A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / Hardening a SIP edge

Hardening a SIP edge

A defensive edge limits peers, requires digest and TLS, strips PAI, and does not share SRTP keying across legs.

Learn in 5 minutes

  1. Write an allow list of signaling peers
  2. Require digest on REGISTER and a domain certificate on TLS
  3. Keep identity and media keying rules explicit

Visual

Policy on one INVITE · study drawing · cyphermonkeylabs.com AliceSBCCarrier INVITE 407 INVITE INVITE

SVG HTML PNG

Each control answers a different failure. Removing one does not make the others optional.

Worked example

Checklist, not a device stanza Read the teaching checklist. It is not a vendor configuration and it is not a router QoS policy.

  1. Read each numbered line.
  2. Name the RFC for the certificate line.
  3. Name the header that answers a 407.

Fault

Operators cleared a scanning alarm by accepting every REGISTER. A new Contact appears for alice@example.com.

REGISTER without a challenge is how an unexpected Contact gets stored. That is the hijack class.

Quiz

An edge allow list should


REGISTER authentication uses


A TLS trunk certificate is checked against


PAI at the trust boundary is


SRTP keying on an SBC


Call authentication on the FCC page


Ecosystem

Glossary, sister systems, and the integration seam for this room.

Workforce management WFM forecasts volume and builds schedules. It consumes contact-center events. It does not parse Via headers. When a forecast is wrong, the SIP symptom is usually queue delay and 480 or carrier congestion, not a broken dialog ID.

Programmable communications APIs Twilio’s docs home is API reference, tutorials, and integration for Twilio products. Elastic SIP Trunking is the SIP-shaped product already cited in this lab. This page does not define the word CPaaS from an RFC. Read the vendor page before you copy a diagram that uses that word.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper