Asterisk with Twilio Elastic SIP Trunking Interconnection Guide using Secure Trunking (SRTP/TLS)

Transcription

1 Asterisk with Twilio Elastic SIP Trunking Interconnection Guide using Secure Trunking (SRTP/TLS) With the Introduction of Twilio Elastic SIP trunking this guide provides the configuration steps required to implement Asterisk PBX using a Twilio Elastic SIP trunk using SIP TLS and SRTP. Please look at the references below to get more detail information for each component. SIP TLS greatly enhances the SIP portion of your customer communications. Using certificates signed by a Public CA (as opposed to selfsigned certs) you can prevent MITM (man in the middle) compromises. However, TLS by itself does not protect voice rtp traffic. Voice RTP traffic is protected by using SRTP. This tutorial will help you to implement outgoing voice calls from your IP PBX to the PSTN using Twilio SIP Trunk. Requirements Asterisk 1.8+ Twilio Elastic SIP Trunk Secure Trunking Installation instructions Creating Self-signed certificates. This step is optional and is recommended if you want to use openssl to create your self-signed certificates. Other customers may opt for creating certificates using their own CA or via external CA Authority. Follow these steps to use default Asterisk script that creates self-signed certificates including keys, ca and certificates. mkdir /etc/asterisk/keys Next, use the "ast_tls_cert" script in the "contrib/scripts" Asterisk source directory to make a self- signed certificate authority and an Asterisk certificate../ast_tls_cert -C pbx.twilio.com -O "Twilio" -d /etc/asterisk/keys The "- C" option is used to define our host - DNS name or our IP address. The "- O" option defines our organizational name. The "- d" option is the output directory of the keys. 1

2 1. You'll be asked to enter a pass phrase for /etc/asterisk/keys/ca.key, put in something that you'll remember for later. 2. This will create the /etc/asterisk/keys/ca.crt file. 3. You'll be asked to enter the pass phrase again, and then the /etc/asterisk/keys/asterisk.key file will be created. 4. The /etc/asterisk/keys/asterisk.crt file will be automatically generated. 5. You'll be asked to enter the passphrase a third time, and the /etc/asterisk/keys/asterisk.pem will be created, a combination of the asterisk.key and asterisk.crt files. Next, we generate a client certificate for our SIP device../ast_tls_cert - m client - c /etc/asterisk/keys/ca.crt - k /etc/asterisk/keys/ca.key - C phone1.twilio.com - O "Twilio" Enable secure SIP Trunking 2

3 Asterisk configuration sip.conf [general] useragent=asterisk IP PBX registertimeout=20 context=internal allowoverlap=no tcpenable=no tcpbindaddr= udpbindaddr= :5060 transport=udp tlsenable=yes tlsbindaddr= tlscertfile=/etc/asterisk/keys/asterisk.pem tlscafile=/etc/asterisk/keys/ca.crt tlscapath=/etc/asterisk/keys/ tlsdontverifyserver=yes 3

4 tlscipher=all tlsclientmethod=tlsv1 rtptimeout=30 sipdebug=yes externaddr=***<asterisk_external_address> media_address=***<asterisk_media_address> icesupport=yes sdpsession=domain=***<asterisk_domain_address> fromdomain=***<asterisk_domain_address> srvlookup=no subscribecontext=from-sip disallow=all allow=ulaw allow=alaw [TwilioProvider] type=peer secret=***<twilio_password>;(your Twilio IP Credentials password) username=***<twilio_username>;(your Twilio IP Credentials username) host=***<twilio_pstn_uri>;(your Twilio SIP URI business.pstn.twilio.com) dtmfmode=rfc2833 canreinvite=no disallow=all allow=ulaw insecure=port,invite fromuser=***<twilio_phonenumber> ;(your Twilio Phone Number associated with this Trunk) fromdomain=***<twilio_pstn_uri>;(your Twilio SIP URI business.pstn.twilio.com) context=incoming transport=tls encryption=yes media_encryption=sdes extensions.conf [pstn] ;Call PSTN numbers through Twilio (any number longer than 5 digits starting with 9) exten => _9XXXX.,1,Log(NOTICE, Dialing out from ${CALLERID(all)} to ${EXTEN:1} through Twilio Provider) exten => _9XXXX.,n,Dial(SIP/TwilioProvider/+${EXTEN:1},60) exten => _9XXXX.,n,Playtones(congestion) exten => _9XXXX.,n,Hangup() [internal] include => pstn exten => 1000,1,Playback(demo-echotest) ; Let them know what's going on exten => 1000,n,Echo ; Do the echo test exten => 1000,n,Playback(demo-echodone) ; Let them know it's over exten => 1000,n,hangup Troubleshooting 4

5 Asterisk logs asterisk -r >sip set debug on SIP Debugging re-enabled Example: This is the outgoing SIP Invite to Twilio network INVITE SIP/2.0 Via: SIP/2.0/TLS :5061;branch=z9hG4bK c Max-Forwards: 70 From: "John Doe" To: Contact: Call-ID: CSeq: 103 INVITE User-Agent: Twilio Media Proxy-Authorization: Digest username="jdoe", realm="sip.twilio.com", algorithm=md5, nonce="a21ba28ef1bbd37ac9005b4380fd2ac0", response="5ce1443e dff40c c", opaque="67537e02fbbd5b18120b5926ba36dab5", qop=auth, cnonce="0a7dc914", nc= Date: Wed, 12 Aug :29:16 GMT Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE Supported: replaces, timer Content-Type: application/sdp Content-Length: 746 v=0 o=root IN IP s=c=in IP t=0 0 m=audio RTP/SAVP a=rtpmap:0 PCMU/8000 a=rtpmap:101 telephone-event/8000 a=fmtp: a=ptime:20 a=maxptime:150 a=ice-ufrag:185439ab204da3f775b0ad0b583b3517 a=ice-pwd: b0f54b14cf3c0881d780a53 a=candidate:hac1f UDP typ host a=candidate:s36d UDP typ srflx raddr rport

6 a=candidate:hac1f UDP typ host a=candidate:s36d UDP typ srflx raddr rport a=sendrecv a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:jcqoxqvlzjgf95xdd8d6zrerl0q8yba4vwx7nnss In line above you can see Asterisk adding to SDP crypto capabilities. Packet capture tcpdump -i eth0 -s 0 not port ssh -v tcpdump -i eth0 -s 0 not port ssh -w sips.pcap Twilio platform trunking/log/calls References Original guide for connecting Asterisk and Twilio can be found here: Asterisk documentation for TLS Engineering Reference Author: Gonzalo Gasca Meza 6