Ribbon SBC Edge R9.0 SIP Interface Interop with Identity Hub : Interoperability Guide

Interoperable Vendors

Copyright      

© 2023 Ribbon Communications Operating Company, Inc. © 2023 ECI Telecom Ltd. All rights reserved. The compilation (meaning the collection, arrangement and assembly) of all content on this site is protected by U.S. and international copyright laws and treaty provisions and may not be used, copied, reproduced, modified, published, uploaded, posted, transmitted or distributed in any way, without prior written consent of Ribbon Communications Inc.

The trademarks, logos, service marks, trade names, and trade dress (“look and feel”) on this website, including without limitation the RIBBON and RIBBON logo marks, are protected by applicable US and foreign trademark rights and other proprietary rights and are the property of Ribbon Communications Operating Company, Inc. or its affiliates. Any third-party trademarks, logos, service marks, trade names and trade dress may be the property of their respective owners.  Any uses of the trademarks, logos, service marks, trade names, and trade dress without the prior written consent of Ribbon Communications Operating Company, Inc., its affiliates, or the third parties that own the proprietary rights, are expressly prohibited.

Document Overview

This document depicts the configuration details for Ribbon's SBC Edge interworking & compliance with IDH SIP Interface.

About Ribbon SBC Edge

The Ribbon Session Border Controller Edge provides best-in-class communications security. The SBC Edge dramatically simplifies the deployment of robust communications security services for SIP Trunking, Direct Routing, and Cloud UC services.

About SIP Interface

The Client SIP Node (SBC Edge) needs specific configuration to be able to access SIP interface towards the Identity Hub for Reputation scoring service.

About Identity Hub Reputation Scoring Process

The SIP client initiates a request by routing the SIP INVITE request for a call to the Identity Hub service FQDN. The INVITE request must include a FROM header to identify the calling party and a To header to identify the called party. Based on workflow selector and workflow configuration, Identity Hub selects the service graph and begins reputation scoring.

Scope

This document provides configuration best practices for deploying Ribbon SBC Edge when connecting with Identity Hub SIP Interface. Note that these are configuration best practices, and each customer may have unique needs and networks. Ribbon recommends that customers work with network design and deployment engineers to establish the network design which best meets their requirements.  

Non-Goals

It is not the goal of this guide to provide detailed configurations that will meet the requirements of every customer. Use this guide as a starting point and build the SBC configurations in consultation with network design and deployment engineers. 

Audience

This is a technical document intended for telecommunications engineers with the purpose of configuring both the Ribbon SBC and the third-party product. Navigating the third-party product as well as the Ribbon SBC Edge GUI is required. Understanding the basic concepts of TLS/TCP/UDP, IP/Routing, SIP/RTP and SIP/SRTP is also necessary to complete the configuration and any required troubleshooting.

Prerequisites

The following aspects are required before proceeding with the interop:

• Ribbon SBC Edge on VMware
• Ribbon SBC Edge license
  
  • This interop requires the acquisition and application of SIP sessions, as documented in Working with Licenses.
• Public IP Addresses and Port to communicate with Identity Hub Solution
• TLS certificates for SBC Edge
  • For more details, please visit: Working with Certificates.

Product and Device Details

The configuration uses the following equipment and software:

Network Topology 

Deployment Topology 

IOT Lab Topology 

Signaling and Media Flow

TCP Call Flow

TCP-TLS Call Flow

Document Workflow

The sections in this document follow the sequence below. The reader is advised to complete each section for the successful configuration.

Section A : Ribbon SBC Edge Configuration

Installing Ribbon SBC Edge on VMware

The SBC Edge is available for deployment on VMware. To deploy an SBC Edge instance, refer to: https://doc.rbbn.com/display/UXDOC90/Installing+SBC+SWe+Lite+on+VMware+ESXi.

Once the Edge instance is successfully created on VMware, retrieve the allocated NAT Public IPs, Ethernet IPs, and the Management IP. For more details, visit the link given in the References section.

Accessing Ribbon SBC Edge

1. Open any browser and enter the SBC IP address.
   
2. Click Enter and log in with a valid User ID and Password.
   

Networking Interfaces Information

The Ribbon SBC Edge supports five system-created logical interfaces (known as Administrative IP, Ethernet 1 IP, Ethernet 2 IP, Ethernet 3 IP, and Ethernet 4 IP). In addition to the system-created logical interfaces, the Ribbon SBC Edge supports user-created VLAN logical sub-interfaces.

Ethernet 1 IP and Ethernet 2 IP are used for this interop.

From the Settings tab, navigate to Networking Interfaces > Logical Interfaces.

Ethernet 1 IP

 Configure this Ethernet 2 interface as follows as per the requirement. This interface will face the IDH SIP Interface Solution and the Public Network.

Ethernet 2 IP

Ethernet 1 IP is assigned an IP address used for transporting all the VOIP media packets (for example, RTP, SRTP) and all the protocol packets (for example, SIP, RTCP, TLS). In the default software, Ethernet 1 IP is enabled, and an IPv4 address is acquired through a connected DHCP server, or you can assign a static IP as well. 

Configure Static Routes

Static routes are used to create communication to remote networks. In a production environment, static routes are mainly configured for routing from a specific network to another network that you can only access through one point or one interface (single path access or default route).

License and TLS Certificates

View License

This section describes how to view the status of each license along with a copy of the license keys installed on your SBC. The Feature Licenses panel enables you to verify whether a feature is licensed, along with the number of remaining licenses available for a given feature at run-time.

From the Settings tab, navigate to System > Licensing > Current Licenses.

Import Trusted Root CA Certificates

A Trusted CA Certificate is a certificate issued by a trusted certificate authority. Trusted CA Certificates are imported to the SBC Edge to establish its authenticity on the network.

From the Settings tab, navigate to Security > SBC Certificates > Trusted CA Certificates.

This section describes the process of importing Trusted Root CA Certificates, using either the File Upload or Copy and Paste methods.

1. To import a Trusted CA Certificate, click the Import Trusted CA Certificate () Icon.
2. Select either Copy and Paste or File Upload from the Mode menu.
3. If you choose File Upload, use the Select File button to find the file.
4. Click OK.

Follow the steps above to import certificates for this interop.

Ribbon SBC Edge Configurations for PSTN, IDH & Enterprise side

This configuration uses web-based Easy Configuration Wizard for quick start provisioning towards the PSTN/carrier network as well as towards the Microsoft Teams cloud.

Modify Media List

Modify the media list that was created using the Easy Configuration Wizard.

Select Settings > Media > Media List > IDH Interop 

SIP Profile

SIP Profiles control how the SBC Edge communicates with SIP devices. The SIP Profile controls important characteristics, such as the following: session timers, SIP header customization, SIP timers, MIME payloads, and option tags

1. Select Settings > SIP > SIP Profiles.
2. Create a new SIP profile with desired name "IDH: SIP Interface" and with the session timer enabled. The Minimum Acceptable Timer is 600, and the Offered Session Timer is 3600.
3. Configure the required fields as shown in the screenshot below. 

TLS Profile

The TLS profile defines the crypto parameters for the SIP protocol.

1. Select Settings  > Security > TLS Profile. 
2. Click the  icon to create a new TLS profile.
3. Create a profile with desired name "IDH_TLS_Certificate" and Set ‘TLS Protocol’ to TLS 1.2 Only.
4. Select the correct valid public certificate from the drop down menu and finally, ensure ‘Validate Client FQDN’ is Enabled/Disabled.

SIP Server Table

Select Settings > SIP > SIP Server Tables

SIP Server Tables contain information about the SIP devices connected to the SBC Edge . The entries in the tables provide information about the IP Addresses, ports, and protocols used to communicate with each server. The table entries also contain links to counters that are useful for troubleshooting.

SIP Server Table for IDH Server

1. Create a SIP Server Table with desired name: "IDH_Server".
2. Add domain name provided by the IDH Solution.
3. Enter the correct signaling port number – this will be 5061 for TLS or 5060 for TCP/UDP.
4. Select the signaling protocol you require. The TLS is shown.
5. For TLS, you will need to select the TLS Profile you created earlier.

SIP Server Table for PSTN

1. Create a SIP Server Table with desired name "PSTN_Endpoint"
2. Add domain name provided by the IDH Solution.
3. Enter the correct signaling port number – this will be 5061 for TLS or 5060 for TCP/UDP.
4. Select the signaling protocol you require. The TLS is shown.
5. For TLS, you will need to select the TLS Profile you created earlier.

SIP Server Table for Enterprise

1. Create a SIP Server Table with desired name "Enterprize_Endpoint".
2. Add domain name provided by the IDH Solution.
3. Enter the correct signaling port number – this will be 5061 for TLS or 5060 for TCP/UDP.
4. Select the signaling protocol you require. The TLS is shown.
5. For TLS, you will need to select the TLS Profile you created earlier.

SIP Server Table for Public PSTN 

1. Create a SIP Server Table with desired name "Public Destination"
2. Add domain name provided by the IDH Solution.
3. Enter the correct signaling port number – this will be 5061 for TLS or 5060 for TCP/UDP.
4. Select the signaling protocol you require. The TLS is shown.
5. For TLS, you will need to select the TLS Profile you created earlier.

Signaling Group

Inbound Signaling Group

Signaling Groups allow grouping telephony channels together for the purposes of routing and shared configuration. They are the entity where calls are routed, as well as the location that the Call Routes are selected.

1. Select Settings > Signaling Groups.
2. Create an entry in the signaling group named: "SG_PSTN_Private_Vlan".
3. Choose "Default SIP Profile" under Sip Profile.

4. Choose Call Routing as "PSTN ENTERPRIZE".
   

   Initially, choose "Default" for the call Route. Create the Route, as shown in the call Routing section, and then update the call Route to "PSTN_ENTERPRIZE".

5. Choose Agent type as "Back-to-Back user agent" and Media List as "IDH Interop".
6. Choose SIP Server Table as "PSTN Endpoint".
   
7. Update the Federated IP/FQD with endpoint IPv4.
8. Add a listening port for TLS.
   

Outbound Signaling Group towards IDH

1. Select Settings > Signaling Groups.
2. Create an entry in the signaling group named: "SG_To_IDH_Environment".
3. Choose "Default SIP Profile" under SIP Profile.
4. Choose Call Routing as "Default Route table".
5. Choose Agent type as "Back-to-Back user agent" and Media List as "IDH Interop".
6. Choose SIP Server Table as "IDH Server".
   
   
7. Update the Federated IP/FQD with endpoint IPv4.
8. Add a listening port for TLS.
   
   

Outbound Signaling Group towards Enterprise Private

1. Select Settings > Signaling Groups.
2. Create an entry in the signaling group named: "SG_Enterprize_Private_Vlan".
3. Choose "Default SIP Profile" under SIP Profile.
4. Choose Call Routing as "ENTERPRIZE_PSTN".
5. Choose Agent type as "Back-to-Back user agent" and Media List as "IDH Interop".
6. Choose SIP Server Table as "Enterprize Endpoint".
   
7. Update the Federated IP/FQD with endpoint IPv4.
8. Add a listening port for TLS.
   

Inbound Signaling Group Enterprise Private

1. Select Settings > Signaling Groups.
2. Create an entry in the signaling group named: "SG_Enterprize_Private".
3. Choose "Default SIP Profile" under SIP Profile.
4. Choose Call Routing as "Private_to_Public.
5. Choose Agent type as "Back-to-Back user agent" and Media List as "IDH Interop".
6. Choose SIP Server Table as "Public Destination".
   
7. Update the Federated IP/FQD with endpoint IPv4.
   

Outbound Signaling Group - PSTN Public

1. Select Settings > Signaling Groups.
2. Create an entry in the signaling group named: "SG_PSTN_Public".
3. Choose "Default SIP Profile" under SIP Profile.
4. Choose Call Routing as "Public_to_Private".
5. Choose Agent type as "Back-to-Back user agent" and media list as "IDH Interop".
6. Choose SIP Server Table as "Public Destination".
   
7. Update the Federated IP/FQD with endpoint IPv4.
8. Add a listening port for TLS.
   

Cause Code Reroutes

1. Select Telephony Mapping Tables  > Cause Code Reroutes.
2. Click the Cause Code Reroute table () icon to create a new entry.
3. Provide the required description.
4. Add the Q.850 Cause Codes as '47:Resource Unavailable Unspecified' & '41:Temporary Failure'.
5. Click Apply.

Transformation Table

Transformation Tables facilitate the conversion of names, numbers and other fields when routing a call. They can, for example, convert a public PSTN number into a private extension number, or into a SIP address (URI). Every entry in a Call Routing Table requires a Transformation Table, and they are selected from there. In addition, Transformation tables are configurable as a reusable pool that Action sets can reference.

From the Settings > Call Routing >  Transformation.

Create Transformation Table

Each Transformation Table contains a list of entries considered as routing rules to execute on. Each rule is executed in order until the end of the table is reached or when a Mandatory entry fails to execute.

• Create transformation table as "Towards_IDH_Without_Country_Code".

Follow the procedure described below to configure Transformation Tables and the Entries.

1. Click the Create ( ) icon.

2. Enter a descriptive name in the Description text field.
3. Click OK.

• Creating an Entry to a Message Transformation Table.

For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions. The UCC prime number can be configured.

1. Click the Create () icon next to the table created in the previous step.

2. Provide the details below:

   Admin State	Enabled - The default state is Enabled.
   Match Type	Optional: Optional entries must match at least one of that Input Field type. When a call arrives at a Transformation Table, the incoming message contains a number of Informational Elements (IEs). These IEs include important call information such as: Called Address/Number, Called Extension, Calling Name, Redirecting Number and others. Each Informational Element is processed row by row in the Transformation Table.
   Value (Input/Output)	Specifies the value to match against for the selected type. Depending on the type selected, values are free-form or selected from a menu.

   
   

3. Click Apply.

From the Settings > Call Routing >  Transformation.

Create Transformation Table for PSTN to Enterprise

Each Transformation Table contains a list of entries considered as routing rules to execute on. Each rule is executed in order until the end of the table is reached or when a Mandatory entry fails to execute.

• Create transformation table as "PSTN_Enterprize".

Follow the procedure described below to configure Transformation Tables and the Entries.

1. Click the Create ( ) icon.

2. Enter a descriptive name in the Description text field.
3. Click OK.

• Creating an Entry to a Message Transformation Table.

For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions. The UCC prime number can be configured.

1. Click the Create () icon next to the table created in the previous step.

2. Provide the details below:

   Admin State	Enabled - The default state is Enabled.
   Match Type	Optional: Optional entries must match at least one of that Input Field type. When a call arrives at a Transformation Table, the incoming message contains a number of Informational Elements (IEs). These IEs include important call information such as: Called Address/Number, Called Extension, Calling Name, Redirecting Number and others. Each Informational Element is processed row by row in the Transformation Table.
   Value (Input/Output)	Specifies the value to match against for the selected type. Depending on the type selected, values are free-form or selected from a menu.

3. Click Apply.

Create Transformation Table for Enterprise to PSTN

Each Transformation Table contains a list of entries considered as routing rules to execute on. Each rule is executed in order until the end of the table is reached or when a Mandatory entry fails to execute.

• Create transformation table as "Enterprize_PSTN".

Follow the procedure described below to configure Transformation Tables and the Entries.

1. Click the Create ( ) icon.

2. Enter a descriptive name in the Description text field.
3. Click OK.

• Creating an Entry to a Message Transformation Table.

For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions. The UCC prime number can be configured.

1. Click the Create () icon next to the table created in the previous step.

2. Provide the details below:

   Admin State	Enabled - The default state is Enabled.
   Match Type	Optional: Optional entries must match at least one of that Input Field type. When a call arrives at a Transformation Table, the incoming message contains a number of Informational Elements (IEs). These IEs include important call information such as: Called Address/Number, Called Extension, Calling Name, Redirecting Number and others. Each Informational Element is processed row by row in the Transformation Table.
   Value (Input/Output)	Specifies the value to match against for the selected type. Depending on the type selected, values are free-form or selected from a menu.

3. Click Apply.

Create Transformation Table for Emergency Call

Each Transformation Table contains a list of entries considered as routing rules to execute on. Each rule is executed in order until the end of the table is reached or when a Mandatory entry fails to execute.

• Create transformation table as "Emergency Call".

Follow the procedure described below to configure Transformation Tables and the Entries.

1. Click the Create ( ) icon.

2. Enter a descriptive name in the Description text field.
3. Click OK.

• Creating an Entry to a Message Transformation Table.

For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions. The UCC prime number can be configured.

1. Click the Create () icon next to the table created in the previous step.

2. Provide the details below :

   Admin State	Enabled - The default state is Enabled.
   Match Type	Optional: Optional entries must match at least one of that Input Field type. When a call arrives at a Transformation Table, the incoming message contains a number of Informational Elements (IEs). These IEs include important call information such as: Called Address/Number, Called Extension, Calling Name, Redirecting Number and others. Each Informational Element is processed row by row in the Transformation Table.
   Value (Input/Output)	Specifies the value to match against for the selected type. Depending on the type selected, values are free-form or selected from a menu.

3. Click Apply.

Call Routing Table 

Call Routing allows carrying of calls between Signaling Groups. Routes are defined by Call Routing Tables, which allow for a flexible configuration that calls carry, and how to translate them. 

Select Settings  > Call Routing > Call Routing Table.

Create Call Routing Table for PSTN to Enterprise

Call Routing Tables are one of the central connection points of the system, linking Transformation Tables, Message Translations, Cause Code Reroute Tables, Media Lists and the three types of Signaling Groups (ISDN, SIP and CAS).

• Create Call Routing table as "PSTN_Enterprize"

In the SBC Edge , call routing occurs between Signaling Groups.

In order to route any call to or from a call system connected to the SBC, you must first configure a Signaling Group to represent that device or system. The following list illustrates the hierarchical relationships of the various Telephony routing components of a SBC call system:

Each call routing entry describes how to route the call and also points to a Transformation Table that defines the conversion of names, numbers and other fields when routing a call.

To create an entry:

1. Click the Create Routing Entry ( ) icon.

2. Set the following fields:

   Admin State	Enabled - Enables the call route entry for routing the call, displays in configuration header as .
   Route Priority	Priority of the route from 1 (highest) to 10 (lowest). Higher priority routes are matched against before lower priority routes, regardless of the order of the routes in the table.
   Number/Name Transformation Table	Specifies the Transformation Table to use for this routing entry. This drop-down list is populated from the entries in the Transformation Table.
   Destination Signaling Groups	Specifies the Signaling Groups used as the destination of calls. The first operational Signaling Group from the list is chosen to place the call. Click the Add/Edit button to select the destination signaling group.

3. Click Apply.

Route1 details: Number/Name Transformation Table with "Towards_IDH_without_Counry_Code" and Destination Signaling Groups with "SG_To_IDH_Environment".

Route2 details: Number/Name Transformation Table with "PSTN Enterprize" and Destination Signaling Groups with "SG_Enterprize_Private_Vlan".

Create Call Routing Table for Enterprise to PSTN

Call Routing Tables are one of the central connection points of the system, linking Transformation Tables, Message Translations, Cause Code Reroute Tables, Media Lists and the three types of Signaling Groups (ISDN, SIP and CAS).

• Create Call Routing table as "PSTN_Enterprize"

In the SBC Edge, call routing occurs between Signaling Groups.

In order to route any call to or from a call system connected to the SBC, you must first configure a Signaling Group to represent that device or system. The following list illustrates the hierarchical relationships of the various Telephony routing components of a SBC call system:

Each call routing entry describes how to route the call and also points to a Transformation Table that defines the conversion of names, numbers and other fields when routing a call.

To create an entry:

1. Click the Create Routing Entry ( ) icon.

2. Set the following fields:

   Admin State	Enabled - Enables the call route entry for routing the call, displays in configuration header as .
   Route Priority	Priority of the route from 1 (highest) to 10 (lowest). Higher priority routes are matched against before lower priority routes, regardless of the order of the routes in the table.
   Number/Name Transformation Table	Specifies the Transformation Table to use for this routing entry. This drop-down list is populated from the entries in the Transformation Table.
   Destination Signaling Groups	Specifies the Signaling Groups used as the destination of calls. The first operational Signaling Group from the list is chosen to place the call. Click the Add/Edit button to select the destination signaling group.
   Audio Stream Mode	DSP (default entry): The SBC uses DSP resources for media handling (transcoding), but does not facilitate the capabilities/features between endpoints that are not supported within the SBC (codec/capability mismatch). When the DSP is configured, the Signaling Groups enabled to support DSP are attempted in order.

3. Click Apply.

Route1 details: Number/Name Transformation Table with "Towards_IDH_without_Counry_Code" and Destination Signaling Groups with "SG_To_IDH_Environment".

Route2 details: Number/Name Transformation Table with "Enterprize_PSTN" and Destination Signaling Groups with "SG_PSTN_Private_Vlan"

Emergency 

The Emergency Services functionality is an essential and important feature in support of the E911 and 911 feature in the SBC.

Emergency Calls are logged in the emergency call status table whenever the SBC identifies the call as an emergency and raises an alarm to alert the operator. Call Forking or Call routing on failure are provided as part of existing call routing functionality.

Callback Number

Callback number lists contain up to 16 numbers. These numbers replace the actual number of the calling party when the call is sent to the Emergency Services Operator (PSAP). If the PSAP operator calls back (to the callback number) the call is routed using a Transformation Table entry back to the original calling extension.

Creating a Callback Number List

1.Click the Create Callback Numbers List () icon at the top of the Callback Numbers Table page.

Section B : Ribbon Identity Hub Configuration

Identity Hub Reputation Scoring Process

The SIP client initiates a request by routing the SIP INVITE request for a call to the Identity Hub service FQDN. The INVITE request must include a From header to identify the calling party and a To header to identify the called party. Based on the workflow selector and the workflow configuration, the Identity Hub selects the service graph and begins reputation scoring.

Following the scoring process, the Identity Hub returns different response codes to the SIP client based on the fraud score. If the fraud score is below the suspect-call threshold value of 80, then the service returns a 503 SIP response code. If the fraud score is 80 or above, then the service returns a 608 SIP response code. Note that the 503 and 608 values are the default responses. When setting up your service with Ribbon, you have the option to use 480 as an alternative response to non-fraud calls, and either 603 or 607 as an alternative response to fraud calls.

The SIP client then either resumes routing a good call, or terminates a fraud call and relays the 6xx response back to the originator. 

Possible SIP Responses

The SIP service API can return the following responses:

• 503 (default), 480 – call is unlikely to be fraudulent (fraud score less than 80)
• 608 (default), 603, 607 – call is likely fraudulent (fraud score is 80 or above)
• 405 Method Not Allowed – non-INVITE request is not allowed
• Other 4xx, 5xx  – service failure or error

For Reputation scoring using SIP interface related configurations, refer to: https://doc.rbbn.com/display/IDHDOC20/Reputation+Scoring+using+the+SIP+Interface.

Supplementary Services and Features Coverage

The following checklist depicts the set of services/features covered through the configuration defined in this Interop Guide.

Legend

Caveats

• The Call forward issue has been observed during testing with SIP interface towards the Identity Hub. As per the current design of Ribbon SBC Edge, the call routing table can perform cause code reroute only once. This is a known constraint for Ribbon SBC Edge and will be addressed in the upcoming release.

• The SBC Edge initiates a 2nd INVITE towards the IDH solution after getting a 5xx response for the 1st INVITE. This issue will be addressed in the upcoming SBC release. 

Support

For any support related queries about this guide, please contact your local Ribbon representative, or use the details below:

• Sales and Support: 1-833-742-2661
• Other Queries: 1-877-412-8867
• Website: https://ribboncommunications.com/about-us

References

For detailed information about Ribbon products and solutions, please visit:
https://ribboncommunications.com/products

Conclusion

This Interoperability Guide describes the configuration steps required for Ribbon SBC Edge SIP Interface to successfully interoperate with IDH. All features and serviceability test cases were completed and passed with the exceptions/observations noted in test results. All features and capabilities tested are detailed within this document - any limitations, notes or observations are also recorded in order to provide the reader with an accurate understanding of what is/is not covered.

Configuration guidance is provided to enable the reader to replicate the same base setup. Any additional configuration changes are possibly required to suit the exact customer deployment environment.

© 2023 Ribbon Communications Operating Company, Inc. © 2023 ECI Telecom Ltd. All rights reserved.