# Enable Encryption Tunnel for Mobile App Calls

Cloud Voice can wrap mobile app traffic in a dedicated encrypted tunnel. Once you turn this on, the SIP (Session Initiation Protocol, the messaging that sets up and controls calls) signaling and RTP (Real-time Transport Protocol, the stream that carries the call audio) media exchanged by the Cloud Voice App on phones and tablets travel to the PBX (Private Branch Exchange, your phone system) through that tunnel instead of over the open network. The result is tighter call security and better resilience against carrier-level SIP blocking, so extensions stay registered and calls hold up even on restrictive mobile networks.

## Before you begin

Confirm the following are in place:

- **Software versions.** Your PBX server must be running version **84.21.0.117** or later. On the mobile side, the Cloud Voice App must be version **5.22.19** or later on iOS, or **5.22.12** or later on Android.
- **Provider-side setup.** Your service provider must have prepared the tunnel on the management platform by opening the required tunnel port and enabling the **Call Encryption Tunnel** feature.

:::note
If the provider-side steps have not been completed, enabling the option in your portal will not establish a working tunnel. Check with your service provider if you are unsure.
:::

## Turn on the encryption tunnel

1. Sign in to the PBX web portal and go to **Security > Security Settings > Security Options**.
2. Scroll to the **Call Encryption Tunnel** section and select **Enable Call Encryption Tunnel**.

   ![Security Options page with the Call Encryption Tunnel checkbox selected](/images/pbx/enable-tunnel.png)
3. Click **Save**.

   :::caution
   Saving applies the tunnel to every Cloud Voice App mobile client registered to this PBX, not just your own device. Make sure your mobile users are running at least the app versions listed above before you save, since clients below those versions may not connect through the tunnel.
   :::

## Result

The encrypted tunnel is now active on the PBX. From this point on, all call signaling and media for Cloud Voice App mobile clients connected to this PBX are carried through the encrypted tunnel.