# SIP Interface This document provides an overview of Sinch SIP calling service. ## Overview When using Sinch for voice calling, the Sinch platform can be seen as a big telephony switch. It receives incoming phone calls (also known as *incoming call “legs”*), sets up outgoing phone calls (also known as *outgoing call “legs”*), and bridges the two. In Sinch SIP calling service the *incoming call legs* and *outgoing call legs* is to your own SIP infrastructure such as a SIP IP-PBX, SBC or similar equipment. Using SIP calling together with our [Voice API v2.0](/docs/voice-2.0/api-reference/voice) you can combine all different types of *incoming calls* and *outgoing calls* the Sinch platform supports, including for example Call recording and conference rooms. ![spider](/assets/spider_v2.c130f8f8eea4dbf48deed8ef647d4125b234bb1411e88f91c4cf5dff19ff7a10.c43d86dc.png) ## Use cases SIP legs are handled via [WebHooks](/docs/voice-2.0/api-reference/voice/webhooks) or via a [Service Call Behaviors](/docs/voice-2.0/api-reference/voice/services/updateservice#services/updateservice/t=request&path=callbehavior). ### Static SIP trunk A Static SIP trunk consists of SIP Inbound, SIP Outbound or both flows combined. The most common use case is to configure a SIP trunk to handle below flows: * SIP Inbound to PHONE Outbound. * PHONE Inbound to SIP Outbound. Each flow needs its own app configuration in the Sinch Build Portal. How this is configured is described under SIP Inbound, SIP Outbound and service config sections below. ### SIP trunk with API Callback If you need more control or advanced calls flow, you can instruct a call to be connected to your SIP server by responding to the Incoming Call Event callback with the [ConnectSIP](/docs/voice/api-reference/svaml/actions#connectsip) action. The Callback could handle both SIP Inbound and SIP Outbound. ## Service configuration ### Static SIP trunk Add one service for SIP INBOUND. This service's key and secret is used for SIP authentication. Add one service for SIP OUTBOUND. On this service SIP forwarding should be configured and number(s) be assigned. ### SIP trunk with Callback Configure one service with a Callback URL set. This service could handle both SIP Inbound and SIP Outbound call flows. ## IP allowlisting You must allowlist *ALL* of Sinch's IPs, subnets and ports on your firewall for SIP signalling and RTP media traffic. ### SIP You need to allow your SIP server to receive traffic from those IPs and subnets (CIDRs). Sinch strongly recommends that you allowlist all of its IP addresses and subnets. #### Ports > 5060 (UDP/TCP) 5061 (TCP/SIP over TLS) div div table thead tr th Geographical location th IP address tbody tr td Europe td 206.146.136.0/28 tr td North America td 206.146.133.0/28 tr td South America td 206.146.138.0/28 tr td Southeast Asia td 206.146.139.0/28 tr td Australia td 206.146.141.0/28 ### RTP Static IPs for media resources. > RTP ports: 10000–60000 (UDP) div div table thead tr th Geographical location th RTP IP address tbody tr td Europe td 206.146.136.128/26 tr td North America td 206.146.133.128/26 tr td South America td 206.146.138.128/26 tr td Southeast Asia td 206.146.139.128/26 tr td Australia td 206.146.141.128/26 ### Codecs Sinch currently supports the following codecs: > * G.711u * G.711a * Opus * G.729 ## Secure SIP trunk Sinch offers support for encryption to ensure that the call media and associated signaling remains private during transmission. ### SIP Signaling Encryption (TLS) Sinch supports TLS (Transport Layer Security) to encrypt SIP signaling between your SIP infrastructure and Sinch. > Sinch recommends using TLSv1.2 #### Supported TLS Cipher Suites Secure calling supports TLSv1.2 with these cipher suites: div div table thead tr th Cipher suites Supported tbody tr td i TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 br TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 br TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 br TLS_ECDHE_ECDSA_WITH_AES_256_CCM br TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 br TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA br TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 br TLS_ECDHE_ECDSA_WITH_AES_128_CCM br TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 br TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA br > **Note:** If your equipment does not support these cipher suites, contact Sinch support. ### Media Encryption (SRTP) SRTP provides a framework for encryption of RTP & RTCP. SRTP is offered and accepted when TLS is used as transport for your signaling. #### Supported SRTP Cipher Suites div div table thead tr th Cipher suites Supported tbody tr td i AEAD_AES_256_GCM br AEAD_AES_128_GCM br AES_256_CM_HMAC_SHA1_80 br AES_256_CM_HMAC_SHA1_32 br AES_192_CM_HMAC_SHA1_80 br AES_192_CM_HMAC_SHA1_32 br AES_CM_128_HMAC_SHA1_80 br AES_CM_128_HMAC_SHA1_32 br F8_128_HMAC_SHA1_80 br F8_128_HMAC_SHA1_32 br ### Certificate Requirements Sinch uses certificates issued by [Let's Encrypt](https://letsencrypt.org/certificates/). To ensure successful TLS connections, install the Let's Encrypt root and intermediate certificates on your SIP devices. **How to install:** 1. Download the root and intermediate certificates from [Let's Encrypt Certificates](https://letsencrypt.org/certificates/). 2. Follow your device vendor's instructions to import these certificates. > **Tip:** If you experience certificate errors, verify that your device's trust store is up to date. ## Troubleshooting * **No SIP response:** Check that Inbound SIP URI host is the FQDNs and not the SIP proxy IPs. * **403 Forbidden:** Check your SIP credentials and authentication realm. * **TLS handshake failures:** Verify your device trusts Let's Encrypt root certificates. * **One-way audio:** Ensure RTP ports (10000–60000 UDP) from any IP are open on your firewall.