Cisco 79XX Series Phones and TLS integration with kamailio

List overview All Threads
Download

newer

older

Possible Oversight, but CDRs are...

Internal server error

Jonathan Hunter

19 Jun 2014 19 Jun '14

8:50 a.m.

Hi All, As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G. They work well now with kamailio, using UDP or TCP as the transport protocol. I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices. I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS. I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this. Thanks Jon

Attachments:

attachment.html (text/html — 1.3 KB)

Show replies by date

Mark Boyce

19 Jun 19 Jun

9:37 a.m.

Hi Jon

It sounds like you’re a few steps in front of me. I’m just starting to try and get a working set of config files etc for provisioning to the phones. Which at the moment is going through the motions of registering but not actually sending anything.

Would you mind sharing your experiences so far?

Thanks

Mark

On 19 Jun 2014, at 09:50, Jonathan Hunter hunterj91@hotmail.com wrote:

...

Hi All,

As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G.

They work well now with kamailio, using UDP or TCP as the transport protocol.

I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices.

I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS.

I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this.

Thanks

Jon _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Jonathan Hunter

9:48 a.m.

New subject: Cisco 79XX Series Phones and TLS integration with kamailio

Hi Mark, Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour. What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge. Then I can give you some more details on at least them trying to register to kamailio. Thanks Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

On 19 Jun 2014, at 09:50, Jonathan Hunter hunterj91@hotmail.com wrote:Hi All, As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G. They work well now with kamailio, using UDP or TCP as the transport protocol. I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices. I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS. I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this. Thanks Jon_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

John Murray

9:58 a.m.

Jon hi,

Which software version/image do you find works best for this?

We found some later versions to have introduced more problems.

Regards

John

From: sr-users-bounces@lists.sip-router.org [mailto:sr-users-bounces@lists.sip-router.org] On Behalf Of Jonathan Hunter Sent: 19 June 2014 10:48 To: Kamailio (SER) - Users Mailing List Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Mark,

Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour.

What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge.

Then I can give you some more details on at least them trying to register to kamailio.

Thanks

Jon

_____

From: mark@darkorigins.com mailto:mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org mailto:sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon

It sounds like you're a few steps in front of me. I'm just starting to try and get a working set of config files etc for provisioning to the phones. Which at the moment is going through the motions of registering but not actually sending anything.

Would you mind sharing your experiences so far?

Thanks

Mark

On 19 Jun 2014, at 09:50, Jonathan Hunter <hunterj91@hotmail.com mailto:hunterj91@hotmail.com > wrote:

Hi All,

As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G.

They work well now with kamailio, using UDP or TCP as the transport protocol.

I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices.

I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS.

I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this.

Thanks

Jon

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org mailto:sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Jonathan Hunter

10:30 a.m.

New subject: Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon, In terms or software version for the Cisco, we use SIP45.9-3-1SR4-1S, this being for 7945,7965,7940,7941,7961. All seem to work ok with kamailio version 4.x

Jon

From: john.murray@skyracktelecom.com To: sr-users@lists.sip-router.org Date: Thu, 19 Jun 2014 10:58:10 +0100 Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Jon hi, Which software version/image do you find works best for this?We found some later versions to have introduced more problems. Regards John From: sr-users-bounces@lists.sip-router.org [mailto:sr-users-bounces@lists.sip-router.org] On Behalf Of Jonathan Hunter Sent: 19 June 2014 10:48 To: Kamailio (SER) - Users Mailing List Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio Hi Mark, Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour. What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge. Then I can give you some more details on at least them trying to register to kamailio. Thanks JonFrom: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon It sounds like you’re a few steps in front of me. I’m just starting to try and get a working set of config files etc for provisioning to the phones. Which at the moment is going through the motions of registering but not actually sending anything. Would you mind sharing your experiences so far? Thanks Mark On 19 Jun 2014, at 09:50, Jonathan Hunter hunterj91@hotmail.com wrote: Hi All, As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G. They work well now with kamailio, using UDP or TCP as the transport protocol. I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices. I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS. I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this. Thanks Jon_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Mark Boyce

10:03 a.m.

Hi Jon

I’m working with a variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks.

So far;

- Phone on test is a 7970

- Variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks. All configured to NAT, no firewall filtering

- SIP v9.3(1)SR4 firmware on the phone

- Provisioning side ‘appears’ to be working. In that it requests the files, says ‘registering’

- Doesn’t appear to generate any SIP traffic during registration (tcpdump on router/kamailio server)

Wondering if I’ve got something wrong in the .cnf xml …

Cheers

Mark

On 19 Jun 2014, at 10:48, Jonathan Hunter hunterj91@hotmail.com wrote:

...

Hi Mark,

Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour.

What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge.

Then I can give you some more details on at least them trying to register to kamailio.

Thanks

Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon

It sounds like you’re a few steps in front of me. I’m just starting to try and get a working set of config files etc for provisioning to the phones. Which at the moment is going through the motions of registering but not actually sending anything.

Would you mind sharing your experiences so far?

Thanks

Mark

On 19 Jun 2014, at 09:50, Jonathan Hunter hunterj91@hotmail.com wrote:

Hi All,

As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G.

They work well now with kamailio, using UDP or TCP as the transport protocol.

I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices.

I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS.

I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this.

Thanks

Jon _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Jonathan Hunter

10:51 a.m.

New subject: Cisco 79XX Series Phones and TLS integration with kamailio

Hi Mark, Yes we had exactly the same issue with a 7940. It is with the .cnf xml file. You need to make sure that the line name is populated; line1_name: "<<USERNAME>>"line1_authname: "<<USERNAME>>"line1_password: "supersecret" See an example file attached, hopefully will give you an idea. Thanks Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 11:03:25 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon I’m working with a variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks. So far; - Phone on test is a 7970 - Variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks. All configured to NAT, no firewall filtering - SIP v9.3(1)SR4 firmware on the phone - Provisioning side ‘appears’ to be working. In that it requests the files, says ‘registering’ - Doesn’t appear to generate any SIP traffic during registration (tcpdump on router/kamailio server)

Wondering if I’ve got something wrong in the .cnf xml … Cheers

Mark

On 19 Jun 2014, at 10:48, Jonathan Hunter hunterj91@hotmail.com wrote:Hi Mark, Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour. What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge. Then I can give you some more details on at least them trying to register to kamailio. Thanks Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users_______________... SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Mark Boyce

11:24 a.m.

Hi Jon

Thanks for that. Trying to translate between the txt version and the xml version, most of the settings seem to be about right.

I think the problem might be with the way we’re referring to the sip server in the xml. The previous advice I got was to do it using the call manager section;

and then later in the config

<sipLines> <line button="1"> <featureID>9</featureID> <featureLabel>SIPACCOUNT</featureLabel> <name>SIPACCOUNT</name> <displayName>SIPACCOUNT</displayName> <contact>SIPACCOUNT</contact> <proxy>USECALLMANAGER</proxy> <port>5060</port> <authName>SIPACCOUNT</authName> <authPassword>MYPASSWORD</authPassword> <sharedLine>false</sharedLine> </line> </sipLines>

It seems to be seeing the line name etc but never trying to contact the server.

Putting the SIP servers IP in the <proxy> field doesn’t seem to make any difference.

Cheers

Mark

On 19 Jun 2014, at 11:51, Jonathan Hunter hunterj91@hotmail.com wrote:

...

Hi Mark,

Yes we had exactly the same issue with a 7940.

It is with the .cnf xml file.

You need to make sure that the line name is populated;

line1_name: "<<USERNAME>>"

line1_authname: "<<USERNAME>>"

line1_password: "supersecret"

See an example file attached, hopefully will give you an idea.

Thanks

Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 11:03:25 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon

I’m working with a variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks.

So far;

Phone on test is a 7970

Variety of routers here at the moment (testing / lab environment :-) ranging from Mikrotik, Draytek to Firebricks. All configured to NAT, no firewall filtering

SIP v9.3(1)SR4 firmware on the phone

Provisioning side ‘appears’ to be working. In that it requests the files, says ‘registering’

Doesn’t appear to generate any SIP traffic during registration (tcpdump on router/kamailio server)

Wondering if I’ve got something wrong in the .cnf xml …

Cheers

Mark

On 19 Jun 2014, at 10:48, Jonathan Hunter hunterj91@hotmail.com wrote:

Hi Mark,

Sure of course, they are some what painful to get working due to their asymmetric NAT behaviour.

What handset models are you working with, and what firewall devices do you have on site, as I have them working with a Cisco ASA on the network edge.

Then I can give you some more details on at least them trying to register to kamailio.

Thanks

Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon

It sounds like you’re a few steps in front of me. I’m just starting to try and get a working set of config files etc for provisioning to the phones. Which at the moment is going through the motions of registering but not actually sending anything.

Would you mind sharing your experiences so far?

Thanks

Mark

On 19 Jun 2014, at 09:50, Jonathan Hunter hunterj91@hotmail.com wrote:

Hi All,

As you guys might remember I have been doing alot of work with these legacy handsets recently, in particular the Cisco IP phones 7945G and 7965G.

They work well now with kamailio, using UDP or TCP as the transport protocol.

I am now looking to implement SIP over TLS with them, and wondered if anyone had completed the same, as it appears they were designed very much to support SIP over TLS and SRTP but with Cisco call manager and not other SIP devices.

I am trying to understand if its possible to integrate with kamailio, as from Cisco documentation it appears a CTL file (client trust list) is required which seems to be generated by cisco software, and the handset needs it before it will try to initiate a SIP connection over TLS.

I have implemented TLS /SRTP with Cisco SPA's, Bria etc on kamailio fine, so its more a question around the handset and if anyone has achieved this.

Thanks

Jon _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users <7940examplefile.txt>_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Jonathan Hunter

11:51 a.m.

New subject: Cisco 79XX Series Phones and TLS integration with kamailio

Hi Mark, Yes you need to define the sip proxy as USECALLMANAGER instead of the IP itself. If you want to send me to xml file I can take a look, as I have configs for a few different phones. Thanks Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 12:24:04 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Hi Jon Thanks for that. Trying to translate between the txt version and the xml version, most of the settings seem to be about right. I think the problem might be with the way we’re referring to the sip server in the xml. The previous advice I got was to do it using the call manager section; <callManagerGroup> <members> <member priority="0"> <callManager> <ports> <ethernetPhonePort>2000</ethernetPhonePort> <sipPort>5060</sipPort> <securedSipPort>5061</securedSipPort> </ports> <processNodeName>1.2.3.4</processNodeName> </callManager> </member> </members></callManagerGroup> and then later in the config <sipLines> <line button="1"> <featureID>9</featureID> <featureLabel>SIPACCOUNT</featureLabel> <name>SIPACCOUNT</name> <displayName>SIPACCOUNT</displayName> <contact>SIPACCOUNT</contact> <proxy>USECALLMANAGER</proxy> <port>5060</port> <authName>SIPACCOUNT</authName> <authPassword>MYPASSWORD</authPassword> <sharedLine>false</sharedLine> </line></sipLines> It seems to be seeing the line name etc but never trying to contact the server.

Putting the SIP servers IP in the <proxy> field doesn’t seem to make any difference. Cheers Mark

On 19 Jun 2014, at 11:51, Jonathan Hunter hunterj91@hotmail.com wrote:Hi Mark, Yes we had exactly the same issue with a 7940. It is with the .cnf xml file. You need to make sure that the line name is populated; line1_name: "<<USERNAME>>"line1_authname: "<<USERNAME>>"line1_password: "supersecret" See an example file attached, hopefully will give you an idea. Thanks Jon

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 11:03:25 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

Wondering if I’ve got something wrong in the .cnf xml … Cheers

Mark

From: mark@darkorigins.com Date: Thu, 19 Jun 2014 10:37:42 +0100 To: sr-users@lists.sip-router.org Subject: Re: [SR-Users] Cisco 79XX Series Phones and TLS integration with kamailio

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<7940examplefile.txt>_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

3907

Age (days ago)

3907

Last active (days ago)

sr-users@lists.kamailio.org

8 comments

3 participants

tags (0)

participants (3)

John Murray
Jonathan Hunter
Mark Boyce