Transport Protocol Selection

The Peeredge Orchestrator supports UDP, TCP, and TLS v1.2 as transport protocols for SIP signaling. The Peeredge Orchestrator supports RTP and SRTP protocols for media sessions. Both RTP and SRTP use UDP as the transport protocol.

 Transport protocols provide essential services to voice applications, including: 

• Multiplexing  Assign port numbers to each application, which enables the IP network to carry thousands of application messages between hosts simultaneously.

• Reliable message delivery  The receiver verifies the transmission of each packet using a checksum to ensure contents are not corrupted. The receiver acknowledges the verified packet or requests retransmission of the corrupted packet. If the transmitter doesn’t receive an acknowledgment, it assumes the packet is lost and retransmits it. The transport layer also ensures packets arrive in sequence by inserting a sequence number.

• Flow control  The receiver uses a transmission window value to provide feedback to the sender about buffer space to avoid buffer overruns and underruns.

• Congestion management  When multiple losses occur, the transport layer implements a back-off algorithm that allows congestion to clear before resuming transmission. 

Recommendations

If any portion of the end-to-end network transport is considered unsecure (i.e. direct Internet), then 46 Labs recommends using TLS.

If the end-to-end network transport is already secure (i.e. SD-WAN, MPLS, IPsec tunnels), then 46 Labs recommends using UDP. If any customer networking devices in the SIP signaling path between the customer SBCs/PBXs and the Peeredge SBC do not properly handle UDP message fragmentation and assembly, then 46 Labs recommends TCP.

The Peeredge Orchestrator supports the following cipher suites, signature hashing algorithms and crypto media suites.

TLS supported cipher suites

Signature Hashing Algorithms supported 

Crypto Media Suites Supported

Note: The selection of cipher suites and signature hashing algorithms is limited by the what cryptographic algorithm RSA (Rivest-Shamir-Adleman) or ECDSA (Elliptic Curve Digital Signature Algorithm) was used to sign the TLS certificate.  For example, an RSA signed certificate would not support the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite.