Mediant SBC with Mi cros oft Tea ms Dire ct Routing Hosting M odel Configuration Note

Configuration Note
AudioCodes Mediant™ Family of Media Gateways & Session Border Controllers

Connecting AudioCodes' SBC to
Microsoft Teams Direct Routing
Hosting Model

Contents

SBC for Teams DR Hosting

Table of Contents
Notice ................................................................................................................................ iv
WEEE EU Directive ......................................................................................................................... iv
Customer Support ......................................................................................................................... iv
Stay in the Loop with AudioCodes ................................................................................................. iv
Abbreviations and Terminology ..................................................................................................... iv
Related Documentation ................................................................................................................. iv
Document Revision Record ............................................................................................................. v
Documentation Feedback .............................................................................................................. vi

1

2

Introduction .................................................................................................................1
1.1

About Teams Direct Routing ................................................................................................. 1

1.2

About AudioCodes SBC Product Series ................................................................................. 1

1.3

Validated AudioCodes SBC Version ...................................................................................... 2

1.4

Infrastructure Prerequisites.................................................................................................. 2

Configuring AudioCodes' SBC ........................................................................................3
2.1

Prerequisites ......................................................................................................................... 5
2.1.1

About the SBC Domain Name in Hosting Model ................................................................. 5
2.1.1.1

SBC Domain Name in a Carrier Office 365 Tenant .............................................. 5

2.1.1.2

SBC Domain Name in a Customer Office 365 Tenant .......................................... 7

2.2

Validating AudioCodes SBC License ...................................................................................... 8

2.3

SBC Configuration Concept ................................................................................................... 8

2.4

Configuring LAN and WAN IP Interfaces ............................................................................... 9

2.5

2.4.1

Validating Configuration of Physical Ports and Ethernet Groups ....................................... 10

2.4.2

Configure LAN and WAN VLANs........................................................................................ 11

2.4.3

Configure Network Interfaces .......................................................................................... 12

Configuring TLS Context for Teams ..................................................................................... 13
2.5.1

Configuring the NTP Server Address ................................................................................. 14

2.5.2

Creating a TLS Context for Teams Direct Routing .............................................................. 15

2.5.3

Generating a CSR and Obtaining the Certificate from a Supported CA .............................. 16

2.5.4

Deploying the SBC and Root / Intermediate Certificates on the SBC ................................. 18

2.6

Method of Generating and Installing the Wildcard Certificate ........................................... 20

2.7

Deploying Trusted Root Certificate for MTLS connection ................................................... 20

2.8

Configuring Media Realms .................................................................................................. 21

2.9

Configuring SIP Signaling Interfaces ................................................................................... 22

2.10 Configuring Proxy Sets and Proxy Address ......................................................................... 23
2.10.1

Configuring Proxy Sets...................................................................................................... 23

2.10.2

Configuring a Proxy Address ............................................................................................. 24

2.11 Configuring the Dial Plan Table (Customer DID Only) ......................................................... 26
2.12 Configuring Call Setup Rules ............................................................................................... 27- ii -

Contents

SBC for Teams DR Hosting

2.13 Configuring Message Manipulation Rules .......................................................................... 28
2.14 Configuring a Coder Group ................................................................................................. 32
2.15 Configuring an IP Profile ..................................................................................................... 33
2.16 Configuring IP Groups ......................................................................................................... 35
2.17 Configuring SRTP ................................................................................................................ 37
2.18 Configuring Message Condition Rules ................................................................................ 38
2.19 Configuring Classification Rules .......................................................................................... 39
2.20 Configuring IP-to-IP Call Routing Rules ............................................................................... 40
2.21 Configuring Firewall Settings .............................................................................................. 41
2.22 Configuring SBC To Play Music On Hold (Optional) ............................................................ 42

3

Verifying the Pairing between the SBC and Direct Routing ..........................................43

4

Making a Test Call.......................................................................................................445

Configuring via UMP 365 (Optional)............................................................................45

A

Syntax Requirements for SIP Messages 'INVITE' and 'OPTIONS' ..................................46

B

A.1

Terminology........................................................................................................................ 46

A.2

Syntax Requirements for 'INVITE' Messages ...................................................................... 46

A.3

Requirements for 'OPTIONS' Messages Syntax................................................................... 47

A.4

Connectivity Interface Characteristics ................................................................................ 48

SIP Proxy Direct Routing Requirements ......................................................................49
B.1

Failover Mechanism ........................................................................................................... 49- iii -

Notices

SBC for Teams DR Hosting

NoticeNoticeInformation contained in this document is believed to be accurate and reliable at the time ofprinting. However, due to ongoing product improvements and revisions, AudioCodes cannot
guarantee accuracy of printed material after the Date Published nor can it accept responsibility forerrors or omissions. Updates to this document can be downloaded fromhttps://www.audiocodes.com/library/technical-documents.
This document is subject to change without notice.
Date Published: June-12-2023

WEEE EU Directive
Pursuant to the WEEE EU Directive, electronic and electrical waste must not be disposed of withunsorted waste. Please contact your local recycling authority for disposal of this product.

Customer Support
Customer technical support and services are provided by AudioCodes or by an authorized
AudioCodes Service Partner. For more information on how to buy technical support for AudioCodes
products
andforcontact
information,pleasevisit
ourwebsiteathttps://www.audiocodes.com/services-support/maintenance-and-support.

Stay in the Loop with AudioCodes

Abbreviations and Terminology
Each abbreviation, unless widely used, is spelled out in full when first used.

Related Documentation
Document NameMediant 500 Gateway & E-SBC User's ManualMediant 500L Gateway & E-SBC User's ManualMediant 800 Gateway & E-SBC User's ManualMediant 1000B Gateway & E-SBC User's ManualMediant 2600 E-SBC User's ManualMediant 4000 SBC User's ManualMediant 9000 SBC User's ManualMediant Software SBC User's Manual
Gateway and SBC CLI Reference Guide- iv -

Notices

SBC for Teams DR Hosting

Document NameSIP Message Manipulation Reference Guide
AudioCodes User Management Pack 365 SP Edition Installation and Administration Guide

Document Revision Record
LTRT

Description

12885

Initial document release for Version 7.2. Hosting Model.

12886

Fixes
New: Configure the Dial Plan Table; Configuring Call Setup Rules; Note about Proxy Address;
Tenant Provisioning Script; Note under IP Profile

12887

Modified: Configuration Example: IP Profile; Configuration Example: IP Group - Teams Global
FQDNs; Configuration Example: SIP Interface; Configuration Example: Proxy Set - Teams Global FQDNs; the note under SIP Interfaces, About the SBC Domain Name in Hosting Model,
Classification rule, Route rule, IP-to-IP Routing. Appendix B.

12888

Call Flows. Configuration Concept.

12889

Parameter ‘Request Type’. SIP I/F-Index entry deleted. Parameter ‘SBC Media Security
Method’.
Firmware version 7.20A.204.015 and later:

13202

New parameter ‘Proxy Keep-Alive using IP Group settings’ added in the IP Group Table. Due tothis, Message Manipulation Set for OPTIONS was removed and now only one SIP Interface isrequired for Teams Direct Routing.
Modified: ‘Query Target’ parameter was added to Call Setup Rule #2
A link was added to Microsoft’s official list of supported Trusted Certificate Authorities in
section “Configure TLS Context”.
Updated CLI script – removed SIP Interface.

13203

13204

Removed DTLS Context from IP Group configuration.
Updated the configuration to support Tag-based Classification (Fix Dial Plan tags, Added CSR,SIP Interface)
Modified sections: Prerequisites; SBC Configuration Concept; Outgoing Call from the Teams
Client (figure); licenses required on device; Configure the Dial Plan Table (Customer DID Only);
Configuring Call Setup Rules Based on Customer DID Range (Dial Plan); Call Setup rule (step 1);
Configuration Example: IP Group - Teams Global FQDNs (table); Configuring an SBC to Suppress
Call Line ID (Optional); Teams IP Profile
Modified parameters: IP address (parameter – adding NI for WAN); Routing from SIP Trunk to
Direct Routing (Name); srctag name; Options Classification; DialPlan tag update
New section: Add Routing option based on Host name

13205

Modified sections: Configure a SIP Signaling Interface; Configure a Proxy Address; Configure an
IP Group (per Tenant)

13206

Modified sections: TLS Context Generation procedure13207

Add ‘Source IP Address’ to Classification Table

13208

Modified due to changes in the Microsoft concept of Hosting Model. For more details refer tohttps://docs.microsoft.com/en-us/microsoftteams/direct-routing-sbc-multipletenants#create-a-trunk-and-provision-users.

-v-

Notices

SBC for Teams DR Hosting

LTRT

Description

13209

Added a configuration example for SIP Trunk. Configuration is simplified by moving to one IP
Group for Teams and changing Call Setup Rules. Added NTP Server configuration. Updated
certified firmware version and links to Microsoft documents.

13210

Modified sections: Deploy Baltimore Trusted Root Certificate (added note for Baltimore
Trusted Root Certificate and MTLS implementation); Configure SIP Signaling Interfaces;
Configure Call Setup Rules ; Configure Message Manipulation Rules; Configure IP Groups;

13211

Note removed regarding external firewall.

13212

License update (typo)13213

Update to topology figures and correction for parameter “Remote Update Support” to “SIP
UPDATE Support”.

13214

Update to the “Related Documentation” table to include the Mediant 1000B Gateway & E-SBC
product.

13215

Update in configuration concept. Modified sections: SBC Configuration Concept; Configure
Proxy Sets and Proxy Address; Configure IP Groups; Configure IP-to-IP Call Routing Rules.
Section “Tenant Provisioning Script” replaced with “UMP Configuration”. An Additional 2 IP
addresses were added to firewall per Microsoft request.

13216

Update for Message Manipulation rule towards Microsoft Teams.

13217

Update to the Firewall Table Rules table with two additional IP addresses of the new
infrastructure in Japan.

13218

Update to SIP Trunk IP Profile and validated firmware version.

13219

Fix to Call Setup Rule; Added section for overcoming problem of not playing music on holdduring conversational transfer.

13330

Remote Replaces Mode parameter with value “Handle Locally” was added to the Teams IP
Profile due to new Microsoft requirements. The Classification rule was updated.
Update to the Firewall Table Rules table due to new Microsoft requirements.

13333

TLS Root Certificate Authority updated by Microsoft.

13335

Updated Classification Table with stricter rules to only allow for documented Microsoft SIP
Proxies.

13337

Note added detailing deployment in Office 365 GCC DoD and GCC High environments.

13338

TLS Private Key size of 1024 was removed. Microsoft subnets were updated in theClassification and Firewall tables.

Documentation Feedback
AudioCodes continually strives to produce high quality documentation. If you have any comments(suggestions or errors) regarding this document, please fill out the Documentation Feedback formon our website at https://online.audiocodes.com/documentation-feedback.

- vi -

1. Introduction

1

SBC for Teams DR Hosting

Introduction
This document describes how to connect AudioCodes' SBC to Teams Direct Routing Hosting modeland refers to the AudioCodes SBC configuration only.
For configuring the Office 365 side, please refer to https://docs.microsoft.com/enus/microsoftteams/direct-routing-configure and https://docs.microsoft.com/enus/microsoftteams/direct-routing-sbc-multiple-tenants.
This document is intended for IT or telephony professionals.

To zoom in on screenshots of Web interface configuration examples, press Ctrl and +.

1.1

About Teams Direct Routing
Teams Direct Routing allows connecting a customer-provided SBC to Microsoft Phone System. The
customer-provided SBC can be connected to almost any telephony trunk, or connect with third-party
PSTN equipment. The connection allows:

1.2◼

Using virtually any PSTN trunk with Microsoft Phone System◼

Configuring interoperability between customer-owned telephony equipment, such as thirdparty PBXs, analog devices, and Microsoft Phone System

About AudioCodes SBC Product Series
AudioCodes' family of SBC devices enables reliable connectivity and security between theenterprise's VoIP network and the service provider's VoIP network.
The SBC provides perimeter defense as a way of protecting enterprises from malicious VoIP attacks;
mediation for allowing the connection of any PBX and/or IP-PBX to any service provider; and Service
Assurance for service quality and manageability.
Designed as a cost-effective appliance, the SBC is based on field-proven VoIP and network services
with a native host processor, allowing the creation of purpose-built multiservice appliances,providing smooth connectivity to cloud services, with integrated quality of service, SLA monitoring,security and manageability. The native implementation of SBC provides a host of additional
capabilities that are not possible with standalone SBC appliances such as VoIP mediation, PSTN accesssurvivability, and third-party value-added services applications. This enables enterprises to utilize theadvantages of converged networks and eliminate the need for standalone appliances.
AudioCodes' SBC is available as an integrated solution running on top of its field-proven MediantMedia Gateway and Multi-Service Business Router platforms, or as a software-only solution for
deployment with third-party hardware. The SBC can be offered as a Virtualized SBC, supporting thefollowing platforms: Hyper-V, AWS, AZURE, AWP, KVM and VMWare.

-1-1. Introduction

1.3

SBC for Teams DR Hosting

Validated AudioCodes SBC Version
Microsoft has successfully conducted validation tests with AudioCodes' Mediant SBC Ver. 7.40A.250.
Previous certified firmware versions are 7.20A.258 and 7.40A.100. For an updated list, refer to Listof Session Border Controllers certified for Direct Routing.
For implementing Microsoft Teams Direct Routing based on the configuration described inthis document, AudioCodes SBC must be installed with a License Key that includes thefollowing features:
◼

◼
◼
◼
◼

MSFT (general Microsoft license)
Note: By default, all AudioCodes media gateways and SBCs are shipped with thislicense (except MSBR products, Mediant 500 SBC, and Mediant 500 Media Gateway).
SW/TEAMS (Microsoft Teams license)
Number of SBC sessions (based on requirements)
Transcoding sessions (only if media transcoding is needed)
Coders (based on requirements)

For more information about the License Key, contact your AudioCodes sales
representative.

1.4

Infrastructure Prerequisites
The table below shows the list of infrastructure prerequisites for deploying Direct Routing.
Table 1: Infrastructure Prerequisites
Infrastructure Prerequisite

Details

Certified Session Border Controller (SBC)
SIP Trunks connected to the SBC
Office 365 carrier tenant and customer tenant
Domains
Public IP address for the SBC
Fully Qualified Domain Name (FQDN) for the SBC
Public DNS entry for the SBC

See Microsoft's Plan Direct Routing document.

Public trusted certificate for the SBC
Firewall ports for Direct Routing signaling
Firewall IP addresses and ports for Direct Routing media
Media Transport Profile
Firewall ports for client media-2-2. Configuring AudioCodes' SBC

2

SBC for Teams DR Hosting

Configuring AudioCodes' SBC
This section shows how to configure AudioCodes' SBC for internetworking with Teams Direct Routing.
The figure below shows an example of the connection topology for the hosting model. Multiple
connection entities are shown in the figure:◼

Teams Phone Systems Direct Routing Interface on the WAN◼

Service Provider SIP TrunkFigure 1: Connection Topology - Network Interfaces
sbc1.audctrunk.aceducation.info

Service Provider Network
Phone System

Session Border Controller

Teams UsersEnterprise 1
DMZ

sbc2.audctrunk.aceducation.info

Internet
Management
Station (OAMP)LAN

Firewall

Phone System

Teams UsersEnterprise 2

sbc3.audctrunk.aceducation.info

ITSP

Phone System

Teams UsersEnterprise 3Enterprise 3
SIP Trunk

Enterprise 1
SIP Trunk
Enterprise 2
SIP Trunk

This document shows how to configure the connection between AudioCodes' SBC and theTeams Direct Routing with a generic SIP Trunk. For detailed configuration of other entities
in the deployment such as the SIP Trunk Provider and the local IP-PBX, see AudioCodes' SIP
Trunk Configuration Notes (in the interoperability suite of documents).

-3-

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 2: Carrier Office 365 Tenant Domain Structure-4-

2. Configuring AudioCodes' SBC

2.1

SBC for Teams DR Hosting

Prerequisites
Before you begin configuration, make sure you have the below for every Hosting SBC you wish to
pair:◼

Public IP address◼

FQDN name matching the SIP addresses of the Teams users◼

Public certificate, issued by one of the supported CAs

2.1.1

About the SBC Domain Name in Hosting Model

2.1.1.1

SBC Domain Name in a Carrier Office 365 Tenant
The SBC domain name must be from one of the names registered in 'Domains' of the tenant. You
cannot use the *.onmicrosoft.com tenant for the domain name. For example, in the administrator
registered the following DNS names for the tenant:Table 2: DNS Names Registered by an Administrator for a Carriers’ Office 365 Tenant
DNS name

Examples of FQDN names for
Hosting Customers

Can be used for SBC FQDN

Valid names:◼
◼

Customers.aceducation.info

Yes◼

sbc.Customers.aceducation.i
nfo
ussbcs15.Customers.aceducation.info
europe.Customers.aceducati
on.info

Invalid name:sbc1.europe.Customers.aceducation.info
adatumbiz.onmicrosoft.com

No

Using *.onmicrosoft.com
domains is not supported for SBC
names.

Please check the DNS configuration with TXT and that an A record has been validated.

-5-2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 3: Example of Registered DNS Names

For activating the domain, the Hosting Provider needs to add at least one user with Microsoft plan
as Enterprise or Business with Phone System (e.g., E5 or E1/E3 with Phone System) from the SIP
domain registered for the carriers’ Office 365 tenant. For example, you can provide users
sbc@Customers.aceducation.info with the Domain FQDN Customers.aceducation.info if this nameis registered for this tenant. You should create at least one licensed user belonging to the SBC domain
you added as described above.

Microsoft commit for up to 24 Hours, before the PSTN gateway is activate.
Figure 4: Example of User Belonging to SBC Carrier’s Domain-6-2. Configuring AudioCodes' SBC

2.1.1.2

SBC for Teams DR Hosting

SBC Domain Name in a Customer Office 365 Tenant
For each customer tenant, you should add a domain belonging to a carrier that points to a customer
tenant as in Figure 5 and create at least one licensed user with Microsoft plan as Enterprise or
Business with Phone System (e.g. E5 or E1/E3 with Phone System) belonging to your SBC domain as
in Figure 6.
Figure 5: Example of Domain for Carrier SBC in Customer Domain

Figure 6: Example of User for Carrier SBC in Customer Domain

The following IP address and FQDN are used as examples in this guide:
Public IP
195.189.192.157

FQDN Name of Carrier’s SBC for a customer
sbc2.Customers.ACeducation.info

Each customer needs to add at least one user from the Carrier’s SIP domain registered for the tenant.
For example, you can provide users sbc@SBC2.Customers.aceducation.info with the Domain FQDN
sbc2.Customers.aceducation.info so long as this name is registered for this tenant.
You should create at least one licensed user belonging to your SBC domain that you added in the step
above.

Microsoft commits for up to 24 hours, before the PSTN gateway is activated.

Please refer to Microsoft guidelines “how to Register a subdomain name in a customer
tenant” - https://docs.microsoft.com/en-us/microsoftteams/direct-routing-sbc-multipletenants#register-a-subdomain-name-in-a-customer-tenant-7-2. Configuring AudioCodes' SBC

2.2

SBC for Teams DR Hosting

Validating AudioCodes SBC License
Please refer to Section 1.2 on page 1 for the list of required licenses.

2.3

SBC Configuration Concept
The figure below illustrates the concept behind the configuration of AudioCodes’ SBC device.
Figure 7: SBC Configuration Concept

Proxy Set

SIP
Trunk

IP Group(Enerprise1
SIP Trunk)
IP Group(Enerprise2
SIP Trunk)
IP Group(Enerprise3
SIP Trunk)

SBC

SIP
Interface

SIP
Interface

IP Group

Phone System

Configuration may be changed per customer request to a dedicated Proxy Set per IP Group(Enterprise’s SIP Trunk).
The routing from the SIP Trunk to Direct Routing is dependent on the Class 4 switch routing method.
The routing decision can be based on:◼

Customer DID Range◼

Trunk Context (TGRP)◼

IP Interface◼

SIP Interface (UDP/TCP Port)◼

Host name◼

etc.

The configuration shown in this document is based on Customer DID Range using Dial Plan. For more
information, see the AudioCodes' documentation suite.

-8-2. Configuring AudioCodes' SBC

2.4

SBC for Teams DR Hosting

Configuring LAN and WAN IP Interfaces
This section describes how to configure the SBC's IP network interfaces. There are several ways todeploy the SBC:◼

SBC interfaces with the following IP entities:•

Teams Direct Routing, located on the WAN•

SIP Trunk - located on the LAN◼

SBC connects to the WAN through a DMZ network◼

Physical connection: The type of physical connection depends on the method used to connect
to the Enterprise's network. In the interoperability test topology, SBC connects to the LAN and
DMZ using dedicated Ethernet ports (i.e., two ports and two network cables are used).

◼

SBC also uses two logical network interfaces:•

LAN (VLAN ID 1)•

DMZ (VLAN ID 2)
Figure 8: Network Interfaces in the Topology with SIP Trunk on the LAN
LAN Port

Session Border Controller

Vlan ID 1

Management
Station (OAMP)LANLAN Port

Vlan ID 2

DMZ
WAN

Phone System
FirewallITSP-9-

2. Configuring AudioCodes' SBC

2.4.1

SBC for Teams DR Hosting

Validating Configuration of Physical Ports and Ethernet Groups
The physical ports are automatically detected by the SBC. The Ethernet groups are also auto-assigned
to the ports. In this step, only parameter validation is necessary.
To validate physical ports:
1.

Open the Physical Ports table (Setup menu > IP Network tab > Core Entities folder > PhysicalPorts).

2.

Validate that you have at least two physical ports detected by the SBC, one for LAN and theother for WAN. Make sure both ports are in Enabled mode.

Based on your hardware configuration, you might have more than two ports.

Figure 9: Physical Ports Configuration Interface

To validate Ethernet Groups:
1.

Open the Ethernet Groups table (Setup menu > IP Network tab > Core Entities folder >Ethernet Groups).

2.

Validate that you have at least two Ethernet Groups detected by the SBC, one for LAN and theother for WAN.
Figure 10: Ethernet Groups Configuration Interface- 10 -

2. Configuring AudioCodes' SBC

2.4.2

SBC for Teams DR Hosting

Configure LAN and WAN VLANs
This section describes how to define VLANs for each of the following interfaces:◼

LAN Interface (assigned the name "LAN_IF")◼

WAN Interface (assigned the name "WAN_IF")

To configure VLANs:
1.

Open the Ethernet Device table (Setup menu > IP Network tab > Core Entities folder >Ethernet Devices).

2.

There will be one existing row for VLAN ID 1 and underlying interface GROUP_1.

3.

Add another VLAN ID 2 for the WAN side.
Figure 11: Configured VLANs in the Ethernet Device Table- 11 -

2. Configuring AudioCodes' SBC

2.4.3

SBC for Teams DR Hosting

Configure Network Interfaces
This section describes how to configure the IP network interfaces for each of the following interfaces:◼

LAN Interface (assigned the name "LAN_IF")◼

WAN Interface (assigned the name "WAN_IF")

To configure network parameters for both LAN and WAN interfaces:
1.

Open the IP Interfaces table (Setup menu > IP Network tab > Core Entities folder > IPInterfaces).

2.

Configure the IP interfaces as follows (your network parameters might be different):
Table 3: Configuration Example of the Network Interface Table

Index

Application
Types

InterfaceMode

IP Address

PrefixLengthGateway

DNS

I/F Name

Ethernet
Device0

OAMP+ Media +Control

IPv4 Manual

10.15.77.77

16

10.15.0.1

10.15.27.1

LAN_IFvlan 1

1

Media + Control(as this interface
points to theinternet, enabling
OAMP is notrecommended)

IPv4 Manual

195.189.192.157 (DMZ
IP address of SBC)

25

195.189.192.129(router's IP address)

According to
your Internet
provider's
instructions

WAN_IFvlan 2The configured IP network interfaces are shown below:
Figure 12: Configuration Example of the Network Interface Table- 12 -

2. Configuring AudioCodes' SBC

2.5

SBC for Teams DR Hosting

Configuring TLS Context for Teams
The configuration instructions in this section are based on the following domain structure that must
be implemented as part of the certificate which must be loaded to the host SBC:◼

CN: *.customers.ACeducation.info◼

1st SAN: customers.ACeducation.info◼

2nd SAN: *.customers.ACeducation.info

This certificate module is based on the carriers’ own TLS Certificate. For more certificate structure
options, see Microsoft Teams Direct Routing documentation.
Figure 13: Carriers’ Office 365 Tenants Domain Structure

From Teams to SIP Trunk
Request-URI: Sbc1.Customers.ACeducation.info
Request-URI: Sbc2.Customers.ACeducation.info
Request-URI: Sbc3.Customers.ACeducation.info
From SIP Trunk to Teams
Contact: Sbc1.Customers.ACeducation.info
Contact: Sbc2.Customers.ACeducation.info
Contact: Sbc3.Customers.ACeducation.info

The Teams Direct Routing Interface only allows TLS connections from SBC devices for SIP traffic witha certificate signed by one of the trusted Certificate Authorities. The currently supported Certification
Authorities can be found at:https://docs.microsoft.com/en-us/microsoftteams/direct-routing-plan#public-trusted-certificatefor-the-sbc- 13 -

2. Configuring AudioCodes' SBC

2.5.1

SBC for Teams DR Hosting

Configuring the NTP Server AddressThis section describes how to configure the NTP server's IP address. It is recommended to implement
an NTP server (Microsoft NTP server or another global server) to ensure that the SBC receives thecurrent date and time. This is necessary for validating certificates of remote parties. It is important,that NTP Server will be locate on the OAMP IP Interface (LAN_IF in our case) or will be accessible
through it.
To configure the NTP server address:
1.

Open the Time & Date page (Setup menu > Administration tab > Time & Date).

2.

In the 'Primary NTP Server Address' field, enter the IP address of the NTP server(e.g., 10.15.28.1).
Figure 14: Configuring NTP Server Address

3.

Click Apply.

- 14 -

2. Configuring AudioCodes' SBC

2.5.2

SBC for Teams DR Hosting

Creating a TLS Context for Teams Direct Routing
The section below describes how to request a certificate for the SBC WAN interface and configure it,based on the example of DigiCert Global Root CA. The certificate is used by the SBC to authenticate
the connection with Teams Direct Routing.
The procedure involves the following main steps:a.

Creating a TLS Context for Teams Direct Routing.

b.

Generating a Certificate Signing Request (CSR) and obtaining the certificate from a supported
Certification Authority.

c.

Deploying the SBC and Root / Intermediate certificates on the SBC.

To create a TLS Context for Teams Direct Routing:
1.

Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).

2.

Create a new TLS Context by clicking +New, and then configure the parameters using the tablebelow as reference.
Table 4: New TLS Context

Index

Name

TLS Version

1

Teams (arbitrary descriptive name)TLSv1.2

All other parameters can be left unchanged with their default values.

The table above exemplifies configuration focusing on interconnecting SIP and media. Youmight want to configure additional parameters according to your company's policies. For
example, you might want to configure Online Certificate Status Protocol (OCSP) to check if
SBC certificates displayed in the online server are still valid or revoked. For more
information on the SBC's configuration, see the User's Manual, available for downloadfrom https://www.audiocodes.com/library/technical-documents.
Figure 15: Configuration of TLS Context for Direct Routing- 15 -

2. Configuring AudioCodes' SBC

3.

SBC for Teams DR Hosting

Click Apply; you should see the new TLS Context and option to manage the certificates at thebottom of 'TLS Context' table.

Figure 16: Configured TLS Context for Direct Routing and Interface to Manage the Certificates

2.5.3

Generating a CSR and Obtaining the Certificate from a Supported CA
This section shows how to generate a Certificate Signing Request (CSR) and obtain the certificate
from a supported Certification Authority.
To generate a Certificate Signing Request (CSR) and obtain the certificate from a supported
Certification Authority:
1.

Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).

2.

In the TLS Contexts page, select the Teams TLS Context index row, and then click the Change
Certificate link located below the table; the Context Certificates page appears.

3.

Under the Certificate Signing Request group, do the following:a.

In the 'Common Name [CN]' field, enter the wildcard FQDN name(based on example above, *.customers.ACeducation.info).

b.

In the '1st Subject Alternative Name [SAN]' field, change the type to ‘DNS’ and enter the
SBC FQDN name (based on example above, customers.ACeducation.info).

c.

In the '2nd Subject Alternative Name [SAN]' field, change the type to ‘DNS’ and enter the
wildcard FQDN name (based on example above, *.customers.ACeducation.info).
The domain portion of the Common Name [CN], 1st and 2nd Subject Alternative Name [SAN]
must match the SIP suffix configured for carrier Office 365 tenant (see Section 2.1.1.1).

d.

Fill in the rest of the request fields according to your security provider's instructions.

e.

Click the Create CSR button; a textual certificate signing request is displayed in the area
below the button:- 16 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 17: Example of Certificate Signing Request Page

4.

Copy the CSR from the line "----BEGIN CERTIFICATE" to "END CERTIFICATE REQUEST----" to atext file (such as Notepad), and then save it to a folder on your computer with the file name,for example certreq.txt.

5.

Send certreq.txt file to the Certified Authority Administrator for signing.

- 17 -

2. Configuring AudioCodes' SBC

2.5.4

SBC for Teams DR Hosting

Deploying the SBC and Root / Intermediate Certificates on the SBC
After obtaining the SBC signed and Trusted Root/Intermediate Certificate from the CA, install thefollowing:◼

SBC certificate◼

Root / Intermediate certificates:

To install the SBC certificate:1.

In the SBC's Web interface, return to the TLS Contexts page and do the following:a.

In the TLS Contexts page, select the required TLS Context index row, and then click the
Change Certificate link located below the table; the Context Certificates page appears.

b.

Scroll down to the Upload certificates files from your computer group, click the Choose
File button corresponding to the 'Send Device Certificate...' field, navigate to thecertificate file obtained from the CA, and then click Load File to upload the certificate to
the SBC.

Figure 18: Uploading the Certificate Obtained from the Certification Authority

2.

Validate that the certificate was uploaded correctly. A message indicating that the certificate
was uploaded successfully is displayed in blue in the lower part of the page:
Figure 19: Message Indicating Successful Upload of the Certificate

3.

In the SBC's Web interface, return to the TLS Contexts page, select the required TLS Context
index row, and then click the Certificate Information link, located at the bottom of the TLS.
Then validate the Key size, certificate status and Subject Name:- 18 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 20: Certificate Information Example

4.

5.

In the SBC's Web interface, return to the TLS Contexts page.
a.

In the TLS Contexts page, select the required TLS Context index row, and then click theTrusted Root Certificates link, located at the bottom of the TLS Contexts page; theTrusted Certificates page appears.

b.

Click the Import button, and then select all Root/Intermediate Certificates obtained fromyour Certification Authority to load.

Click OK; the certificate is loaded to the device and listed in the Trusted Certificates store:
Figure 21: Configured Trusted Certificates Page

The above method creates a signed certificate for an explicit device, on which a Certificate
Sign Request was generated (and signed with private key). To be able to use the samewildcard certificate on multiple devices, use following methods.

- 19 -

2. Configuring AudioCodes' SBC

2.6

SBC for Teams DR Hosting

Method of Generating and Installing the Wildcard Certificate
To use the same certificate on multiple devices, you may prefer using 3 rd party application (e.g.,
DigiCert Certificate Utility for Windows) to process the certificate request from your Certificate
Authority on another machine, with this utility installed.
After you've processed the certificate request and response using the DigiCert utility, test thecertificate private key and chain and then export the certificate with private key and assign apassword.
To install the certificate:

2.7

1.

Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).

2.

In the TLS Contexts page, select the required TLS Context index row, and then click the Change
Certificate link located below the table; the Context Certificates page appears.

3.

Scroll down to the Upload certificates files from your computer group and do the following:a.

Enter the password assigned during export with the DigiCert utility in the 'Private key
pass-phrase' field.

b.

Click the Choose File button corresponding to the 'Send Private Key...' field and thenselect the SBC certificate file exported from the DigiCert utility.

Deploying Trusted Root Certificate for MTLS connection
Loading Trusted Root Certificates to AudioCodes' SBC is mandatory when implementing an
MTLS connection with the Microsoft Teams network.
Microsoft 365 is updating services powering messaging, meetings, telephony, voice, andvideo to use TLS certificates from a different set of Root Certificate Authorities (CAs). For
more details of the new Root CAs, refer to Microsoft technical guidance at Office TLS
Certificate Changes. Services began transitioning to the new Root CAs (e.g., DigiCert)
beginning in January 2022 and will continue through October 2022. During this migration
period, it’s possible to load both the old (Baltimore) and the new (DigiCert) Root certificate
to the same TLS Context.
The DNS name of the Teams Direct Routing interface is sip.pstnhub.microsoft.com. In this interface,a certificate is presented which is signed by DigiCert with:
Serial Number: 0x033af1e6a711a9a0bb2864b11d09fae5,
SHA-1 Thumbprint: DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 andSHA-256 Thumbprint: CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F.
For more information on the DNS name, see Appendix B.
To trust this certificate, your SBC must have the certificate in Trusted Certificates storage.
Download the DigiCert Global Root G2 (df3c) certificate in PEM format fromhttps://www.digicert.com/kb/digicert-root-certificates.htm and follow the steps above to import
the certificate to the Trusted Root storage.
Before importing the DigiCert Root Certificate into AudioCodes' SBC, make sure it's in .PEM
or .PFX format. If it isn't, you need to convert it to .PEM or .PFX format, otherwise the'Failed to load new certificate' error message is displayed. To convert to PEM format, use
Windows local store on any Windows OS and then export it as 'Base-64 encoded X.509(.CER) certificate'.

- 20 -

2. Configuring AudioCodes' SBC

2.8

SBC for Teams DR Hosting

Configuring Media Realms
Media Realms allow dividing the UDP port ranges for use on different interfaces. In the example
below, two Media Realms are configured:◼

One for the LAN interface, with the UDP port starting at 6000 and the number of media
session legs 100 (you need to calculate number of media session legs based on your usage)◼

One for the WAN interface, with the UDP port range starting at 7000 and the number of
media session legs 100

To configure Media Realms:
1.

Open the Media Realms table (Setup menu > Signaling & Media tab > Core Entities folder >Media Realms).

2.

Configure Media Realms as follows (you can use the default Media Realm - Index 0 - butmodify it):
Table 5: Configuration Example Media Realms in Media Realm Table

Index

Name

0

MRLan
(arbitrary name)

1

MRWan
(arbitrary name)

Topology
LocationUp

IPv4 Interface
Name

Port Range
Start

Number of Media
Session Legs

LAN_IF

6000

100 (media sessions
assigned with port range)

WAN_IF

7000

100 (media sessions
assigned with port range)

The configured Media Realms are shown in the figure below:
Figure 22: Configuration Example Media Realms in Media Realm Table- 21 -

2. Configuring AudioCodes' SBC

2.9

SBC for Teams DR Hosting

Configuring SIP Signaling Interfaces
This section shows how to configure a SIP Signaling Interfaces. A SIP Interface defines a listening port
and type (UDP, TCP, or TLS) for SIP signaling traffic on a specific logical IP network interface(configured in the Interface Table above) and Media Realm.
Note that the configuration of a SIP interface for the SIP Trunk shows as an example and yourconfiguration might be different. For specific configuration of interfaces pointing to SIP trunks and/or
a third-party PSTN environment connected to the SBC, see the trunk / environment vendor
documentation.
AudioCodes also offers a comprehensive suite of documents covering the interconnection between
different trunks and equipment.
To configure a SIP interfaces:
1.

Open the SIP Interface table (Setup menu > Signaling & Media tab > Core Entities folder > SIP
Interfaces).

2.

Configure SIP Interfaces. You can use the default SIP Interface (Index 0), but modify it asshown in the table below. The table below shows an example of the configuration. You canchange some parameters according to your requirements.
The Direct Routing interface can only use TLS for a SIP port. It does not support using TCP
due to security reasons. The SIP port might be any port of your choice. When pairing the
SBC with Office 365, the chosen port is specified in the pairing command.
Table 6: Configuration Example of SIP Signaling Interfaces

Index

Name

Network
Interface

ApplicationType

UDP Port

TCP
Port

TLS Port

Enable TCP
Keepalive

Classification
Failure Response
Type

Media
Realm

TLS
Context
Name

0

SIPTrunk(arbitrary
name)

LAN_IF

SBC

5060 (according
to Service
Providerrequirement)00Disable(leavedefault
value)

500 (leave
default value)

MRLan

-

1

Teams
(arbitrary
name)

WAN_IF

SBC

0(Phone Systemdoes not use
UDP or TCP for
SIP signaling)

05061 (asconfiguredin theOffice 365)

Enable0(Recommended
to prevent DoS
attacks)

MRWan

Teams

For implementing an MTLS connection with the Microsoft Teams network, configure ‘TLS
Mutual Authentication’ to “Enable” for the Teams SIP Interface.
Loading DigiCert Trusted Root Certificates to AudioCodes' SBC is mandatory for
implementing an MTLS connection with the Microsoft Teams network. Refer to Section 2.7
on page 20.

- 22 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

The configured SIP Interfaces are shown in the figure below:
Figure 23: Configuration Example of SIP Signaling Interfaces

2.10

Configuring Proxy Sets and Proxy AddressThis section describes how to configure Proxy Sets and Proxy addresses.

2.10.1

Configuring Proxy Sets
The Proxy Set and Proxy Address defines TLS parameters, IP interfaces, FQDN and the remote entity's
port. Proxy Sets can also be used to configure load balancing between multiple servers. The example
below covers configuration of a Proxy Sets for Teams Direct Routing and SIP Trunks. Note that theconfiguration of a Proxy Set for the SIP Trunk shows as an example and your configuration might bedifferent. For specific configuration of interfaces pointing to SIP Trunks and/or the third-party PSTN
environment connected to the SBC, see the trunk/environment vendor's documentation.
AudioCodes also offers a comprehensive suite of documents covering the interconnection between
different trunks and the equipment. The Proxy Sets will later be applied to the VoIP network byassigning them to IP Groups.
To configure a Proxy Sets:
1.

Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy
Sets).

2.

Configure Proxy Sets as shown in the table below:
Table 7: Configuration Example Proxy Sets in Proxy Sets Table

Index

Name

SBC IPv4 SIP
Interface

TLS Context
Name

Proxy KeepAlive

Proxy Hot
Swap

Proxy Load
Balancing Method

1

Teams
(arbitrary name)

Teams

Teams

Using Options

EnableRandom Weights

2

SIPTrunks(arbitrary name)

SIPTrunk

Default

Using Options--

The configured Proxy Sets are shown in the figure below:
Figure 24: Configuration Example Proxy Sets in Proxy Sets Table- 23 -

2. Configuring AudioCodes' SBC

2.10.2

SBC for Teams DR Hosting

Configuring a Proxy AddressThis section shows how to configure a Proxy Address.
To configure a Proxy Address for Teams:
1.

Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy
Sets) and then click the Proxy Set Teams, and then click the Proxy Address link located below
the table; the Proxy Address table opens.

2.

Click +New; the following dialog box appears:
Figure 25: Configuring Proxy Address for Teams Direct Routing Interface

3.

Configure the address of the Proxy Set according to the parameters described in the tablebelow (for more information, see Appendix B):
Table 8: Configuration Proxy Address for Teams Direct Routing

4.

Index

Proxy Address

Transport
Type

Proxy
Priority

Proxy Random
Weight0

sip.pstnhub.microsoft.com:5061

TLS

1

1

1

sip2.pstnhub.microsoft.com:5061

TLS

2

1

2

sip3.pstnhub.microsoft.com:5061

TLS

3

1

Click Apply.
If the SBC is deployed in Office 365 GCC DoD or GCC High environments, please contact
AudioCodes deployment services, since these environments have different configurations(FQDNs) than the public Office 365 environment.

To configure a Proxy Address for SIP Trunks:
1.

Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy
Sets) and then click the Proxy Set SIPTrunks, and then click the Proxy Address link locatedbelow the table; the Proxy Address table opens.

2.

Click +New; the following dialog box appears:- 24 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 26: Configuring Proxy Address for SIP Trunk3.

Configure the address of the Proxy Set according to the parameters described in the tablebelow:
Table 9: Configuration Proxy Address for SIP Trunk

4.

Index

Proxy Address

Transport
Type

Proxy
Priority

Proxy Random
Weight0

SIPTrunk.com:5060(SIP Trunk IP / FQDN and port)

UDP

0

0

Click Apply.

- 25 -

2. Configuring AudioCodes' SBC

2.11

SBC for Teams DR Hosting

Configuring the Dial Plan Table (Customer DID Only)
For deployments requiring hundreds of routing rules (which may exceed the maximum number ofrules that can be configured in the IP-to-IP Routing table), you can employ tags to represent the manydifferent calling (source URI user name) and called (destination URI user name) prefix numbers inyour routing rules. Tags are typically implemented when you have users of many different called
and/or calling numbers that need to be routed to the same destination (e.g., IP Group or IP address).
In such a scenario, instead of configuring many routing rules to match all the required prefix numbers,
you need only to configure a single routing rule using the tag to represent all the possible prefix
numbers.
The Dial Plan (e.g., TeamsTenants) will be configured with an Office 365 customer tenant FQDN tag
per prefix.
To configure Dial Plans:
1.

Open the Dial Plan table (Setup menu > Signaling & Media tab > SIP Definitions folder > Dial
Plan).

2.

Click New and then configure a Dial Plan name (e.g., TeamsTenants) according to theparameters described in the table below.

3.

Click Apply.

4.

In the Dial Plan table, select the row for which you want to configure dial plan rules and thenclick the Dial Plan Rule link located below the table; the Dial Plan Rule table appears.

5.

Click New; the following dialog box appears:
Figure 27: Dial Plan Rule Table - Add Dialog Box

6.

Configure a dial plan rule according to the parameters described in the table below.
Table 10: Dial Plan Carriers’ Office 365 Teams Tenants

Index

Name

PrefixTag0Enterprise1+19098[0000-9999]<FQDN name of the carrier customer 1 tenant in SBC>. For example,
sbc1.customers.ACeducation.info

1Enterprise2+17093[0000-9999]<FQDN name of the carrier customer 2 tenant in SBC>. For example,
sbc2.customers.ACeducation.info

2Enterprise3+18097[0000-9999]<FQDN name of the carrier customer 3 tenant in SBC>. For example,
sbc3.customers.ACeducation.info

7.

Click Apply and then save your settings to flash memory.

- 26 -

2. Configuring AudioCodes' SBC

2.12

SBC for Teams DR Hosting

Configuring Call Setup Rules
This section describes how to configure Call Setup Rules based on customer DID range (Dial Plan).
Call Setup rules define various sequences that are run upon receipt of an incoming call (dialog) at call
setup, before the device routes the call to its destination.
Configured Call Setup Rules need be assigned to specific IP Group.
To configure a Call Setup Rules based on customer DID range (Dial Plan):
1.

Open the Call Setup Rules table (Setup menu > Signaling & Media tab > SIP Definitions folder> Call Setup Rules).

2.

Click New; the following dialog box appears:
Figure 28: Call Setup Rules Table - Add Dialog Box

3.

Configure a Call Setup rule according to the parameters described in the table below.
Table 11: Call Setup Rules Table

Index

Rules
Set ID

Search Key

Condition

Action Subject

ActionType

Action Value

00

TenantFQDN by
Dial Plan TeamsTenants
PAI

Header.P-AssertedIdentity.URL.User

DialPlan.Found exists

var.session.TenantFQDN

ModifyDialPlan.Result

10

TenantFQDN by
Dial Plan TeamsTenants
From

Param.Call.Src.User

DialPlan.Found exists AND
var.session.TenantFQDN var.session.TenantFQDN== ''ModifyDialPlan.Result

20

DstTags

Modifyvar.session.TenantFQDN

3

1

TenantFQDN by
Dial Plan TeamsTenants
R-URI

var.session.TenantFQDN

ModifyDialPlan.Result

41Teams DstTags

DstTags

Modify'Teams'

Name

Query
Type

Query Target

SIP Trunk
DstTags

4.

Param.Call.Dst.User

DialPlan.Found exists

Click Apply and then save your settings to flash memory.

- 27 -

2. Configuring AudioCodes' SBC

2.13

SBC for Teams DR Hosting

Configuring Message Manipulation Rules
This section describes how to configure SIP message manipulation rules. SIP message manipulation
rules can include insertion, removal, and/or modification of SIP headers. Manipulation rules aregrouped into Manipulation Sets, enabling you to apply multiple rules to the same SIP message (IPentity).
Once you have configured the SIP message manipulation rules, you need to assign them to therelevant IP Group (in the IP Group table) and determine whether they must be applied to inbound oroutbound messages.
To configure SIP message manipulation rule for Teams:
1.

Open the Message Manipulations page (Setup menu > Signaling & Media tab > Message
Manipulation folder > Message Manipulations).

2.

Configure a new manipulation rule (Manipulation Set 2) for Teams IP Group. This rule applies
to messages sent to the Teams IP Group. This replaces the host part of the SIP Contact Header
with the value saved in the session variable ‘TenantFQDN’ during execution of the Call Setup
Rule.
Parameter

Value

Index

0

Name

TeamsTenants (arbitrary name)

Manipulation Set ID

2Condition

Var.Session.TenantFQDN != ''Action Subject

Header.Contact.URL.Host

Action Type

ModifyAction Value

Var.Session.TenantFQDN

Figure 29: Configuring SIP Message Manipulation Rule 0 (for Teams IP Group)- 28 -

2. Configuring AudioCodes' SBC

3.

SBC for Teams DR Hosting

Configure another manipulation rule (Manipulation Set 1) for Teams IP Group. This rule
applies to messages received from the Teams IP Group. This rule removes the SIP Privacy
Header in all messages, except of call with presentation restriction.
Parameter

Value

Index

1

Name

Remove Privacy Header

Manipulation Set ID

1

Condition

Header.Privacy exists And Header.From.URL !contains'anonymous'

Action Subject

Header.Privacy

Action Type

RemoveFigure 30: Configuring SIP Message Manipulation Rule 1 (for Teams IP Group)

4.

Configure another manipulation rule (Manipulation Set 1) for Teams IP Group. This rule
applies to messages received from the Teams IP Group. This rule removes the SIP P-AssertedIdentity Header.
Parameter

Value

Index

2

Name

Remove PAI

Manipulation Set ID

1

Action Subject

Header.P-Asserted-Identity

Action Type

Remove- 29 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 31: Configuring SIP Message Manipulation Rule 2 (for Teams IP Group)5.

Configure a new manipulation rule (Manipulation Set 2) for Teams IP Group. This rule applies
to messages sent to the Teams IP Group. This rule adds a routing policy rule toward Microsoft
for handling different call forwarding scenarios (according to the action values shown below).
Parameter

Value

Index

3

Name

Teams Routing Policy (arbitrary name)

Manipulation Set ID

2Condition
Action Subject

header.X-MS-RoutingPolicies

Action Type

Add

Action Value

One of the following values: "none", "no_missed_call","disable_forwarding", "disable_forwarding_except_phone

Implementation of this Message Manipulation rule with Microsoft Teams is optional
according to site deployment requirements.

- 30 -

2. Configuring AudioCodes' SBC

SBC for Teams DR Hosting

Figure 32: Configuring SIP Message Manipulation Rule 1 (for Teams IP Group) Disable Forwarding Example- 31 -

2. Configuring AudioCodes' SBC

2.14

SBC for Teams DR Hosting

Configuring a Coder Group
This section describes how to configure coders (termed Coder Groups). As Teams Direct Routing
supports the SILK and G.729 coders while the network connection to the SIP Trunk may restrict
operation with a dedicated coders list, you need to add a Coder Group with the supported coders foreach leg, the Teams Direct Routing and the SIP Trunk.
Note that the Coder Group ID for this entity will be assigned to its corresponding IP Profile in the next
section.
To configure a Coder Group:
1.

Open the Coder Groups table (Setup menu > Signaling & Media tab > Coders & Profiles folder> Coder Groups).

2.

From the 'Coder Group Name' dropdown, select 1:Does Not Exist and add the required codecs
as shown in the figure below.
Figure 33: Configuring Coder Group for Teams Direct Routing

3.

Click Apply and confirm the configuration change in the prompt that pops up.

- 32 -

2. Configuring AudioCodes' SBC

2.15

SBC for Teams DR Hosting

Configuring an IP Profile
This section describes how to configure IP Profiles. An IP Profile is a set of parameters with userdefined settings related to signaling (e.g., SIP message terminations such as REFER) and media (e.g.,
coder type). An IP Profile need be assigned to specific IP Group.
To configure an IP Profile:1.

Open the Proxy Sets table (Setup menu > Signaling & Media tab > Coders & Profiles folder >IP Profiles).

2.

Click +New to add the IP Profile for the Direct Routing interface. Configure the parameters
using the table below as reference.
Table 12: Configuration Example: Teams IP Profile
Parameter

Value

GeneralName

Teams (arbitrary descriptive name)Media Security
SBC Media Security Mode

SecuredSBC Early Media
Remote Early Media RTP Detection
Mode

By Media (required, as Teams Direct Routing does not send RTP
immediately to remote side when it sends a SIP 18x response)

SBC Media
Extension Coders Group

AudioCodersGroups_1

RTCP Mode

Generate Always (required, as some ITSPs do not send RTCP packets
while in Hold mode, but Microsoft expected them)

ICE Mode

Lite (required only when Media Bypass is enabled on Teams)

SBC Signaling
SIP UPDATE Support

Not Supported

Remote re-INVITE Support

Supported Only With SDP

Remote Delayed Offer Support

Not Supported

SBC Forward and Transfer
Remote REFER Mode

Handle Locally

Remote Replaces Mode

Handle Locally

Remote 3xx Mode

Handle Locally

SBC Hold
Remote Hold Format

Inactive (some SIP Trunk may answer with a=inactive and IP=0.0.0.0
in response to the Re-Invite with Hold request from Teams.
Microsoft Media Stack doesn’t support this format. So, SBC will
replace 0.0.0.0 with its IP address)
All other parameters can be left unchanged with their default values.

3.

Click Apply, and then save your settings to flash memory.

- 33 -

2. Configuring AudioCodes' SBC

4.

SBC for Teams DR Hosting

Click +New to add the IP Profile for the SIP Trunks. Configure the parameters using the tablebelow as reference.
Table 13: Configuration Example: SIP Trunk IP Profile
Parameter

Value

GeneralName

SIPTrunks (arbitrary descriptive name)Media Security
SBC Media Security Mode

Not Secured

SBC Signaling
P-Asserted-Identity Header Mode

Add (required for anonymous calls)

SBC Forward and Transfer
Remote REFER Mode

Handle Locally

Remote Replaces Mode

Handle Locally

Play RBT To Transferee

Yes (required, as some SIP Trunks do not playring-back tone during transfer)

Remote 3xx Mode

Handle Locally
All other parameters can be left unchanged with their default values.

5.

Click Apply and then save your settings to flash memory.
Teams Hold music is not supported by Microsoft in consultative transfer of a PSTN call. The
transferee will hear silence during the transfer. To overcome this issue, it is possible toconfigure SBC to play music during a consultative transfer. To do this, refer to Section 2.22.

- 34 -

2. Configuring AudioCodes' SBC

2.16

SBC for Teams DR Hosting

Configuring IP Groups
This section describes how to configure IP Groups. The IP Group represents an IP entity on the
network with which the SBC communicates. This can be a server (e.g., IP-PBX or SIP Trunk) or it canbe a group of users (e.g., LAN IP phones). For servers, the IP Group is typically used to define theserver's IP address by associating it with a Proxy Set. Once IP Groups are configured, they are used
to configure IP-to-IP routing rules for denoting source and destination of the call.
To configure an IP Groups:
1.

Open the IP Groups table (Setup menu > Signaling & Media tab > Core Entities folder > IP
Groups).

2.

Configure IP Group for the Teams Direct Routing:Parameter

Value

Name

Teams

Topology Location

Up

Type

ServerProxy Set

Teams

IP Profile

Teams

Media Realm

MRWan

Classify By Proxy Set

DisableLocal Host Name<FQDN name of the SBC in the carrier tenant>(based on our example, customers.ACeducation.info).

Teams Direct Routing Mode

Enable (Enables the SBC to include Microsoft's proprietary X-MSSBC header in outgoing SIP INVITE and OPTIONS messages in a
Microsoft Teams Direct Routing environment. The header is usedby Microsoft Teams to identify vendor equipment. The header'svalue is in the format 'Audiocodes/<model>/<firmware>').

Always Use Src Address

Yes

Call Setup Rules Set ID

0

Tags

Teams

Inbound Message
Manipulation Set ID

1

Outbound Message
Manipulation Set

2

Proxy Keep-Alive using IP
Group settings

EnableAll other parameters can be left unchanged with their default values.

- 35 -

2. Configuring AudioCodes' SBC

3.

SBC for Teams DR Hosting

Configure IP Groups for the Enterprise’s SIP Trunks (for each enterprise create a dedicated IP
Group):
Parameter

Value

Name

Enterprise1-SIPTrunk (arbitrary descriptive name)Type

ServerProxy Set

SIPTrunks

IP Profile

SIPTrunks

Media Realm

MRLan or MRWan (according to your network environment)

Call Setup Rules Set ID

1

Tags

<FQDN name of the SBC in the customer tenant>(For example, sbc1.customers.ACeducation.info)
All other parameters can be left unchanged with their default values.

The configured IP Groups are shown in the figure below:
Figure 34: Configuration Example IP Groups in IP Group Table- 36 -

2. Configuring AudioCodes' SBC

2.17

SBC for Teams DR Hosting

Configuring SRTP
This section describes how to configure media security. The Direct Routing Interface needs to use of
SRTP only, so you need to configure the SBC to operate in the same manner. By default, SRTP isdisabled.
To enable SRTP:
1.

Open the Media Security page (Setup menu > Signaling & Media tab > Media folder > Media
Security).

2.

From the 'Media Security' drop-down list, select Enable to enable SRTP.
Figure 35: Configuring Media Security Parameter3.

Click Apply.

- 37 -

2. Configuring AudioCodes' SBC

2.18

SBC for Teams DR Hosting

Configuring Message Condition Rules
This section describes how to configure the Message Condition Rules. A Message Condition defines
special conditions (pre-requisites) for incoming SIP messages. These rules can be used as additional
matching criteria for the IP-to-IP routing rules in the IP-to-IP Routing table.
To configure a Message Condition rule:
1.

Open the Message Conditions table (Setup menu > Signaling & Media tab > Message
Manipulation folder > Message Conditions).

2.

Click New, and then configure the parameters as follows:

Parameter

Value

Index

0

Name

Teams-Contact (arbitrary descriptive name)

Condition

Header.Contact.URL.Host contains 'pstnhub.microsoft.com'
Figure 36: Configuring Condition Table

3.

Click Apply.

- 38 -

2. Configuring AudioCodes' SBC

2.19

SBC for Teams DR Hosting

Configuring Classification Rules
This section describes how to configure Classification rules. A Classification rule classifies incoming
SIP dialog-initiating requests (e.g., INVITE messages) to a "source" IP Group. The source IP Group is
the SIP entity that sent the SIP dialog request. Once classified, the device uses the IP Group to process
the call (manipulation and routing).
You can also use the Classification table for employing SIP-level access control for successfullyclassified calls, by configuring Classification rules with whitelist and blacklist settings. If aClassification rule is configured as a whitelist ("Allow"), the device accepts the SIP dialog andprocesses the call. If the Classification rule is configured as a blacklist ("Deny"), the device rejects the
SIP dialog.
To configure a Classification rule:
1.

Open the Classification table (Setup menu > Signaling & Media tab > SBC folder >Classification Table).

2.

Configure Classification rules as shown in the table below:
Table 14: Classification Rules

Index

Name

Source SIP
Interface

Source IP
Address

Message
Condition

ActionType

Source IP
Group

0Teams_52_112(arbitrary name)Teams

52.112.*.*

TeamsContact

Allow

Teams

1

Teams_52_113(arbitrary name)Teams

52.113.*.*

TeamsContact

Allow

Teams

2

Teams_52_114(arbitrary name)Teams

52.114.*.*

TeamsContact

Allow

Teams

3

Teams_52_115(arbitrary name)Teams

52.115.*.*

TeamsContact

Allow

Teams

4

Teams_52_122(arbitrary name)Teams

52.122.*.*

TeamsContact

Allow

Teams

5

Teams_52_123(arbitrary name)Teams

52.123.*.*

TeamsContact

Allow

Teams

3.

Click Apply.

- 39 -

2. Configuring AudioCodes' SBC

2.20

SBC for Teams DR Hosting

Configuring IP-to-IP Call Routing Rules
This section describes how to configure IP-to-IP call routing rules. These rules define the routes forforwarding SIP messages (e.g., INVITE) received from one IP entity to another. The SBC selects therule whose configured input characteristics (e.g., IP Group) match those of the incoming SIP message.
If the input characteristics do not match the first rule in the table, they are compared to the second
rule, and so on, until a matching rule is located. If no rule is matched, the message is rejected.
The example shown below only covers IP-to-IP routing, though you can route the calls from SIP
Trunks to Teams and vice versa. See AudioCodes' SBC documentation for more information on how
to route in other scenarios.
The following IP-to-IP Routing Rules will be defined:◼

Terminate SIP OPTIONS messages on the SBC that are received from any entity◼

Terminate REFER messages to Teams Direct Routing◼

Destination Tag based Routing (from/to Microsoft Teams Direct Routing or SIP Trunks)

To configure IP-to-IP routing rules:
1.

Open the IP-to-IP Routing table (Setup menu > Signaling & Media tab > SBC folder > Routing >IP-to-IP Routing).

2.

Configure routing rules as shown in the table below:

Index

Name

Source IP
Group

RequestType

0

Terminate OPTIONSAny

OPTIONS

1

Refer Termination(arbitrary name)Any

2

Dest Tag Based Routing(arbitrary name)

Any

Call
Triger

ReRoute IPGroup

Dest TypeDest
IP Group

Dest Address
REFER

Teams

Dest
Address
internal

Request URI

Teams

Destination
Tag

-

-

The configured routing rules are shown in the figure below:
Figure 37: Configured IP-to-IP Routing Rules in IP-to-IP Routing Table

The routing configuration may change according to your specific deployment topology.

- 40 -

2. Configuring AudioCodes' SBC

2.21

SBC for Teams DR Hosting

Configuring Firewall Settings
As extra security, there is an option to configure traffic filtering rules (access list) for incoming traffic
on AudioCodes SBC. For each packet received on the configured network interface, the SBC searches
the table from top to bottom until the first matching rule is found. The matched rule can permit(allow) or deny (block) the packet. Once a rule in the table is located, subsequent rules further down
the table are ignored. If the end of the table is reached without a match, the packet is accepted.
Please note that the firewall is stateless. The blocking rules will apply to all incoming packets,
including UDP or TCP responses.
To configure a firewall rule:
1.

Open the Firewall table (Setup menu > IP Network tab > Security folder> Firewall).

2.

Configure the following Access list rules for Teams Direct Rout IP Interface:
Table 15: Firewall Table Rules

Index

Source IP

SubnetPrefix

Start
Port

End
Port

ProtocolUse SpecificInterface

Interface
ID

Allow
Type

0

<Public DNS Server IP>(e.g., 8.8.8.8)

32

0

65535

Any

Enable

WAN_IFAllow

1

52.112.0.0

14

0

65535

TCP

Enable

WAN_IFAllow

2

52.122.0.0

15

0

65535

TCP

Enable

WAN_IF

Allow

3

xxx.xxx.xxx.xxx

32

0

65535

UDP

Enable

WAN_IFAllow

49

0.0.0.0

0

0

65535

Any

Enable

WAN_IFBlock

For information about prerequisites and planning your deployment, refer to Plan Direct
Routing.
Be aware, that if in your configuration, connectivity to SIP Trunk (or other entities) is
performed through the same IP Interface as Teams (WAN_IF in our example), you must
add rules to allow traffic from these entities. See an example in the row of index 3.

- 41 -

2. Configuring AudioCodes' SBC

2.22

SBC for Teams DR Hosting

Configuring SBC To Play Music On Hold (Optional)
Teams Hold music is not supported by Microsoft in consultative transfer of a PSTN call. The transferee
will hear silence during the transfer. To overcome this issue, it is possible to configure SBC to playmusic during a consultative transfer. To do this, a Prerecorded Tones (PRT) file needs to be prepared
and loaded to the SBC. This section shows how to load a PRT file to the SBC. For a detailed procedure
how to create a Prerecorded Tones (PRT) file, refer to appropriated AudioCodes' device User Manual
document.
Update configuration of the SIP Trunk IP Profile:1.

Open the Proxy Sets table (Setup > Signaling and Media > Coders and Profiles > IP Profiles).

2.

Choose SIP Trunk IP Profile, created in the Section 2.15 on the page 33. Configure theparameters using the table below as reference.
Table 16: Update Configuration of the SIP Trunk IP Profile
Parameter

Value

SBC Hold
Remote Hold Format

Send Only

Reliable Held Tone Source

No

Play Held Tone

Internal

3.

Click Apply, and then save your settings to flash memory.

To load PRT file to the device using the Web interface:
1.

Open the Auxiliary Files page:•

Toolbar: From the Actions drop-down menu, choose Auxiliary Files.

•

Navigation tree: Setup menu > Administration tab > Maintenance folder > Auxiliary
Files.

2.

Click the Browse button corresponding to the Prerecorded Tones file type that you want toload, navigate to the folder in which the file is located, and then click Open;the name and path of the file appear in the field next to the Browse button.

3.

Click the Load File button corresponding to the file you want to load.

4.

Save the loaded auxiliary files to flash memory.
- 42 -

3. Verifying the Pairing between the SBC and Direct Routing

3

SBC for Teams DR Hosting

Verifying the Pairing between the SBC and Direct
Routing
After you've paired the SBC with Direct Routing, validate that the SBC can successfully exchange
OPTIONs with Direct Routing.
To validate the pairing using SIP OPTIONS:
1.

Open the Proxy Set Status page (Monitor > VOIP Status > Proxy Set Status).

2.

Find the Direct SIP connection and verify that 'Status' is online. If you see a failure, you need totroubleshoot the connection first, before configuring voice routing.
Figure 38: Proxy Set Status- 43 -

4. Making a Test Call

4

SBC for Teams DR Hosting

Making a Test Call
After installation is complete, you can run a test call from the SBC to a registered user, and in theother direction as well. Running a test call will help to perform diagnostics and to check theconnectivity for future support calls or setup automation.
Test calls can be performed using the Test Agent, integral to AudioCodes' SBC. The Test Agent gives
you the ability to remotely verify connectivity, voice quality and SIP message flow between SIP UAs.
A simulated endpoint can be configured on the SBC to test SIP signaling of calls between the SBC anda remote destination. This feature is useful because it can remotely verify SIP message flow without
involving the remote end in the debug process. The SIP test call simulates the SIP signaling process:Call setup, SIP 1xx responses, through to completing the SIP transaction with a 200 OK.
The test call sends Syslog messages to a Syslog server, showing the SIP message flow, tone signals(e.g., DTMF), termination reasons, as well as voice quality statistics and thresholds (e.g., MOS).
To configure the Test Agent:
1.

Open the Test Call Rules table (Troubleshooting menu > Troubleshooting tab > Test Call > Test
Call Rules).

2.

Configure a test call according to the parameters of your network. For detailed description
refer to AudioCodes User Manual documents.

To start, stop and restart a test call:1.

In the Test Call Rules table, select the required test call entry.

2.

From the Action drop-down list, choose the required command:•

Dial: Starts the test call (applicable only if the test call party is the caller).

•

Drop Call: Stops the test call.

•

Restart: Ends all established calls and then starts the test call session again.

- 44 -

5. Configuring via UMP 365 (Optional)

5

SBC for Teams DR Hosting

Configuring via UMP 365 (Optional)
AudioCodes’ User Management Pack 365 (UMP 365) SP Edition is a software application that
simplifies the carriers’ management of its customers (Microsoft Office 365 tenants) onboarding
automation, users MACD and lifecycle management of Microsoft Teams, SharePoint and OneDrive
policies with Microsoft Direct Routing capabilities.
The application is an asynchronous model. This implies that changes to users will only be applied
after replication takes place, either from scheduled tasks or by forcing a replication cycle from within
the web application.
The figure below displays an example screen including a list of M365 customers tenants:
Figure 39: Provider Main Screen View◼

View typical Microsoft 365 Tenant Phone Numbers◼

Audit activities◼

View queue for tasks status and results◼

Update the Microsoft 365 Setting
Figure 40: Customer Tenant view – User List

For a detailed description, refer to AudioCodes User Management Pack 365 SP Edition Installation
and Administration Guide.
- 45 -

A. Syntax Requirements for SIP Messages 'INVITE' and 'OPTIONS'A

SBC for Teams DR Hosting

Syntax Requirements for SIP Messages 'INVITE'
and 'OPTIONS'The syntax of SIP messages must conform with Direct Routing requirements.
This section covers the high-level requirements for the SIP syntax used in 'INVITE' and 'OPTIONS'
messages. You can use the information presented here as a first step when troubleshooting
unsuccessful calls. AudioCodes has found that most issues are related to incorrect syntax in SIP
messages.

A.1

Terminology
Strictly required. The deployment does not function correctly without the correct
configuration of these parameters.

Must

A.2

Syntax Requirements for 'INVITE' Messages
Figure 41: Example of an 'INVITE' Message◼

Contact header•

MUST: When placing calls to the Direct Routing interface, the 'CONTACT' header musthave the SBC FQDN in the URI hostname•

Syntax: Contact: <phone number>@<FQDN of subdomain in the SBC>:<SBC
Port>;<transport type>•

If the parameter is not configured correctly, calls are rejected with a '403 Forbidden'
message.

- 46 -

A. Syntax Requirements for SIP Messages 'INVITE' and 'OPTIONS'

A.3

SBC for Teams DR Hosting

Requirements for 'OPTIONS' Messages Syntax
Figure 42: Example of 'OPTIONS' message◼

Contact header•

MUST: When sending OPTIONS to the Direct Routing interface, the 'CONTACT' header
must have the Carrier Trunk FQDN in the URI hostname•

Syntax: Contact: <phone number>@<Carrier Trunk FQDN>:<SBC Port>;<transport type>•

If the parameter is not configured correctly, the calls are rejected with a '403 Forbidden'
message

The table below shows where in the Web interface the parameters are configured and where in thisdocument you can find the configuration instructions.
Table 17: Syntax Requirements for an 'OPTIONS' Message
Parameter
Contact

Where configured
Setup > Signaling and Media > Core Entities > IP Groups><Group Name> > Local Host Name
In IP Group, 'Contact' must be configured. In this field('Local Host Name'), define the local host name of the SBC
as a string, for example, sbc1.AUDCTrunk.ACeducation.info.
The name changes the host name in the call received fromthe IP Group.

- 47 -How to configure
See Section 2.16.

A. Syntax Requirements for SIP Messages 'INVITE' and 'OPTIONS'

A.4

SBC for Teams DR Hosting

Connectivity Interface Characteristics
The table below shows the technical characteristics of the Direct Routing interface.
In most cases, Microsoft uses RFC standards as a guide during development, but does not guarantee
interoperability with SBCs - even if they support all the parameters in the table below - due to thespecifics of the implementation of the standards by SBC vendors.
Microsoft has a partnership with some SBC vendors and guarantees their devices' interoperability
with the interface. All validated devices are listed on Microsoft's website. Microsoft only supports
devices that are validated in order to connect to the Direct Routing interface.
AudioCodes is one of the vendors who are in partnership with Microsoft.
AudioCodes' SBCs are validated by Microsoft to connect to the Direct Routing interface.
Table 18: Teams Direct Routing Interface - Technical Characteristics

Category

ParameterPorts and IP
rangesTransport
and Security

Value

Comments

SIP Interface FQDN
Name

See Microsoft's document Deploying Direct Routing Guide.

-

IP Addresses range for
SIP interfaces

See Microsoft's document Deploying Direct Routing Guide.

-

SIP Port

5061-

IP Address range forMedia

See Microsoft's document Deploying Direct Routing Guide.

-Media port range on
Media Processors

See Microsoft's document Deploying Direct Routing Guide.

-Media Port range on
the client

See Microsoft's document Deploying Direct Routing Guide.

-

SIP transport

TLS-

Media Transport

SRTP

-

SRTP Security Context

DTLS, SIPS
Note: Support for DTLS is pending. Currently, SIPS must be
configured. When support for DTLS will be announced, it
will be the recommended context.

Crypto Suite

AES_CM_128_HMAC_SHA1_80, non-MKI

Control protocol for
media transport

SRTCP (SRTCP-Mux recommended)

Supported Certification
Authorities

See the Deployment Guide-

Transport for Media
Bypass (of configured)◼
◼

-

Audio codecs◼

ICE-lite (RFC5245) – recommended
Client also has Transport Relays

https://tools.ietf.org/ht
ml/rfc5763

Using RTCP MUX helps
reduce the number ofrequired ports

G711
Silk (Teams clients)
Opus (WebRTC clients) - only if Media Bypass is used
◼ G729

-

◼
◼

-

◼
◼

CodecsOther codecs

◼
◼
◼
◼

CN
Required narrowband and wideband
RED - Not required
DTMF - Required
Events 0-16
Silence Suppression - Not required- 48 -

B. SIP Proxy Direct Routing Requirements

B

SBC for Teams DR Hosting

SIP Proxy Direct Routing Requirements
Teams Direct Routing has three FQDNs:◼

sip.pstnhub.microsoft.com [Global FQDN. The SBC attempts to use it as the first priority
region. When the SBC sends a request to resolve this name, the Microsoft Azure DNS server
returns an IP address pointing to the primary Azure datacenter assigned to the SBC. The
assignment is based on performance metrics of the datacenters and geographical proximity to
the SBC. The IP address returned corresponds to the primary FQDN.]◼

sip2.pstnhub.microsoft.com [Secondary FQDN. Geographically maps to the second priority
region.]◼

sip3.pstnhub.microsoft.com [Tertiary FQDN. Geographically maps to the third priority region.]

These three FQDNs must be placed in the order shown above to provide optimal quality of experience(less loaded and closest to the SBC datacenter assigned by querying the first FQDN).
The three FQDNs provide a failover if a connection is established from an SBC to a datacenter that is
experiencing a temporary issue.

B.1

Failover Mechanism
The SBC queries the DNS server to resolve sip.pstnhub.microsoft.com. The primary datacenter isselected based on geographical proximity and datacenters performance metrics.
If during the connection the primary datacenter experiences an issue, the SBC will attempt
sip2.pstnhub.microsoft.com which resolves to the second assigned datacenter, and in rare cases if
datacenters in two regions are unavailable, the SBC retries the last FQDN
(sip3.pstnhub.microsoft.com) which provides the tertiary datacenter IP address.
The SBC must send SIP OPTIONS to all IP addresses that are resolved from the three FQDNs, that is,
sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com.

- 49 -

International Headquarters
1 Hayarden Street,
Airport City
Lod 7019900, Israel
Tel: +972-3-976-4000
Fax: +972-3-976-4040
AudioCodes Inc.
80 Kingsbridge Rd
Piscataway, NJ 08854, USA
Tel: +1-732-469-0880
Fax: +1-732-469-2298

Contact us: https://www.audiocodes.com/corporate/offices-worldwide
Website: https://www.audiocodes.com©2023 AudioCodes Ltd. All rights reserved. AudioCodes, AC, HD VoIP, HD VoIP Sounds Better, IPmedia,
Mediant, MediaPack, What’s Inside Matters, OSN, SmartTAP, User Management Pack, VMAS, VoIPerfect,
VoIPerfectHD, Your Gateway To VoIP, 3GX, VocaNom, AudioCodes One Voice, AudioCodes Meeting
Insights, and AudioCodes Room Experience are trademarks or registered trademarks of AudioCodes
Limited. All other products or trademarks are property of their respective owners. Product specifications
are subject to change without notice.

Document #: LTRT-13338