP and port to bind to for this transport

;tos=cs3 ; Sets TOS for SIP Signalling

;cos=3 ; Sets COS for SIP Signalling

[transport-tls]

type=transport ; Must be of type 'transport'.

protocol=tls ; Protocol to use for SIP traffic

bind=0.0.0.0:5061 ; IP and port to bind to for this transport

method=tlsv1_2 ; Specifies the TLS protocol version to use.

ca_list_file=/opt/bt/tls/active/ca.crt ; Path to the CA certificate

cert_file=/opt/bt/tls/active/server.crt ; Path to the server's TLS certificate.

priv_key_file=/opt/bt/tls/active/private.key ; Path to the server's private key that matches the certificate above.

ImportantNote_Icon

The default [transport-tls] example includes valid certificate paths but remains commented out.

The certificates will not exist in those paths until the server has been secured through the TLS Setup process.

Enable this section only after completing TLS setup for the server’s Web UI.

Extension Configuration

To enable extensions to use the new [transport-tls] (definded above), define an additional default template that references the TLS transport.

Place this new template immediately below the existing [extension-defaults](!) section in "Web UI > Configuration > Extensions".

[extension-defaults-tls](!)

type = wizard

accepts_auth = yes

accepts_registrations = yes

transport = transport-tls

endpoint/allow = !all,alaw,ulaw

endpoint/context = outbound

endpoint/dtmf_mode = auto

endpoint/direct_media = yes

endpoint/media_encryption = sdes

;endpoint/tos_audio = ef

;endpoint/cos_audio = 5

aor/qualify_frequency = 30

aor/max_contacts = 1

aor/remove_existing = yes

ImportantNote_Icon

When TLS and SRTP are enabled for secure calling, Asterisk does not support direct media between endpoints.

The direct media setting has no effect.

All encrypted media streams (SRTP) are intentionally routed through the Asterisk PBX to maintain full encryption and call control.

It should be noted that this design provides strong security but results in additional processing overhead,

especially on larger systems with higher concurrent call counts.

In the example above, we defined the configuration used by the template [extension-defaults-tls](!).

As shown, this template makes use of the TLS transport we created earlier using "transport = transport-tls".

You can now define your TLS-enabled extensions using this template.

Example TLS extension configuration:

[1500](extension-defaults-tls)

inbound_auth/username = 1500

inbound_auth/password = 123456

endpoint/callerid = Asterisk_TLS <1500>

endpoint/rewrite_contact = yes

In this example, we’re defining an extension 1500 that inherits from the [extension-defaults-tls] template, allowing it to use the secure TLS transport for encrypted signaling and media.

TSS Configuration

ImportantNote_Icon

This guide outlines the key configuration steps on the TSS for enabling secure calling (TLS) on the BT Call Server.

It focuses on the basic setup required for secure communication.

Zone

Turret Boot Settings:

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings

SIP

SIP Local TLS Ports
Key: application.sip.tlsconnection.port Description: Defines list of ports dedicated to SIP TLS connections Port are separated by commas: 5061,5062 Defining several ports allows system to register extensions using only one IP address but different ports. TLS is used for Skype for Business. Care should be taken on the TPO VM that "Yes" is not selected on the Network discovery popup as this will use port 5357 causing a potential clash. Constraint: Any valid port number Mind that except in CUCM mode on TPO, all ports defined in application.sip.connection.port can't be as well defined in application.sip.tls connection.port. During a CUCM Devices Fetch, both keys application.sip.connection.port and application.sip.tls connection.port are automatically filled for the TPO. The TPO will use right ports depending of the secure/non secure configuration. The ports defined in this setting cannot be used by another application running on the same host. Related settings: SIP Local IP Ports (application.sip.connection.port) WebSocket Local Listening Ports (application.sip.websocket.listening.port) WebSocket Secure Local Listening Ports (application.sip.websocketsecure.listening.port)

Location: Terminal Boot Settings, Terminal Profile Settings, boot

RTP

Enable SRTP protocol	truefalse
Key: profile.setting.protocol.srtp.enable Description: This parameter allows the turret to handle SRTP for voice stream and also in SIP SDP signalling. It is automatically enabled when Skype for Business compatibility is set.

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings

SIP

Enable TLS protocol	truefalse
Key: application.protocol.sips.enable Description: This parameter allows to enable TLS protocol in the SIP signalling (SIPS)

Location: Terminal Boot Settings

SIP

CuCM Secure mode - Enable	truefalse
Key: application.tr.ccmsecuremode.enable Description: Allow to support SIPS and SRTP when using Cisco CuCM

TPO Cluster:

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings

SIP

Enable TLS protocol	truefalse
Key: application.protocol.sips.enable Description: This parameter allows to enable TLS protocol in the SIP signalling (SIPS)

Location: TPO Shared Settings, TPO Boot Settings

Media

Enable SRTP protocol	truefalse
Key: application.protocol.srtp.enable Description: This parameter allows TPO to handle SRTP for voice stream and also in SIP SDP signalling. It is automatically enabled when Skype for Business compatibility is set. Constraint: true \| false Related settings: SIP Compatibility mode (application.sip.non-standard.compatibility) Skype For Business (SfB) Enable (application.usesfbproxy.enable) Key generator compatibility (application.protocol.keygen.compatibility) Authorize RTP protocol even if SRTP protocol is enabled (application.protocol.srtp.rtp.authorized)

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings

SIP

SIP Local TLS Ports
Key: application.sip.tlsconnection.port Description: Defines list of ports dedicated to SIP TLS connections Port are separated by commas: 5061,5062 Defining several ports allows system to register extensions using only one IP address but different ports. TLS is used for Skype for Business. Care should be taken on the TPO VM that "Yes" is not selected on the Network discovery popup as this will use port 5357 causing a potential clash. Constraint: Any valid port number Mind that except in CUCM mode on TPO, all ports defined in application.sip.connection.port can't be as well defined in application.sip.tls connection.port. During a CUCM Devices Fetch, both keys application.sip.connection.port and application.sip.tls connection.port are automatically filled for the TPO. The TPO will use right ports depending of the secure/non secure configuration. The ports defined in this setting cannot be used by another application running on the same host. Related settings: SIP Local IP Ports (application.sip.connection.port) WebSocket Local Listening Ports (application.sip.websocket.listening.port) WebSocket Secure Local Listening Ports (application.sip.websocketsecure.listening.port)

TPO Certificates:

Secure the TPO with the appropriate certificates so that turrets can register and communicate over TLS.

Refer to TPO Server Certificate for details.

User Profile:

Location: Terminal Profile Settings

SIP

Authorize SIPS	truefalse
Key: profile.setting.authorizesips Description: Defines if the user is allowed to use SIPS (Session Initiation Protocol transported over TCP/TLS) when making calls. Notes: - If user configuration leads him to use SIPS in anyway and this setting isn't "true", system avoids user to authenticates. - force SIP setting here attached can be used for SfB users in DDI Only that wouldn't need to uses SIPS between turret and TPOs Constraint: true\|false Related settings: Force sip session on DDI lines between Turret and TPO (profile.setting.ddi.force.sip)

PBX Cluster:

Add the PBX cluster nodes, and ensure that TLS is enabled for each node by selecting the TLS option. This allows the cluster to communicate using the TLS protocol.

Secure-Calling_01