Управление zrtp

ZRTP ("Z" is a reference to its inventor, Zimmermann; "RTP" stands for Real-time Transport Protocol)[2] is described in the Internet Draft as a "key agreement protocol which performs Diffie–Hellman key exchange during call setup in-band in the Real-time Transport Protocol (RTP) media stream which has been established using some other signaling protocol such as Session Initiation Protocol (SIP). This generates a shared secret which is then used to generate keys and salt for a Secure RTP (SRTP) session." One of ZRTP's features is that it does not rely on SIP signaling for the key management, or on any servers at all. It supports opportunistic encryption by auto-sensing if the other VoIP client supports ZRTP.
http://en.wikipedia.org/wiki/ZRTP

ZRTP is SRTP based, but instead of using SIP to exchange keys, it exchanges keys within the media stream itself making it more secure. It does not require PKI.
https://wiki.freeswitch.org/wiki/ZRTP

Включение: в switch.conf:

<param name="rtp-enable-zrtp" value="true"/>

Есть 3 режима работы:

1. trusted MITM, когда устанавливается 2 сессии с сервером, с транскодингом, 
2. простой проброс rtp - media relay, и 
3. прямой (direct, peer-to-peer) режим, когда rtp через сервер вообще не ходит.

Про первый режим
The PBX can operate as a trusted man-in-the-middle, terminating the media streams for both parties at the PBX. This also terminates the ZRTP encryption for both parties at the PBX. This is mathematically equivalent to a classic man-in-the-middle attack, but it's not really an attack if the clients trust the PBX and consent to this. ZRTP has a mechanism to allow a client to recognize a trusted PBX to act as a "friendly" man-in-the-middle. This allows conference mixing, transcoding, and lawful interception of plaintext media, all within the confines of the trusted PBX.
http://zfoneproject.com/faq.html
ну и в целом дока интересная и полезная.

Включить первый режим:

<action application="set" data="zrtp_enrollment=true"/>

второй режим (проксирование):

<param name="inbound-zrtp-passthru" value="true"/>

плюс
https://wiki.freeswitch.org/wiki/Proxy_Media

И напоследок дока с картинками
http://zfone.com/docs/asterisk/man/html/u_guide.html