diff --git a/conf/vanilla/dialplan/default.xml b/conf/vanilla/dialplan/default.xml
index 4dc615157a..2abeb38e12 100644
--- a/conf/vanilla/dialplan/default.xml
+++ b/conf/vanilla/dialplan/default.xml
@@ -135,7 +135,7 @@
 	<anti-action application="start_dtmf"/>
       </condition>
       -->
-      <condition field="${rtp_has_crypto}" expression="^(AES_CM_128_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_80)$" break="never">
+      <condition field="${rtp_has_crypto}" expression="^($${rtp_sdes_suites})$" break="never">
 	<action application="set" data="rtp_secure_media=true"/>
 	<!-- Offer SRTP on outbound legs if we have it on inbound. -->
 	<!-- <action application="export" data="rtp_secure_media=true"/> -->
diff --git a/conf/vanilla/vars.xml b/conf/vanilla/vars.xml
index d55e126e3d..906110384c 100644
--- a/conf/vanilla/vars.xml
+++ b/conf/vanilla/vars.xml
@@ -50,7 +50,7 @@
   <X-PRE-PROCESS cmd="set" data="domain_name=$${domain}"/>
   <X-PRE-PROCESS cmd="set" data="hold_music=local_stream://moh"/>
   <X-PRE-PROCESS cmd="set" data="use_profile=internal"/>
-
+  <X-PRE-PROCESS cmd="set" data="rtp_sdes_suites=AEAD_AES_256_GCM_8|AEAD_AES_128_GCM_8|AES_CM_256_HMAC_SHA1_80|AES_CM_192_HMAC_SHA1_80|AES_CM_128_HMAC_SHA1_80|AES_CM_256_HMAC_SHA1_32|AES_CM_192_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_32|AES_CM_128_NULL_AUTH"/>
   <!--
       Enable ZRTP globally you can override this on a per channel basis