WarmTransfer
Configuration · guide

Setting up a carrier SIP trunk on an AudioCodes SBC

AudioCodes Mediant SBC

Verified 2026-10-01 · 117 sources · tier 1–2

For Voice engineers who administer an AudioCodes Mediant SBC through its Web interface and hold the carrier's trunk details..

On a Mediant SBC, an IP Group represents a SIP entity the device communicates with, such as an IP PBX or ITSP, and a Proxy Set defines the address and transport type of a SIP server 83 84. This guide builds the carrier side of a trunk on the Mediant Software SBC by following the version 7.6 User's Manual, and ends with calls placed by the SBC's Test Call feature 85 74.

Before you start

  • A PBX-side IP Group must already exist, because a registration Account pairs a served IP Group, such as an IP-PBX, with a serving IP Group, such as an ITSP 2.
  • The carrier-facing IP interface must have the Control application type, because a SIP Interface can reference only such an interface 65.
  • Collect the carrier's signaling addresses, which a Proxy Set accepts as IPv4 address:port, bracketed IPv6 address with port, or FQDN 35.
  • Collect the carrier's transport, because each Proxy Address takes a Transport Type of UDP, TCP, TLS or SCTP 42.
  • Collect the carrier's coder list in preference order, because the first coder in a Coders Group has the highest priority 12.
  • For registration, collect the username, password and AOR, because an Account holds the information the SBC uses to register and digest-authenticate, and sets the AOR host and user parts 2 3.
  • Collect the number format the carrier requires, because Outbound Manipulation rewrites the source or destination Request-URI user part toward it 34.

See also AudioCodes Mediant SBC.

See also SIP trunk authentication: registration and static IP and mutual TLS.

See also SIP trunk carrier turn-up and acceptance testing.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

How does the carrier authenticate your trunk?
Which signaling transport does the carrier require?
Is the SBC's carrier-facing interface behind NAT?
How did the carrier give you its signaling address?

Four questions. One permanent page you can send to your manager.

Step 1 Create a Media Realm for the carrier-facing interface

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > Media Realms, and add a realm with the carrier-facing IPv4 Interface Name, a UDP Port Range Start and a Number of Media Session Legs 46. Choose a range that does not overlap another Media Realm on the same IP interface and does not conflict with SIP signaling ports on that interface 47. The Media Realm you later assign to the carrier IP Group determines the UDP port range and maximum number of media sessions for that IP Group's media 86.

Verify

The UDP Port Range End is read-only and is calculated from the start port plus the number of session legs times the port spacing, minus 1 48. Suggested check: confirm the calculated end port matches the media range your firewall passes and the carrier expects.

Rollback

Only 1 Media Realm can be marked as the Default Media Realm, which is used where no Media Realm is explicitly assigned 49. Suggested rollback: remove the realm from any SIP Interface or IP Group that references it, then delete the realm row.

Step 2 Prepare a TLS Context

SIP over TLS

Do

Open Setup menu > IP Network tab > Security folder > TLS Contexts and add a context for the carrier; up to 100 can be configured 76. The SBC ships with an undeletable default TLS Context, named 'default', that holds a self-generated private key and a self-signed server certificate 75. WarmTransfer's reading of the sources is that a carrier that validates the SBC's certificate will likely require a dedicated TLS Context with a certificate it trusts and with the carrier's root CA loaded 18. Obtaining a CA-signed certificate proceeds by generating a CSR on the device, sending it to the CA, importing the signed certificate and verifying it matches the private key 87. The SBC accepts a peer certificate only if a CA in the TLS Context's Trusted Root CA store signed it, and roots are imported through TLS Contexts > Trusted Root Certificates > Import Certificate as Base64 (PEM) encoded X.509 88. The TLS Version parameter defaults to TLSv1.2 and TLSv1.3, and combinations from TLSv1.0 to TLSv1.3 can be selected 78. OCSP checking of peer certificates is disabled by default 77. TLS mutual authentication is optional and is enabled with the 'TLS Mutual Authentication' check box under Setup > IP Network > Security > Security Settings 79. By default the SBC initiates TLS only for the next network hop, and the 'SIPS' check box is for multi-hop TLS 82.

Verify

The manual's procedure for SIP over TLS toward an IP Group is to configure a TLS Context, assign it to the Proxy Set or SIP Interface associated with that IP Group, and configure a TLS port on the SIP Interface 81. Suggested check: confirm the new context lists your own certificate and the carrier's root, not only the built-in certificate.

Rollback

The default TLS Context cannot be deleted 75. Suggested rollback: unassign the carrier context from the SIP Interface and Proxy Set, then delete it.

SIP over UDP

Do

Skip this step, because the manual places the TLS Context in its procedure for SIP over TLS 81. RFC 3261 says implementations SHOULD use TLS to protect SIP messages 56, and SIP digest authentication does not protect the message body 54.

Verify

Suggested check: confirm with the carrier that it requires unencrypted signaling and does not offer an encrypted alternative.

Step 3 Create a SIP Interface for the carrier

SIP over TLS

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > SIP Interfaces 64. A SIP Interface defines a local listening port and transport type and assigns an IP network interface for SIP signaling 89. Set the mandatory Network Interface to the carrier-facing interface, which must have the Control application type 65. Assign the carrier Media Realm, since the parameter defaults to none 63. Keep or set the TLS Port, which defaults to 5061 and must differ from the TCP port on the same interface 68. Set the UDP or TCP port to 0 to disable a transport you will not use 66. Set TLS Context Name to the carrier TLS Context, because it otherwise defaults to 'default' 67. No other SIP Interface on the same network interface may use these signaling ports, and the signaling port should not fall inside an RTP port range 70.

Verify

The TLS Context Name otherwise stays on the context named 'default' 67. Suggested check: confirm the interface saves without a port conflict and shows your carrier context.

Rollback

At least 1 SIP Interface must be assigned to a Proxy Set 90. Suggested rollback: remove the interface from any Proxy Set that references it, then delete it.

SIP over UDP

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > SIP Interfaces 64. A SIP Interface defines a local listening port and transport type and assigns an IP network interface for SIP signaling 89. Set the mandatory Network Interface to the carrier-facing interface, which must have the Control application type 65. Assign the carrier Media Realm, since the parameter defaults to none 63. Keep or set the UDP Port, which defaults to 5060 69. Set the TCP and TLS ports to 0 if the carrier does not use them, because 0 disables that transport 66. No other SIP Interface on the same network interface may use these signaling ports, and the signaling port should not fall inside an RTP port range 70.

Verify

Suggested check: confirm the interface saves without a port conflict.

Rollback

At least 1 SIP Interface must be assigned to a Proxy Set 90. Suggested rollback: remove the interface from any Proxy Set that references it, then delete it.

Step 4 Set the public address the carrier will see

Behind NAT (private address translated by a firewall)

Do

Configure the public address either as a single Static NAT IP Address for all interfaces or per IP interface in the NAT Translation table; the static address takes priority if both are set 29. WarmTransfer's reading of the sources is that, with static IP authentication, the address the carrier sees is this NAT address, so it is the one to give the carrier for its allow list 16.

Verify

Suggested check: in a SIP trace of an outbound OPTIONS or INVITE, confirm the public address appears where the private address would otherwise be, and note which headers carry it.

Rollback

If no NAT address is configured, the SBC sends packets using the IP address configured for the interface in the IP Interfaces table 28. Suggested rollback: delete the translation rule or clear the static address.

Public address configured on the interface

Do

Leave NAT unconfigured, so the SBC sends packets using the IP address configured for the interface in the IP Interfaces table 28. WarmTransfer's reading of the sources is that, with static IP authentication and no NAT address, the carrier sees the interface address, so that is the address to give the carrier for its allow list 16.

Verify

Suggested check: confirm the source address in an outbound trace equals the interface address.

Step 5 Create the carrier Proxy Set

SIP over TLS

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets; proxy addresses go in the child Proxy Address table 40. Assign the carrier SIP Interface, because at least 1 SIP Interface must be assigned to a Proxy Set 90. Enter each carrier address as address:port, a bracketed IPv6 address with port, or an FQDN 35. FQDNs are resolved by A-record by default, or by SRV, NAPTR or a Microsoft Skype for Business method 91. Set each Proxy Address Transport Type to TLS rather than UDP 80. Assign the carrier TLS Context, because no TLS Context is assigned to a Proxy Set by default 41. Set Proxy Keep-Alive to Using OPTIONS, because it defaults to Disable 39. The Proxy Keep-Alive Time defaults to 60 seconds and can be set from 5 to 2,000,000 seconds 92. Optionally list up to 3 SIP response codes in Keep-Alive Failure Responses; receiving any of them in reply to a keep-alive marks the proxy offline 37. With several carrier addresses, choose Parking redundancy to stay with the current proxy until it fails, or Homing to always try the highest-priority proxy currently online 93. Proxy Hot Swap Mode defaults to Disable; when enabled, a SIP message that fails toward one proxy is re-sent to a redundant proxy in the same Proxy Set 38.

Verify

The Proxy Set status view shows each proxy address as Online, Offline or Not Resolved, with success and failure counts 45. Suggested check: after saving, wait for keep-alives to run and confirm each carrier address reads Online.

Rollback

Suggested rollback: unassign the Proxy Set from the carrier IP Group, then delete it.

SIP over UDP

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets; proxy addresses go in the child Proxy Address table 40. Assign the carrier SIP Interface, because at least 1 SIP Interface must be assigned to a Proxy Set 90. Enter each carrier address as address:port, a bracketed IPv6 address with port, or an FQDN 35. FQDNs are resolved by A-record by default, or by SRV, NAPTR or a Microsoft Skype for Business method 91. Set each Proxy Address Transport Type explicitly to UDP, because a Transport Type left Not configured uses the global SIPTransportType parameter 42. Set Proxy Keep-Alive to Using OPTIONS, because it defaults to Disable 39. The Proxy Keep-Alive Time defaults to 60 seconds and can be set from 5 to 2,000,000 seconds 92. Optionally list up to 3 SIP response codes in Keep-Alive Failure Responses; receiving any of them in reply to a keep-alive marks the proxy offline 37. With several carrier addresses, choose Parking redundancy to stay with the current proxy until it fails, or Homing to always try the highest-priority proxy currently online 93. Proxy Hot Swap Mode defaults to Disable; when enabled, a SIP message that fails toward one proxy is re-sent to a redundant proxy in the same Proxy Set 38.

Verify

The Proxy Set status view shows each proxy address as Online, Offline or Not Resolved, with success and failure counts 45. Suggested check: after saving, wait for keep-alives to run and confirm each carrier address reads Online.

Rollback

Suggested rollback: unassign the Proxy Set from the carrier IP Group, then delete it.

Step 6 Build the carrier's Coders Group and IP Profile

Do

Open Setup menu > Signaling & Media tab > Coders & Profiles folder > Coders Groups and list the carrier's coders 14. The first coder listed has the highest priority and is used whenever possible 12. Up to 21 Coders Groups can be configured, each with up to 10 coders, and each coder entry has a packetization time, rate, payload type and silence suppression setting 13. Coders Groups are assigned through IP Profiles 94. Create the carrier IP Profile under Setup menu > Signaling & Media tab > Coders & Profiles folder > IP Profiles 26. The Allowed Audio Coders parameter has no group assigned by default, which allows all coders 24. To shape what is offered to the carrier, assign the group and set Allowed Coders Mode to Restriction, Preference, or Restriction and Preference 25. SBC Media Security Mode defaults to 'As is', which does no special RTP/SRTP handling; the other values are Secured, Not Secured and Both 95. SBC Session Expires defaults to Transparent, in which the SBC does not interfere with session-timer negotiation 27. The IP Profile takes effect for calls once it is assigned to the carrier IP Group 96.

Verify

Restriction removes coders not in the allowed group, and Preference reorders coders by the allowed group's priority 25. Suggested check: in the test call trace, confirm the offer sent to the carrier lists only the coders you allowed, in your order.

Rollback

Suggested rollback: unassign the IP Profile from the carrier IP Group, then delete the profile and the Coders Group.

Step 7 Create the carrier IP Group

Registration with digest credentials (username and password)

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > IP Groups 21. Create a Server-type IP Group, the type for an entity whose address is known, usually through a Proxy Set 97. Link it to the carrier Proxy Set, IP Profile and Media Realm 98. INVITE messages destined to a Server-type IP Group are sent to the address in its Proxy Set 99. Set SIP Group Name only if you need the host part of the URI in certain SIP headers overwritten, which is what that parameter does 100. Set Registration Mode to SBC Initiates Registration 22. Set Authentication Mode to SBC as Client, so the SBC itself authenticates when the IP Group challenges it 19. In SIP digest authentication a user agent server challenges with 401 Unauthorized and a proxy with 407 Proxy Authentication Required 52. The client retries with an Authorization header after a 401 and a Proxy-Authorization header after a 407 53.

Verify

Suggested check: confirm the IP Group saves; registration itself is confirmed in Step 12.

Rollback

Registration Mode defaults to User Initiates Registration 22, and Authentication Mode defaults to User Authenticates 19. Suggested rollback: return both fields to those defaults, or delete the IP Group once no routing rule or Account refers to it.

Static IP authentication (the carrier allow-lists your public address)

Do

Open Setup menu > Signaling & Media tab > Core Entities folder > IP Groups 21. Create a Server-type IP Group, the type for an entity whose address is known, usually through a Proxy Set 97. Link it to the carrier Proxy Set, IP Profile and Media Realm 98. INVITE messages destined to a Server-type IP Group are sent to the address in its Proxy Set 99. Set SIP Group Name only if you need the host part of the URI in certain SIP headers overwritten, which is what that parameter does 100. Set Registration Mode to Registrations not Needed 22. Leave Authentication Mode at its default, User Authenticates, unless the carrier also challenges the SBC, in which case SBC as Client makes the SBC authenticate itself 19. Optionally enable Validate Source IP, so the SBC checks that incoming dialog-initiating requests come from an address in the IP Group's Proxy Set 23.

Verify

Suggested check: confirm the IP Group saves; reachability is confirmed in Step 12.

Rollback

Registration Mode defaults to User Initiates Registration 22. Suggested rollback: return changed fields to their defaults, or delete the IP Group once no routing rule refers to it.

Step 8 Add the registration Account

Registration with digest credentials (username and password)

Do

Open Setup menu > Signaling & Media tab > SIP Definitions folder > Accounts 5. Set the served IP Group to your PBX-side IP Group and the serving IP Group to the carrier IP Group, which receives the REGISTER requests 2. Set Register to Regular 6. Enter the carrier's username and password in the Account, which holds the information the SBC uses to register and digest-authenticate with the serving IP Group 2. Set Host Name to the AOR host and Contact User to the AOR user part the carrier gave you; Host Name otherwise defaults to the IP Group's SIP Group Name 3. Only 1 Account may exist for a given served and serving IP Group pair 7. If the carrier wants keep-alive by REGISTER rather than OPTIONS, Proxy Set keep-alive can also use REGISTER 101.

Verify

Open Monitor menu > Monitor tab > VoIP Status folder > Registration Status 50. The Accounts Registration Status table shows, per served IP Group, the registrar address and port and a Registration State of Registered or Not Registered 51. SIP registrations expire and must be refreshed before expiry to keep the binding active 55. Suggested check: recheck the registration state after the carrier's registration interval has passed to confirm the refresh succeeded.

Rollback

Suggested rollback: delete the Account row so the SBC stops registering for that pair.

Static IP authentication (the carrier allow-lists your public address)

Do

WarmTransfer's reading of the sources is that the carrier allow-lists the address it sees, which is the NAT address if one is configured and otherwise the interface address 16. If the carrier challenges INVITEs without wanting REGISTER, an Account with Register set to No provides authentication only, with no registration 6.

Verify

The Accounts Registration Status table lists accounts per served IP Group 51. Suggested check: confirm no registering account appears for the carrier.

Step 9 Classify inbound carrier calls to the carrier IP Group

One or more fixed IP addresses

Do

To classify an incoming dialog, the SBC checks the users registration database, then the Proxy Set by source address, then the Classification table 102. If no Classification rule matches, the SBC rejects or allows the call according to the classification-failure action setting 103. Open Setup menu > Signaling & Media tab > SBC folder > Classification Table 11. Add a rule matching the carrier's Source IP Address, your carrier Source SIP Interface and the Source Transport Type, and assign the dialog to the carrier as Source IP Group 10. Set Action Type to Allow, which assigns the dialog to the rule's IP Group 104. When the peer's IP address is known, AudioCodes recommends a Classification rule rather than classification by Proxy Set, because rules with several match characteristics resist tampering and IP spoofing better 9. AudioCodes recommends classifying by Proxy Set only when the IP Group's address is unknown, meaning its Proxy Set uses an FQDN 105. Classify by Proxy Set is enabled by default on the IP Group, so clear it there if you follow that recommendation 20. Put specific rules above general ones, because the table is searched top to bottom and the first match is used 8.

Verify

The SIP Interface's Classification Failure Response Type defaults to 500 106. Suggested check: place an inbound test call and confirm it reaches routing instead of drawing the classification-failure response.

Rollback

Suggested rollback: delete the Classification rule and re-enable classification by Proxy Set on the carrier IP Group.

An FQDN resolved by DNS

Do

To classify an incoming dialog, the SBC checks the users registration database, then the Proxy Set by source address, then the Classification table 102. If no Classification rule matches, the SBC rejects or allows the call according to the classification-failure action setting 103. Keep Classify by Proxy Set enabled on the carrier IP Group, as it is by default 20. If the source address of an incoming dialog equals an address of a Proxy Set, the SBC classifies the dialog to that Proxy Set's IP Group 36. AudioCodes recommends classifying by Proxy Set only when the IP Group's address is unknown, meaning its Proxy Set uses an FQDN 105. If the carrier publishes its source addresses, AudioCodes recommends Classification rules for known addresses because they resist tampering and IP spoofing better 9.

Verify

The SIP Interface's Classification Failure Response Type defaults to 500 106. Suggested check: place an inbound test call and confirm it is classified to the carrier rather than rejected.

Rollback

Suggested rollback: delete any Classification rules you added for the carrier.

Step 10 Add IP-to-IP routing rules in both directions

Do

Open Setup menu > Signaling & Media tab > SBC folder > Routing > IP-to-IP Routing 61. Add one rule from the PBX IP Group to the carrier IP Group and one from the carrier IP Group to the PBX IP Group, keeping Destination Type at its default, IP Group, which requires a Destination IP Group 58. For an IP Group destination, the SIP Interface comes from the IP Group's Proxy Set rather than from the rule 57. Set Source IP Group explicitly, because it defaults to Any; Request Type defaults to All 62. Source and Destination Username Patterns accept special notations up to 60 characters, and a dollar sign matches a request with no user part 59. The table is searched top to bottom and the first matching rule is used 107. AudioCodes advises placing stricter rules higher than less strict rules 108.

Verify

If no IP-to-IP Routing rule matches an incoming call, the SBC rejects the call 109. Suggested check: place a test call in each direction and confirm both complete.

Rollback

Suggested rollback: delete the two rules, accepting that calls between the groups will then be rejected.

Step 11 Normalize numbers toward the carrier

Do

Open Setup menu > Signaling & Media tab > SBC folder > Manipulation > Outbound Manipulations; up to 3,000 rules can be configured 33. An Outbound Manipulation rule changes the source or destination Request-URI user part, or the calling name, of outbound SIP dialog requests 34. Add rules for the carrier as destination, choosing the Manipulated Item (Source URI, Destination URI or Calling Name) and actions such as Remove From Left, Remove From Right, Leave From Right, Prefix to Add, Suffix to Add or Privacy Restriction Mode 30. Write routing patterns against the original number, because outbound manipulations are applied only after routing 31. Put stricter rules higher, because the first matching rule applies 32. Header changes rather than number changes go in the Inbound and Outbound Message Manipulation Sets assigned to the IP Group 110. Message Manipulation rules can add, remove or modify SIP headers, header parameters and bodies, and translate response codes 111. Their condition and action syntax is documented in a separate AudioCodes SIP Message Manipulation Reference Guide 112.

Verify

Suggested check: in the test call trace, confirm the Request-URI and From user parts sent to the carrier match the carrier's required format.

Rollback

Suggested rollback: delete the manipulation rules you added for the carrier.

Step 12 Confirm the carrier is reachable

Registration with digest credentials (username and password)

Do

Proxy Set status is shown under Monitor > VoIP Status > Proxy Sets Status 113. A proxy's status is empty when keep-alive is disabled for it or the SBC has not yet sent it a keep-alive 44. WarmTransfer's reading of the sources is that a carrier Proxy Set addressed by IP shows no live status until keep-alive is enabled 17. Addresses resolved from DNS queries show as Online even when keep-alive is disabled 43. To capture the exchange, add a logging filter for the carrier IP Group; filters can target calls by IP Group 114. A filter can send output to a syslog server, a debug recording server, local storage or OVOC 115. Syslog is enabled with the 'Enable Syslog' check box under Troubleshoot menu > Troubleshoot tab > Logging folder > Logging Settings 116. AudioCodes warns that media debug recording needs a lot of device resources 117. Open the Registration Status page under Monitor menu > Monitor tab > VoIP Status folder > Registration Status 50.

Verify

The Proxy Set status reads Online, Offline, or Not Resolved for an FQDN whose DNS resolution failed 45. The Registration State reads Registered or Not Registered 51. After a 401 the client retries with an Authorization header, and after a 407 with a Proxy-Authorization header 53. Suggested check: if the state stays Not Registered, look in the capture for the carrier's challenge and confirm the retry carries credentials.

Rollback

Suggested rollback: disable the logging filter once you have the capture you need.

Static IP authentication (the carrier allow-lists your public address)

Do

Proxy Set status is shown under Monitor > VoIP Status > Proxy Sets Status 113. A proxy's status is empty when keep-alive is disabled for it or the SBC has not yet sent it a keep-alive 44. WarmTransfer's reading of the sources is that a carrier Proxy Set addressed by IP shows no live status until keep-alive is enabled 17. Addresses resolved from DNS queries show as Online even when keep-alive is disabled 43. To capture the exchange, add a logging filter for the carrier IP Group; filters can target calls by IP Group 114. A filter can send output to a syslog server, a debug recording server, local storage or OVOC 115. Syslog is enabled with the 'Enable Syslog' check box under Troubleshoot menu > Troubleshoot tab > Logging folder > Logging Settings 116. AudioCodes warns that media debug recording needs a lot of device resources 117.

Verify

The Proxy Set status reads Online, Offline, or Not Resolved for an FQDN whose DNS resolution failed 45. WarmTransfer's reading of the sources is that the carrier sees the NAT address if one is configured and otherwise the interface address 16. Suggested check: if the status reads Offline, confirm in the capture that the keep-alives leave from the address the carrier allow-listed.

Rollback

Suggested rollback: disable the logging filter once you have the capture you need.

Step 13 Place test calls

Do

Open Troubleshoot menu > Troubleshoot tab > Test Call folder > Test Call Rules 72. For outbound, create a rule with Route By set to IP Group (the default) and the carrier IP Group, Call Party set to Caller, and a Called URI for a number you can answer 73. For inbound, create a rule with Call Party set to Called 73. The Test Call feature simulates a phone on the SBC that sets up SIP calls with a remote endpoint and can play DTMF digits or tones 74. By default up to 5 test call rules can be configured, and a License Key raises the number 71.

Verify

Suggested check: confirm calls connect in both directions with two-way audio, and that the trace shows the expected coder and number format.

Rollback

Suggested rollback: delete the test call rules when testing is complete.

Applicability

Applies to: AudioCodes Mediant Software SBC, AudioCodes Mediant 500 SBC, IETF SIP, and AudioCodes Mediant SBC. Deployments: cloud, on-premises, multi-tenant, cloud-hosted, cloud-iaas, and virtual. Sources checked 2026-10-01. The Software SBC claims come from a single User's Manual, version 7.6, that documents Mediant VE, CE and SE together 85. The digest authentication, registration refresh and TLS recommendations are taken from RFC 3261 52 55 56.

What remains uncertain

Configuring the PBX-side IP Group, Proxy Set and SIP Interface is not covered by the sources below. The value of the global SIPTransportType default is not covered by the sources below, so set each Proxy Address Transport Type explicitly. Which SIP headers the SBC rewrites with the NAT address is not covered by the sources below. Whether the NAT and IP Profile pages cited here match those on every Mediant model and firmware build is not covered by the sources below. Carrier-specific SRTP requirements beyond the SBC Media Security Mode values are not covered by the sources below. Emergency calling, caller-ID obligations and carrier contract terms are not covered by the sources below. CLI equivalents of these Web interface steps are not covered by the sources below. Firewall handling in front of the SBC, including whether a SIP ALG interferes, is not covered by the sources below.

See also

Configures

  • AudioCodes Mediant SBC — Step-by-step carrier (ITSP) trunk build on the Mediant SBC object model: SIP Interface; Media Realm; Proxy Set; IP Group; IP Profile; Accounts; routing and manipulation.

Related

Referenced by

Sources

  1. 1
    An Account's Username and Password are the MD5 digest credentials used for registration and authentication, and the manual describes them as optional when IP Group credentials are used instead.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, 'Username' and 'Password' parameters · Checked 2026-10-01
  2. 2
    An Account holds the information the SBC uses to register and digest-authenticate a 'served' IP Group (for example an IP-PBX) with a 'serving' IP Group (for example an ITSP) that receives the REGISTER requests.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, introduction; 'Served IP Group' and 'Serving IP Group' parameters · Checked 2026-10-01
  3. 3
    The Account 'Host Name' sets the host part of the AOR in the REGISTER and defaults to the IP Group's SIP Group Name; 'Contact User' sets the AOR user part.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, 'Host Name' and 'Contact User' parameters · Checked 2026-10-01
  4. 4
    The Mediant Software SBC supports up to 1,500 Accounts below 64 GB RAM and 5,000 at 64 GB, with a per-IP-Group limit of 50 to 100 depending on memory.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, introduction · Checked 2026-10-01
  5. 5
    Registration Accounts are configured under Setup menu > Signaling & Media tab > SIP Definitions folder > Accounts.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, procedure · Checked 2026-10-01
  6. 6
    The Account 'Register' parameter takes No (authentication only, no registration), Regular, or GIN (for legacy PBX support).
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, 'Register' parameter · Checked 2026-10-01
  7. 7
    Only one Account may exist for a given combination of served IP Group and serving IP Group.
    Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6) · Configuring Registration Accounts, note under introduction · Checked 2026-10-01
  8. 8
    The SBC searches the Classification table from top to bottom and uses the first rule that matches.
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, note on table search · Checked 2026-10-01
  9. 9
    When the peer's IP address is known, AudioCodes recommends a Classification rule rather than classification by Proxy Set, because rules with several match characteristics resist tampering and IP spoofing better.
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, introduction note · Checked 2026-10-01
  10. 10
    Classification rules can match on Source SIP Interface, Source IP Address (with x and * wildcards), Source Transport Type, Source Port and Destination Host, and assign the dialog to a Source IP Group.
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, Match and Action parameters · Checked 2026-10-01
  11. 11
    Classification rules are configured under Setup menu > Signaling & Media tab > SBC folder > Classification Table.
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, procedure · Checked 2026-10-01
  12. 12
    The first coder listed in a Coders Group has the highest priority and is used whenever possible.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, note on coder priority · Checked 2026-10-01
  13. 13
    Up to 21 Coders Groups can be configured, each with up to 10 coders, and each coder entry has a packetization time, rate, payload type and silence suppression setting.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, introduction and parameter table · Checked 2026-10-01
  14. 14
    Coders Groups, which determine the audio coders used for calls, are configured under Setup menu > Signaling & Media tab > Coders & Profiles folder > Coders Groups.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, introduction and procedure · Checked 2026-10-01
  15. 15
    Coders Groups take effect on SBC calls through IP Profiles, using the IP Profile's Extension Coders Group parameter together with its Allowed Coders Mode setting.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, assignment note · Checked 2026-10-01
  16. 16
    With static IP authentication the address the carrier sees is the SBC's NAT address if one is configured and otherwise the interface address, so that address is the one to give the carrier for its allow list.inferred
    Device Located behind NAT (Mediant 500 SBC User's Manual Version 7.6) · Device Located behind NAT, configuration methods and fallback paragraph · Checked 2026-10-01
  17. 17
    Because Proxy Keep-Alive is disabled by default and a proxy's status stays empty without keep-alive, a carrier Proxy Set addressed by IP shows no live status until keep-alive is enabled.inferred
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Proxy Set Status, 'Status' column; combined with Configuring Proxy Sets, 'Proxy Keep-Alive' default · Checked 2026-10-01
  18. 18
    Since the default TLS Context only holds a self-signed certificate, a carrier that validates the SBC's certificate will likely require a dedicated TLS Context with a certificate it trusts and with the carrier's root CA loaded.inferred
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, introduction (default context) · Checked 2026-10-01
  19. 19
    The IP Group 'Authentication Mode' parameter defaults to User Authenticates; with SBC as Client the SBC itself authenticates when the IP Group challenges it, and SBC as Server and SBC as Both Client and Server are also offered.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Authentication Mode' parameter · Checked 2026-10-01
  20. 20
    The IP Group 'Classify by Proxy Set' parameter is enabled by default, so dialogs whose source address matches the IP Group's Proxy Set are classified to it.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Classify by Proxy Set' parameter · Checked 2026-10-01
  21. 21
    IP Groups are configured under Setup menu > Signaling & Media tab > Core Entities folder > IP Groups.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, procedure · Checked 2026-10-01
  22. 22
    The IP Group 'Registration Mode' parameter has the values User Initiates Registration (default), SBC Initiates Registration and Registrations not Needed.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Registration Mode' parameter · Checked 2026-10-01
  23. 23
    When the IP Group 'Validate Source IP' option is enabled, the SBC checks that the source address of incoming dialog-initiating requests matches an address in the IP Group's Proxy Set.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Validate Source IP' parameter · Checked 2026-10-01
  24. 24
    The IP Profile 'Allowed Audio Coders' parameter has no group assigned by default, which allows all coders.
    Configuring IP Profiles (Mediant 500 SBC User's Manual Version 7.6) · Configuring IP Profiles, 'Allowed Audio Coders' parameter · Checked 2026-10-01
  25. 25
    The IP Profile 'Allowed Coders Mode' is Restriction (remove coders not in the allowed group), Preference (reorder by the allowed group's priority) or Restriction and Preference.
    Configuring IP Profiles (Mediant 500 SBC User's Manual Version 7.6) · Configuring IP Profiles, 'Allowed Coders Mode' parameter · Checked 2026-10-01
  26. 26
    IP Profiles are configured under Setup menu > Signaling & Media tab > Coders & Profiles folder > IP Profiles.
    Configuring IP Profiles (Mediant 500 SBC User's Manual Version 7.6) · Configuring IP Profiles, procedure · Checked 2026-10-01
  27. 27
    The IP Profile 'SBC Session Expires' parameter defaults to Transparent, in which the SBC does not interfere with session-timer negotiation.
    Configuring IP Profiles (Mediant 500 SBC User's Manual Version 7.6) · Configuring IP Profiles, 'SBC Session Expires' parameter · Checked 2026-10-01
  28. 28
    If no NAT address is configured, the SBC sends packets using the IP address configured for the interface in the IP Interfaces table.
    Device Located behind NAT (Mediant 500 SBC User's Manual Version 7.6) · Device Located behind NAT, fallback paragraph · Checked 2026-10-01
  29. 29
    When the SBC sits behind NAT, its public address is configured either as a single Static NAT IP Address for all interfaces or per IP interface in the NAT Translation table, and the static address takes priority if both are set.
    Device Located behind NAT (Mediant 500 SBC User's Manual Version 7.6) · Device Located behind NAT, configuration methods list · Checked 2026-10-01
  30. 30
    Outbound Manipulation actions are Remove From Left, Remove From Right, Leave From Right, Prefix to Add, Suffix to Add and Privacy Restriction Mode, applied to the chosen Manipulated Item (Source URI, Destination URI or Calling Name).
    Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6) · Configuring IP-to-IP Outbound Manipulations, Action parameters · Checked 2026-10-01
  31. 31
    Outbound manipulations are applied only after the routing process, so routing rules match the number as it was before outbound manipulation.
    Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6) · Configuring IP-to-IP Outbound Manipulations, introduction · Checked 2026-10-01
  32. 32
    The SBC applies the first matching Outbound Manipulation rule, so stricter rules belong higher in the table.
    Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6) · Configuring IP-to-IP Outbound Manipulations, note on rule order · Checked 2026-10-01
  33. 33
    Outbound number manipulation rules are configured under Setup menu > Signaling & Media tab > SBC folder > Manipulation > Outbound Manipulations, and up to 3,000 rules can be configured.
    Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6) · Configuring IP-to-IP Outbound Manipulations, introduction and procedure · Checked 2026-10-01
  34. 34
    An Outbound Manipulation rule changes the source or destination Request-URI user part, or the calling name, of outbound SIP dialog requests.
    Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6) · Configuring IP-to-IP Outbound Manipulations, introduction · Checked 2026-10-01
  35. 35
    A Proxy Address is entered as an IPv4 address with port (address:port), a bracketed IPv6 address with port, or an FQDN.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, Proxy Address table, 'Proxy Address' parameter · Checked 2026-10-01
  36. 36
    If the source address of an incoming SIP dialog equals an address of a Proxy Set, the SBC classifies the dialog to the IP Group associated with that Proxy Set.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, classification note · Checked 2026-10-01
  37. 37
    The Proxy Set 'Keep-Alive Failure Responses' parameter accepts up to three SIP response codes; receiving any of them in reply to a keep-alive marks the proxy offline.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Keep-Alive Failure Responses' parameter · Checked 2026-10-01
  38. 38
    Proxy Hot Swap Mode defaults to Disable; when enabled, a SIP message that fails toward one proxy is re-sent to a redundant proxy in the same Proxy Set.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Proxy Hot Swap Mode' parameter · Checked 2026-10-01
  39. 39
    The Proxy Set 'Proxy Keep-Alive' parameter defaults to Disable; the other options are Using OPTIONS, Using REGISTER, Using OPTIONS on Active Server and Using Fake REGISTER.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Proxy Keep-Alive' parameter · Checked 2026-10-01
  40. 40
    Proxy Sets are configured under Setup menu > Signaling & Media tab > Core Entities folder > Proxy Sets, with proxy addresses entered in a child Proxy Address table.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, procedure · Checked 2026-10-01
  41. 41
    A Proxy Set can be assigned a TLS Context; by default no TLS Context is assigned to a Proxy Set.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'TLS Context Name' parameter · Checked 2026-10-01
  42. 42
    Each Proxy Address has a Transport Type of UDP, TCP, TLS or SCTP; if left Not configured, the global SIPTransportType parameter is used.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, Proxy Address table, 'Transport Type' parameter · Checked 2026-10-01
  43. 43
    Addresses resolved from DNS queries show as Online even when keep-alive is disabled.
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Proxy Set Status, note under 'Status' column · Checked 2026-10-01
  44. 44
    A proxy's status field is empty when keep-alive is disabled for it or the SBC has not yet sent it a keep-alive.
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Proxy Set Status, 'Status' column, empty value · Checked 2026-10-01
  45. 45
    The Proxy Set status view shows each proxy address as Online, Offline, or Not Resolved (an FQDN whose DNS resolution failed), with success and failure counts.
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Proxy Set Status, 'Status' column values · Checked 2026-10-01
  46. 46
    Media Realms are configured under Setup menu > Signaling & Media tab > Core Entities folder > Media Realms, with an IPv4 Interface Name, a UDP Port Range Start and a Number of Media Session Legs.
    Configuring Media Realms (Mediant Software SBC User's Manual Version 7.6) · Configuring Media Realms, procedure and parameter table · Checked 2026-10-01
  47. 47
    Media Realms associated with the same IP interface must not have overlapping port ranges, and their ranges must not conflict with SIP signaling ports on that interface.
    Configuring Media Realms (Mediant Software SBC User's Manual Version 7.6) · Configuring Media Realms, port range notes · Checked 2026-10-01
  48. 48
    A Media Realm's UDP Port Range End is read-only and is calculated from the start port plus the number of session legs times the port spacing, minus one.
    Configuring Media Realms (Mediant Software SBC User's Manual Version 7.6) · Configuring Media Realms, 'UDP Port Range End' parameter · Checked 2026-10-01
  49. 49
    Only one Media Realm can be marked as the Default Media Realm, which is used where no Media Realm is explicitly assigned.
    Configuring Media Realms (Mediant Software SBC User's Manual Version 7.6) · Configuring Media Realms, 'Default Media Realm' parameter · Checked 2026-10-01
  50. 50
    Account registration state is shown on the Registration Status page under Monitor menu > Monitor tab > VoIP Status folder > Registration Status.
    Viewing Registration Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Registration Status, procedure · Checked 2026-10-01
  51. 51
    The Accounts Registration Status table shows, per served IP Group, the registrar server address and port and a Registration State of Registered or Not Registered.
    Viewing Registration Status (Mediant Software SBC User's Manual Version 7.6) · Viewing Registration Status, Accounts Registration Status table columns · Checked 2026-10-01
  52. 52
    In SIP digest authentication a user agent server challenges with 401 Unauthorized and a proxy challenges with 407 Proxy Authentication Required.
    RFC 3261 — SIP: Session Initiation Protocol · RFC 3261 section 22.1 · Checked 2026-10-01
  53. 53
    After a 401 the client retries with an Authorization header, and after a 407 with a Proxy-Authorization header.
    RFC 3261 — SIP: Session Initiation Protocol · RFC 3261 sections 22.2 and 22.3 · Checked 2026-10-01
  54. 54
    SIP digest authentication does not protect the message body.
    RFC 3261 — SIP: Session Initiation Protocol · RFC 3261 section 26.4.1 · Checked 2026-10-01
  55. 55
    SIP registrations expire and must be refreshed before expiry to keep the binding active.
    RFC 3261 — SIP: Session Initiation Protocol · RFC 3261 section 10.2.4 · Checked 2026-10-01
  56. 56
    RFC 3261 says implementations SHOULD use TLS to protect SIP messages, and TLS encrypts the whole SIP message on each hop.
    RFC 3261 — SIP: Session Initiation Protocol · RFC 3261 sections 26.2.1 and 26.3.1 · Checked 2026-10-01
  57. 57
    The routing rule's Destination SIP Interface applies only when Destination Type is something other than IP Group; for an IP Group destination the SIP Interface comes from the IP Group's Proxy Set.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, 'Destination SIP Interface' parameter · Checked 2026-10-01
  58. 58
    An IP-to-IP routing rule's Destination Type defaults to IP Group, which requires a Destination IP Group; other types include Dest Address, Request URI, ENUM, Dial Plan and Routing Server.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, 'Destination Type' and 'Destination IP Group' parameters · Checked 2026-10-01
  59. 59
    Source and Destination Username Patterns in routing rules accept special notations up to 60 characters, and a dollar sign matches a request with no user part.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, 'Source Username Pattern' and 'Destination Username Pattern' parameters · Checked 2026-10-01
  60. 60
    The Mediant Software SBC supports up to 9,000 IP-to-IP routing rules on SE and on VE/CE with 3.5 GB, and 4,500 on VE/CE with 2 GB.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, introduction · Checked 2026-10-01
  61. 61
    IP-to-IP Routing rules are configured under Setup menu > Signaling & Media tab > SBC folder > Routing > IP-to-IP Routing.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, procedure · Checked 2026-10-01
  62. 62
    An IP-to-IP routing rule's Source IP Group defaults to Any, and its Request Type defaults to All (INVITE, REGISTER, SUBSCRIBE and combinations can be selected).
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, 'Source IP Group' and 'Request Type' parameters · Checked 2026-10-01
  63. 63
    A SIP Interface can optionally be assigned a Media Realm; the parameter defaults to none.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'Media Realm' parameter · Checked 2026-10-01
  64. 64
    On the Mediant Software SBC 7.6, SIP Interfaces are configured under Setup menu > Signaling & Media tab > Core Entities folder > SIP Interfaces.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, procedure step 1 · Checked 2026-10-01
  65. 65
    A SIP Interface's Network Interface parameter is mandatory and must reference an IP interface that has the Control application type.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'Network Interface' parameter · Checked 2026-10-01
  66. 66
    Setting a SIP Interface's UDP, TCP or TLS port to 0 disables that transport on the interface.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, port parameters · Checked 2026-10-01
  67. 67
    A SIP Interface's TLS Context Name parameter defaults to the TLS Context named 'default'.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'TLS Context Name' parameter · Checked 2026-10-01
  68. 68
    A SIP Interface's TLS Port defaults to 5061 and must differ from the TCP port on the same interface.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'TLS Port' parameter · Checked 2026-10-01
  69. 69
    A SIP Interface's UDP Port and TCP Port both default to 5060.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'UDP Port' and 'TCP Port' parameters · Checked 2026-10-01
  70. 70
    Each SIP Interface must use UDP, TCP and TLS signaling ports that no other SIP Interface on the same network interface uses, and the signaling port should not fall inside an RTP port range.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, note on port uniqueness and 'UDP Port' parameter · Checked 2026-10-01
  71. 71
    By default up to five test call rules can be configured; a License Key raises the number.
    Configuring Test Call Endpoints (Mediant Software SBC User's Manual Version 7.6) · Configuring Test Call Endpoints, introduction note · Checked 2026-10-01
  72. 72
    Test Call rules are configured under Troubleshoot menu > Troubleshoot tab > Test Call folder > Test Call Rules.
    Configuring Test Call Endpoints (Mediant Software SBC User's Manual Version 7.6) · Configuring Test Call Endpoints, procedure · Checked 2026-10-01
  73. 73
    A test call rule's 'Route By' is IP Group (default) or Destination Address, its 'Call Party' is Caller (outgoing) or Called (incoming), and 'Called URI' sets the Request-URI user of the outgoing INVITE.
    Configuring Test Call Endpoints (Mediant Software SBC User's Manual Version 7.6) · Configuring Test Call Endpoints, 'Route By', 'Call Party' and 'Called URI' parameters · Checked 2026-10-01
  74. 74
    The Test Call feature simulates a phone on the SBC that sets up SIP calls with a remote endpoint to test signaling and media, and can play DTMF digits or tones.
    Configuring Test Call Endpoints (Mediant Software SBC User's Manual Version 7.6) · Configuring Test Call Endpoints, introduction and 'Play' parameter · Checked 2026-10-01
  75. 75
    The SBC ships with an undeletable default TLS Context (index 0, named 'default') holding a self-generated private key and a self-signed server certificate.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, introduction · Checked 2026-10-01
  76. 76
    TLS Contexts are configured under Setup menu > IP Network tab > Security folder > TLS Contexts, and up to 100 can be configured.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, introduction and procedure · Checked 2026-10-01
  77. 77
    OCSP checking of peer certificates is disabled by default in a TLS Context, and the SBC does not query OCSP for its own certificate.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, OCSP parameters · Checked 2026-10-01
  78. 78
    A TLS Context's TLS Version parameter defaults to TLSv1.2 and TLSv1.3; combinations from TLSv1.0 to TLSv1.3 can be selected.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, 'TLS Version' parameter · Checked 2026-10-01
  79. 79
    TLS mutual authentication is optional and is enabled with the 'TLS Mutual Authentication' check box (SIPSRequireClientCertificate) under Setup > IP Network > Security > Security Settings.
    Configuring TLS for Secured SIP (Mediant Software SBC User's Manual Version 7.6) · Configuring TLS for Secured SIP, mutual authentication step · Checked 2026-10-01
  80. 80
    For a TLS trunk, the Proxy Set's Transport Type must be set to TLS rather than UDP.
    Configuring TLS for Secured SIP (Mediant Software SBC User's Manual Version 7.6) · Configuring TLS for Secured SIP, Proxy Set transport step · Checked 2026-10-01
  81. 81
    To use SIP over TLS toward an IP Group, the manual's procedure is to configure a TLS Context, assign it to the Proxy Set or SIP Interface associated with that IP Group, and configure a TLS port on the SIP Interface.
    Configuring TLS for Secured SIP (Mediant Software SBC User's Manual Version 7.6) · Configuring TLS for Secured SIP, procedure steps 1-3 · Checked 2026-10-01
  82. 82
    By default the SBC initiates TLS only for the next network hop; the 'SIPS' check box (EnableSIPS) under SIP Definitions > Transport Settings is for multi-hop TLS.
    Configuring TLS for Secured SIP (Mediant Software SBC User's Manual Version 7.6) · Configuring TLS for Secured SIP, SIPS step · Checked 2026-10-01
  83. 83
    On a Mediant SBC, an IP Group represents a SIP entity the device communicates with, either a server such as an IP PBX or ITSP, or a group of users such as LAN IP phones.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, opening paragraph · Checked 2026-09-24
  84. 84
    A Mediant Proxy Set defines the address (IP address or FQDN) and transport type (for example UDP or TCP) of a SIP server such as a proxy or registrar.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, opening paragraph · Checked 2026-09-24
  85. 85
    AudioCodes documents Mediant VE (Virtual Edition), Mediant CE (Cloud Edition) and Mediant SE (Server Edition) together in one 'Mediant Software SBC' User's Manual, version 7.6.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Page header: manual title 'Mediant Software (VE, CE and SE) Session Border Controller User's Manual Version 7.6' · Checked 2026-09-24
  86. 86
    The Media Realm assigned to an IP Group determines the UDP port range and maximum number of media sessions on a specific IP interface for that IP Group's media.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Media Realm' parameter description · Checked 2026-09-24
  87. 87
    Obtaining a CA-signed certificate for a Mediant TLS Context proceeds by generating a CSR (the device creates a key pair if none exists and includes DN fields and SANs), sending it to the CA, importing the signed certificate, and verifying the certificate matches the private key.
    Assigning CSR-based Certificates to TLS Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Assigning CSR-based Certificates to TLS Contexts, overview and stage list · Checked 2026-09-30
  88. 88
    The Mediant accepts a peer certificate only if a CA in the TLS Context's Trusted Root CA store signed it; certificates are imported through TLS Contexts > Trusted Root Certificates > Import Certificate and must be Base64 (PEM) encoded X.509.
    Importing a Certificate into the Trusted Root CA Certificate Store (Mediant Software SBC User's Manual Ver. 7.6) · Importing a Certificate into the Trusted Root CA Certificate Store · Checked 2026-09-30
  89. 89
    A SIP Interface represents a Layer-3 network by defining a local listening port and transport type and assigning an IP network interface for SIP signaling.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, opening paragraph · Checked 2026-09-24
  90. 90
    At least one SIP Interface must be assigned to a Proxy Set.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, SIP Interface parameter note · Checked 2026-09-24
  91. 91
    Proxy Set FQDNs can be resolved by A-record (the default), SRV, NAPTR or a Microsoft Skype for Business method.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'DNS Resolve Method' parameter · Checked 2026-09-24
  92. 92
    The Proxy Set 'Proxy Keep-Alive Time' defaults to 60 seconds and can be set from 5 to 2,000,000 seconds.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Proxy Keep-Alive Time' parameter · Checked 2026-09-24
  93. 93
    In Parking redundancy mode the SBC stays with the current proxy until it fails; in Homing mode it always tries to use the highest-priority proxy currently online.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Redundancy Mode' parameter · Checked 2026-09-24
  94. 94
    Mediant Coders Groups determine the audio coders used for calls, are assigned through IP Profiles, list coders in priority order (first is preferred), and let the device add a coder the other side needs to the SDP offer so it can transcode.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, opening paragraphs · Checked 2026-09-30
  95. 95
    The IP Profile 'SBC Media Security Mode' defaults to 'As is', which does no special RTP/SRTP handling; the other values are Secured, Not Secured and Both.
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · Configuring IP Profiles, 'SBC Media Security Mode' parameter · Checked 2026-09-24
  96. 96
    An IP Profile is a set of signaling and media parameters (for example REFER handling and coders) that takes effect for calls when assigned to IP Groups.
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · Configuring IP Profiles, opening paragraph · Checked 2026-09-24
  97. 97
    Mediant IP Groups have three types: Server (address known, usually through a Proxy Set), User (location learned from REGISTER), and Gateway (SBC only; address taken from the Contact header of the gateway's REGISTER).
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Type' parameter description · Checked 2026-09-24
  98. 98
    A Mediant IP Group of type Server represents a SIP entity with a known address and is linked to a Proxy Set (where its requests are sent), an IP Profile, a Media Realm and optional inbound and outbound Message Manipulation Sets.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, parameters Type, Proxy Set, IP Profile, Media Realm, Inbound/Outbound Manipulation Set · Checked 2026-09-30
  99. 99
    For a Server-type IP Group, INVITE messages destined to the IP Group are sent to the address configured in the Proxy Set associated with that IP Group.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Proxy Set' parameter description · Checked 2026-09-24
  100. 100
    The IP Group 'SIP Group Name' parameter provides topology hiding by overwriting the host part of the URI in certain SIP headers for both source and destination IP Groups.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'SIP Group Name' parameter description · Checked 2026-09-24
  101. 101
    Proxy Set keep-alive can use SIP OPTIONS, REGISTER, OPTIONS sent only to the active server, or a 'fake REGISTER' that expects a 404 response.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Proxy Keep-Alive' parameter values · Checked 2026-09-24
  102. 102
    To classify an incoming dialog to a source IP Group, the SBC checks, in order, the users registration database, then the Proxy Set (by source address), then the Classification table.
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, classification process description · Checked 2026-09-24
  103. 103
    If no Classification rule matches, the SBC rejects or allows the call depending on configuration (the classification-failure action setting).
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, cross-reference to 'Configuring Action for Classification Failure' · Checked 2026-09-24
  104. 104
    Classification rules take an Action Type of Allow (whitelist: assign the dialog to the rule's IP Group) or Deny (blacklist: block the dialog).
    Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Classification Rules, 'Action Type' parameter · Checked 2026-09-24
  105. 105
    For security, AudioCodes recommends classifying SIP dialogs by Proxy Set only when the IP Group's address is unknown, meaning its Proxy Set is configured with an FQDN.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Classify By Proxy Set' parameter note · Checked 2026-09-24
  106. 106
    The SIP Interface 'Classification Failure Response Type' sets the SIP response sent when classification fails; the default is 500, valid values are 400 to 699, and 0 sends no response, which helps against DoS.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, 'Classification Failure Response Type' parameter · Checked 2026-09-24
  107. 107
    The Mediant SBC searches the IP-to-IP Routing table from top to bottom and uses the first rule that matches the incoming call.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, introductory paragraphs · Checked 2026-09-24
  108. 108
    AudioCodes advises placing stricter IP-to-IP Routing rules higher in the table than less strict rules.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, note on rule order · Checked 2026-09-24
  109. 109
    If no IP-to-IP Routing rule matches an incoming call, the Mediant SBC rejects the call.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, introductory paragraphs · Checked 2026-09-24
  110. 110
    Each IP Group can be assigned an Inbound Message Manipulation Set and an Outbound Message Manipulation Set, applied to SIP messages on the respective call leg.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Inbound Message Manipulation Set' and 'Outbound Message Manipulation Set' parameters · Checked 2026-09-24
  111. 111
    Message Manipulation rules can add, remove or modify SIP headers, header parameters and message bodies, translate response codes, and support topology hiding; several rules can apply to the same message in sequence.
    Configuring SIP Message Manipulation (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Message Manipulation, opening list of manipulation capabilities · Checked 2026-09-24
  112. 112
    The syntax for Message Manipulation conditions and actions is documented in a separate AudioCodes SIP Message Manipulation Reference Guide, not in the User's Manual.
    Configuring SIP Message Manipulation (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Message Manipulation, reference-guide cross-reference · Checked 2026-09-24
  113. 113
    The Mediant shows Proxy Set status under Monitor > VoIP Status > Proxy Sets Status as ONLINE, OFFLINE (keep-alive failed) or NOT RESOLVED (DNS failure), and the field is empty when keep-alive is disabled or has not yet been sent.
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Ver. 7.4) · Viewing Proxy Set Status, status table · Checked 2026-09-30
  114. 114
    The Logging Filters table holds up to 60 rules, and filters can target calls by criteria such as Any, IP Group, SRD, Classification, IP-to-IP Routing, User, SIP Interface or IP Trace.
    Configuring Log Filter Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Log Filter Rules, table limit note and 'Filter Type' parameter · Checked 2026-09-24
  115. 115
    A logging filter can send its output to a syslog server, a debug recording server, local storage on the device, or OVOC (for quality-of-experience data), with log types of Signaling, Signaling & Media, or Signaling & Media & PCM.
    Configuring Log Filter Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Log Filter Rules, 'Log Destination' and 'Log Type' parameters · Checked 2026-09-24
  116. 116
    In the Web interface, syslog is enabled with the 'Enable Syslog' check box on the Logging Settings page (Troubleshoot menu > Troubleshoot tab > Logging folder > Logging Settings).
    Enabling Syslog (Mediant Software SBC User's Manual Version 7.6) · Enabling Syslog, procedure step 1 · Checked 2026-09-24
  117. 117
    AudioCodes warns that media debug recording needs a lot of device resources and that, when many media sessions are selected, not all sessions and their signaling will be recorded.
    Configuring Log Filter Rules (Mediant Software SBC User's Manual Version 7.6) · Configuring Log Filter Rules, notes on media recording · Checked 2026-09-24

Documents

tier 1 standards and regulators

RFC 3261 — SIP: Session Initiation Protocol

IETF / RFC Editor · 2002-06 · accessed 2026-09-04

tier 2 current vendor documentation

Assigning CSR-based Certificates to TLS Contexts (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configuring Classification Rules (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring IP Profiles (Mediant 500 SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring IP-to-IP Outbound Manipulations (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Configuring Log Filter Rules (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring Media Realms (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring Registration Accounts (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring SIP Message Manipulation (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring Test Call Endpoints (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configuring TLS for Secured SIP (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Device Located behind NAT (Mediant 500 SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Enabling Syslog (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Importing a Certificate into the Trusted Root CA Certificate Store (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Viewing Proxy Set Status (Mediant Software SBC User's Manual Ver. 7.4)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Viewing Proxy Set Status (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

tier 2 current vendor documentation

Viewing Registration Status (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · 2026-10-01 · accessed 2026-10-01

Cite this page

APA

WarmTransfer. (2026, October 1). Setting up a carrier SIP trunk on an AudioCodes SBC. WarmTransfer. https://warmtransfer.net/guides/audiocodes-carrier-sip-trunk-setup

BibTeX

@misc{warmtransfer-audiocodes-carrier-sip-trunk-setup,
  title  = {Setting up a carrier SIP trunk on an AudioCodes SBC},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/audiocodes-carrier-sip-trunk-setup},
  note   = {Verified 2026-10-01}
}