DNS, public IP and firewall for the SBC

What it is for

Microsoft sets up the SIP trunk from its network to the SBC. For this the SBC must be reachable under a public name and a public address, and the firewall must let signalling and audio through. Most errors during commissioning arise here, not in EasyUC.

This chapter summarises what you prepare in DNS, at router and firewall and in the Microsoft 365 tenant before you create the first tenant in EasyUC. The port numbers are EasyUC’s defaults. If your settings differ, the values on the SBC page apply.

The SBC accepts SIP only over TLS with mutual certificate verification and audio only as SRTP. It does not use media bypass: audio always runs between Microsoft and the SBC.

Prerequisites

• Access to the public DNS zone of the customer domain.
• Access to firewall and NAT in front of the EasyUC server.
• A fixed public IPv4 address for the SBC.
• An administrator of the Microsoft 365 tenant who can verify the domain there.
• The EasyUC server has outbound access to Microsoft, to Let’s Encrypt and to public DNS.

Step by step

1. For each tenant, choose a hostname in the customer’s domain, for example sbc.kunde.de.
2. In the public DNS zone, create an A record for this hostname pointing to the public IP of the SBC.
3. In the Microsoft 365 admin center under Settings → Domains, check that the domain of the hostname is verified in the customer’s tenant. For sbc.kunde.de that is kunde.de. For a name with two subdomain levels such as sbc.voice.kunde.de, exactly voice.kunde.de must be registered.
4. Set up a 1:1 NAT from the public IP to the EasyUC server, or assign the address directly on the server.
5. Allow inbound TCP on the tenant’s TLS port, default 5061, from the source networks 52.112.0.0/14 and 52.120.0.0/14.
6. Allow inbound UDP on the RTP range, default 20000 to 20999, from the same source networks.
7. Allow outbound TCP 5061 to Microsoft. The SBC itself sends OPTIONS to sip.pstnhub.microsoft.com.
8. Allow outbound UDP from the RTP range to the Microsoft networks.
9. Allow the EasyUC server outbound HTTPS to Let’s Encrypt, to Microsoft Graph and to the Microsoft sign-in. For automatic renewal, also to the Cloudflare API.
10. Enter the values in EasyUC under SBC Setup: the outer address under Public IP, the internal address of the server under Media IP.
11. For each further tenant, additionally open its TLS port. It is shown in the tenant list after the hostname.

Fields and options

Check the result and narrow down errors

• Success: the hostname resolves to the public IP from outside. After certificate and trunk setup, the tenant page shows a current time under Last OPTIONS.
• Check from outside: a TLS connection to the hostname on the TLS port must deliver the certificate including the intermediate certificate. The port opens only when the public IP is set, the certificate is issued and the tenant is active.
• Trunk down, no OPTIONS from Microsoft: Microsoft starts only when the SBC’s OPTIONS arrive there. Check outbound TCP 5061 and the inbound TLS port.
• The call is set up but there is no audio: the public IP is wrong or the UDP range is not open.
• Audio only on some calls: the RTP range overlaps another service. EasyUC rejects such ranges when saving; check the message on the SBC page.
• „Microsoft kennt die Domain dieses SBC-Namens in diesem Tenant nicht.“ The domain is not verified in the Microsoft 365 tenant.
• „Die öffentliche IP muss aus dem Internet erreichbar sein; … liegt in einem privaten oder reservierten Bereich.“ Enter the outer address.