SDES Configuration

SDES configuration consists of the following steps.

  1. Create one or more SDES profiles which specify parameter values negotiated during the offer/answer exchange.
  2. Create one or more Media Security Policies that specify key exchange protocols and protocol-specific profiles.
  3. Assign a Media Security Policy to a realm.
  4. Create an interface-specific Security Policy.

SDES Profile Configuration

An SDES profile specifies the parameter values offered or accepted during SDES negotiation.

To configure SDES profile parameters:

  1. Access the sdes-profile configuration element. 
    ORACLE# configure terminal
ORACLE(configure)# security
ORACLE(security)# media-security
ORACLE(media-security)# sdes-profile
ORACLE(sdes-profile)#
  2. Use the required name parameter to provide a unique identifier for this sdes-profile instance.

    name enables the creation of multiple sdes-profile instances.

  3. Use the crypto-list parameter to select the encryption and authentication algorithms accepted or offered by this sdes-profile.

    The crypto-list attribute supports the following ciphers on the Acme Packet 6300, Acme Packet 6350, and Acme Packet 4600:

    • AES_CM_128_HMAC_SHA1_80
    • AES_CM_128_HMAC_SHA1_32 (not available if FIPS is enabled)
    • ARIA_CM_192_HMAC_SHA1_80 (not available if FIPS is enabled)
    • ARIA_CM_192_HMAC_SHA1_32 (not available if FIPS is enabled)

    The crypto-list attribute supports the following ciphers on the Acme Packet 6400, Acme Packet 4900, Acme Packet 3900, Acme Packet 1100, and virtual platforms:

    • AES_CM_128_HMAC_SHA1_80
    • AES_CM_128_HMAC_SHA1_32 (not available if FIPS is enabled)
    • AES_256_CM_HMAC_SHA1_80
    • AEAD_AES_256_GCM
  4. Use the srtp-auth parameter to enable or disable the authentication of SRTP packets.
  5. Use the srtp-encrypt parameter to enable or disable the encryption of RTP packets.

    With encryption enabled, the default condition, the Oracle Communications Session Border Controller offers RTP encryption, and rejects an answer that contains an UNENCRYPTED_SRTP session parameter in the crypto attribute.

    With encryption disabled, the Oracle Communications Session Border Controller does not offer RTP encryption and includes an UNENCRYPTED_SRTP session parameter in the SDP crypto attribute; it accepts an answer that contains an UNENCRYPTED_SRTP session parameter.

  6. Use the srtcp-encrypt parameter to enable or disable the encryption of RTCP packets.

    With encryption enabled, the default condition, the Oracle Communications Session Border Controller offers RTCP encryption, and rejects an answer that contains an UNENCRYPTED_SRTCP session parameter in the crypto attribute.

    With encryption disabled, the Oracle Communications Session Border Controller does not offer RTCP encryption and includes an UNENCRYPTED_SRTCP session parameter in the SDP crypto attribute; it accepts an answer that contains an UNENCRYPTED_SRTCP session parameter.

  7. Use the mki parameter to enable or disable the inclusion of the MKI:length field in the SDP crypto attribute.

    The master key identifier (MKI) is an optional field within the SDP crypto attribute that differentiates one key from another. MKI is expressed as a pair of decimal numbers in the form: |mki:mki_length| where mki is the MKI integer value and mki_length is the length of the MKI field in bytes. For hardware-based platforms, the length value can be up to 32 bytes. For software-based platforms, the length value is 4 bytes.

    The MKI field is necessary only in topologies that may offer multiple keys within the crypto attribute.

    Allowable values are enabled and disabled (the default).

    enabled – an MKI field is sent within the crypto attribute (16 bytes maximum)

    disabled – no MKI field is sent

  8. Use done, exit, and verify-config to complete configuration of this SDES profile instance.
  9. Repeat Steps 1 through 8 to configure additional SDES profiles.

Media Security Policy Configuration

Use the following procedure to create a Media Security Policy that specifies the role of the Oracle Communications Session Border Controller in the security negotiation. If the Oracle Communications Session Border Controller takes part in the negotiation, the policy specifies a key exchange protocol and SDES profile for both incoming and outgoing calls.

Note:

The media security policy configuration does not apply to hairpin calls.

To configure media-security-policy parameters:

  1. From superuser mode, use the following command sequence to access media-sec-policy configuration mode. 
    ORACLE# configure terminal
ORACLE(configure)# security
ORACLE(security)# media-security
ORACLE(media-security)# media-sec-policy
ORACLE(media-sec-policy)#
  2. Use the required name parameter to provide a unique identifier for this media-sec-policy instance.

    name enables the creation of multiple media-sec-policy instances.

  3. Use optional pass-thru parameter to enable or disable pass-thru mode.

    With pass-thru mode enabled, the User Agent (UA) endpoints negotiate security parameters between each other; consequently, the Oracle Communications Session Border Controller simply passes SRTP traffic between the two endpoints.

    With pass-thru mode disabled (the default state), the Oracle Communications Session Border Controller disallows end-to-end negotiation — rather the Oracle Communications Session Border Controller initiates and terminates SRTP tunnels with both endpoints.

  4. Use the outbound navigation command to move to media-sec-outbound configuration mode. While in this configuration mode you specify security parameters applied to the outbound call leg, that is calls sent by the Oracle Communications Session Border Controller.
  5. Use the protocol parameter to select the key exchange protocol.

    Select sdes for SDES key exchange.

  6. Use the profile parameter to specify the name of the SDES profile applied to calls sent by the Oracle Communications Session Border Controller.
  7. Use the mode parameter to select the real time transport protocol.

    Allowable values are rtp and srtp (the default).

    mode identifies the transport protocol (RTP or SRTP) included in an SDP offer when this media-security-policy is in effect.

  8. Use the done and exit parameters to return to media-sec-policy configuration mode.
  9. Use the inbound navigation command to move to media-sec-inbound configuration mode. While in this configuration mode you specify security parameters applied to the inbound call leg, that is calls received by the Oracle Communications Session Border Controller.
  10. Use the protocol parameter to select the key exchange protocol.

    Select sdes for SDES.

  11. Use the profile parameter to specify the name of the SDES profile applied to calls received by the Oracle Communications Session Border Controller.
  12. Use the mode parameter to select the real time transport protocol.

    Allowable values are rtp and srtp (the default).

    mode identifies the transport protocol (RTP or SRTP) accepted in an SDP offer when this media-security-policy is in effect.

  13. Use done, exit, and verify-config to complete configuration of this media security policy instance.
  14. Repeat Steps 1 through 13 to configure additional media-security policies.

Assign the Media Security Policy to a Realm

To assign a media-security-policy to a realm:

  1. From superuser mode, use the following command sequence to access realm-config configuration mode. While in this mode, you assign an existing media-security-policy to an existing realm. 
    ORACLE# configure terminal
ORACLE(configure)# media-manager
ORACLE(media-manager)# realm-config
ORACLE(realm-config)# select
identifier:
1. access-12
...
...
selection: 1
ORACLE(realm-config)#
  2. Use the media-sec-policy parameter to assign the policy to the target realm.
  3. Use done, exit, and verify-config to complete assignment of the media-security-policy to the realm.