SIP Authentication

TPO Configuration

To improve the security of the system we can enable authentication of the SIP communication. The following can have authentication:

 - DDI registration - Where TPO sends a SIP register for its configured DDIs

 - Turret to TPO session - For internal messaging 

 - Non registered invites such as private wires. - For SIP PWs which do not follow the registration process that DDIs use.

DDI Registration

Assume the SBC is setup as per AudioCodes as a PBX

For DDI line configuration including digest username/password follow PBX Line configuration

•enable user section on SBC. The SBC must have Far End User license and you must enable 'User-Information Usage on Setup menu > Signaling & Media tab > SIP Definitions folder > Proxy & Registration. Then configure the User table

•On the DDI SIP Profile set "User Security Mode" to "Accept Registered Users from Same Source". 

Turret to TPO session

Turret :

•"Enable SIP authentication" is set to "true"

Location: Terminal Boot Settings, TPO Boot Settings
SIP	Enable SIP authentication truefalse Key: application.sip.auth.enable Description: Uses credentials stored in Credential Manager See: Solution Documentation > IT & Operations > Security > SIP Authentication Related settings: SIP nonce validity (application.sip.auth.request.delay.validity) SIP authentication realm (application.sip.auth.realm)

•Add generic credential using "BTTRADE_TSS_BOOT_CREDENTIALS". This is the same credential required for Securing Device Session > Turret

TPO : 

•"Enable SIP authentication" is set to "true"

Location: Terminal Boot Settings, TPO Boot Settings
SIP	Enable SIP authentication truefalse Key: application.sip.auth.enable Description: Uses credentials stored in Credential Manager See: Solution Documentation > IT & Operations > Security > SIP Authentication Related settings: SIP nonce validity (application.sip.auth.request.delay.validity) SIP authentication realm (application.sip.auth.realm)

•Add generic credential using "BTTRADE_TSS_BOOT_CREDENTIALS" via "C:\Users\Public\sc.bat". This is the same credential required for Securing Device Session > TPO

Non-registered invites

TPO

•"Enable SIP authentication" is set to "true"

Location: Terminal Boot Settings, TPO Boot Settings
SIP	Enable SIP authentication truefalse Key: application.sip.auth.enable Description: Uses credentials stored in Credential Manager See: Solution Documentation > IT & Operations > Security > SIP Authentication Related settings: SIP nonce validity (application.sip.auth.request.delay.validity) SIP authentication realm (application.sip.auth.realm)

•Add an additional generic credential using "BTTRADE_TPO_SBC_KEY1_CREDENTIALS" in the same "C:\Users\Public\sc.bat" file mentioned in Securing Device Session > TPO

Example of what the file should look like:

SBC

•For invites from SBC towards the TPO add account. Ensure you add this for each IP group that can send invites towards the TPO including one TPO DDI calling another. The served IP group is where the call originates from and the serving IP group should be the TPO. The username is arbitary but the password must match "BTTRADE_TPO_SBC_KEY1_CREDENTIALS". The SBC will then insert this authentication when contacting the TPO

•For invites towards the SBC from the TPO have an account as per above where the serving and served IP groups are swapped. Then set the authentication mode within the TPO ip group to "SBC as Client"

•You can also use these accounts to have the authenticate towards other trunks though this is out of scope for this documentation

Troubleshooting

•If SIP communication is not authenticated by a digest, check if  application.sip.auth.enable is set correctly in the TPO debug info

•If turret cannot contact the TPO : 

ocheck if application.sip.auth.enable is set correctly in the turret debug info

oIf turret or TPO cannot find the credentials, they will send a CCL!E5008 error, meaning they could not retrieve the credentials, in that case : 

▪Check if credentials are present

▪Check if user can access the credentials

▪Check if there is an additional error code

•If you're using TPO to TPO authentication, ensure that both credentials are present and that TPO client "BTTRADE_TPO_SBC_KEY1_CREDENTIALS" credentials are the same as TPO server "BTTRADE_TSS_BOOT_CREDENTIALS" credentials. 

•If TPO client must also communicate with SBC, ensure that credentials are coherent everywhere as TPO client will use the same "BTTRADE_TPO_SBC_KEY1_CREDENTIALS" for both TPO server and SBC.