Oracle SBC Security Guide
The “mode” under the media-sec-policy should be set to ANY. Also, the profile should be configured
with the sdes/mikey-profile that would be used in case of SRTP and the protocol should be set to
SDES/MIKEY, depending on which protocol is required.
When inbound mode=any, the SBC will accept SDP with only RTP description, SDP with only SRTP
description and SDP with 2 m lines having both RTP and SRTP description.
When outbound mode=any, the SBC will insert an SDP with only RTP, only SRTP or with 2 m lines,
supporting both RTP and SRTP, this is controlled under the sdes/mikey-profile:
(sdes-profile)# egress-offer-format
<enumeration> format of offer SDP in 'any' mode
{same-as-ingress | simultaneous-best-effort}
Same-as-ingress: The SBC will use to build the egress SDP offer the mode received in the ingress
realm. So if the SBC received only RTP in the ingress realm, it will insert only RTP in the egress
SDP, and if it received only SRTP in the ingress SDP, it will set the egress SDP to only SRTP.
Simultaneous-best-effort: The SBC will insert additional SRTP description in the SDP if the
ingress SDP contained only RTP and vice-versa, so the resultant SDP should contain both RTP
and SRTP media profiles contained in 2 different media lines in the SDP.
# show running-config sdes-profile
sdes-profile
name sdes1
crypto-list AES_CM_128_HMAC_SHA1_80
AES_CM_128_HMAC_SHA1_32
srtp-auth enabled
srtp-encrypt enabled
srtcp-encrypt enabled
egress-offer-format same-as-ingress
use-ingress-session-params srtcp-encrypt
srtp-auth
srtp-encrypt
mki disabled
key
salt
(mikey-profile)# show
mikey-profile
name mikey1
key-exchange-method pre-shared
encr-algorithm AES-CM
auth-algorithm HMAC-SHA1-80 HMAC-SHA1-32
shared-secret
mki disabled
egress-offer-format same-as-ingress
use-ingress-session-params
(mikey-profile)#
(media-sec-policy)# show
media-sec-policy
Kommentare zu diesen Handbüchern