Page History

Microsoft Teams Direct Routing allows only TLS connections from the SBC for SIP traffic with a certificate signed by one of the trusted certification authorities.

Request a certificate for the SBC External interface and configure it based on the example using GlobalSign as follows:

• Generate a Certificate Signing Request (CSR) and obtain the certificate from a supported Certification Authority.
• Import the Public CA Root/Intermediate Certificate on the SBC.
• Import the Microsoft CA Certificate on the SBC.
• Import the SBC Certificate.

Step 1: Generate a Certificate Signing Request and obtain the certificate from a supported Certification Authority (CA)

Many CA's do not support a private key with a length of 1024 bits. Validate with your CA requirements and select the appropriate length of the key.

1. Access the WebUI.
2. Access Settings > Security > SBC Certificates.

3. Click Generate SBC Edge CSR.

4. Enter data in the required fields.

5. Click OK. After the Certificate Signing request finishes generating, copy the result to the clipboard. 

   
   

   Caption
   0 Figure 1 Generate Certificate Signing Request
   Image Modified

   
   

6. Use the generated CSR text from the clipboard to obtain the certificate. 

Step 2: Deploy the SBC and Root/Intermediate Certificates on the SBC

After receiving the certificates from the certification authority, install the SBC Certificate and Root/Intermediate Certificates as follows:

1. Obtain Trusted Root and Intermediary signing certificates from your certification authority.
2. Access the WebUI.
3. To install Trusted Root Certificates, click Settings > Security > SBC Certificates > Trusted Root Certificates.
4. Click Import and select the trusted root certificates.
5. To install the SBC certificate, open Settings > Security > SBC Certificates > SBC Primary Certificate.

6. Validate the certificate is installed correctly.

   Caption
   0 Figure 1 Validate Certificate
   Image Modified

   
   

7. Click Import  and select X.509 Signed Certificate.

8. Validate the certificate is installed correctly.

   Caption
   0 Figure 1 Validate Certificate
   Image Modified

   
   

Inbound Public (Internet to SBC)

• SIP TLS: TCP 5061*

• Media for SBC 1000: UDP 16384-17584**
• Media for SBC 2000: UDP 16384-19384*
• Media for SBC SWe Lite: UDP 16384-21384

Outbound Public (SBC to Internet)

• DNS: TCP 53

• DNS: UDP 53

• NTP: UDP 123

• SIP TLS: TCP 5061

• Media: UDP 49152-53247

Public Access Information

The tables below represent ACL (Access Control List) examples that protect the SBC Edge. When using Easy Configuration Teams related wizards in an Enterprise deployment, these attributes are automatically provisioned. If you are manually configuring the SBC Edge as part of a Microsoft Teams Direct Routing migration scenario (for example Skype for Business or CCE), you must manually configure these ports. For details on ACLs, refer to Creating and Modifying Rules for IPv6 Access Control Lists.

* Define in Tenant configuration

** Depends SBC SWe Lite does not require this rule to be created since Media ports are opened as needed. This rule is required only for SBC 1000, SBC 2000 and then depends of the Media Port Port paired configured in the SBC.

Apply the following firewall rules below:

Inbound Public (Internet to SBC) 

Outbound Public (SBC to Internet)

Media: UDP 50000-50019

If the device that handles the NAT between the Teams Client and SBC Public IP is performing PAT (Port Address Translation), verify that this device has the source port range of the Teams Client media or open all the ports from 1024 to 65535.

For SBC behind NAT, the firewall should allow access between the firewall IP and the NAT device's IP.

For SBC not using NAT, there must be access between the firewall and the SBC's Public IP.

Public Access

The tables below represent ACL (Access Control List) examples that protect the SBC Edge; these ACL attributes are automatically provisioned if the Teams-related Easy Configuration wizards are used (applies to the greenfield deployment scenario only).

* Define in Tenant configuration

** Depends SBC SWe Lite does not require this rule to be created since Media ports are opened as needed. This rule is required only for SBC 1000, SBC 2000 and then depends of the Media Port Port paired configured in the SBC.