Calculating Virtual Machine Requirements for an SBC SWe Lite

Introduction

This document describes how to determine the VM (Virtual Machine), vCPU, and RAM resources (or a VM instance for cloud-related deployments) required for an SBC SWe Lite deployment to support an enterprise's planned maximum SIP session density. The SBC SWe Lite session capacity varies in proportion to the vCPU and RAM resources assigned to the VM host; improper assignment of vCPU and RAM resources to a VM may result in SBC SWe Lite being unable to service the required enterprise session workload. Deploying an SBC SWe Lite instance applies to the following:

• For an on-premises Microsoft Hyper-V/VMware ESXi/KVM VMM (Virtual Machine Monitor) deployment, identify (for the VM that will host the SBC SWe Lite) the number of vCPU and RAM resources to service a given maximum SIP session density.
• For a Microsoft Azure cloud deployment, identify the required Azure VM for an SBC SWe Lite to address the required maximum SIP session density.

Definitions and Terminology

Concepts

RTP Direct Media Mode Sessions

Description

RTP direct media mode sessions do not flow through the SBC SWe Lite. These flows are common with endpoints that reside within the same physical premises (such as a single branch office) where there is no need for any manipulation of any aspect of the media flow (such as codecs, headers, and encrypting/decrypting). The implications of such sessions on the SBC SWe Lite are:

• • The SBC SWe Lite does not consume a VM's RAM or vCPU resources processing the RTP direct media mode sessions; vCPU and RAM resources are consumed for SIP signaling and call processing only.
  • Partners/customers do not need to consider RTP direct media mode sessions when determining a VM's vCPU and RAM resources for a given SBC SWe Lite deployment.

• • Multiple direct media mode session streams (audio, video, and so on) may be associated with a given SIP session, and do not require additional licensing unless identified elsewhere.
    
    
  • Only one mode of media is supported against a given SIP session. For example, one stream of media in direct media mode and one stream of media in RTP proxy media mode, cannot both be associated with the same SIP signaling session.

Licensing

The SBC SWe Lite supports a single RTP media session on a 1:1 basis with an associated SIP signaling session. Note the following:

• • The SBC SWe Lite requires a SIP session license to enable a given SIP signaling session. Refer to: SIP Session Licensing.
  • Any SIP session license also enables RTP direct media mode session support on a 1:1 basis with an associated SIP signaling session (i.e., no additional licensing beyond the SIP session license is required for RTP direct media mode session support). 

Refer to Working with Licenses for a description of available SBC SWe Lite SIP session licenses that include support for RTP direct media mode session, as follows:

• • For KVM, VMware, Microsoft Hyper-V on-premises SBC SWe Lite deployments, all SIP session licenses that end with the following characters: -SG, -SGX, -SP
  • For Microsoft Azure cloud-based SBC SWe Lite deployments, all SIP session licenses that end with the following characters: -SG-CLOUD, -SGX-CLOUD, -SP-CLOUD

RTP Proxy Media Mode Sessions

Description

These flows are common with endpoints that do not reside within the same physical premises, but do reside within the same enterprise. If these sessions require access to a public SIP trunk (call flows out of the corporate WAN), there may be a need for encryption/decryption and IP address manipulation services. Many public carriers do not support the forwarding of encrypted media or private IP addresses. However, complex media manipulation such as transcoding is not required due to enterprise-wide policies surrounding codec usage being in force. The implications for these sessions include:

• The SBC SWe Lite consumes a VM's RAM and vCPU resources processing the RTP proxy media mode sessions.
• Consumption of RAM and vCPU resources is less than the consumption of RAM and vCPU resources associated with RTP media manipulation mode sessions.
• RTP proxy media mode sessions must be accessed when determining a VM's vCPU and RAM resources for a given SBC SWe Litedeployment.

• Multiple RTP proxy media mode session streams (audio, video, and so on) may be associated with a given SIP session, and do not require additional licensing unless identified elsewhere.
  
  
• Only ONE mode of media is supported against a given SIP session. For example, with one stream of media in direct media mode and one stream of media in RTP proxy media mode, both cannot be associated with the same SIP signaling session.

Licensing

The SBC SWe Lite supports a single RTP proxy media mode session on a 1:1 basis with an associated SIP signaling session. Note the following regarding RTP proxy media mode sessions:

• • The SBC SWe Lite requires a SIP session license to enable a given SIP signaling session. For more information, refer to: SIP Session Licensing.
    
    
  • Any SIP session license also enables RTP proxy media mode session support without encryption/decryption services on a 1:1 basis with an associated SIP signaling session (i.e. no additional licensing beyond the SIP session license is required for RTP proxy media mode session support without encryption/decryption services). The SBC applies the following:
    
    • The modification of the IP address and other data within the S/RTP, UDP, IP and other header data as provisioned by the user.
    • The pass-through of encrypted media traffic (SRTP ↔ SRTP) where no change is required to the previously applied encryption.
      
      
  • Select (not all) SIP session licenses also enable RTP proxy media mode session support with encryption/decryption services on a 1:1 basis with an associated SIP signaling session. Encryption/decryption services means:
    • An RTP proxy media mode session that requires the SBC to support RTP ↔ SRTP conversions
    • An RTP proxy media mode session that requires SRTP ↔ SRTP changes, such as a cipher change and authentication algorithm, change as the media flow transits the SBC.

Refer to Working with Licenses for more information about SIP session licenses that support RTP proxy media mode sessions:

• • For SIP sessions requiring no support for encryption/decryption services within the context of RTP proxy media mode sessions:
    • KVM, VMware, Microsoft Hyper-V on-premises SBC SWe Lite deployments, all licenses that end with the following characters: -SG, -SGX, -SP
    • Microsoft Azure cloud-based SBC SWe Lite deployments, all licenses that end with the following characters: -SG-CLOUD, -SGX-CLOUD, -SP-CLOUD
      
      
  • For SIP sessions requiring support for encryption/decryption services within the context of RTP proxy media mode sessions:
    • KVM, VMware, Microsoft Hyper-V on-premises SBC SWe Lite deployments, all licenses that end with the following characters: -SGX, -SP
    • Microsoft Azure cloud-based SBC SWe Lite deployments, all licenses that end with the following characters: -SGX-CLOUD, -SP-CLOUD

RTP Media Manipulation Mode Sessions

Description

A media session requiring media manipulation is labeled an RTP media manipulation mode session. Such flows are common with endpoints that communicate across enterprise and public boundaries. The SBC SWe Lite delivers RTP media manipulation services through the application of virtual DSP (Digital Signal Processing) feature to the media session. The media manipulation services delivered by the SBC SWe Lite include:

1. 1. Transcoding. This includes G.711 (common codec in enterprises) ↔ G.729ab (common codec in public networks) translation, and G.711 A-law ↔ G.711 µ-law. Refer to Protocols and Protocols and Functions Supported for the list of codecs.
   2. Transrating. Transrating includes call legs that carry a different time sample size of media, where the SBC SWe Lite performs the translation. Transrating is used often when enterprises or the service provider is looking to save bandwidth by reducing packet count at the expense of voice quality (should a packet be dropped).
   3. Silence suppression. The SBC SWe Lite looks to remove/insert RTP packets carrying no meaningful media to save packet traffic.
   4. Fax calls.
      
      1. Fax tone detection and interworking to T.38
      2. G.711 fax media pass-through, as DSP intervention reduces the likelihood of in-band fax signaling/media issues
   5. In-band ↔ out-of-band interworking. Required for the following:
      
      1. In-band DTMF tone detection interworking with out-of-band RFC 4733 (supersedes RFC 2833)
      2. In-band DTMF tone detection interworking with SIP INFO messages
      3. Interworking RTP dynamic payload types, required when the subtended SBC peers use differing payload type identifiers from the dynamic RTP payload range (for example 96 - 127) to identify a common payload format (in other words,  codec)
   6. Media that originates from the SBC in support of call developments. For example:
      1. Announcement playback
      2. Local ringback tone
      3. Music on Hold
      4. Comfort noise
   7. Jitter compensation. Used to maximize user experience with voice quality.
   8. Certified Skype for Business/Teams Phones and Devices interworking with non-certified endpoints. With virtual DSP intervention, SBC SWe Lites can address media incompatibility issues between certified Skype for Business Server endpoints (Refer to https://technet.microsoft.com/en-us/office/dn947482) and other SIP-based client endpoints, such as RTCP reporting interval mismatch, and unrecognized in-band supplementary service requests.

The implications of RTP media manipulation mode sessions are the following:

• • The SBC SWe Lite consumes VM RAM and vCPU resources to deliver RTP media manipulation services via the virtual DSP feature.
  • Consumption of a VM's RAM and vCPU resources is higher when delivering RTP media manipulation services than the consumption of RAM and vCPU resources associated with RTP proxy media mode services.

  • Consider RTP media manipulation mode session density to determine a VM's vCPU and RAM resources for a specific SBC SWe Lite. 

    
    

    RTP Media Manipulation Mode - Notes

    • The virtual DSP (within the context of an RTP media manipulation mode session) supports complete encryption/decryption services, such as RTP ↔ SRTP conversions, cipher change, & authentication algorithm change.

    • Multiple RTP media manipulation mode session streams (audio, video, and so on) may be associated with a given SIP session, and do not require additional licensing unless identified elsewhere.

    • Only one mode of media is supported against a given SIP session; for example, you cannot have one stream of media in RTP media manipulation mode, one stream of media in RTP proxy media mode, both associated with the same SIP signaling session.

Licensing

The SBC SWe Lite supports a single RTP media manipulation mode session on a 1:1 basis with an associated SIP signaling session. See below.

• • The SBC SWe Lite requires a SIP session license to enable a given SIP signaling session. Refer to SIP Session Licensing.
  • Select (not all) SIP session licenses also enable RTP media manipulation mode session support on a 1:1 basis with an associated SIP signaling session.

Refer to Working with Licenses for a description of available SBC SWe Lite SIP session licenses that include support for RTP media manipulation mode sessions. See below.

• • For SIP sessions requiring no support for transcoding and/or transrating but support for all other RTP media manipulation services: 
    • KVM, VMware, Microsoft Hyper-V on-premises SBC SWe Lite deployments, all licenses that end with the following characters: -SGX, -SP, -ME
    • Microsoft Azure cloud-based SBC SWe Lite deployments, all licenses that end with the following characters: -SGX-CLOUD, -SP-CLOUD, -ME-CLOUD
      
      
  • For SIP sessions requiring support for transcoding and/or transrating over and above other RTP media manipulation services: 
    
    • KVM, VMware, Microsoft Hyper-V on-premises SBC SWe Lite deployments, all licenses that end with the following characters: -SP, -ME
    • Microsoft Azure cloud-based SBC SWe Lite deployments, all licenses that end with the following characters: -SP-CLOUD, -ME-CLOUD

Session Density Map

The table below is a guide to the maximum capacity of an SBC SWe Lite configured into a VM (Virtual Machine) with a given set of vCPU and RAM resources.  The maximum number of the following items vary depending upon a given VM resource profile:

• RTP media manipulation mode sessions
• RTP proxy session mode sessions requiring encryption/decryption services
• RTP proxy session mode sessions not requiring encryption/decryption services
• Direct media mode sessions (not presented in the table, but equivalent to RTP proxy session mode sessions not requiring encryption/decryption services)
• SIP registrations.

Use the tables below to identify and plan the required resource configuration for a given deployment of an SBC SWe Lite to address SIP traffic flow.

¹Maximum number of concurrent sessions. The number assumes that calls are made using RTP/SRTP Proxy mode, or a mix of RTP/SRTP Proxy, media manipulation and video calls.

²Maximum number of concurrent sessions with virtual DSP intervention. See Transcoding Capacity below for details.

³Maximum number of concurrent audio/video sessions. The total system capacity is affected if A/V calls are introduced into the call mix. Maximum number of calls is reduced by the number of video streams used. For example, 1 vCPU instance processing 25 A/V calls has a total capacity of:  300 (max number of calls) - 25 (calls processed with 1 vCPU instance) = 275 calls.

⁴Maximum number of concurrent sessions (when virtual DSP intervention is applied to 450 sessions) is 1000.

⁵Maximum number of concurrent sessions (when virtual DSP intervention is applied to 600 sessions) is 600.

⁶Maximum number of proxy media mode concurrent sessions is reduced by a count equivalent to the active number of concurrent RTP media manipulation sessions. Refer to note 1.

Process to Determine VM Resources 

1. Identify and record the minimum quantity of VM resources to support your maximum default RTP media manipulation mode sessions: 

   1. For an on-premises SBC SWe Lite deployment, refer to Table 1 and record the required minimum quantity of vCPUs and RAM found in the vCPU # and GB RAM column that supports a number of default RTP media manipulation mode sessions greater or equal to your deployment need; note the number of supported default RTP media manipulation mode sessions is found in the Default scenario: G.711/G.729ab RTP ↔ G.729ab/G.711SRTP, with in-band services column.

   2. For an Microsoft Azure-based SBC SWe Lite deployment, refer to Table 2 and record the required minimum Azure VM instance type found in the VM instance column that supports a number of default RTP media manipulation mode sessions greater or equal to your deployment need; note the number of supported default RTP media manipulation mode sessions is found in the Default scenario: G.711/G.729ab RTP ↔ G.729ab/G.711SRTP, with in-band services column.

      Use of Table 3 for non-default RTP media manipulation mode sessions

      If on-premises SBC SWe Lite deployment is required to support a transcoding scenario other than G.711 ↔ G.729ab (the default RTP media manipulation mode session scenario), use Table 3 to identify the required minimum quantity of vCPUs to assign to the VM. For example, support for 50 G.711 ↔ OPUS sessions requires 2 vCPUs. The 2 vCPU figure should be used when undertaking step 2(a).

2. Identify and record the minimum quantity of VM resources to support the additional RTP proxy session mode sessions (beyond the maximum default RTP media manipulation mode sessions) for your SBC SWe Lite deployment.

   Calculating the maximum available RTP proxy mode sessions for your VM resource

   The maximum available RTP proxy session mode session capacity is not equal to a value found in the Maximum SIP with corresponding RTP Media Sessions column in Tables 1 or 2; rather, it is determined by subtracting the maximum default RTP media manipulation mode sessions identified in Step 1 from the Maximum SIP with corresponding RTP Media Sessions column value associated with the quantity of vCPUs and RAM recorded from Step 1.

   Step	Action
   a	For an on-premises SBC SWe Lite deployment, refer to Table 1 and calculate the maximum available RTP proxy session mode session capacity with the quantity of vCPUs and RAM recorded from Step 1 (or Step 2 (b)). For an Microsoft Azure-based SBC SWe Lite deployment, refer to Table 2 and calculate the maximum available RTP proxy session mode session capacity with the Azure VM instance type recorded from Step 1 (or Step 2(b)).
   b	Identify if the calculated maximum available RTP proxy session capacity from (a) above is larger than your required additional RTP proxy session mode sessions: If... Then Calculated capacity from 2 (a) is larger than required RTP proxy session mode sessions Proceed to step 3, using the quantity of vCPUs and RAM determined from point 2(a) above. Calculated capacity from 2 (a) is smaller than required RTP proxy session mode sessions Review Table 1 (or Table 2 for an Azure-based deployment) and increase the quantity of vCPUs and RAM (or upgrade to a more powerful) Azure VM, then re-execute step 2(a).

3. Prepare to configure your SBC SWe Lite with the resources arrived at the end of step 2.

   1. For an on-premises SBC SWe Litedeployment, refer Installing SBC SWe Lite.

   2. For an Microsoft Azure-based SBC SWe Litedeployment, refer to Running a SWe Lite via Microsoft Azure Marketplace.

Examples

Calculating a VM's vCPU and RAM Resource Requirements for an On-premises Low-Density KVM-based SBC SWe Lite Deployment

1. Fifty (50) RTP media manipulation mode sessions are required (a session is equivalent to the Default RTP Media Manipulation Scenario defined above).
   1. A single vCPU and 1 GiB of RAM is the minimal vCPU and RAM count that supports this number of  RTP media manipulation sessions. 
   2. Record these values as the potential number of vCPU and RAM resources to assign to the VM hosting the SBC SWe Lite.
      
      
2. One hundred (100) additional RTP proxy session mode sessions services are required.
   
   1. A single vCPU and 1 GiB of RAM supports a maximum of 300 total SIP with corresponding RTP sessions.  Subtract the 50 RTP media manipulation mode sessions from the 300 and there are 250 remaining sessions.
   2. 250 sessions is greater than the 100 additional RTP proxy session mode sessions; run concurrent to the 50 RTP media manipulation mode sessions, and use the 1 vCPU and 1 GiB RAM resources identified from point 1.
3. Refer to the Installing SBC SWe Lite on KVM Hypervisor to configure a VM with 1 vCPU and 1 GiB RAM to host the SBC SWe Lite.

Identifying the Microsoft Azure VM Instance for a Cloud-based SBC SWe Lite Deployment

1.  200 RTP media manipulation mode sessions that support G.711 ↔ G.729ab transcoding are required.
   • The F2s VM supports this capacity of the default RTP media manipulation sessions. 
   • Record the F2s value as the potential Azure VM that will host the SBC SWe Lite.

   2. 800 additional RTP proxy session mode sessions are required.

   • The F2s VM supports 1000 SIP with corresponding RTP media sessions.
   • Subtract the 200 RTP media manipulation mode sessions from the 1000, and 800 sessions remain.
   • Record the F2s VM instance as the 800 sessions determined previously is equal to the 800 additional RTP proxy session mode sessions required to run concurrent to the 200 RTP media manipulation mode sessions.

   3. Refer to Running a SWe Lite via Microsoft Azure Marketplace to start an F2s VM hosting the SBC SWe Lite.

Calculating the vCPU and RAM Resource Requirements for an On-premises High-Density Hyper-V based SBC SWe Lite Deployment

1. 200 RTP media manipulation mode sessions are required to support G.711 ↔ AMR WB transcoding.
   
   
   • 4 vCPU supports this capacity. 
   • Record the 4 vCPU value as the potential number of vCPU resources to assign to the VM that will host (under Hyper-V) the SBC SWe Lite. Note the required RAM will be determined in the next step.

   2. 800 additional RTP proxy session mode sessions with encryption/decryption services.
   
   

   • From Table 1, I see 4 vCPU and 2.5 GiB of RAM supports 1000 SIP with corresponding RTP media sessions are required.
   • Subtract the 200 RTP media manipulation mode sessions from the 1000, and 800 sessions remain.
   • Record the 4 vCPU and 2.5 GiB RAM figures; the 800 session figure determined previously is equal to the 800 additional RTP proxy session mode sessions required to run concurrent to the 200 RTP media manipulation mode sessions.

   3. Refer to Hyper-V installation guide to begin the process of instantiating a VM with 1 vCPU and 1 GiB RAM to host the SBC SWe Lite.

Calculating the vCPU and RAM Resource Requirements for a High-Density SIP Registration SBC SWe Lite Deployment

The required vCPU and RAM for a high capacity SIP Registration deployment are relatively simple: if the number of SIP registrations exceeds 1,000 endpoints, configure the VM with a minimum of 4 vCPUs and 2.5 GiB RAM. If less/equal to 1,000, the RAM is defined by the required session capacity.

Considerations for RTP Media Manipulation Session Mode versus RTP Proxy Session Mode

SIP Signaling Group Considerations

SIP Signaling groups (provisioning constructs that represent a connection between the SBC SWe Lite and another SIP based peer) can be configured to use either RTP media manipulation session mode or a RTP proxy session mode. See below:

• Preference can be set so that either media manipulation session mode or RTP proxy session mode is preferred, but not required.
• If RTP proxy session mode is configured as preferred by both signaling groups, the call proceeds using RTP proxy session mode.
• If media manipulation session mode is configured as preferred by both signaling groups, the call proceeds in media manipulation session mode.
• If one signaling group is configured as media manipulation session mode preferred, and the other signaling group is configured as RTP proxy session mode preferred, the selection of mode is based on the preference of the signaling group associated with the party initiating the call. If media manipulation session mode is preferred but there is no available resource for the initiating party, the initiating party falls back to attempt the call using RTP proxy session mode.
• After a media path is established between the SIP client and the SBC SWe Lite in either media manipulation session mode or RTP proxy session mode, there is no support for a mid-call dynamic switch to change mode – this includes the case of call transfer and conference. This is not necessarily a limitation – it emphasizes the importance of understanding the network deployment/architecture.
• If media manipulation session mode is preferred but not required, and if the other signaling group is configured for RTP proxy session mode only, the call goes through using RTP proxy session mode. This improves preservation of the media manipulation session mode resource for calls which require the resources most. A mid-call dynamic switch to change mode, including the case of call transfer and conference is not supported. This is not necessarily a limitation. This also emphasizes the importance of understanding the network deployment/architecture.
• If media manipulation session mode is either required or preferred and a RTP proxy session mode route is not possible, the SBC SWe Lite must have an available media manipulation session mode resource. Otherwise, the call will fail.

Considerations for DTMF

There are several alternatives for DTMF calls:

• When a DTMF call is received, the SBC SWe Lite terminates the call and transmits G.711. Other codec types may also be used. However, types such as G.723.1 may be less reliable.
• When a DTMF call is received, the SBC SWe Lite terminates the call and transmits the signals as out-of-band RFC 2833/4733 compliant messages or out-of-band SIP INFO messages.
• A signaling group can be provisioned to transmit in-band signals as voice, RFC 2833/4733, or SIP INFO messages. There is no fall-back function.
• In the case of RTP proxy session mode, the SBC SWe Lite does not process the DTMF.

Considerations for Video Interworking

The SBC SWe Lite supports 25 video streams per vCPU to a maximum of 100 streams. Exceeding 4 vCPUs does not allow more than 100 video streams.