diff --git a/src/switch_core_media.c b/src/switch_core_media.c
index 50763bc1ea..9251f88748 100644
--- a/src/switch_core_media.c
+++ b/src/switch_core_media.c
@@ -6127,10 +6127,7 @@ static void generate_m(switch_core_session_t *session, char *buf, size_t buflen,
 	//port, secure ? "S" : "", switch_channel_test_flag(session->channel, CF_AVPF) ? "F" : "");
 
 	switch_snprintf(buf + strlen(buf), buflen - strlen(buf), "m=audio %d %s", port, 
-					get_media_profile_name(session, 
-										   (secure && switch_channel_direction(session->channel) == SWITCH_CALL_DIRECTION_OUTBOUND) || 
-										   a_engine->crypto_type != CRYPTO_INVALID));
-	
+					get_media_profile_name(session, secure || a_engine->crypto_type != CRYPTO_INVALID));
 
 	for (i = 0; i < smh->mparams->num_codecs; i++) {
 		const switch_codec_implementation_t *imp = smh->codecs[i];
@@ -6556,6 +6553,12 @@ SWITCH_DECLARE(void) switch_core_media_gen_local_sdp(switch_core_session_t *sess
 		switch_channel_clear_flag(smh->session->channel, CF_DTLS);
 	}
 
+	if (switch_channel_test_flag(session->channel, CF_PROXY_OFF) && (tmp = switch_channel_get_variable(smh->session->channel, "uuid_media_secure_media"))) {
+		switch_channel_set_variable(smh->session->channel, "rtp_secure_media", tmp);
+		switch_core_session_parse_crypto_prefs(session);
+		switch_core_session_check_outgoing_crypto(session);
+	}
+
 	if (is_outbound || switch_channel_test_flag(session->channel, CF_RECOVERING) ||
 		switch_channel_test_flag(session->channel, CF_3PCC)) {
 		if (!switch_channel_test_flag(session->channel, CF_AVPF) && 
@@ -6973,7 +6976,6 @@ SWITCH_DECLARE(void) switch_core_media_gen_local_sdp(switch_core_session_t *sess
 		
 		mult = switch_channel_get_variable(session->channel, "sdp_m_per_ptime");
 
-		
 		if (switch_channel_test_flag(session->channel, CF_AVPF) || (mult && switch_false(mult))) {
 			char *bp = buf;
 			int both = (switch_channel_test_flag(session->channel, CF_AVPF) || switch_channel_test_flag(session->channel, CF_DTLS)) ? 0 : 1;
diff --git a/src/switch_core_session.c b/src/switch_core_session.c
index 29b770a9e8..5f0d126157 100644
--- a/src/switch_core_session.c
+++ b/src/switch_core_session.c
@@ -808,6 +808,10 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_perform_receive_message(swit
 		switch_channel_clear_flag(session->channel, CF_EARLY_MEDIA);
 	}
 
+	if (message->message_id == SWITCH_MESSAGE_INDICATE_MEDIA) {
+		switch_channel_set_flag(session->channel, CF_PROXY_OFF);
+	}
+
 	if (message->message_id == SWITCH_MESSAGE_INDICATE_DISPLAY) {
 		char *arg = NULL;
 
@@ -914,6 +918,10 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_perform_receive_message(swit
 
   end:
 
+	if (message->message_id == SWITCH_MESSAGE_INDICATE_MEDIA) {
+		switch_channel_clear_flag(session->channel, CF_PROXY_OFF);
+	}
+
 	switch_core_session_free_message(&message);
 	switch_core_session_rwunlock(session);
 
diff --git a/src/switch_ivr.c b/src/switch_ivr.c
index 64a00a8827..3abdb40e81 100644
--- a/src/switch_ivr.c
+++ b/src/switch_ivr.c
@@ -1655,6 +1655,13 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_nomedia(const char *uuid, switch_medi
 		status = SWITCH_STATUS_SUCCESS;
 		channel = switch_core_session_get_channel(session);
 
+		if (switch_channel_test_flag(channel, CF_SECURE)) {
+			switch_core_session_rwunlock(session);
+			switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_ERROR, 
+							  "Cannot bypass %s due to secure connection.\n", switch_channel_get_name(channel));
+			return SWITCH_STATUS_FALSE;
+		}
+
 		if (switch_channel_test_flag(channel, CF_MEDIA_TRANS)) {
 			switch_core_session_rwunlock(session);
 			return SWITCH_STATUS_INUSE;