Section | ||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Pagebreak
© 2021 Ribbon Communications Operating Company, Inc. © 2021 ECI Telecom Ltd. All rights reserved. The compilation (meaning the collection, arrangement and assembly) of all content on this site is protected by U.S. and international copyright laws and treaty provisions and may not be used, copied, reproduced, modified, published, uploaded, posted, transmitted or distributed in any way, without prior written consent of Ribbon Communications Inc.
The trademarks, logos, service marks, trade names, and trade dress (“look and feel”) on this website, including without limitation the RIBBON and RIBBON logo marks, are protected by applicable US and foreign trademark rights and other proprietary rights and are the property of Ribbon Communications Operating Company, Inc. or its affiliates. Any third-party trademarks, logos, service marks, trade names and trade dress may be the property of their respective owners. Any uses of the trademarks, logos, service marks, trade names, and trade dress without the prior written consent of Ribbon Communications Operating Company, Inc., its affiliates, or the third parties that own the proprietary rights, are expressly prohibited.
This document provides the configuration details for Ribbon's SBC SWe Lite interworking with Twilio Elastic SIP Trunk, Microsoft Teams Direct Routing and Cisco Unified Communication Manager.
The Ribbon Session Border Controller Software Edition Lite (SBC SWe Lite) provides best-in class communications security. The SBC SWe Lite dramatically simplifies the deployment of robust communications security services for SIP Trunking, Direct Routing, and Cloud UC services. SBC SWe Lite operates natively in the Azure and AWS Cloud as well as on virtual machine platforms including Microsoft Hyper-V, VMware and Linux KVM.
Twilio has developed an advanced SIP trunking service that addresses the key challenges that are holding back enterprises from realizing their communications transformation goals. Twilio Elastic SIP Trunking delivers global PSTN connectivity that enables enterprises to increase business agility, reduce costs and deliver uniform global reach.
Microsoft Phone System Direct Routing allows connection of a supported customer-provided Session Border Controller (SBC) to a Microsoft Phone System. Direct Routing enables using virtually any PSTN trunk with Microsoft Phone System and configuring interoperability between customer-owned telephony equipment, such as a third-party private branch exchange (PBX), analog devices, and Microsoft Phone System.
Cisco Unified Communication Manager is a core call-control application of Cisco UCM. It provides enterprise-class call control, session management, voice, video, messaging, mobility and conferencing services in a way that is efficient, highly secure, scalable and reliable.
This document provides configuration best practices for deploying Ribbon's SBC SWe Lite with Cisco Unified Communication Manager (CUCM) and Microsoft Teams for Twilio Elastic SIP Trunking interop. Note that these are configuration best practices and each customer may have unique needs and networks. Ribbon recommends that customers work with network design and deployment engineers to establish the network design which best meets their requirements.
It is not the goal of this guide to provide detailed configurations that will meet the requirements of every customer. Use this guide as a starting point and build the SBC configurations in consultation with network design and deployment engineers.
This is a technical document intended for telecommunications engineers with the purpose of configuring both the Ribbon SBC and the third-party product. Navigating the third-party product as well as the Ribbon SBC SWe Lite GUI is required. Understanding the basic concepts of TLS/TCP/UDP, IP/Routing, and SIP/SRTP is also necessary to complete the configuration and any required troubleshooting.
The following aspects are required before proceeding with the interop:
The configuration uses the following equipment and software:
Caption | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||
|
Info | ||
---|---|---|
| ||
Two Trunks (US and EMEA) were included for testing purpose. Customers can configure the Trunks as per their requirement. |
The sections in this document follow the sequence below. The reader is advised to complete each section for the successful configuration.
Anchor | ||||
---|---|---|---|---|
|
The SBC SWe Lite is available for deployment in AWS. It is created as a virtual machine (VM) hosted in AWS. To deploy an SBC SWe Lite instance, refer to Deploying an SBC SWe Lite via Amazon Web Services-AWS. Once SWe Lite instance is successfully created on AWS, retrieve the allocated NAT Public IPs, Ethernet IPs and Management IP. Also ensure ensure Twilio IP addresses are are whitelisted on AWS access list. For more details, visit the link given in the References section.
Open any browser and enter the SBC SWe Lite IP address.
Click Enter and log in with a valid User ID and Password.
This section describes how to view the status of each license along with a copy of the license keys installed on your SBC. The Feature Licenses panel enables you to verify whether a feature is licensed, along with the number of remaining licenses available for a given feature at run-time.
...
For more details on Licenses, refer to Cloud-Based SBC SWe Lite Deployment Licenses.
A Trusted CA Certificate is a certificate issued by a trusted certificate authority. Trusted CA Certificates are imported to the SBC SWe Lite to establish its authenticity on the network.
...
For more details on Certificates, refer to Working with Certificates.
Info | ||
---|---|---|
| ||
When the Verify Status field in the Certificate panel indicates Expired or Expiring Soon, replace the Trusted CA Certificate. You must delete the old certificate before importing a new certificate successfully. |
...
Warning | ||
---|---|---|
| ||
Most Certificate Vendors sign the SBC Edge certificate with an intermediate certificate authority. There is at least one, but there could be several intermediate CAs in the certificate chain. When importing the Trusted Root CA Certificates, import the root CA certificate and all Intermediate CA certificates. Failure to import all certificates in the chain causes the import of the SBC Edge certificate to fail. Please refer to Unable To Get Local Issuer Certificate for more information. |
The SBC SWe Lite supports five system created logical interfaces (known as Administrative IP, Ethernet 1 IP, Ethernet 2 IP, Ethernet 3 IP, and Ethernet 4 IP). In addition to the system created logical interfaces, the Ribbon SBC SWe supports user-created VLAN logical sub-interfaces.
...
After initial configuration, you may configure this logical interface using the Settings or Tasks tabs in the WebUI, or you can use the IP address configured during Initial Setup.
Static routes are used to create communication to remote networks. In a production environment, static routes are mainly configured for routing from a specific network to another network that you can only access through one point or one interface (single path access or default route).
...
Metric
Specifies the cost of this route and therefore indirectly specifies the preference of the route. Lower values indicate more preferred routes. The typical value is 1 for most static routes, indicating that static routes are preferred to dynamic routes.
The SBC Edge WebUI provides a built-in Easy Configuration wizard that lets you quickly and easily deploy the SBC for operation with provider endpoints (SIP trunk, ISDN PSTN trunk, or IP PBX trunk) and user endpoints (Microsoft Teams, Microsoft On Premises - Skype for Business/Lync, IP Phones, or ISDN PBX or IP PBX).
As the wizard runs, it directs you through three configuration steps:
...
During this interop:
...
Tip | ||
---|---|---|
| ||
Customers can also choose any standard approach to configure SBC SWe Lite using Easy Config Wizard. The following are a few possible ways:
|
Step 1: Configure US Trunk for Twilio along with Microsoft Teams using Multi-legged approach by following the steps below:
...
Step 1: Use Single-legged approach for Twilio EMEA Trunk configuration.
...
Step 1: Use the Single-legged approach to configure IP PBX.
...
The Easy Configuration Wizard does not currently set all Twilio applicable variables to the correct settings. This will be addressed in the subsequent SBC SWe Lite releases. Until then, please follow the procedures below.
Change the settings on all the SGs as follows:
...
Enable Static NAT and map the respective IP addresses.
An OPTIONS message is sent to the server. When this option is selected, additional configuration items are displayed:
...
Info | ||
---|---|---|
| ||
Repeat the above steps to enable OPTIONS on all the SIP Server Tables (TEAMS-TWILIO_US: Teams Direct Routing Server, TEAMS-TWILIO_US: Border Element, TEAMS-TWILIO_EMEA: Border Element and CUCM: Cisco CUCM). |
Enable Session Timers
From the Settings tab, navigate to SIP > SIP Profiles, Enable Session Timers and set the Timer as Required on all the SIP Profiles.
...
Specifies whether or not to use RTCP-based Dead Call Detection (DCD).
...
This section describes the steps to configure SBC SWe Lite with TLS/SRTP towards Twilio SIP Trunk. Ribbon strongly recommends encrypting the connection between Twilio SIP Trunk and SBC SWe Lite.
SDES-SRTP Profiles define a cryptographic context which is used in SRTP negotiation. SDES-SRTP Profiles required for enabling encryption and SRTP are applied to Media Lists. SDES-SRTP Profiles was previously named Media Crypto Profiles.
...
From the Settings tab, navigate to Media > Media List, Click the expand ( ) icon next to the entry.
...
Signaling Groups allow grouping telephony channels together for the purposes of routing and shared configuration. They are the entity to which calls are routed, as well as the location from which Call Routes are selected.
...
SIP Server Tables contain information about the SIP devices connected to the SBC Edge. The entries in the tables provide information about the IP Addresses, ports, and protocols used to communicate with each server. The Table Entries also contain links to counters that are useful for troubleshooting.
...
Info | ||
---|---|---|
| ||
Procedure and snapshots for TLS configuration are provided only for Twilio US Trunk. Follow the same procedure to modify Twilio EMEA Trunk. |
Transformation Tables facilitate the conversion of names, numbers and other fields when routing a call. They can, for example, convert a public PSTN number into a private extension number, or into a SIP address (URI). Every entry in a Call Routing Table requires a Transformation Table, and they are selected from there. In addition, Transformation tables are configurable as a reusable pool that Action sets can reference.
From the Settings tab, navigate to Transformation.
The Transformation Tables are created for MS Teams and Twilio US Trunk (TEAMS-TWILIO_US: From Microsoft Teams Direct Routing: Passthrough and TEAMS-TWILIO_US: From SIP Trunk: Passthrough respectively) through Easy Config Wizard. These are modified to allow specific patterns to reach the destination Signaling Group.
Each Transformation Table contains a list of entries considered as routing rules to execute on. Each rule is executed in order until the end of the table is reached or when a Mandatory entry fails to execute.
...
Follow the same procedure to create Transformation Tables for CUCM.
For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions.
...
Info | ||
---|---|---|
| ||
For details on Transformation Table Entry configuration, refer to Creating and Modifying Entries to Transformation Tables. For call digit matching and manipulation through the use of regular expressions, refer to Creating Call Routing Logic with Regular Expressions. |
Call Routing allows carrying of calls between Signaling Groups. Routes are defined by Call Routing Tables, which allow for flexible configuration of which calls are carried, and how they are translated.
...
The Call Routing Tables are created to route the calls between TEAMS-TWILIO_US: Teams Direct Routing SG and TEAMS-TWILIO_US: Border Element SG through Easy Config Wizard. The user is allowed to modify these tables as per the requirement.
Call Routing Tables are one of the central connection points of the system, linking Transformation Tables, Message Translations, Cause Code Reroute Tables, Media Lists and the three types of Signaling Groups(ISDN, SIP and CAS).
...
Set the following fields:
Admin State:
Enabled - Enables the call route entry for routing the call, displays in configuration header as
Route Priority:
Priority of the route from 1 (highest) to 10 (lowest). Higher priority routes are matched against before lower priority routes regardless of the order of the routes in the table.
Number/Name Transformation Table:
Specifies the Transformation Table to use for this routing entry. This drop down list is populated from the entries in the Transformation Table.
Destination Signaling Groups:
Specifies the Signaling Groups used as the destination of calls. The first operational Signaling Group from the list is chosen to place the call. Click the Add/Edit button to select the destination signaling group.
Audio Stream Mode:
DSP (default entry): The SBC uses DSP resources for media handling (transcoding) but it does not facilitate the capabilities/features between endpoints that are not supported within the SBC (codec/capability mismatch). When DSP is configured, the Signaling Groups enabled to support DSP are attempted in order.
Media Transcoding:
Enabled: Enable Transcoding on SIP-to-SIP calls.
SBC SWe Lite allows the user to create multiple entries to a Call Routing table. As there are four SIP Signaling Groups in this deployment, it is required to create multiple route entries to allow the call to reach a specific destination SIP Signaling Group.
...
Warning | ||
---|---|---|
| ||
In case of SIP URI calling, change the FQDN from sip.pstnhub.microsoft.com/sip2.pstnhub.microsoft.com/sip3.pstnhub.microsoft.com to interopdomain.com using the SMM and attach it to the Outbound Message Manipulation Table on TEAMS-TWILIO_US: Teams Direct Routing Signaling Group. |
All the calls initiated from Teams endpoint will have "PRIVACY: id" header. As Trusted interface is disabled on Twilio (US and EMEA) SIP profiles, SWe Lite sends out all the calls as Anonymous. In order to avoid this, we have used an SMM on the Inbound Message Manipulation list of TEAMS-TWILIO_US: Teams Direct Routing SIP SG.
...
The Message Manipulation feature comprises two primary components that work in concert to modify SIP messages. Those component are Condition Rules and Rule Tables.
Condition rules are simple rules that apply to a specific component of a message (e.g., diversion.uri.host, from.uri.host, etc.) the value of the field specified in the Match Type list box can match against a; literal value, token, or REGEX.
...
Use Regex Operation.
Operation specifies the match type for this condition.
From the Settings tab, navigate to SIP > Message Manipulation > Message Rule Table. Click the Create Message Rule Table( ) icon.
...
From the Settings tab, navigate to Signaling Groups > TEAMS-TWILIO_US: Teams Direct Routing.
...
Anchor | ||||
---|---|---|---|---|
|
From your Twilio Console, navigate to the Elastic SIP Trunking area (or click on the icon on the left vertical navigation bar).
Click on Authentication in the left navigation, and then click on IP Access Control Lists.
...
Create a new IP-ACL, for example call it "Ribbon" and add your SBCs IP addresses (Kindly refer to the section Ribbon Installing SBC Edge SWe Lite R9.0 on AWS Interop with Cisco UCM and Microsoft Teams Direct Routing for Twilio Elastic SIP Trunking : Interoperability Guide)
For each geographical region desired (eg. North America, Europe), create a new Elastic SIP Trunk.
...
Note: Here is where you can enable the use of TLS & SRTP on your Trunk, learn more here.
In the Termination section, select a Termination SIP URI.
...
Note: If you enabled “Secure Trunking”, then you need to include the “transport=tls” parameter in your Origination URIs, learn more here.
Continue to add the other Origination URIs, so you have the following configuration:
...
In this example, Origination traffic is first routed via Twilio’s Ashburn edge, if that fails then we'll route from Twilio’s Umatilla edge.
In the Numbers section of your Trunk, add the Phone Numbers that you want to associate with each Trunk. Remember to associate the Numbers from a given country in the right Trunk. For example, associate US & Canada Numbers with the North American Trunk and European Numbers with the European Trunk etc.
Unified Communications Manager Administration groups security-related settings for the SIP trunk to allow you to assign a single security profile to multiple SIP trunks. Security-related settings include device security mode, digest authentication, and incoming/outgoing transport type settings.
...
A SIP profile comprises the set of SIP attributes that are associated with SIP trunks and SIP endpoints. SIP profiles include information such as name, description, timing, retry, call pickup URI, and so on. The profiles contain some standard entries that you cannot delete or change.
...
Media resource management comprises working with media resource groups and media resource group lists. Media resource management provides a mechanism for managing media resources, so all Cisco Unified Communications Managers within a cluster can share them. Media resources provide conferencing, transcoding, media termination, annunciator, and music on hold services.
...
A Media Resource Group List provides a prioritized grouping of media resource groups. An application selects the required media resource, such as a music on hold server, from among the available media resources according to the priority order that is defined in a Media Resource Group List.
...
Choose the Media Resource Group created in the previous step from the Available Media Resource Groups list and click the down arrow that is located between the two panes. After a media resource group is added, its name moves to the Selected Media Resource Groups pane.
Use a trunk device to configure a logical route to a SIP network.
...
Info | ||
---|---|---|
| ||
Resetting/restarting a SIP device does not physically reset/restart the hardware; it only reinitializes the configuration that is loaded by Cisco Unified Communications Manager. For SIP trunks, Restart and Reset behave the same way, so all active calls will disconnect when either choice is pressed. |
A route pattern comprises a string of digits (an address) and a set of associated digit manipulations that route calls to a route list or a gateway. Route patterns provide flexibility in network design. They work in conjunction with route filters and route lists to direct calls to specific devices and to include, exclude, or modify specific digit patterns.
...
The End User Configuration window allows you to add, search, display, and maintain information about Unified Communications Manager end users. End users can control phones after you associate a phone in the End User Configuration window.
...
...
...
In Cisco Unified Communications Manager Administration, use the
...
The SIP URI scheme is a Uniform Resource Identifier(URI) scheme for the Session Initiation Protocol(SIP) multimedia communications protocol.
...
Cisco Unified Communications Manager uses SIP route patterns to route or block both internal and external calls.
...
Using Cisco Unified Communications Manager Administration, you configure and modify directory numbers (DNs) that are assigned to specific phones.
...
For Microsoft Teams Direct Routing configuration for SBC SWe Lite, refer to the following: Connect SBC Edge to Microsoft Teams Direct Routing
Please check the connectivity for interfacing with Microsoft Teams Direct Routing before making the calls by following the procedure provided at the following link: Working with Connectivity Check - Verifying Service and Port Requirements for CCE and Teams
Info | ||
---|---|---|
| ||
This interop was performed with Media-Bypass OFF configuration on Microsoft Teams Direct Routing. |
Access SBC SWe Lite's WebUI and click the Monitor tab. Confirm all the SIP Signaling Groups are active. This panel provides current information on the status of Ports, Channels and in-progress Calls on the Ribbon SBC SWe Lite system.
...
...
Info | ||
---|---|---|
| ||
|
The following checklist depicts the set of services/features covered through the configuration defined in this Interop Guide.
...
Legend
Supported | |
Not Supported |
Note the following items in relation to this Interop:
For any support related queries about this guide, please contact your local Ribbon representative, or use the details below:
For detailed information about Ribbon products and solutions, please visit:
https://ribboncommunications.com/products
...
For additional information on Ribbon SBC SWe Lite on AWS, please visit:
Deploying an SBC SWe Lite via Amazon Web Services-AWS
For additional information on Teams, please visit:
Best Practice - Troubleshoot Issues with Microsoft Teams Direct Routing and Connect SBC Edge to Microsoft Teams Direct Routing
For detailed information about Twilio Elastic SIP Trunking and solutions, please visit:
https://www.twilio.com/sip-trunking, https://www.twilio.com/docs/sip-trunking and https://www.twilio.com/docs/sip-trunking/elastic-sip-trunking-solution-blueprints
This Interoperability Guide describes successful configuration for Twilio Elastic SIP Trunking interop involving Ribbon SBC SWe Lite on AWS, Cisco Unified Communication Manager and Microsoft Teams Direct Routing.
...