Page History

h1, h2, {font-size: 18pt !important;}
h3 {font-size: 16pt !important;}
h4 {font-size: 14pt !important;}
h5 {font-size: 14pt !important;}

.wiki-content h1 {
border-top: 1px solid rgb(145,150,153);
}

In the subsequent sections, SBC 5x10, 5400, 7000 and SWe are represented as SBC Core.

This configuration guide is offered as a convenience to Ribbon customers. The specifications and information regarding the product in this guide are subject to change without notice. All statements, information, and recommendations in this guide are believed to be accurate but are presented without warranty of any kind, express or implied, and are provided “AS IS.” Users must take full responsibility for applying the specifications and information in this guide.

The Ribbon SBC Core portfolio includes SBC 5x10, SBC 5400, SBC 7000 (appliance-based), and SBC SWe (virtualized platform). The software version applies to the Ribbon SBC Core portfolio; hence, this configuration guide is valid for all these devices.

Mgmt is an RJ45 port and is the management interface of the SBC.

Media 0/Media1 depicted as pkt0/pkt1 are RJ45 ports. Media 0 and Media 1 are used in the current deployment, and the same interfaces can be used in SBC Core 5K and 7K (appliance-based). 

For the SBC SWe (virtualized platform), the logical pkt0/pkt1 interfaces must be mapped to a physical port.

• Configuring static routing is preferable for smaller networks with just one or two routes. This is often more efficient since a link is not being wasted by exchanging dynamic routing information.
• Static routing configurations are not required for networks with a LAN-side Gateway on Voice VLAN or Multi-Switch Edge Devices (MSEs) with Voice VLAN towards SBC Core.
  

Add the static route once PSTN Leg and Zoom Leg configurations are done on the SBC.

set addressContext default staticRoute 0.0.0.0 0 10.54.X.X LIF1 PKT0_V4 preference 100
commit

set addressContext default staticRoute 162.12.X.X 24 115.110.X.X LIF2 PKT1_V4 preference 100
commit

# To create a Certificate Signing Request (CSR) and key file for a Subject Alternative Name (SAN) certificate with multiple subject alternate names, complete the following procedure:
  
Create an OpenSSL configuration file (text file) on the local computer by editing the fields to the company requirements.
  
Note 1: In the example used in this article the configuration file is req.conf.
  
Note 2: req_extensions will put the subject alternative names in a CSR, whereas x509_extensions would be used when creating an actual certificate file.
  
[req]
        distinguished_name = req_distinguished_name
        req_extensions = v3_req
        prompt = no
        [req_distinguished_name]
        C = US
        ST = VA
        L = SomeCity
        O = MyCompany
        OU = MyDivision
        CN = www.company.com
        [v3_req]
        keyUsage = keyEncipherment, dataEncipherment
        extendedKeyUsage = serverAuth
        subjectAltName = @alt_names
        [alt_names]
        DNS.1 = www.company.com
        DNS.2 = company.com
        DNS.3 = www.company.net
        DNS.4 = company.net
  
Make sure there are no whitespaces at the end of the lines.
  
#Run the following commands to create the Certificate Signing Request (CSR) and a new Key file:
openssl req -new -out company_san.csr -newkey rsa:2048 -nodes -sha256 -keyout company_san.key.temp -config req.conf
  
#Run the following command to verify the Certificate Signing Request:
openssl req -text -noout -verify -in company_san.csr
   
# After receiving the CSR with above information, provide it to CA (Certificate Authority). You will then receive the proper CA signed certificate in .crt format that is convertable into other formats using openssl.
 
# By default, you should receive two or more certificates from CA (depanding upon your CA). One is the SBC certificate, and other is CA's root and intermediate certificate.
 
# Upload the certificates to the SBC at /opt/sonus/external and convert them into SBC-readable format, i.e. SBC certificate is in .pem or .p12 format and root certificate is in .cer or .der.
  
#Converting .crt to .pem USING OPENSSL for SBC certificate.
openssl x509 -in sbc_cert.crt -out sbc_cert.der -outform DER
openssl x509 -in sbc_cert.der -inform DER -out sbc_cert.pem -outform PEM
  
#After generating sbc_cert.pem file, convert it to .p12 format using below command and the location of the certificate key.
openssl pkcs12 -export -out sbc1_cert.p12 -in sbc_cert.pem -inkey /opt/sonus/company_san.key.temp
  
#CONVERTING CRT to CER USING OPENSSL for CA's root and intermediate certificate.
openssl x509 -in root_cert.crt -out root_cert.cer -outform DER
  
After converting all these certificates upload them on SBC at /opt/sonus/external location.

set system security pki certificate CA_ROOT_CERT type remote fileName root_cert.cer state enabled

set system security pki certificate SBC_CERT filename sbc1_cert.p12 passPhrase <Password defined during CSR generation> state enabled type local

set system security pki certificate DIGI_ROOT_G2 fileName DigiCertGlobalRootG2.crt type remote state enabled  

set system security pki certificate DIGI_ROOT_G5 fileName DigiCertTLSRSA4096RootG5.crt.pem type remote state enabled   

set profiles security tlsProfile TLS_PROF clientCertName SBC_CERT serverCertName SBC_CERT cipherSuite1 tls_ecdhe_rsa_with_aes_256_gcm_sha384 cipherSuite2 tls_ecdhe_rsa_with_aes_128_cbc_sha cipherSuite3 tls_ecdh_ecdsa_with_aes_256_gcm_sha384 authClient true allowedRoles clientandserver acceptableCertValidationErrors invalidPurpose
set profiles security tlsProfile TLS_PROF v1_0 disable
set profiles security tlsProfile TLS_PROF v1_1 enable
set profiles security tlsProfile TLS_PROF v1_2 enable
commit

set addressContext default zone ZOOM sipSigPort 7 state disabled mode outOfService
commit
set addressContext default zone ZOOM sipSigPort 7 tlsProfileName TLS_PROF
commit
set addressContext default zone ZOOM sipSigPort 7 state enabled mode inService
commit

set system mediaProfile compression 75 tone 25
commit

This configuration is not required for the SBC SWe 7.2 release onwards.

set profiles media toneAndAnnouncementProfile LRBT_PROF
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone signalingTonePackageState enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone precedence lower
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone makeInbandToneAvailable enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags useThisLrbtForEgress enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags useThisLrbtForIngress enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags dynamicLRBT enable
commit

set profiles signaling sipAdaptorProfile Modify_maxptime state enabled
set profiles signaling sipAdaptorProfile Modify_maxptime advancedSMM disabled
set profiles signaling sipAdaptorProfile Modify_maxptime profileType messageManipulation
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 applyMatchHeader one
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 1 type message
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 1 message
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 1 message messageTypes all
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 type messageBody
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 messageBody
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 messageBody condition regex-match
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 messageBody regexp
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 messageBody regexp string a=maxptime:20
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 criterion 2 messageBody regexp numMatch match
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 type messageBody
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 operation regsub
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 from
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 from type value
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 from value a=ptime
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 to
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 to type messageBody
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 to messageBodyValue all
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 regexp
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 regexp string a=maxptime
set profiles signaling sipAdaptorProfile Modify_maxptime rule 1 action 1 regexp matchInstance all

set profiles media codecEntry G711ULAW codec g711
set profiles media codecEntry G711ULAW law ULaw
set profiles media codecEntry G711ULAW packetSize 20
set profiles media codecEntry G711ULAW dtmf relay rfc2833
commit

set profiles media packetServiceProfile PSTN_PSP codec codecEntry1 G711ULAW
set profiles media packetServiceProfile PSTN_PSP rtcpOptions rtcp enable
commit

set profiles signaling ipSignalingProfile PSTN_IPSP
set profiles signaling ipSignalingProfile PSTN_IPSP egressIpAttributes flags disable2806Compliance enable
commit

Replace "x.x.x.x" with the SBC's packet interface (pkt) IP address towards PSTN (example pkt0 IP) and "Y" with its prefix length. Provide ceName used during an SBC deployment.

Here the ceName is "ZOOM1".

set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 ceName ZOOM1 portName pkt0
set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 ipAddress x.x.x.x prefix Y
set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 mode inService state enabled
commit

This Zone groups the set of objects used for the communication towards PSTN.

set addressContext default zone PSTN id 2
commit

Replace "x.x.x.x" with SIP Signaling Port IP of SBC towards PSTN.

set addressContext default zone PSTN sipSigPort 3 ipInterfaceGroupName LIF1
set addressContext default zone PSTN sipSigPort 3 ipAddressV4 x.x.x.x
set addressContext default zone PSTN sipSigPort 3 portNumber 5060
set addressContext default zone PSTN sipSigPort 3 transportProtocolsAllowed sip-udp
set addressContext default zone PSTN sipSigPort 3 mode inService
set addressContext default zone PSTN sipSigPort 3 state enabled
commit

Replace "x.x.x.x" with the PSTN IP.

set addressContext default zone PSTN ipPeer PSTN_IPP ipAddress x.x.x.x
set addressContext default zone PSTN ipPeer PSTN_IPP ipPort 5060
commit

You must configure Trunk Group names using capital letters.

set addressContext default zone PSTN sipTrunkGroup PSTN_TG media mediaIpInterfaceGroupName LIF1 
set addressContext default zone PSTN sipTrunkGroup PSTN_TG mode inService state enabled
commit

set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy signaling ipSignalingProfile PSTN_IPSP
set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy media packetServiceProfile PSTN_PSP
set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy media toneAndAnnouncementProfile LRBT_PROF
set addressContext default zone PSTN sipTrunkGroup PSTN_TG signaling messageManipulation inputAdapterProfile Modify_maxptime
set addressContext default zone PSTN sipTrunkGroup PSTN_TG signaling messageManipulation outputAdapterProfile Modify_maxptime
set addressContext default zone PSTN sipTrunkGroup PSTN_TG ingressIpPrefix 0.0.0.0 0
commit

set global callRouting routingLabel PSTN_RL routingLabelRoute 1 trunkGroup PSTN_TG
set global callRouting routingLabel PSTN_RL routingLabelRoute 1 ipPeer PSTN_IPP
set global callRouting routingLabel PSTN_RL routingLabelRoute 1 inService inService
commit

Provide ceName used during an SBC deployment. "ZOOM1" is the ceName.

set global callRouting route trunkGroup PSTN_TG ZOOM1 standard Sonus_NULL 1 all all ALL none Sonus_NULL routingLabel ZOOM_RL
commit

set profiles media codecEntry G711_Zoom codec g711
set profiles media codecEntry G711_Zoom law ULaw
set profiles media codecEntry G711_Zoom packetSize 20
set profiles media codecEntry G711_Zoom dtmf relay rfc2833
commit

set profiles security cryptoSuiteProfile CRYPT_PROF entry 1 cryptoSuite AES-CM-128-HMAC-SHA1-80

set profiles media packetServiceProfile ZOOM_PSP codec codecEntry1 G711_Zoom
set profiles media packetServiceProfile ZOOM_PSP rtcpOptions rtcp enable
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp cryptoSuiteProfile CRYPT_PROF
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp flags allowFallback enable
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp flags enableSrtp enable
commit

The SBC Core to Zoom transport type is TLS, enabling the same transport type in ZOOM_IPSP.

set profiles signaling ipSignalingProfile ZOOM_IPSP
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes flags disable2806Compliance enable
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes numberGlobalizationProfile DEFAULT_IP
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes transport type1 tlsOverTcp
commit

Replace "x.x.x.x" with the SBC's packet interface (pkt) IP address towards ZOOM (example pkt1 IP) and "Y" with its prefix length. Provide the ceName used during an SBC deployment.

Here the ceName is "ZOOM1".

set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 ceName ZOOM1 portName pkt1
set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 ipAddress x.x.x.x prefix Y
set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 mode inService state enabled
commit

This Zone groups the set of objects used for communication towards Zoom.

set addressContext default zone ZOOM id 6
commit

Replace "x.x.x.x" with the SIP Signaling Port IP address of the SBC towards Zoom.

set addressContext default zone ZOOM sipSigPort 7 ipInterfaceGroupName LIF2
set addressContext default zone ZOOM sipSigPort 7 ipAddressV4 x.x.x.x
set addressContext default zone ZOOM sipSigPort 7 portNumber 5060
set addressContext default zone ZOOM sipSigPort 7 tlsProfileName TLS_PROF
set addressContext default zone ZOOM sipSigPort 7 transportProtocolsAllowed sip-tls-tcp
set addressContext default zone ZOOM sipSigPort 7 mode inService
set addressContext default zone ZOOM sipSigPort 7 state enabled
commit

You created the TLS profile in TLS Profile.

There are a few areas that result in a TLS negotiation issue. One area involves assigning the incorrect port. Ensure the following are accomplished: 

• Zoom listens on port number 5061 (default setting).

• Configure port number 5060 on Zoom IP-Peer since Ribbon SBC Core increments the port by 1 when the transport protocol is TLS.

Replace "x.x.x.x" with the Zoom SIP signaling IP.

set addressContext default zone ZOOM ipPeer ZOOM_IPP ipAddress x.x.x.x
set addressContext default zone ZOOM ipPeer ZOOM_IPP ipPort 5060
commit

set profiles services pathCheckProfile ZOOM_OPTIONS protocol sipOptions sendInterval 20 replyTimeoutCount 1 recoveryCount 1
set profiles services pathCheckProfile ZOOM_OPTIONS transportPreference preference1 tls-tcp
commit

You must configure Trunk Group names using capital letters.

set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG media mediaIpInterfaceGroupName LIF2 
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG mode inService state enabled
commit

set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy signaling ipSignalingProfile ZOOM_IPSP
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy media packetServiceProfile ZOOM_PSP
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy media toneAndAnnouncementProfile LRBT_PROF
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG signaling messageManipulation inputAdapterProfile Modify_maxptime
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG signaling messageManipulation outputAdapterProfile Modify_maxptime
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG ingressIpPrefix 0.0.0.0 0
commit

set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 trunkGroup ZOOM_TG
set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 ipPeer ZOOM_IPP
set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 inService inService
commit

Provide the ceName used during an SBC deployment. "ZOOM1" is the ceName.

set global callRouting route trunkGroup ZOOM_TG ZOOM1 standard Sonus_NULL 1 all all ALL none Sonus_NULL routingLabel PSTN_RL
commit

Ensure a Zoom Phone Provider Exchange SIP trunk is built between the Zoom and the Ribbon SBC Core deployed on a customer site.