Best Practice - Running Microsoft Teams Direct Routing when SBC SWe Lite is Hosted in Azure

Introduction

This Best Practice details the configuration required for an 

• Third-party party PBX and subtended clients

• SIP trunk from a third-party provider (PSTN)

  SBC SWe Lite in Microsoft Azure offering Direct Routing Services to Teams Clients

  

From the Azure public cloud, the

• Security: Call encryption/decryption, denial-of-service (DoS)/distributed DoS attack neutralization, and protection from toll fraud.
• Interoperability: Call mediation services to connect Teams certified clients to non-Teams clients, including popular 3^rd  party SIP trunking and SIP PBX platforms such as the Avaya® Aura® Communication Manager and the Cisco® Unified Communications Manager.
• Survivability: Uninterrupted calling services for SIP clients (including Polycom® and Yealink® phones) through built-in SIP registrar and re-routing around failed routes/proxy servers/destination endpoints.
  
  

Prerequisites

Deploy SBC SWe Lite in Azure Marketplace

Deploy the SBC SWe Lite in Azure Marketplace. Refer to: Running a SWe Lite via Microsoft Azure Marketplace.

Tenant Description

A tenant is used within the Microsoft environment to describe a single independent enterprise that has subscribed to Office 365 services; through this tenant, administrators can manage projects, users, and roles. 

Microsoft Teams Direct Routing Configuration

Consult the Microsoft documentation for the Direct Routing interface configuration guidelines, including the RFC standards and the syntax of SIP messages.

SBC Configuration

Obtain IP Address, FQDN & Public Certificate

Requirements for configuring the SBC Edge in support of Teams Direct Routing include:

SBC Edge Requirements

Requirement	Details
Public IP Address	Media Bypass is not currently supported in Azure deployments; ICE Lite is not required. The SBC can use a Public IP behind a NAT.
Public FQDN	Must point to the Public IP Address.
Public certificate associated with the Public FQDN	Certificate must be issued by one of the supported certification authorities (CAs). Wildcard certificates are supported. Refer to Microsoft documentation for the supported CAs. Refer to Domain Name for certificate formats.

Obtain Domain Name

The SBC FQDN must be from one of the Domain names registered in “Domains” of the Tenant. The table below lists Domain Name examples.

Do  not use the *.onmicrosoft.com tenant for the domain name.

Domain Name Examples

Domain Name	Use for SBC FQDN?	FQDN Names - Examples
SonusMS01.com		Valid names: aepsite6.SonusMS01.com
hybridvoice.org		Valid names: sbc1. hybridvoice.org ussbcs15. hybridvoice.org europe. hybridvoice.org Non-Valid name: sbc1.europe.hybridvoice.org (requires registering domain name europe. hybridvoice.org in “Domains” first)

Users may be from any SIP domain registered for the tenant. For example, you can configure user user@SonusMS01.com with the SBC FQDN name sbc1.hybridvoice.org, as long as both names are registered for the tenant.

Configure Domain Names - Example

 

Prerequisite - Verify Domain Before Adding PSTN Gateway

Verify the correct domain name is configured for the Tenant. The correct domain name is required for the SBC to pair with Microsoft Teams.

1. On the Microsoft Teams Tenant side, execute Get-CsTenant.
2. Review the output.
3. Verify that the Domain Name configured is listed in the Domains and DomainUrlMap attributes. If the Domain Name is incorrect or missing, the SBC will not pair with Microsoft Teams.

Firewall Settings

The following section details the requirements for ports, protocols and services for firewalls in the path of Direct Routing calls.

Firewall settings may be referenced and applied at any time before, during or after the SBC configuration, but the settings must be applied before Direct Routing services take affect.

Ribbon recommends the deployment of the SBC Edge product (including the SBC SWe Lite) behind a firewall, within the DMZ, regardless of the assignment of a public IP to the SBC in question. Refer to SBC Edge Security Hardening Checklist for more information about the SBC and firewalls.

Basic Firewall Settings for All Call Flows

Inbound Public (Internet to SBC)

• SIP TLS: TCP 5061*

• Media for SBC 1000: UDP 16384-17584**
• Media for SBC 2000: UDP 16384-19384*

Outbound Public (SBC to Internet)

• DNS: TCP 53

• DNS: UDP 53

• NTP: UDP 123

• SIP TLS: TCP 5061

• Media: UDP 49152-53247

Public Access Information

The tables below represent ACL (Access Control List) examples that protect the SBC Edge; these attributes are automatically provisioned if the Teams-related Easy Configuration wizards are used (applies to the greenfield deployment scenario only).

 

Public Access In - Requirements

Description	Protocol	Action	Src IP Address	Src Port	Dest IP Address	Dest Port
Outbound DNS Reply	TCP	Allow	0.0.0.0/0	53	SBC/32	0-65535
Outbound DNS Reply	UDP	Allow	0.0.0.0/0	53	SBC/32	0-65535
Outbound NTP Reply	UDP	Allow	0.0.0.0/0	123	SBC/32	123
Outbound SIP Reply	TCP	Allow	0.0.0.0/0	5061	SBC/32	1024-65535
Inbound SIP Request	TCP	Allow	0.0.0.0/0	1024-65535	SBC/32	5061*
Inbound Media Helper	UDP	Allow	52.112.0.0/14	49152-53247	SBC/32	16384-17584**
Deny All	Any	Deny	0.0.0.0/0		0.0.0.0/0

Public Access Out - Requirements

Description	Protocol	Action	Src IP Address	Src Port	Dest IP Address	Dest Port
Outbound DNS Request	TCP	Allow	SBC/32	0-65535	0.0.0.0/0	53
Outbound DNS Request	UDP	Allow	SBC/32	0-65535	0.0.0.0/0	53
Outbound NTP Request	UDP	Allow	SBC/32	0-65535	0.0.0.0/0	123
Outbound SIP Request	TCP	Allow	SBC/32	0-65535	0.0.0.0/0	5061
Inbound SIP Reply	TCP	Allow	SBC/32	5061*	0.0.0.0/0	1024-65535
Outbound Media Helper	UDP	Allow	SBC/32	16384-17584**	52.112.0.0/14	49152-53247
Deny All	Any	Deny	0.0.0.0/0		0.0.0.0/0

* Define in Tenant configuration

** Depends of the Media Port paired configured in SBC

Firewall Securing the SBC with Media Bypass

Configure the Firewall per Basic Firewall Settings for All Call Flows, and then apply the updates below.

The Teams Client IP address cannot be predicted. As a result, allow Any IP (0.0.0.0/0).

Inbound Public (Internet to SBC) 

Media for SBC 1000: UDP 17586-21186**

Media for SBC 2000: UDP 19386-28386**

Outbound Public (SBC to Internet)

Media: UDP 50000-50019

If the device that handles the NAT between the Teams Client and SBC Public IP is performing PAT (Port Address Translation), verify that this device has the source port range of the Teams Client media or open all the ports from 1024 to 65535.

Public Access

The tables below represent ACL (Access Control List) examples that protect the SBC Edge; these ACL attributes are automatically provisioned if the Teams-related Easy Configuration wizards are used (applies to the greenfield deployment scenario only).

Public Access In - Requirements (Media Bypass Scenario)

Description	Protocol	Action	Src IP Address	Src Port	Dest IP Address	Dest Port
Inbound Media Bypass Helper	UDP	Allow	0.0.0.0/0	1024-65535	SBC/32	16384-21186**

Public Access Out - Requirements (Media Bypass Scenario)

Description	Protocol	Action	Src IP Address	Src Port	Dest IP Address	Dest Port
Outbound Media Bypass Helper	UDP	Allow	SBC/32	16384-21186**	0.0.0.0/0	1024-65535

* Define in Tenant configuration

** Depends of the Media Port paired configured in SBC

 

Configure Azure for Microsoft Teams Direct Routing 

Assign a Static Public IP Address on the Media Port

Assign a Static Public IP address on the media interface in Azure for Microsoft Teams Direct Routing.

1. Connect to the Azure portal. Refer to portal.azure.com.
2. From the left navigation pane, click Virtual Machines.

3. Click the desired VM to be used for Microsoft Teams Direct Routing.

   Click on VM

   

4. Under Settings, click Networking to open the media interface.

   Select Networking

   

5. Click on the network interface.

6. Under Settings, click IP Configuration.

   Select IP Configuration

   

7. Click ipconfig1.
8. Enable a Public IP address and create a new Static Public IP address on the media interface through a series of windows:
   

   1. From the Public IP address settings option, select Enabled.

   2. Click IP address.

   3. From the Choose public IP address window, click Create new.

   4. From the Create public IP address window and the Assignment options, select Static.

Create Static Public IP Address

Run Easy Configuration Wizard for Microsoft Teams Direct Routing

Run the Easy Configuration Wizard to deploy a Microsoft Teams Direct Routing scenario. Refer to the following configurations under Working with SBC Easy Configuration:

• Configure SIP Trunk with Microsoft Teams.

• Configure an IP PBX with Microsoft Teams.

Complete SBC SWe Lite Configuration for Microsoft Teams Direct Routing in Azure

Configure IP Routing

IP Routing must be customized in the SBC SWe Lite for Microsoft Teams Direct Routing in Azure. Two options are available for configuration:

• Set the Default Route on the Media Interface.
• Add a Static Route for Microsoft Teams Direct Routing traffic to the Media Interface.

Option 1: Set the Default Route on a Media Interface

When using multiple NICs on the SBC SWe Lite, Azure designates the first Network's Interface as the Primary Network Interface. Only the Primary Network Interface receives a network default gateway and routes via DHCP. To assign the Network Default Route on another Subnet, you must designate another Network's Interface as the Primary Network Interface.

To assign the network default route, refer to Change Azure Default Route.

Option 2: Add a Static Route for Microsoft Teams traffic to a Media Interface

Add a static route for the traffic to the following IP address and Mask: 52.112.0.0/14 (52.112.0.0/255.252.0.0).

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Protocols > IP > Static Routes. 
3. Click the Create Static IP Route () icon at the top of the Static IP Route Table page.

4. Add the following Static Route using your media interface:

   1. Destination IP: 52.112.0.0

   2. Mask: 255.252.0.0

   3. Gateway: 10.1.9.1

      Create Static IP Route

      

5. Click OK.

Confirm the IP Configuration

Ensure that all network interfaces are configured as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Networking Interfaces > Logical Interfaces.
3. Verify the following is configured:
   1. IP Assign Method: DHCP.

   2. DHCP Options to Use: IP Address and Default Route.
      
      

      Select Networking Options

      

4. Update if required.

Configure the Outbound NAT Traversal

Configure the Outbound Static NAT for all Signaling Groups that use an interface with a Public IP address (at the minimum for the Microsoft Teams Direct Routing Signaling Groups).

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Signaling Groups.
3. Click on the Signaling Group used for Microsoft Teams Direct Routing. For details on modifying a signaling group, refer to Creating and Modifying SIP Signaling Groups.
4. From the Outbound NAT Traversal drop down list, select Static NAT.

5. From the NAT Public IP (Signaling/Media) drop down list, enter the Public IP Address assigned on this media port (the Public IP used in the screen is an example only; use the Public IP for your network).

   Configure Outbound NAT Traversal

   

Disable Media Bypass

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to System > Signaling Groups.

3. Select the Signaling Group used for Microsoft Teams Direct Routing.

4. From the RTCP Multiplexing drop-down list, select Disable.

   Disable RTCP Multiplexing

   

5. From the ICE Support drop down list, select Disabled.

   Disable ICE Support

   

6. Click OK.

Place a Test Call

Place a test call and verify the operation via  Confirm the configuration. For troubleshooting steps, refer to Best Practice - Troubleshoot Issues with Microsoft Teams Direct Routing.