Configure Teams Direct Routing: The Definitive Guide (2023)

This document describes how to configure teams direct routing Hosting model and refers to the AudioCodes SBC configuration only.

Teams Direct Routing

Teams Direct Routing allows connecting a customer-provided SBC to Microsoft Phone System. The customer-provided SBC can be connected to almost any telephony trunk, or connect with third-party PSTN equipment.

The connection allows:

• Using virtually any PSTN trunk with Microsoft Phone System
• Configuring interoperability between customer-owned telephony equipment, such as third-party PBXs, analog devices, and Microsoft Phone System

AudioCodes SBC Product Series

AudioCodes’ family of SBC devices enables reliable connectivity and security between the enterprise’s VoIP network and the service provider’s VoIP network. The SBC provides perimeter defense as a way of protecting enterprises from malicious VoIP attacks; mediation for allowing the connection of any PBX and/or IP-PBX to any service provider; and Service Assurance for service quality and manageability.

Designed as a cost-effective appliance, the SBC is based on field-proven VoIP and network services with a native host processor, allowing the creation of purpose-built multiservice appliances, providing smooth connectivity to cloud services, with integrated quality of service, SLA monitoring, security and manageability. The native implementation of SBC provides a host of additional capabilities that are not possible with standalone SBC appliances such as VoIP mediation, PSTN access survivability, and third-party value-added services applications. This enables enterprises to utilize the advantages of converged networks and eliminate the need for standalone appliances.

AudioCodes’ SBC is available as an integrated solution running on top of its field-proven Mediant Media Gateway and Multi-Service Business Router platforms, or as a software-only solution for deployment with third-party hardware. The SBC can be offered as a Virtualized SBC, supporting the following platforms: Hyper-V, AWS, AZURE, AWP, KVM and VMWare.

Configuring AudioCodes SBC

This section shows on how to configure AudioCodes’ SBC for internetworking with Teams Direct Routing. The figure below shows an example of the connection topology for the hosting model. Multiple connection entities are shown in the figure:

• Teams Phone Systems Direct Routing Interface on the WAN.
• Service Provider SIP Trunk.

Tenants Domain Structure:

Prerequisites

Before you begin configuration, make sure you have these for every Hosting SBC you want to pair:

• Public IP address.
• FQDN name matching SIP addresses of the users.
• Public certificate, issued by one of the supported CAs.

SBC Domain Name in a Carrier’s Tenant

The SBC domain name must be from one of the names registered in ‘Domains’ of the tenant. You cannot use the *.onmicrosoft.com tenant for the domain name.

DNS Names Registered by an Administrator for a Carrier’s Tenant:

Example of Registered DNS Names:

For activating the domain, the Hosting Provider needs to add at least one user from the SIP domain registered for the tenant. For example, you can provide users sbc@Customers.aceducation.info with the Domain FQDN Customers.aceducation.info if this name is registered for this tenant. You should create at least one licensed user belonging to the SBC domain you added as described above.

Example of a user belonging to SBC Carrier’s Domain:

SBC Domain Name in a Customer’s Tenant

For each Customer’s tenant, you should add a domain belonging to a carrier that points to a customer tenant.

Example of a user for Carrier SBC in Customer Domain:

The following IP address and FQDN are used as examples in this guide:

Each customer needs to add at least one user from the Carrier’s SIP domain registered for the tenant. For example, you can provide users sbc@SBC2.Customers.aceducation.info with the Domain FQDN sbc2.Customers.aceducation.info so long as this name is registered for this tenant. You should create at least one licensed user belonging to your SBC domain that you added in the step above.

SBC Configuration Concept

The figure below illustrates the concept behind the configuration of AudioCodes’ SBC device.

The routing from the SIP Trunk to Direct Routing is dependent on the Class 4 switch routing method. The routing decision can be based on:

• Customer DID Range
• Trunk Context (TGRP)
• IP Interface
• SIP Interface (UDP/TCP Port)
• Host name

The configuration shown in this document is based on Customer DID Range using Dial Plan.

Configure LAN and WAN IP Interfaces

This section describes on how to configure the SBC’s IP network interfaces. There are several ways to deploy the SBC. SBC interfaces with the following IP entities:

• Teams Direct Routing, located on the WAN.
• SIP Trunk – located on the LAN.
• SBC connects to the WAN through a DMZ network.
• Physical connection: The type of physical connection depends on the method used to connect to the Enterprise’s network. In the interoperability test topology, SBC connects to the LAN and DMZ using dedicated Ethernet ports (i.e., two ports and two network cables are used).SBC also uses two logical network interfaces: LAN (VLAN ID 1) and DMZ (VLAN ID 2).

Network Interfaces in the Topology with SIP Trunk on the LAN

Validate Configuration of Physical Ports and Ethernet Groups

The physical ports are automatically detected by the SBC. The Ethernet groups are also auto-assigned to the ports. In this step, only parameter validation is necessary.

To validate physical ports:

• Open the Physical Ports table (Setup menu > IP Network tab > Core Entities folder > Physical Ports).
• Validate that you have at least two physical ports detected by the SBC, one for LAN and the other for WAN. Make sure both ports are in Enabled mode.

To validate Ethernet Groups:

• Open the Ethernet Groups table (Setup menu > IP Network tab > Core Entities folder > Ethernet Groups).
• Validate that you have at least two Ethernet Groups detected by the SBC, one for LAN and the other for WAN.

Configure LAN and WAN VLANs

This section describes on how to define VLANs for each of the following interfaces:

• LAN Interface (assigned the name “LAN_IF”)
• WAN Interface (assigned the name “WAN_IF”)

To configure VLANs:

• Open the Ethernet Device table (Setup menu > IP Network tab > Core Entities folder > Ethernet Devices).
• There will be one existing row for VLAN ID 1 and underlying interface GROUP_1.
• Add another VLAN ID 2 for the WAN side.

Configure Network Interfaces

This section describes on how to configure the IP network interfaces for each of the following interfaces:

• LAN Interface (assigned the name “LAN_IF”)
• WAN Interface (assigned the name “WAN_IF”)

To configure network parameters for both LAN and WAN interfaces:

• Open the IP Interfaces table (Setup menu > IP Network tab > Core Entities folder > IP Interfaces).
• Configure the IP interfaces as follows (your network parameters might be different)

The configured IP network interfaces are shown below.

Configure TLS Context

The configuration instructions in this section are based on the following domain structure that must be implemented as part of the certificate which must be loaded to the host SBC:

CN: customers.ACeducation.info
SAN: *.customers.ACeducation.info

This certificate module is based on the Service Provider’s own TLS Certificate.

The Teams Direct Routing Interface only allows TLS connections from SBC devices for SIP traffic with a certificate signed by one of the trusted Certificate Authorities. The currently supported Certification Authorities can be found at Microsoft website.

Configure the NTP Server Address

This section describes on how to configure the NTP server’s IP address. It is recommended to implement an NTP server (Microsoft NTP server or another global server) to ensure that the SBC receives the current date and time. This is necessary for validating certificates of remote parties. It is important, that NTP Server will be locate on the OAMP IP Interface (LAN_IF in our case) or will be accessible through it.

To configure the NTP server address:

• Open the Time & Date page (Setup menu > Administration tab > Time & Date).
• In the ‘Primary NTP Server Address’ field, enter the IP address of the NTP server (e.g., 10.15.28.1).

• Click Apply

Create a TLS Context for Teams Direct Routing

The section below describes on how to request a certificate for the SBC WAN interface and configure it, based on the example of DigiCert Global Root CA. The certificate is used by the SBC to authenticate the connection with Teams Direct Routing. The procedure involves the following main steps:

• Create a TLS Context for Teams Direct Routing.
• Generate a Certificate Signing Request (CSR) and obtain the certificate from a supported Certification Authority.
• Deploy the SBC and Root / Intermediate certificates on the SBC.

To create a TLS Context for Teams Direct Routing:

• Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).
• Create a new TLS Context by clicking +New, and then configure the parameters using the table below as reference.

Note: The table above exemplifies configuration focusing on interconnecting SIP and media. You might want to configure additional parameters according to your company’s policies. For example, you might want to configure Online Certificate Status Protocol (OCSP) to check if SBC certificates presented in the online server are still valid or revoked.

• Click Apply. You should see the new TLS Context and option to manage the certificates at the bottom of ‘TLS Context’ table.

Generate a CSR and Obtain the Certificate from a Supported CA

This section shows on how to generate a Certificate Signing Request (CSR) and obtain the certificate from a supported Certification Authority.

To generate a Certificate Signing Request (CSR) and obtain the certificate from a supported Certification Authority:

• Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).
• In the TLS Contexts page, select the Teams TLS Context index row, and then click the Change Certificate link located below the table; the Context Certificates page appears.

Under the Certificate Signing Request group, do the following:

• In the ‘Common Name [CN]’ field, enter the SBC FQDN name (based on example above, customers.ACeducation.info).
• In the ‘1st Subject Alternative Name [SAN]’ field, change the type to ‘DNS’ and enter the wildcard FQDN name (based on example above, *.customers.ACeducation.info).
• Change the ‘Private Key Size’ based on the requirements of your Certification Authority. Many CAs do not support private key of size 1024. In this case, you must change the key size to 2048.
• To change the key size on TLS Context, go to: Generate New Private Key and Self-Signed Certificate, change the ‘Private Key Size’ to 2048 and then click Generate Private-Key. To use 1024 as a Private Key Size value, you can click Generate Private-Key without changing the default key size value.
• Fill in the rest of the request fields according to your security provider’s instructions.
• Click the Create CSR button; a textual certificate signing request is displayed in the area below the button.

• Copy the CSR from the line “—-BEGIN CERTIFICATE” to “END CERTIFICATE REQUEST—-” to a text file (such as Notepad), and then save it to a folder on your computer with the file name, for example certreq.txt.
• Send certreq.txt file to the Certified Authority Administrator for signing.

Deploy the SBC and Root / Intermediate Certificates on the SBC

After obtaining the SBC signed and Trusted Root/Intermediate Certificate from the CA, install the following:

• SBC certificate
• Root / Intermediate certificates

To install the SBC certificate:

• In the TLS Contexts page, select the required TLS Context index row, and then click the Change Certificate link located below the table; the Context Certificates page appears.
• Scroll down to the Upload certificates files from your computer group.
• Click the Choose File button corresponding to the ‘Send Device Certificate…’ field, navigate to the certificate file obtained from the CA, and then click Load File to upload the certificate to the SBC.

• Validate that the certificate was uploaded correctly. A message indicating that the certificate was uploaded successfully is displayed in blue in the lower part of the page:

• In the SBC’s Web interface, return to the TLS Contexts page, select the required TLS Context index row, and then click the Certificate Information link, located at the bottom of the TLS. Then validate the Key size, certificate status and Subject Name:

• In the SBC’s Web interface, return to the TLS Contexts page.
• In the TLS Contexts page, select the required TLS Context index row, and then click the Trusted Root Certificates link, located at the bottom of the TLS Contexts page; the Trusted Certificates page appears.
• Click the Import button, and then select all Root/Intermediate Certificates obtained from your Certification Authority to load.
• Click OK; the certificate is loaded to the device and listed in the Trusted Certificates store.

The above method creates a signed certificate for an explicit device, on which a Certificate Sign Request was generated (and signed with private key). To be able to use the same wildcard certificate on multiple devices, use following methods.

Method of Generating and Installing the Wildcard Certificate

To use the same certificate on multiple devices, you may prefer using 3rd party application (e.g., DigiCert Certificate Utility for Windows) to process the certificate request from your Certificate Authority on another machine, with this utility installed.
After you’ve processed the certificate request and response using the DigiCert utility, test the certificate private key and chain and then export the certificate with private key and assign a password.

To install the certificate:

• Open the TLS Contexts page (Setup menu > IP Network tab > Security folder > TLS Contexts).
• In the TLS Contexts page, select the required TLS Context index row, and then click the Change Certificate link located below the table; the Context Certificates page appears.
• Scroll down to the Upload certificates files from your computer group and do the following:
  Enter the password assigned during export with the DigiCert utility in the ‘Private key pass-phrase’ field.
  Click the Choose File button corresponding to the ‘Send Private Key…’ field and then select the SBC certificate file exported from the DigiCert utility.

Deploy Baltimore Trusted Root Certificate

Loading Baltimore Trusted Root Certificates to AudioCodes’ SBC is mandatory for implementing an MTLS connection with the Microsoft Teams network.

The DNS name of the Teams Direct Routing interface is sip.pstnhub.microsoft.com. In this interface, a certificate is presented which is signed by Baltimore Cyber Baltimore CyberTrust Root with Serial Number: 02 00 00 b9 and SHA fingerprint: d4:de:20:d0:5e:66:fc: 53:fe:1a:50:88:2c:78:db:28:52:ca:e4:74. To trust this certificate, your SBC must have the certificate in Trusted Certificates storage. Download the certificate from and follow the steps above to import the certificate to the Trusted Root storage.

Before importing the Baltimore root certificate into AudioCodes’ SBC, make sure it’s in .PEM or .PFX format. If it isn’t, you need to convert it to .PEM or .PFX format, otherwise the ‘Failed to load new certificate’ error message is displayed. To convert to PEM format, use Windows local store on any Windows OS and then export it as ‘Base-64 encoded X.509 (.CER) certificate’.

Configure Media Realms

Media Realms allow dividing the UDP port ranges for use on different interfaces. In the example below, two Media Realms are configured:

• One for the LAN interface, with the UDP port starting at 6000 and the number of media session legs 100 (you need to calculate number of media session legs based on your usage)
• One for the WAN interface, with the UDP port range starting at 7000 and the number of media session legs 100

To configure Media Realms:

• Open the Media Realms table (Setup menu > Signaling & Media tab > Core Entities folder > Media Realms).
• Configure Media Realms as follows (you can use the default Media Realm – Index 0 – but modify it):

The configured Media Realms are shown in the figure below.

Configure SIP Signaling Interfaces

This section shows on how to configure a SIP Signaling Interfaces. A SIP Interface defines a listening port and type (UDP, TCP, or TLS) for SIP signaling traffic on a specific logical IP network interface (configured in the Interface Table above) and Media Realm.

Note that the configuration of a SIP interface for the SIP Trunk shows as an example and your configuration might be different. For specific configuration of interfaces pointing to SIP trunks and/or a third-party PSTN environment connected to the SBC, see the trunk / environment vendor documentation.

AudioCodes also offers a comprehensive suite of documents covering the interconnection between different trunks and equipment.

To configure a SIP interfaces:

• Open the SIP Interface table (Setup menu > Signaling & Media tab > Core Entities folder > SIP Interfaces).
• Configure SIP Interfaces. You can use the default SIP Interface (Index 0), but modify it as shown in the table below. The table below shows an example of the configuration. You can change some parameters according to your requirements.

The configured SIP Interfaces are shown in the figure below.

Configure Proxy Sets

The Proxy Set and Proxy Address defines TLS parameters, IP interfaces, FQDN and the remote entity’s port. Proxy Sets can also be used to configure load balancing between multiple servers. The example below covers configuration of a Proxy Sets for Teams Direct Routing and SIP Trunk. Note that the configuration of a Proxy Set for the SIP Trunk shows as an example and your configuration might be different.

For specific configuration of interfaces pointing to SIP trunks and/or the third-party PSTN environment connected to the SBC. AudioCodes also offers a comprehensive suite of documents covering the interconnection between different trunks and the equipment.

The Proxy Sets will later be applied to the VoIP network by assigning them to IP Groups.

To configure a Proxy Sets:

• Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets).
• Configure Proxy Sets as shown in the table below.

• The configured Proxy Sets are shown in the figure below.

Configure a Proxy Address

This section shows on how to configure a Proxy Address.

To configure a Proxy Address for SIP Trunk:

• Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets) and then click the Proxy Set SIPTrunk, and then click the Proxy Address link located below the table; the Proxy Address table opens.
• Click +New; the following dialog box appears.

• Configure the address of the Proxy Set according to the parameters described in the table below.

• Click Apply.

To configure a Proxy Address for Teams:

• Open the Proxy Sets table (Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets) and then click the Proxy Set Teams, and then click the Proxy Address link located below the table; the Proxy Address table opens.
• Click +New; the following dialog box appears.

• Configure the address of the Proxy Set according to the parameters described in the table below.

• Click Apply.

Configure the Dial Plan

For deployments requiring hundreds of routing rules (which may exceed the maximum number of rules that can be configured in the IP-to-IP Routing table), you can employ tags to represent the many different calling (source URI user name) and called (destination URI user name) prefix numbers in your routing rules.

Tags are typically implemented when you have users of many different called and/or calling numbers that need to be routed to the same destination (e.g., IP Group or IP address). In such a scenario, instead of configuring many routing rules to match all the required prefix numbers, you need only to configure a single routing rule using the tag to represent all the possible prefix numbers.

The Dial Plan (e.g., TeamsTenants) will be configured with a customer tenant FQDN tag per prefix.

To configure Dial Plans:

• Open the Dial Plan table (Setup menu > Signaling & Media tab > SIP Definitions folder > Dial Plan).
• Click New and then configure a Dial Plan name (e.g., TeamsTenants) according to the parameters described in the table below.
• Click Apply.
• In the Dial Plan table, select the row for which you want to configure dial plan rules and then click the Dial Plan Rule link located below the table; the Dial Plan Rule table appears.
• Click New; the following dialog box appears.

• Configure a dial plan rule according to the parameters described in the table below.

• Click Apply and then save your settings to flash memory

Configure Call Setup Rules

This section describes on how to configure Call Setup Rules based on customer DID range (Dial Plan). Call Setup rules define various sequences that are run upon receipt of an incoming call (dialog) at call setup, before the device routes the call to its destination.
Configured Call Setup Rules need be assigned to specific IP Group.

To configure a Call Setup Rules based on customer DID range (Dial Plan):

• Open the Call Setup Rules table (Setup menu > Signaling & Media tab > SIP Definitions folder > Call Setup Rules).
• Click New; the following dialog box appears.

• Configure a Call Setup rule according to the parameters described in the table below.

• Click Apply and then save your settings to flash memory.

Configure Message Manipulation Rules

This section describes on how to configure SIP message manipulation rules. SIP message manipulation rules can include insertion, removal, and/or modification of SIP headers. Manipulation rules are grouped into Manipulation Sets, enabling you to apply multiple rules to the same SIP message (IP entity).
Once you have configured the SIP message manipulation rules, you need to assign them to the relevant IP Group (in the IP Group table) and determine whether they must be applied to inbound or outbound messages.

To configure SIP message manipulation rule for Teams:

• Open the Message Manipulations page (Setup menu > Signaling & Media tab > Message Manipulation folder > Message Manipulations).
• Configure a new manipulation rule (Manipulation Set 4) for Teams IP Group. This rule applies to messages sent to the Teams IP Group. This replaces the host part of the SIP Contact Header with the value saved in the session variable ‘TenantFQDN’ during execution of the Call Setup Rule.

• Configuring SIP Message Manipulation Rule 0 (for Teams IP Group)

Configure a Coder Group

This section describes on how to configure coders (termed Coder Groups). As Teams Direct Routing supports the SILK and OPUS coders while the network connection to the SIP Trunk may restrict operation with a dedicated coders list, you need to add a Coder Group with the supported coders for each leg, the Teams Direct Routing and the SIP Trunk.

Note that the Coder Group ID for this entity will be assigned to its corresponding IP Profile in the next section.

To configure a Coder Group:

• Open the Coder Groups table (Setup menu > Signaling & Media tab > Coders & Profiles folder > Coder Groups).
• From the ‘Coder Group Name’ dropdown, select 1:Does Not Exist and add the required codecs as shown in the figure below.

• Click Apply and confirm the configuration change in the prompt that pops up.

Configure an IP Profile

This section describes on how to configure IP Profiles. An IP Profile is a set of parameters with user-defined settings related to signaling (e.g., SIP message terminations such as REFER) and media (e.g., coder type). An IP Profile need be assigned to specific IP Group.

To configure an IP Profile:

• Open the Proxy Sets table (Setup menu > Signaling & Media tab > Coders & Profiles folder > IP Profiles).
• Click +New to add the IP Profile for the Direct Routing interface. Configure the parameters using the table below as reference.

• Click Apply, and then save your settings to flash memory.
• Click +New to add the IP Profile for the SIP Trunk. Configure the parameters using the table below as reference.

• Click Apply and then save your settings to flash memory.

Configure IP Groups

This section describes on how to configure IP Groups. The IP Group represents an IP entity on the network with which the SBC communicates. This can be a server (e.g., IP-PBX or SIP Trunk) or it can be a group of users (e.g., LAN IP phones). For servers, the IP Group is typically used to define the server’s IP address by associating it with a Proxy Set. Once IP Groups are configured, they are used to configure IP-to-IP routing rules for denoting source and destination of the call.

To configure an IP Groups:

• Open the IP Groups table (Setup menu > Signaling & Media tab > Core Entities folder > IP Groups).
• Configure IP Group for the SIP Trunk.

• Configure IP Group for the Teams Direct Routing.

• The configured IP Groups are shown in the figure below.

Configure SRTP

This section describes on how to configure media security. The Direct Routing Interface needs to use of SRTP only, so you need to configure the SBC to operate in the same manner. By default, SRTP is disabled.

To enable SRTP:

• Open the Media Security page (Setup menu > Signaling & Media tab > Media folder > Media Security).
• From the ‘Media Security’ drop-down list, select Enable to enable SRTP.

• Click Apply

Configure Message Condition Rules

This section describes on how to configure the Message Condition Rules. A Message Condition defines special conditions (pre-requisites) for incoming SIP messages. These rules can be used as additional matching criteria for the IP-to-IP routing rules in the IP-to-IP Routing table.

To configure a Message Condition rule:

• Open the Message Conditions table (Setup menu > Signaling & Media tab > Message Manipulation folder > Message Conditions).
• Click New, and then configure the parameters as follows.

• Configuring Condition Table

• Click Apply

Configure Classification Rules

This section describes on how to configure Classification rules. A Classification rule classifies incoming SIP dialog-initiating requests (e.g., INVITE messages) to a “source” IP Group. The source IP Group is the SIP entity that sent the SIP dialog request. Once classified, the device uses the IP Group to process the call (manipulation and routing).
You can also use the Classification table for employing SIP-level access control for successfully classified calls, by configuring Classification rules with whitelist and blacklist settings. If a Classification rule is configured as a whitelist (“Allow”), the device accepts the SIP dialog and processes the call. If the Classification rule is configured as a blacklist (“Deny”), the device rejects the SIP dialog.

To configure a Classification rule:

• Open the Classification table (Setup menu > Signaling & Media tab > SBC folder > Classification Table).
• Click New, and then configure the parameters as follows.

• Configuring Classification Rule

• Click Apply.

Configure IP-to-IP Call Routing Rules

This section describes on how to configure IP-to-IP call routing rules. These rules define the routes for forwarding SIP messages (e.g., INVITE) received from one IP entity to another. The SBC selects the rule whose configured input characteristics (e.g., IP Group) match those of the incoming SIP message. If the input characteristics do not match the first rule in the table, they are compared to the second rule, and so on, until a matching rule is located. If no rule is matched, the message is rejected. The example shown below only covers IP-to-IP routing, though you can route the calls from SIP Trunk to Teams and vice versa.

The following IP-to-IP Routing Rules will be defined:

• Terminate SIP OPTIONS messages on the SBC
• Terminate REFER messages to Teams Direct Routing
• Calls from Teams Direct Routing to SIP Trunk
• Calls from SIP Trunk to Teams Direct Routing

To configure IP-to-IP routing rules:

• Open the IP-to-IP Routing table (Setup menu > Signaling & Media tab > SBC folder > Routing > IP-to-IP Routing).
• Configure routing rules as shown in the table below.

• The configured routing rules are shown in the figure below.

Note: The routing configuration may change according to your specific deployment topology.

Configure Firewall Settings

As extra security, there is an option to configure traffic filtering rules (access list) for incoming traffic on AudioCodes SBC. For each packet received on the configured network interface, the SBC searches the table from top to bottom until the first matching rule is found. The matched rule can permit (allow) or deny (block) the packet. Once a rule in the table is located, subsequent rules further down the table are ignored. If the end of the table is reached without a match, the packet is accepted. Please note that the firewall is stateless. The blocking rules will apply to all incoming packets, including UDP or TCP responses.

To configure a firewall rule:

• Open the Firewall table (Setup menu > IP Network tab > Security folder> Firewall).
• Configure the following Access list rules for Teams Direct Rout IP Interface.

Note: Be aware, that if in your configuration, connectivity to SIP Trunk (or other entities) is performed through the same IP Interface as Teams (WAN_IF in our example), you must add rules to allow traffic from these entities.

Verify the Pairing between the SBC and Direct Routing

After you’ve paired the SBC with Direct Routing using the New-CsOnlinePSTNGateway PowerShell command, validate that the SBC can successfully exchange OPTIONs with Direct Routing.

To validate the pairing using SIP options:

• Open the Proxy Set Status page (Monitor > VOIP Status > Proxy Set Status).
• Find the Direct SIP connection and verify that ‘Status’ is online. If you see a failure, you need to troubleshoot the connection first, before configuring voice routing.

Make a Test Call

After installation is complete, you can run a test call from the SBC to a registered user, and in the other direction as well. Running a test call will help to perform diagnostics and to check the connectivity for future support calls or setup automation.
Test calls can be performed using the Test Agent, integral to AudioCodes’ SBC. The Test Agent gives you the ability to remotely verify connectivity, voice quality and SIP message flow between SIP UAs.

A simulated endpoint can be configured on the SBC to test SIP signaling of calls between the SBC and a remote destination. This feature is useful because it can remotely verify SIP message flow without involving the remote end in the debug process. The SIP test call simulates the SIP signaling process: Call setup, SIP 1xx responses, through to completing the SIP transaction with a 200 OK.

The test call sends Syslog messages to a Syslog server, showing the SIP message flow, tone signals (e.g., DTMF), termination reasons, as well as voice quality statistics and thresholds (e.g., MOS).

To configure the Test Agent:

• Open the Test Call Rules table (Troubleshooting menu > Troubleshooting tab > Test Call > Test Call Rules).
• Configure a test call according to the parameters of your network. For detailed description refer to AudioCodes User Manual documents.

To start, stop and restart a test call:

• In the Test Call Rules table, select the required test call entry.
• From the Action drop-down list, choose the required command.
  Dial: Starts the test call (applicable only if the test call party is the caller).
  Drop Call: Stops the test call.
  Restart: Ends all established calls and then starts the test call session again.

Tenant Provisioning Script

The powershell script below implements a Direct Routing Tenant based on this Configuration.

The script is based on the assumption that a permanent configuration, not unique to a specific Direct Routing Tenant, is already configured (for example, Proxy Sets Table, Condition Table, IP-to-IP Routing, etc.).
Red = variables that must be set/changed for each tenant.
Green = constants unique to this Configuration

Access the powershell using a Telnet admin credentials.

The following script should be executed if the customer uses a Direct Inward Dialing (DID) service.

SIP Proxy Direct Routing Requirements

Teams Direct Routing has three FQDNs:

sip.pstnhub.microsoft.com [Global FQDN. The SBC attempts to use it as the first priority region. When the SBC sends a request to resolve this name, the Microsoft Azure DNS server returns an IP address pointing to the primary Azure datacenter assigned to the SBC. The assignment is based on performance metrics of the datacenters and geographical proximity to the SBC. The IP address returned corresponds to the primary FQDN.]
sip2.pstnhub.microsoft.com [Secondary FQDN. Geographically maps to the second priority region.]
sip3.pstnhub.microsoft.com [Tertiary FQDN. Geographically maps to the third priority region.]

These three FQDNs must be placed in the order shown above to provide optimal quality of experience (less loaded and closest to the SBC datacenter assigned by querying the first FQDN). The three FQDNs provide a failover if a connection is established from an SBC to a datacenter that is experiencing a temporary issue.

Failover Mechanism

• The SBC queries the DNS server to resolve sip.pstnhub.microsoft.com. The primary datacenter is selected based on geographical proximity and datacenters performance metrics.
• If during the connection the primary datacenter experiences an issue, the SBC will attempt sip2.pstnhub.microsoft.com which resolves to the second assigned datacenter, and in rare cases if datacenters in two regions are unavailable, the SBC retries the last FQDN (sip3.pstnhub.microsoft.com) which provides the tertiary datacenter IP address.
• The SBC must send SIP OPTIONS to all IP addresses that are resolved from the three FQDNs, that is, sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com.

Now It’s Your Turn:

So that’s how configure teams direct routing works.

Which finding from today’s report did you find most interesting? Or maybe you have a question about something that I covered.

Either way, I’d like to hear from you. So go ahead and leave a comment below.