TPO

Configure secure connections usage on TPO is made through installer

FTPS

TPO Virtual Appliance lower than 2.5 doesn't allow to reference FTP servers using the FQDN (Full Qualified Domain Name). For now, there's no way to configure TPO Virtual appliance for using FTPS instead of FTP. That means TPO component upgrades and TSS URI retrieving cannot be done over secured connections.

TPO Virtual Appliance higher or equal to 2.5 as well as TPO Installer used on a standard server, allow to reference FTP servers using FQDN. In such context, all FTP access the TPO makes are attempted using FTPS.

HTTPS

As mentioned in Advanced configuration topic, enabling "Use HTTPS for communications" makes TPOs to access TSS though HTTPS instead of non secure HTTP.

TLS communication

This security feature allows TPO to establish SIP session on TLS.

Make sure to have configured TPO Cluster in DNS or in Session Persistency. If not refer to Configure DNS redundancy mode or Configure Session Persistency redundancy mode.

Install the required digital certificates in order to establish SIP session on TLS. Following topic explain how to properly install a TPO Certificate.

•Enable SIPS

application.protocol.sips.enable = true

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings
SIP	Enable TLS protocol truefalse Key: application.protocol.sips.enable Description: This parameter allows to enable TLS protocol in the SIP signalling (SIPS)

•Enable SRTP

application.protocol.srtp.enable = true

Location: TPO Shared Settings, TPO Boot Settings
Media	Enable SRTP protocol truefalse Key: application.protocol.srtp.enable Description: This parameter allows TPO to handle SRTP for voice stream and also in SIP SDP signalling. It is automatically enabled when Skype for Business compatibility is set. Constraint: true | false Related settings: SIP Compatibility mode (application.sip.non-standard.compatibility) Skype For Business (SfB) Enable (application.usesfbproxy.enable) Key generator compatibility (application.protocol.keygen.compatibility) Authorize RTP protocol even if SRTP protocol is enabled (application.protocol.srtp.rtp.authorized)

Additional configuration:

•TLS connection port

application.sip.tlsconnection.port=5061 

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings
SIP	SIP Local TLS Ports Key: application.sip.tlsconnection.port Description: Defines list of ports dedicated to SIP TLS connections Port are separated by commas: 5061,5062 Defining several ports allows system to register extensions using only one IP address but different ports. TLS is used for Skype for Business. Care should be taken on the TPO VM that "Yes" is not selected on the Network discovery popup as this will use port 5357 causing a potential clash. Constraint: Any valid port number Mind that except in CUCM mode on TPO, all ports defined in application.sip.connection.port can't be as well defined in application.sip.tls connection.port. During a CUCM Devices Fetch, both keys application.sip.connection.port and application.sip.tls connection.port are automatically filled for the TPO. The TPO will use right ports depending of the secure/non secure configuration. The ports defined in this setting cannot be used by another application running on the same host. Related settings: SIP Local IP Ports (application.sip.connection.port) WebSocket Local Listening Ports (application.sip.websocket.listening.port) WebSocket Secure Local Listening Ports (application.sip.websocketsecure.listening.port)

•Block SIP port

If it is requried to block port 5060 on standard server then run the following commands to add additional firewall rules :

•netsh advfirewall firewall add rule name=DisableSIPoverTCP dir=in action=block protocol=tcp localport=5060

•netsh advfirewall firewall add rule name=DisableSIPoverUDP dir=in action=block protocol=tcp localport=5060

•Change Ciphers

application.sip.change.tls.ctx=true

application.sip.tls.cipher.list=<list of ciphers>