© 2021 Ribbon Communications Operating Company, Inc. © 2021 ECI Telecom Ltd. All rights reserved. The compilation (meaning the collection, arrangement and assembly) of all content on this site is protected by U.S. and international copyright laws and treaty provisions and may not be used, copied, reproduced, modified, published, uploaded, posted, transmitted or distributed in any way, without prior written consent of Ribbon Communications Inc.
The trademarks, logos, service marks, trade names, and trade dress (“look and feel”) on this website, including without limitation the RIBBON and RIBBON logo marks, are protected by applicable US and foreign trademark rights and other proprietary rights and are the property of Ribbon Communications Operating Company, Inc. or its affiliates. Any third-party trademarks, logos, service marks, trade names and trade dress may be the property of their respective owners. Any uses of the trademarks, logos, service marks, trade names, and trade dress without the prior written consent of Ribbon Communications Operating Company, Inc., its affiliates, or the third parties that own the proprietary rights, are expressly prohibited.
This document provides the configuration snapshot of the interoperability performed between Ribbon's SWe Lite on Azure with on-premise Cisco Unified Communication Manager (CUCM).
The Ribbon Session Border Controller Software Edition Lite (SBC SWe Lite) provides best-in class communications security. The SBC SWe Lite dramatically simplifies the deployment of robust communications security services for SIP Trunking, Direct Routing and Cloud UC services. The SBC SWe Lite operates natively in the Azure and AWS Cloud as well as on virtual machine platforms including Microsoft Hyper-V, VMware and Linux KVM.
Cisco Unified Communication Manager is a core call-control application of Cisco UCM. It provides enterprise-class call control, session management, voice, video, messaging, mobility and conferencing services in a way that is efficient, highly secure, scalable and reliable.
This document provides configuration best practices for deploying Ribbon's SBC SWe Lite with Cisco Unified Communication Manager (CUCM). Note that these are configuration best practices and each customer may have unique needs and networks. Ribbon recommends that customers work with network design and deployment engineers to establish the network design which best meets their requirements.
It is not the goal of this guide to provide detailed configurations that will meet the requirements of every customer. Use this guide as a starting point and build the SBC configurations in consultation with network design and deployment engineers.
This is a technical document intended for telecommunications engineers with the purpose of configuring both the Ribbon SBC and the third-party product. Navigating the third-party product as well as the Ribbon SBC SWe Lite GUI is required. Understanding the basic concepts of TLS/TCP/UDP, IP/Routing, and SIP/SRTP is also necessary to complete the configuration and any required troubleshooting.
The following aspects are required before proceeding with the interop:
|Equipment/ Product||Software Version|
|Ribbon Communications||Ribbon SBC SWe Lite||9.0|
|Third-Party Products||Cisco Unified Communication Manager||11.0|
Administration and Debugging Tools
The sections in this document follow the sequence below. The reader is advised to complete each section for successful configuration.
The SBC SWe Lite is available for deployment in Azure. It is created as a virtual machine (VM) hosted in Azure. To deploy an SBC SWe Lite instance, refer to Deploying an SBC SWe Lite from the Azure Marketplace.
Open any browser and enter the SBC SWe Lite IP address.
Click Enter and log in with a valid User ID and Password.
This section describes how to view the status of each license along with a copy of the license keys installed on your SBC. The Feature Licenses panel enables you to verify whether a feature is licensed, along with the number of remaining licenses available for a given feature at run-time.
From the Settings tab, navigate to System > Licensing > Current Licenses.
For more details on Licenses, refer to Cloud-Based SBC SWe Lite Deployment Licenses.
A Trusted CA Certificate is a certificate issued by a trusted certificate authority. Trusted CA Certificates are imported to the SBC SWe Lite to establish its authenticity on the network.
From the Settings tab, navigate to Security > SBC Certificates > Trusted CA Certificates.
This section describes the process of importing Trusted Root CA Certificates, using either the File Upload or Copy and Paste methods.
Follow the above steps to import the Service Provider's Root and Intermediate certificates of their Public CA.
For more details on Certificates, refer to Working with Certificates.
When the Verify Status field in the Certificate panel indicates Expired or Expiring Soon, replace the Trusted CA Certificate. You must delete the old certificate before importing a new certificate successfully.
Most Certificate Vendors sign the SBC Edge certificate with an intermediate certificate authority. There is at least one, but there could be several intermediate CAs in the certificate chain. When importing the Trusted Root CA Certificates, import the root CA certificate and all Intermediate CA certificates. Failure to import all certificates in the chain causes the import of the SBC Edge certificate to fail. Refer to Unable To Get Local Issuer Certificate for more information.
The SBC SWe Lite supports five system created logical interfaces (known as Administrative IP, Ethernet 1 IP, Ethernet 2 IP, Ethernet 3 IP, and Ethernet 4 IP). In addition to the system created logical interfaces, the Ribbon SBC SWe supports user-created VLAN logical sub-interfaces.
Administrative IP, Ethernet 1 IP and Ethernet 2 IP are used for this interop.
From the Settings tab, navigate to Networking Interfaces > Logical Interfaces.
The SBC SWe Lite system supports a logical interface called the Admin IP (Administrative IP, also known as the Management IP). A Static IP or DHCP is used for running Initial Setup of the SBC SWe Lite system.
Ethernet 1 IP is assigned an IP address used for transporting all the VOIP media packets (for example, RTP, SRTP) and all protocol packets (for example, SIP, RTCP, TLS). DNS servers of the customer's network should map the SBC SWe Lite system hostname to this IP address. In the default software, Ethernet 1 IP is enabled and an IPv4 address is acquired via a connected DHCP server. This IP address is used for performing Initial Setup on the SBC SWe Lite.
Static routes are used to create communication to remote networks. In a production environment, static routes are mainly configured for routing from a specific network to another network that you can only access through one point or one interface (single path access or default route).
Derive the Private IP address and Gateway for each interface on Azure.
Specifies the destination IP address.
Specifies the network mask of the destination host or subnet. If the 'Destination IP Address' field and 'Mask' field are both 0.0.0.0, the static route is called the 'default static route'.
Specifies the IP address of the next-hop router to use for this static route.
Specifies the cost of this route and therefore indirectly specifies the preference of the route. Lower values indicate more preferred routes. The typical value is 1 for most static routes, indicating that static routes are preferred to dynamic routes.
The SBC Edge WebUI provides a built-in Easy Configuration wizard that lets you quickly and easily deploy the SBC for operation with provider endpoints (SIP trunk, ISDN PSTN trunk, or IP PBX trunk) and user endpoints (Microsoft Teams, Microsoft On Premises - Skype for Business/Lync, IP Phones, or ISDN PBX or IP PBX).
As the wizard runs, it directs you through three configuration steps:
Step 1: Set the following parameters to describe the topology for the telephony service provider and user ends of the scenario.
Step 2: Configure the items required for the endpoints selected, fields display based on the endpoint selection in Step 1.
Step 3: The Easy Config validates the final parameters and displays a read-only summary of the configuration that the wizard will apply when you click Finish at Step 3. Before you click Finish, you can return to previous steps to make adjustments to the data summarized.
The wizard displays the following buttons for navigation:
Step 1: Use the Single-legged approach to configure IP PBX.
During this interop, Multi-legged approach was used to configure Service Provider SIP Trunk and IP-PBX (On-Prem CUCM) (Application: SIP Trunk ↔ CUCM)
Step 1: Configure Trunk for Service Provider along with IP-PBX using Multi-legged approach by following the steps below:
Step 2: After selecting the scenario in Step 1, the following template displays. Complete this step by performing the below actions:
Step 3: Follow the steps below.
While using "Easy Configuration Wizard" TLS protocol is not available by default but can be configured later.
Step 4: This step displays a read-only summary of the configuration.
The Easy Configuration Wizard does not currently set all applicable variables to the correct settings. This will be addressed in the subsequent SBC SWe Lite releases. Until then, follow the procedures below.
Change the settings on all the SGs as follows:
Assign the interfaces for Signaling/Media Private IP to all the Signaling Groups accordingly.
Enable Static NAT and map the respective IP addresses for both Signaling Groups.
You can configure SIP Trunk between Service provider and IP-PBX over UDP or TCP or TLS. Ribbon recommends use of TLS protocol to ensure security. Customers who do not wish to use TLS as preferred protocol can skip this section.
An OPTIONS message is sent to the server. When this option is selected, additional configuration items are displayed:
Keep Alive Frequency
Specifies how often, in seconds, the SBC Edge queries the server with an OPTIONS message to determine the server's availability. Visible only when SIP Options is selected from the Monitor field. If the server does not respond, the SBC Edge marks the Signaling Group as down. When the server begins to respond to the OPTIONS messages again, it is marked as up. In this case, Keep Alive Frequency is set to 30 seconds.
Specifies frequency in seconds to check server to determine whether it has become available. Recovery Frequency is set to 5 seconds for this interop.
Local user name of the SBC Edge system. Default entry: Anonymous. Visible only when SIP Options is selected from the Monitor field.
User name of the SIP Server. Visible only when SIP Options is selected from the Monitor field. The user can change Local and Peer Usernames according to their wishes.
Repeat the above steps to enable OPTIONS on other SIP Server Tables.
Specifies whether or not to use RTCP-based Dead Call Detection (DCD).
Dead Call Detection is accomplished by monitoring incoming RTCP packets. If this feature is enabled and no RTCP packets are received from the peer for 30 seconds, the call is considered "dead" and is disconnected. Disable DCD for any peer that does not send RTCP packets.
From the Settings tab, navigate to Media > Media List. Click the expand () Icon next to the entry you wish to enable the feature.
This section describes the steps to configure SBC SWe Lite with TLS/SRTP towards IP-PBX (CUCM) SIP Trunk. Ribbon strongly recommends encrypting the connection between IP-PBX SIP Trunk and SBC SWe Lite.
SDES-SRTP Profiles define a cryptographic context which is used in SRTP negotiation. SDES-SRTP Profiles required for enabling encryption and SRTP are applied to Media Lists. SDES-SRTP Profiles was previously named Media Crypto Profiles.
From the Settings tab, navigate to Media > SDES-SRTP Profiles. Click the to create a new SRTP profile.
Follow the steps below to complete the configuration:
For SIP Trunk towards CUCM, If the SWe Lite SRTP profile is configured with "Operation Option" as "Required" and "Crypto Suit" as "AES_CM_128_HMAC_SHA1_80", call hold initiated from Cisco endpoint will fail. This is a known issue with Cisco CUCM. To overcome it, use "AES_CM_128_HMAC_SHA1_32" between CUCM and SWe Lite.
From the Settings tab, navigate to Media > Media List, Click the expand () icon next to the entry.
Signaling Groups allow grouping telephony channels together for the purposes of routing and shared configuration. They are the entity to which calls are routed, as well as the location from which Call Routes are selected.
From the Settings tab, navigate to Signaling Groups. Click the expand () icon next to the entry.
SIP Server Tables contain information about the SIP devices connected to the SBC Edge. The entries in the tables provide information about the IP Addresses, ports, and protocols used to communicate with each server. The Table Entries also contain links to counters that are useful for troubleshooting.
From the Settings tab, navigate to SIP > SIP Server Tables > SIP TRUNK TO SP & IP-PBX: Cisco CUCM. Click the expand () icon next to the entry.
Transformation Tables facilitate the conversion of names, numbers and other fields when routing a call. They can, for example, convert a public PSTN number into a private extension number, or into a SIP address (URI). Every entry in a Call Routing Table requires a Transformation Table, and they are selected from there. In addition, Transformation tables are configurable as a reusable pool that Action sets can reference.
From the Settings tab, navigate to Transformation.
The Transformation Tables are created for Service Provider SIP Trunk through Easy Config Wizard. These are modified to allow specific patterns to reach the destination Signaling Group.
For this interop, the entries are created based on the numbers associated with each endpoint. Users are free to select their own variables or Regular expressions.
Enabled - The default state is Enabled.
Optional: Optional entries must match at least one of that Input Field type.
When a call arrives at a Transformation Table, the incoming message contains a number of Informational Elements (IEs). These IEs include important call information such as: Called Address/Number, Called Extension, Calling Name, Redirecting Number and others.
Each Informational Element is processed row by row in the Transformation Table.
Specifies the value to match against for the selected type. Depending on the type selected, values are free-form or selected from a menu.
For details on Transformation Table Entry configuration, refer to Creating and Modifying Entries to Transformation Tables. For call digit matching and manipulation through the use of regular expressions, refer to Creating Call Routing Logic with Regular Expressions.
Call Routing allows carrying of calls between Signaling Groups. Routes are defined by Call Routing Tables, which allow for flexible configuration of which calls are carried, and how they are translated.
From the Settings tab, navigate to Call Routing > Call Routing Table.
The Call Routing Tables are created to route the calls between IP-PBX (CUCM) -Service Provider through Easy Config Wizard. The user is allowed to modify these tables as per the requirement.
Call Routing Tables are one of the central connection points of the system, linking Transformation Tables, Message Translations, Cause Code Reroute Tables, Media Lists and the three types of Signaling Groups (ISDN, SIP and CAS).
In the SBC Edge, call routing occurs between Signaling Groups.
In order to route any call to or from a call system connected to the SBC, you must first configure a Signaling Group to represent that device or system. The following list illustrates the hierarchical relationships of the various Telephony routing components of a SBC call system:
Each call routing entry describes how to route the call and also points to a Transformation Table which defines the conversion of names, numbers and other fields when routing a call.
To create an entry:
Set the following fields:
Enabled - Enables the call route entry for routing the call, displays in configuration header as
Priority of the route from 1 (highest) to 10 (lowest). Higher priority routes are matched against before lower priority routes regardless of the order of the routes in the table.
Number/Name Transformation Table:
Specifies the Transformation Table to use for this routing entry. This drop down list is populated from the entries in the Transformation Table.
Destination Signaling Groups:
Specifies the Signaling Groups used as the destination of calls. The first operational Signaling Group from the list is chosen to place the call. Click the Add/Edit button to select the destination signaling group.
Audio Stream Mode:
DSP (default entry): The SBC uses DSP resources for media handling (transcoding) but it does not facilitate the capabilities/features between endpoints that are not supported within the SBC (codec/capability mismatch). When DSP is configured, the Signaling Groups enabled to support DSP are attempted in order.
Enabled: Enable Transcoding on SIP-to-SIP calls.
Unified Communications Manager Administration groups security-related settings for the SIP trunk to allow you to assign a single security profile to multiple SIP trunks. Security-related settings include device security mode, digest authentication, and incoming/outgoing transport type settings.
Customers are free to choose any transport medium depends on their requirements. Ribbon strongly recommends use of secure TLS protocol.
For more information on regarding CSR and Certificate generation for CUCM, refer to https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/215412-configure-sip-tls-between-cucm-cube-cube.html
A SIP profile comprises the set of SIP attributes that are associated with SIP trunks and SIP endpoints. SIP profiles include information such as name, description, timing, retry, call pickup URI, and so on. The profiles contain some standard entries that you cannot delete or change.
Media resource management comprises working with media resource groups and media resource group lists. Media resource management provides a mechanism for managing media resources, so all Cisco Unified Communications Managers within a cluster can share them. Media resources provide conferencing, transcoding, media termination, annunciator, and music on hold services.
A Media Resource Group List provides a prioritized grouping of media resource groups. An application selects the required media resource, such as a music on hold server, from among the available media resources according to the priority order that is defined in a Media Resource Group List.
Choose the Media Resource Group created in the previous step from the Available Media Resource Groups list and click the down arrow that is located between the two panes. After a media resource group is added, its name moves to the Selected Media Resource Groups pane.
Use a trunk device to configure a logical route to a SIP network.
Resetting/restarting a SIP device does not physically reset/restart the hardware, it only reinitializes the configuration that is loaded by Cisco Unified Communications Manager.
For SIP trunks, Restart and Reset behave the same way, so all active calls will disconnect when either choice is pressed.
A route pattern comprises a string of digits (an address) and a set of associated digit manipulations that route calls to a route list or a gateway. Route patterns provide flexibility in network design. They work in conjunction with route filters and route lists to direct calls to specific devices and to include, exclude, or modify specific digit patterns.
The End User Configuration window allows you to add, search, display, and maintain information about Unified Communications Manager end users. End users can control phones after you associate a phone in the End User Configuration window.
CUCM supports auto registration of Cisco endpoints, refer to the following link for more details:
In Cisco Unified Communications Manager Administration, use the
The following checklist depicts the set of services/features covered through the configuration defined in this Interop Guide.
|Sr. No.||Supplementary Services/ Features||Coverage|
|02.||Call Setup and Termination over UDP and TLS|
|03.||Ringing and Local Ringback Tone|
|04.||Remote Ringback Tone Handling|
|05.||Cancel Call, No Answer, Busy and Call Rejection|
|06.||Basic Call with different codecs|
|09.||Call Hold and Resume|
|10.||Call Forward - Unconditional, Busy and No Answer|
|11.||Call Transfer (Blind/Unattended)|
|12.||Call Transfer (Attended)|
|14.||Meet Me Conference|
|15.||4xx/5xx Response Handling|
|16.||Long Duration Calls|
|17.||Early and Late Media|
For any support related queries about this guide, please contact your local Ribbon representative, or use the details below:
For detailed information about Ribbon products and solutions, please visit: https://ribboncommunications.com/products
For additional information on Cisco Unified Communication Manager, please visit: https://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-installation-and-configuration-guides-list.html
For additional information on Ribbon SBC SWe Lite on Azure, please visit: Deploying an SBC SWe Lite from the Azure Marketplace.
This Interoperability Guide describes successful configuration of interop involving Ribbon SBC SWe Lite on Azure, Cisco Unified Communication Manager and SIP Trunk Service Provider.
All features and capabilities tested are detailed within this document - any limitations, notes or observations are also recorded in order to provide the reader with an accurate understanding of what has been covered and what has not.
Configuration guidance is provided to enable the reader to replicate the same base setup - additional configuration changes are possibly required to suit the exact deployment environment.
© 2021 Ribbon Communications Operating Company, Inc. © 2021 ECI Telecom Ltd. All rights reserved.