Hi, when trying to use SRTP, I can see UDP traffic from phones to the asterisk server being dropped be the firewall on arbitrary ports. Where do I configure the SRTP port range (like the rtp port range)? Why aren't the clients talking to each other directly but apparenty try to send the SRTP traffic to the server? That the traffic is being blocked by the firewall is probably the reason why I have no audio when using SRTP ...
On Fri, Feb 22, 2019, at 2:48 PM, hw wrote:> > Hi, > > when trying to use SRTP, I can see UDP traffic from phones to the > asterisk server being dropped be the firewall on arbitrary ports.There is no separate port range used for SRTP, and Asterisk does not control the port that the phone uses for sending to Asterisk. That's up to the endpoint.> > Where do I configure the SRTP port range (like the rtp port range)? > > Why aren't the clients talking to each other directly but apparenty try > to send the SRTP traffic to the server?DIrect media with SRTP is not supported. All media when SRTP goes through Asterisk. -- Joshua C. Colp Digium - A Sangoma Company | Senior Software Developer 445 Jan Davis Drive NW - Huntsville, AL 35806 - US Check us out at: www.digium.com & www.asterisk.org
On 2/22/19 7:56 PM, Joshua C. Colp wrote:> On Fri, Feb 22, 2019, at 2:48 PM, hw wrote: >> >> Hi, >> >> when trying to use SRTP, I can see UDP traffic from phones to the >> asterisk server being dropped be the firewall on arbitrary ports. > > There is no separate port range used for SRTP, and Asterisk does not control the port that the phone uses for sending to Asterisk. That's up to the endpoint.Thanks! The phones do not have any settings with which I could limit the ports used for SRTP.>> Where do I configure the SRTP port range (like the rtp port range)? >> >> Why aren't the clients talking to each other directly but apparenty try >> to send the SRTP traffic to the server? > > DIrect media with SRTP is not supported. All media when SRTP goes through Asterisk.Well, how are we supposed to handle this in firewalls? I do not want to open all ports for UDP traffic directed to the server.