Skip to content
VICICarrier Logo
SECURE INTERCONNECT

Three ways to connect. One price.

Public-internet SIP with TLS+SRTP, IPsec VPN to our SBCs, or private IP NNI at a carrier-neutral facility. Same per-minute rates. Same DID prices.

01 / ARCHITECTUREMETHODS

Technical Requirements

Choose the connection method that fits your compliance profile and engineering bandwidth.

01.01METHOD 01

TLS + SRTP over public internet

SIP signaling over TLS, media over SRTP. Your SBC or softswitch authenticates with a certificate, and every packet between you and us is encrypted. No tunnel, no dedicated circuit — it works from any location with decent internet. This is the right default for most customers who want encryption without re-architecting their network. Provisioning is same-day: you generate a CSR, we sign it (or you bring a public CA cert), and we whitelist your source IPs.

TECHNICAL SPEC
TLS 1.2+ on SIP/TLS port 5061 (TLS 1.3 preferred, both supported). Media encrypted with SRTP AES-128 and HMAC-SHA1 auth. Customer authenticates with an X.509 cert (public CA or we issue one). SRTP keys negotiated via SDES in SDP, or DTLS-SRTP on request. IP allowlist optional on top of cert auth.
01.02METHOD 02

IPsec VPN to our SBCs

A site-to-site tunnel from your edge device to our SBC cluster. Everything inside — SIP signaling, RTP media, registration traffic — travels inside the encrypted tunnel, so your internal systems don't need TLS or SRTP support. Useful when you want full-tunnel privacy but don't want to manage certificates at the SIP layer, or when your PBX has patchy TLS/SRTP support. Works well for organizations that already run IPsec site-to-site for other services and want SIP to sit inside the same encrypted fabric.

TECHNICAL SPEC
IKEv2 with pre-shared key or X.509 certificate auth. AES-256-GCM and SHA-256 by default; other ciphers negotiable. Active-active tunnels to our US East and US West SBCs for failover. SIP runs in the clear inside the tunnel, which keeps your PBX config simple.
01.03METHOD 03

Private IP NNI

A dedicated layer-2 or layer-3 interconnect — no public internet in the path at all. Common for banks, government contractors, and large enterprises with compliance requirements that rule out internet-based connections entirely. We peer with you at a carrier-neutral facility or over a private circuit you bring to us. Higher commercial minimum applies. Lead time is longer than the other methods because cross-connect provisioning depends on the facility.

TECHNICAL SPEC
BGP over a dedicated cross-connect at Equinix Ashburn (DC1–DC11), NY4/NY5, or LD6 — other facilities on request. /30 peering, typically a 1G or 10G port. MPLS L3VPN acceptable if you bring the service. Lead time 10–20 business days depending on facility; other methods provision within 24 hours.
ENGINEERING CONSULT

Not sure which method fits?

Send us your security requirements and we'll tell you what we'd pick — and what other customers at your scale chose.