Page History

Overview

This best practice details how to use Microsoft Azure AD to automatically route calls from a SIP Trunk or PSTN to Microsoft Teams Direct Routing at the same time user migrates to Microsoft Teams.

In this network scenario, a call arrives from the carrier and the 

• If the user has been migrated to Teams, the call is sent to the Teams user using Microsoft Direct Routing.
• If the user is not a Teams user, call is sent to the PBX phone using the PBX connection.

Overview - Call Routing Logic 

In the configuration example used for this Best Practice, a call arrives from the SIP Trunk and an IP address is associated with a SIP Signaling Group (SIP SG). The SIP Signaling Group points to a Call Routing Table which in turn specifies a Transformation Table.

The Transformation Table contains two entries:

• One transformation entry formats the Called Number to match the format used in Azure AD. The 

  Spacevars
  0 product

  adds a "+" to match the format of the telephoneNumber Azure Active Directory user attribute.
• The second transformation entry searches for this formatted value in the phoneNumber Active Directory user attribute stored in the local Azure AD cache.

For the purpose of this example, the following attributes are used:

Step 1: Prerequisites

The following prerequisites are required for configuring the 

• SBC 1000, SBC 2000 or 

  Spacevars
  0 series3

• Spacevars
  0 product

   License includes Active Directory
• Active Azure subscription
• Azure Active Directory tenant associated with your subscription (either synchronized with an on-premises directory or a cloud-only directory)

Setup the 

Spacevars
0 product

Before 

Configure the 

Spacevars
0 product

to Access PSTN, PBX and Direct Routing

Configure the 

Anchor
Prepare Prepare

Prepare Azure Active Directory Domain Services

1. Configure Azure AD Domain Services. Refer to: Create and Configure an Azure Active Directory Domain Services instance.

2. Configure LDAPS on Azure AD Domain Services. Refer to: Configure Secure LDAP for an Azure Active Directory Domain Services Managed Domain. The section "Export a certificate for client computers" is not required.

   1. Take note of the "Secure LDAP External IP Address" or the FQDN that you associated. In this example, ldaps.domain.com is used.

   2. Add the SBC Public IP address to the Azure AD Domain Services Network Security Group (AADDS-domain.com-NSG).

3. Create a user in Active Directory with the correct "AAD DC Administrators". This user is used to query Azure AD from the 

   Spacevars
   0 product

   to read the Azure AD information. In this example, admin@domain.com is used.

Step 2: Configure 

Spacevars
0 product

for Azure Active Directory

Verify Active Directory License

Active Directory based call routing can be preformed only with an AD feature license. Verify this license is installed as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to System > Licensing > Current Licenses.

3. Verify that the Active Directory feature is licensed.

   Caption
   0 Figure 1 View Active Directory License

   
   

   Info
   For detailed information on licenses, refer to: Node-Locked Licensing.

   
   

Create/Configure Domain Controller

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Auth and Directory Services > Active Directory > Domain Controllers.
3. Click the Add Domain Controller icon at the top of the Domain Controllers Table page.

4. Add a domain controller per the parameters below. For details on creating a Domain Controller, refer to Adding and Modifying Domain Controllers.

5. Click OK.

   Caption
   0 Figure 1 Domain Controller Screen

   
   

   Caption
   0 Figure 1 Domain Controller Configuration
   Attribute Value Description Azure AD Domain Controller Address <"Secure LDAP External IP Address" or the FQDN that you associated to it.>. Enter the user created in step 2 in Prepare Azure Active Directory Domain Services. Example: ldaps.domain.com. DC Type Call Route Search Scope <AD object that contains the domain user>  Example: DC=domain,DC=com LDAP Query <Filter to query the proper user>. Example: displayName=* Server Timeout 5 User Name <User used to query Azure AD>. Enter the name created in step 3 in Prepare Azure Active Directory Domain Services. Example: admin@domain.com. Password <Password for admin@domain.com> DC Role Primary DC Priority 1

   
   

Create/Configure Active Directory

Create and configure an Active Directory entry as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Auth and Directory Services > Active Directory > Configuration.
3. Configure the settings per the table below. For details on Active Directory, refer to Configuring the SBC Edge Portfolio for Active Directory.

4. Click Apply.

   Caption
   0 Figure 1 Active Directory Screen

   
   

   Caption
   0 Figure 1 Active Directory Configuration
   Attribute Value AD Enabled True Use TLS True Operating Mode Update Query/Cache Attribute displayName, telephoneNumber Nested Group Lookup for Authentication True Normalize Cache False Update Frequency 1440 Configure Initial Update Time False AD Backup Failure Alarm Enable Encrypt AD Cache True

   
   

Verify Telephone Number in AD Query 

The Active Directory Cache Query tool allows you to query the local AD Cache for records that match a selected property/value pair. The query returns the records associated with the first match it finds. This tool is useful in determining if the Cache has been updated after a record has been added on the Domain Controller. 

Perform an AD query as follows:

1. In the WebUI, click the Diagnostics tab.
2. In the left navigation pane, go to Tools > Query AD Cache.
3. In the Property to Match drop down list, select telephoneNumber.
   
4. In the Value to Match field, enter the Skype user's telephoneNumber (i.e:+12122139087)

5. Click OK.
   The query should return results similar to those shown below. 

   Caption
   0 Figure 1 Query Results

   
   If the request is failing, LDAPS may be denying the ACL that protects the Logical Interface for Teams. Create the following rules:
   
   On the Outbound ACL, create the rule with the following parameters (ensure this rule is higher than "Deny All" rule):

   Caption
   0 Figure 1 Outbound ACL

   
   

   Caption
   0 Figure 1 Outbound ACL Configuration
   Attribute  Value Description Outbound LDAPS Request Protocol TCP Action Allow Port Selection Method Range Source IP Address <IP Address of your logical interface> Source Netmask 255.255.255.255 Source Minimum Port Number 0 Source Maximum Port Number 65535 Destination IP Address <"Secure LDAP External IP Address"> Destination Netmask 255.255.255.255 Destination Minimum Port Number 636 Destination Maximum Port Number 636

   
   On the inbound ACL, create the rule with the following parameters (ensure this rule is higher than "Deny All" rule):

   Caption
   0 Figure 1 Inbound ACL

   
   

   Caption
   0 Figure 1 Inbound ACL Configuration
   Attribute  Value Description Outbound LDAPS Response Protocol TCP Action Allow Port Selection Method Range Source IP Address <"Secure LDAP External IP Address"> Source Netmask 255.255.255.255 Source Minimum Port Number 636 Source Maximum Port Number 636 Destination IP Address <IP Address of your logical interface> Destination Netmask 255.255.255.255 Destination Minimum Port Number 0 Destination Maximum Port Number 65535

   
   

   Info
   For detailed information about ACLs, refer to Working with Access Control Lists and Session Control.

   
   

Step 3: Configure SBC for Active Directory Routing

Create/Configure Transformation Tables

A Transformation table contains a list of entries that contain routing rules. Two Transformation table entries are required:

• Entry for the Called Number to match the format used in Azure AD.
• Entry to search for the formatted value in the phoneNumber Active Directory user attribute stored in the local Azure AD cache.

Create the Transformation Table entries as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Call Routing > Transformation.

3. Create a Transformation table called From SIP-Trunk to Teams user.  For details, refer to Managing Transformation Tables.

4. In the left navigation pane, select the Transformation Table created in the previous step.

5. Add two entries. See below for configuration. For details, refer to Creating and Modifying Entries to Transformation Tables.

   Caption
   0 Figure 1 From SIP-Trunk Teams User - Entry 1

   
   

   Caption
   0 Figure 1 From SIP-Trunk to Teams Entry 2 - Attributes
   Attribute Value Match Type Mandatory Input Field Type Called Address/Number Input Field Value (.*) Output Field Type User Value 1 Output Field Value +\1

   
   

   Caption
   0 Figure 1 From SIP-Trunk to Teams User - Entry 2

   
   

   Caption
   0 Figure 1 From SIP-Trunk to Teams Entry 2 - Attributes
   Attribute Value Match Type Mandatory Input Field Type User Value 1 Input Field Value =telephoneNumber= Output Field Type Called Address/Number Output Field Value =telephoneNumber=