EasyUC for Microsoft Teams
Enable the Teams SBC and set the network details
Enable the integrated Session Border Controller and set IP, ports and certificate method.
In EasyUC: EasyUC Teams → Teams → SBC Setup
Images come from the EasyUC lab. Names and example values provide orientation. A different interface language is indicated beside the relevant image.
What it is for
Microsoft Teams Direct Routing connects a Teams tenant to a Session Border Controller (SBC) over a SIP trunk. EasyUC includes this SBC. It runs on the EasyUC server, accepts the trunk from Microsoft over TLS and hands the calls to the EasyUC scripts (ACD, IVR, attendant console). No additional PBX and no third-party SBC is needed.
On this page you set what applies to the SBC as a whole: the public address at which Microsoft reaches it, the ports it uses and the method EasyUC uses to order certificates from Let’s Encrypt. Hostnames and the certificates themselves belong to the individual tenant and are set up there.
Signalling to Microsoft runs over TLS only, with mutual certificate verification. Audio runs encrypted as SRTP only. Media bypass is not used. The SBC accepts connections from the Microsoft networks only.
Prerequisites
- Licence module
teams. Without this module the EasyUC Teams workspace does not appear. - Role EasyUC Teams (
ROLE_APP_TEAMS_WORKSPACE) with the sub-permissions SBC (ROLE_APP_TEAMS_SBC) to read and SBC bearbeiten (ROLE_APP_TEAMS_SBC_EDIT) to change. - A public IPv4 address at which the EasyUC server is reachable from the Internet. Behind a 1:1 NAT this is the outer address.
- Firewall rules for the TLS port and the RTP range. The exact ports are listed in the chapter “DNS, public IP and firewall for the SBC”.
- An e-mail address for the Let’s Encrypt account. Expiry warnings are sent to it.
Step by step: Enable the SBC for the first time
Step by step: Change settings later
Fields and options
| Field / action | Meaning and use |
|---|---|
| Default domain (optional) | Suggestion for the hostname of new tenants, for example sbc.example.com. Each tenant can use its own hostname in the customer’s domain. |
| Public IP | Address Microsoft connects to. Mandatory: without it the SBC does not start. Private and reserved ranges are rejected. |
| Media IP | Local address for RTP. Behind a 1:1 NAT, enter the internal address of the server here and the outer address under Public IP. |
| First TLS port | Start value for port assignment, default 5061. Each tenant gets the next free port. Ports 8021, 9060, 15060 and 15080 are used internally. |
| RTP from / RTP to | UDP range for audio, default 20000 to 20999, lowest start value 1024. The range must not overlap UDP 16384 to 19999 (CTI ports of the ACD) or 24000 to 24999 (script runtime for Teams calls). |
| Contact e-mail | Address of the Let’s Encrypt account. Without it no certificate can be ordered. |
| Environment | Production delivers a publicly trusted certificate. Staging is for trying things out only; Microsoft does not accept the trunk with it. In production, Let’s Encrypt limits apply: five identical certificates per week, five failed validations per hour. |
| Validation | DNS-01 proves the hostname through a TXT record, port 80 stays closed. HTTP-01 can be selected, but this version requests certificates over DNS-01 only. |
| DNS provider (optional) | Name of the provider for automatic renewal. cloudflare is implemented. For other providers the manual method remains. |
| DNS credentials (optional) | For Cloudflare a line CF_API_TOKEN=…. With credentials EasyUC sets the TXT record itself and renews without intervention. Without them the tenant page shows the record for you to create. |
| Disable | Switches the SBC off. The tenant settings are kept, the trunks are offline afterwards. A confirmation prompt appears first. |
| Teams Tenants / Manage tenants | Opens the tenant list. |
Check the result and narrow down errors
- Success: the header shows SBC service with a version number and last seen with a current time. Below are the default domain, the number of tenants, the running calls and the public IP.
- “The SBC service has not reported in yet. Settings are stored and will be picked up as soon as it runs.” The service is not running or cannot reach the administration. Check in the EasyUC Manager that the Teams module is switched on and the SBC service is running. Without a sign of life the service counts as offline after 90 seconds.
- A message that no public IP is stored and the SBC does not start without it: enter the address under Edit.
- „Die öffentliche IP muss aus dem Internet erreichbar sein; … liegt in einem privaten oder reservierten Bereich.“ You entered the internal address. The outer address belongs in Public IP, the internal one in Media IP.
- „Der RTP-Bereich … überschneidet sich mit …“ or „Der RTP-Bereich … enthält Port …“ Choose a range outside the ports named in the message; 20000 to 20999 is usual.
- „Für Let’s Encrypt wird eine gültige E-Mail-Adresse benötigt.“ Correct the Contact e-mail.
- “Certificates from the staging environment are NOT publicly trusted. Microsoft will not accept the trunk with them.” Set Environment to production and request the tenants’ certificates again.
- A running SBC service says nothing about an individual trunk. Check certificate, trunk and OPTIONS per tenant.