# MS-Teams Direct Routing SBC Example Configuration

## Introduction

This document provides instructions on how to configure your existing Microsoft 365 domain with the ProSBC as an SBC for Direct Routing.

## Official documentation <a href="#official-documentation" id="official-documentation"></a>

* [Configure Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-configure) – High-level steps for connecting SBC to Teams and enabling users.
* [Connect your SBC to Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc) – Detailed instructions for pairing SBC with Teams using Admin Center or PowerShell.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

Refer to [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan) – Infrastructure, licensing, and domain requirements.

| Prerequisites                                                                                                                                                                                  | Example used by this document                                                                                                                                                                              |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>MS365 Licensing requirements</p><ul><li><strong>Microsoft Teams Phone</strong> license assigned to users</li></ul>                                                                          | <p>The “<strong>Microsoft Teams Essentials with Phone</strong>” is used and assigned to three MS users:</p><ul><li><info@contoso.com></li><li><office@contoso.com></li><li><support@contoso.com></li></ul> |
| <p>MS365 : Domain, DNS and certificate requirements</p><ul><li>Public FQDN for SBC and public-signed certificate</li><li>TLS 1.2 support</li><li>MS365 users assigned to that domain</li></ul> | <p>The domain "<strong>contoso.com</strong>" has been added to Microsoft 365.</p><p>“<strong>prosbc.contoso.com</strong>” is the registered ProSBC FQDN.</p>                                               |
| <p>ProSBC instance hosting</p><ul><li>world-wide web reacheable</li><li>configured with public IP and FQDN</li><li>network/firewall configuration for public access</li></ul>                  |                                                                                                                                                                                                            |

## MS365 / MS-Teams Configuration <a href="#ms365-ms-teams-configuration" id="ms365-ms-teams-configuration"></a>

While most of the official documentation is using “PowerShell” commands, the majority of the configuration can be done through the [MS365 Admin Portal](https://admin.cloud.microsoft/) and [MS-Teams Admin Portal](https://admin.teams.microsoft.com/).

#### Create PSTN Gateway in Teams Admin Center or via PowerShell. <a href="#create-pstn-gateway-in-teams-admin-center-or-via-powershell" id="create-pstn-gateway-in-teams-admin-center-or-via-powershell"></a>

**Reference**: <https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc>

**Where**: Microsoft Teams admin center > Voice > Direct Routing > SBCs (tab)

**What to do**: Add an SBC with the following configuration:

* FQDN and TLS SIP port used for SIP trunking between the ProSBC and MS-Teams cloud network
* Send SIP options: On
* Forward call history: Off
* Forward PAI header: Off
* SBC Internet Protocol version: IPv4
* Media bypass: Off
* Bypass mode: None
* All other parameters can be decided
  * Concurrent call capacity
  * Faillover response codes/time
  * Preferred country/region for media traffic
  * Location based routing

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FQvTXY4Q2QeefJ8JznKiX%2Fimage.png?alt=media&#x26;token=598d8033-ee07-4ee7-a65b-d867af3b2fdc" alt=""><figcaption></figcaption></figure></div>

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FMOj3cXFHqNs3TZpyItYe%2Fimage.png?alt=media&#x26;token=1afe82b4-776c-4573-9c2e-fdcbe9fcdfdb" alt=""><figcaption></figcaption></figure></div>

#### Assign SBC to voice routing policies <a href="#assign-sbc-to-voice-routing-policies" id="assign-sbc-to-voice-routing-policies"></a>

**Reference**:&#x20;

* <https://learn.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing>&#x20;
* <https://learn.microsoft.com/en-us/microsoftteams/direct-routing-translate-numbers>

**Where**: Microsoft Teams admin center > Voice > Direct Routing > Voice routes (tab)

**What to do**:

* Add routes with number patterns allowed to be used by MS-Teams users for calls toward PSTN
* Assign these routes to the SBC

**Example**:

For Toll-free numbers (e.g. 1-800-555-5555), the configuration may be like that:

* Dialed number pattern: `^+18(00|33|44|55|66|77|88)[2-9]\d{6}$`
* SBCs enrolled: prosbc.contoso.com
* PSTN usage records: NANP-TollFree

#### Configuring MS365 users with MS-Teams parameters <a href="#configuring-ms365-users-with-ms-teams-parameters" id="configuring-ms365-users-with-ms-teams-parameters"></a>

**Reference**: <https://learn.microsoft.com/en-us/microsoftteams/direct-routing-enable-users>

**Where**: Microsoft Teams admin center > Users > Manage users

**What to do**:

* Under the “Account” tab, do one of the following
  * Assign a phone number (“Direct Routing” type) to each user
  * Enable the “Enterprise Voice” (this user won’t have the full telephony service however)

{% hint style="info" %}
**Enterprise Voice** vs **Direct Routing number type**

Any MS-Teams user can get an incoming SIP call based on its user account identification (e.g. `info@contoso.com`). From ProSBC routing rules, this can be done by enforcing “remapped called” attribute with that user account identification.

```
INVITE sip:info@contoso.com SIP/2.0\r\n
To: <sip:info@contoso.com>\r\n
```

With a phone number assigned, the incoming SIP call can target the phone number itself instead of the user account.

```
INVITE sip:18005555555@prosbc.contoso.com:5060 SIP/2.0\r\n
To: <sip:18005555555@prosbc.contoso.com>\r\n
```

{% endhint %}

## ProSBC Configuration <a href="#prosbc-configuration" id="prosbc-configuration"></a>

Here’s a short list of what must be done on the ProSBC

#### FQDN and certificates <a href="#fqdn-and-certificates" id="fqdn-and-certificates"></a>

**Where**: ProSBC > Security > Certificates

References:

* <https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list>
* <https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan#public-trusted-certificate-for-the-sbc>

**What to do**: Add all certificates needed for TLS connection with MS-Teams

* As “Local” type, a public-signed certificate for the ProSBC itself and its FQDN
* As “Trusted”, the following PEM-format DigiCert certificates coming from MS list:
  * [https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pem](https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem)
  * [https://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pem](https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem)
  * [https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem](https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem)
  * [https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem](https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem)
  * [https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem](https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pemhttps://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem)
* As “Trusted”, the converted PEM-format Microsoft certificates:
  * [Microsoft ECC Root Certificate Authority 2017](https://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt)
  * [Microsoft RSA Root Certificate Authority 2017](https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt)

{% hint style="info" %}
**(When needed) Converting certificate to PEM format**

with openssl, the command command line can be used to generate the .pem file:

```
openssl x509 -in "Microsoft ECC Root Certificate Authority 2017.crt" -out MicrosoftECCRootCA2017.pem
```

{% endhint %}

{% hint style="warning" %}
The list of CA certificate can change, because of date expiration or other reasons. Always give a look at the official documentation for the actual list of required CA. The page states instructions about that.
{% endhint %}

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FMOHHFuoatxK33qmDK6iq%2Fimage.png?alt=media&#x26;token=242622f9-ee8d-40e2-bd34-4f92271ac888" alt=""><figcaption></figcaption></figure></div>

#### TLS Profile <a href="#tls-profile" id="tls-profile"></a>

**Where**: ProSBC > Security > TLS Profile

**What to do**: Create a “Level 1” TLS profile using the local certificate and bundled with the trusted certificates. The “Peer authentication” must be enabled.

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FE3AnUKKsldUu0RCpRMnK%2Fimage.png?alt=media&#x26;token=cfe92cba-1f2f-417e-9f37-2beb0e51dfca" alt=""><figcaption></figcaption></figure></div>

#### SIP stack configuration <a href="#sip-stack-configuration" id="sip-stack-configuration"></a>

**Where**: ProSBC > SIP

**What to do**: Have a SIP stack on the host

* Create a TLS transport dedicated to connect with the MS-Teams servers. The TLS transport must me assigned with the TLS profile previously created for MS-Teams.
*

```
<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FZZPqTNhDdbzVJDPMr8lt%2FUntitled.png?alt=media&#x26;token=74213d9b-ade7-47eb-a184-e3daef9f48b2" alt=""><figcaption></figcaption></figure></div>
```

* To avoid interoperability issues with different SIP peers, disable “**Use session timer**”.

<div data-full-width="false" data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FBqr7Y5luI7b7g3cfpnfk%2FUntitled.png?alt=media&#x26;token=b85d6e02-7a2f-4055-a79f-44523d4b7d82" alt="" width="481"><figcaption></figcaption></figure></div>

#### Public IP and FQDN for NAT traversal <a href="#public-ip-and-fqdn-for-nat-traversal" id="public-ip-and-fqdn-for-nat-traversal"></a>

**Where**: ProSBC > Advanced Networking > NATs

**What to do**: Create two “**Force Public IP or FQDN**” entries: one for the Public IP and one for the FQDN

{% hint style="warning" %}
This may be unneeded if the public IP is directly available to the IP network interface (no NAT topology)
{% endhint %}

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FdcOHiLjJcxATJkPdvFDK%2Fimage.png?alt=media&#x26;token=d01c5f14-0ac3-40c6-a80c-ba3adb6592f5" alt="" width="449"><figcaption></figcaption></figure></div>

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FZic2ouFv3nr6JXrAAeOQ%2Fimage.png?alt=media&#x26;token=76af68dd-6933-4008-9920-7ef26e18ef36" alt="" width="451"><figcaption></figcaption></figure></div>

#### Profile configuration <a href="#nap-profile" id="nap-profile"></a>

**Where**: ProSBC > Profiles

**What to do**: Create a dedicated profile for the NAP and/or route that will be connected to MS-Teams servers:

* VOIP > Media Relay >
  * Allow low-delay media relay := **enabled** (otherwise following RTP and SRTP parameters are hidden)
  * Use RTP anchoring := **enabled**
  * RTP security mode := **Secure** (otherwise following SRTP parameters are hidden)
  * SRTP relay behavior := **Re-encrypt**
  * SRTP key policy := **Reuse**
* VOIP > SIP > Advanced parameters >
  * SDP generation options := **Generate all SDP parameters**
  * SDP combining options := *none selected*
  * Forward SIP hold SDP direction mode := **Force Inactive**
* VOIP > SIP > Allowed SIP methods >
  * REFER := **disabled**
* VOIP > RTP and Audio > RTCP >
  * Enabled := **enabled**
  * RTCP multiplexing := **disabled**

<div data-with-frame="true"><figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FgZFgI7Zhv1nP41tBFheD%2Fimage.png?alt=media&#x26;token=c2744d5e-106e-4043-b8c4-3fd7081d578d" alt=""><figcaption></figcaption></figure></div>

#### NAP configuration <a href="#nap-configuration" id="nap-configuration"></a>

**Where**: ProSBC > NAP

**What to do**: Create three NAPs. Each of them have by default the profile configured above.

* The proxy for each NAP:
  1. `sip.pstnhub.microsoft.com:5061`
  2. `sip2.pstnhub.microsoft.com:5061`
  3. `sip3.pstnhub.microsoft.com:5061`&#x20;
* Assigned the SIP TLS transport created from previous step
* Poll Remote Proxy := **enabled**
* Proxy Environment > Microsoft Teams Direct Routing := **enabled**
* NAT > Remote Method for RTP := None
* NAT > Remote Method for SIP := None
* NAT > Local NAT Method for RTP := *the public IP NAT from previous step*
* NAT > Local NAT Method for RTP := *the FQDN NAT from previous step*

<figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FSn9VYtlYoqIkGaUlEEwJ%2Fimage.png?alt=media&#x26;token=29269cab-6726-4ac3-bd9c-7a035d7e38a7" alt=""><figcaption></figcaption></figure>

#### Routes configuration <a href="#nap-routes" id="nap-routes"></a>

**Where**: ProSBC > Gateway > Routes

**What to do**: For each of the three NAPs, create an inbound and outbound rules

For routes towards MS-Teams server:

* filled the **Remapped Called** with the MS-Teams user identification (user account or phone number)
* enabled the **forward\_sip\_domain** and **forward\_sip\_parameters** parameters.
* Set a priority value to each of MS-Teams NAPs: lowest value has the most priority

<figure><img src="https://3811773442-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiK3TemJSDhHz3xNMOvvk%2Fuploads%2FQds29RQQ8YfKhvhAz5eS%2Fimage.png?alt=media&#x26;token=b445296d-be1d-4e7b-ae21-b44c90ec14eb" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**`sip.pstnhub.microsoft.com`:** Global FQDN, must be tried first.

* When the SBC sends a request to resolve this name, the Microsoft Azure DNS servers return an IP address pointing to the primary Azure datacenter assigned to the SBC. The assignment is based on performance metrics of the datacenters and geographical proximity to the SBC. The IP address returned corresponds to the primary FQDN.

**`sip2.pstnhub.microsoft.com`:** Secondary FQDN, geographically maps to the second priority region.

**`sip3.pstnhub.microsoft.com`:** Tertiary FQDN, geographically maps to the third priority region.
{% endhint %}

Alternatively, we can use the [label routing](https://docs.prosbc.com/configuration-details/configuration-by-web-portal-category/call-routing#label-routing) modules to route a specific list of numbers to the Teams network.