Running a virtual SBC in Azure or AWS

See also

Sources

1. 1
   For a Mediant Software SBC on AWS using an Elastic IP, AudioCodes says to set the NAT rule Target IP Mode to Automatic so the device learns the public address itself, and to use Manual when an external NAT device is involved.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, Target IP Mode parameter notes for AWS · Checked 2026-10-14
2. 2
   For Mediant VE in HA mode on Azure, AudioCodes says to create two NAT rules using the local source IP addresses of the active and redundant devices and not to use the Source Interface parameter.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, note for Mediant VE HA on Azure · Checked 2026-10-14
3. 3
   For Mediant Cloud Edition behind NAT, AudioCodes says two NAT Translation rows are typically needed, one for the signaling interface and one for the Media Components' media interfaces.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, note for Mediant CE · Checked 2026-10-14
4. 4
   The AudioCodes Mediant Software SBC NAT Translation table replaces the source IP of SIP messages from an IP interface with a public address in the Via and Contact headers and the SDP o= and c= fields.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, opening description · Checked 2026-10-14
5. 5
   AudioCodes states the NAT Translation table applies to both signaling and media interfaces of the Mediant Software SBC.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, note on signaling and media · Checked 2026-10-14
6. 6
   For Mediant Software SBC on cloud platforms other than AWS, AudioCodes says to set Target IP Mode to Manual and configure the public IP address explicitly.

   Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4) · Configuring NAT Translation per IP Interface, Target IP Mode parameter notes · Checked 2026-10-14
7. 7
   AWS releases an instance's auto-assigned public IPv4 address when the instance is stopped, hibernated or terminated, and assigns a new one on start.

   Amazon EC2 instance IP addressing · Public IPv4 addresses, first bullet of release cases · Checked 2026-10-14
8. 8
   EC2 instances with 16 vCPUs or fewer have a baseline bandwidth and can burst above it using network I/O credits for a limited time, typically 5 to 60 minutes.

   Amazon EC2 instance network bandwidth · Available instance bandwidth, paragraph on up to bandwidth · Checked 2026-10-14
9. 9
   AWS directs customers who need a persistent public IP address that can be moved between instances to use an Elastic IP address.

   Amazon EC2 instance IP addressing · Public IPv4 addresses, paragraph after release cases · Checked 2026-10-14
10. 10
    Multi-flow traffic through an AWS internet gateway is limited to 5 Gbps for instance types with fewer than 32 vCPUs.

    Amazon EC2 instance network bandwidth · Multi-flow traffic table · Checked 2026-10-14
11. 11
    Traffic sent to an EC2 instance's public IPv4 or Elastic IP address has its destination translated by the internet gateway to the instance's private IPv4 address before delivery.

    Enable internet access for a VPC using an internet gateway · Internet gateway basics, IP addresses and NAT · Checked 2026-10-14
12. 12
    An EC2 instance is only aware of its private VPC address; the internet gateway provides one-to-one NAT so outbound traffic carries the instance's public IPv4 or Elastic IP address.

    Enable internet access for a VPC using an internet gateway · Internet gateway basics, IP addresses and NAT · Checked 2026-10-14
13. 13
    By default AWS does not assign a public IP address to instances launched into a nondefault subnet.

    Amazon EC2 instance IP addressing · Public IPv4 addresses, second paragraph · Checked 2026-10-14
14. 14
    AWS notes an instance may not achieve its listed bandwidth if it exceeds instance-level allowances such as packets per second or tracked connections.

    Amazon EC2 instance network bandwidth · Available instance bandwidth, first paragraph · Checked 2026-10-14
15. 15
    AWS charges for all public IPv4 addresses, including those associated with running instances and Elastic IP addresses.

    Amazon EC2 instance IP addressing · Public IPv4 addresses, Considerations, first bullet · Checked 2026-10-14
16. 16
    Secondary private IPv4 addresses on EC2 can be reassigned from one instance to another, and AWS cites redirecting traffic to a standby instance as a use case.

    Amazon EC2 instance IP addressing · Private IPv4 addresses paragraph and Multiple IP addresses, Use cases · Checked 2026-10-14
17. 17
    EC2 security groups attach to network interfaces, not individual IP addresses, so every IP on an interface is subject to that interface's security groups.

    Amazon EC2 instance IP addressing · Multiple IP addresses, How multiple IP addresses work · Checked 2026-10-14
18. 18
    Accelerated Networking cannot be enabled on a running Azure VM; it can be enabled only when the VM is stopped and deallocated.

    Azure Accelerated Networking Overview and Benefits · Limitations and constraints, third bullet · Checked 2026-10-14
19. 19
    Azure Accelerated Networking enables SR-IOV so traffic bypasses the host virtual switch, which Microsoft says lowers latency, raises packets per second and reduces jitter.

    Azure Accelerated Networking Overview and Benefits · Introduction and Benefits · Checked 2026-10-14
20. 20
    Most general-purpose and compute-optimized Azure VM sizes with two or more vCPUs support Accelerated Networking, and on hyperthreaded sizes four or more vCPUs are required.

    Azure Accelerated Networking Overview and Benefits · Supported VM instances · Checked 2026-10-14
21. 21
    Microsoft retired Basic SKU public IP addresses in Azure on 30 September 2025 and advises upgrading to Standard SKU.

    Upgrade Basic Public IP Address to Standard SKU in Azure · Important banner at top of page · Checked 2026-10-14
22. 22
    Basic public IPs remain operational after 30 September 2025, but customers who keep them accept that the service is unsupported and not covered by SLA guarantees.

    Upgrade Basic Public IP Address to Standard SKU in Azure · FAQ, What will happen to my Basic public IP resource post-retirement · Checked 2026-10-14
23. 23
    The default outbound access IP Azure assigns to a VM with no explicit outbound method is owned by Microsoft and can change without notice.

    Default Outbound Access in Azure · How and when default outbound access is provided · Checked 2026-10-14
24. 24
    Azure's explicit outbound methods are a NAT gateway on the subnet, a Standard load balancer with outbound rules, a Standard public IP on the VM NIC, or an NVA or firewall reached through a user-defined route.

    Default Outbound Access in Azure · Add an explicit outbound method · Checked 2026-10-14
25. 25
    Microsoft lists multiple NICs on a VM yielding inconsistent outbound IPs as a configuration that does not work with default outbound access.

    Default Outbound Access in Azure · Why is disabling default outbound access recommended, list of configurations that don't work · Checked 2026-10-14
26. 26
    For the Azure API version released after 31 March 2026, subnets in new virtual networks default to private (defaultOutboundAccess false), so VMs need an explicit outbound method; existing virtual networks are unchanged.

    Default Outbound Access in Azure · Retirement of default outbound access: scope and impact, What's affected and What isn't affected · Checked 2026-10-14
27. 27
    An Azure Standard SKU public IP is secure by default and closed to inbound traffic; a network security group is required to allow traffic.

    Upgrade Basic Public IP Address to Standard SKU in Azure · Basic SKU vs. Standard SKU table, Security row · Checked 2026-10-14
28. 28
    Azure Standard SKU public IP addresses use static allocation.

    Upgrade Basic Public IP Address to Standard SKU in Azure · Basic SKU vs. Standard SKU table, Allocation method row · Checked 2026-10-14
29. 29
    Azure Standard SKU public IPs can be non-zonal, zonal or zone-redundant, while Basic SKU did not support availability zones.

    Upgrade Basic Public IP Address to Standard SKU in Azure · Basic SKU vs. Standard SKU table, Availability zones row · Checked 2026-10-14
30. 30
    Changing an Azure subnet between private and non-private only takes effect on existing VMs after they are stopped and deallocated.

    Default Outbound Access in Azure · How to configure private subnets, Important note after the tabs · Checked 2026-10-14
31. 31
    Cisco's Azure overview says Accelerated Networking must be enabled for a Catalyst 8000V to reach its licensed throughput performance.

    Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure · Licensing section, PAYG paragraph · Checked 2026-10-14
32. 32
    Cisco Catalyst 8000V on Azure can be licensed BYOL through Cisco Smart Licensing or as pay-as-you-go hourly instances from the Azure Marketplace.

    Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure · Licensing section (BYOL and PAYG) · Checked 2026-10-14
33. 33
    On Azure all Catalyst 8000V interfaces sit in private subnets, and a public IP can be assigned to any interface, typically the first (NIC0).

    Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure · Network interface and public IP notes · Checked 2026-10-14
34. 34
    AudioCodes Mediant Cloud Edition SBC is listed as certified for Direct Routing with and without media bypass, supported from 7.40A.600 with 7.40A.500 recommended.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes row Mediant Cloud Edition SBC · Checked 2026-10-14
35. 35
    AudioCodes Virtual Edition SBC is listed as certified for Direct Routing with and without media bypass, supported from 7.40A.600 with 7.40A.500 recommended.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes row Virtual Edition SBC · Checked 2026-10-14
36. 36
    Microsoft lists Cisco CUBE for Catalyst 8000 Edge Platforms as certified for Direct Routing, supported from IOS XE 17.3.2 with 17.6.1a recommended.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Cisco row CUBE for Catalyst 8000 Edge Platforms · Checked 2026-10-14
37. 37
    Microsoft lists Cisco CUBE for 1000V Series Cloud Services Router as certified for Direct Routing, supported from IOS XE 17.2.1r with 17.3.3 recommended.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Cisco row CUBE for 1000 V Series Cloud Services Router · Checked 2026-10-14
38. 38
    Direct Routing certification covers documented SBC firmware versions, and higher firmware is supported as long as the major.minor version is the same.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Note in introduction, firmware version example · Checked 2026-10-14
39. 39
    Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Introductory paragraphs above Certified SBC vendors · Checked 2026-10-14
40. 40
    Oracle VME is listed as certified for Direct Routing with and without media bypass on software 9.x and 10.x.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Oracle row VME · Checked 2026-10-14
41. 41
    Microsoft's certified list covers all Ribbon SBC SWe variants including hosted offers, with and without media bypass, on 11.1 and later, 10.1, 9.2 and 7.2.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Ribbon row All SBC SWe variants, including hosted offers · Checked 2026-10-14
42. 42
    The Direct Routing SBC FQDN must belong to a verified domain in the Microsoft 365 tenant and cannot use the default *.onmicrosoft.com domain.

    Plan Direct Routing · SBC domain names · Checked 2026-10-14
43. 43
    Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP on ports 3478-3481 and 49152-53247 in both directions.

    Plan Direct Routing · Media ports table · Checked 2026-10-14
44. 44
    Microsoft does not support media re-targeting during an active Direct Routing call: a new media IP sent by the SBC mid-call is negotiated in SIP but Teams never sends media to it.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Final Note at end of page (Media re-targeting isn't supported) · Checked 2026-10-14
45. 45
    Microsoft supports Teams Phone with Direct Routing only with certified SBCs and may decline support requests involving non-certified SBCs.

    Plan Direct Routing · Support boundaries · Checked 2026-10-14
46. 46
    Microsoft lists a public IP address reachable by Microsoft Teams as an infrastructure requirement for the SBC in a Direct Routing deployment.

    Plan Direct Routing · Infrastructure requirements table, row Public IP · Checked 2026-10-14
47. 47
    Direct Routing SIP connection points for commercial clouds resolve to 52.112.0.0/14 and 52.120.0.0/14, and Microsoft says firewalls must allow all Teams ranges rather than only addresses returned by DNS.

    Plan Direct Routing · SIP signaling: FQDNs, range list and Important note · Checked 2026-10-14
48. 48
    Direct Routing signaling from the SBC to the Microsoft SIP proxy uses SIP/TLS to destination port 5061, while the proxy-to-SBC destination port is whatever is configured on the SBC.

    Plan Direct Routing · SIP signaling ports table · Checked 2026-10-14
49. 49
    The Direct Routing SBC certificate must carry the SBC FQDN in the CN or SAN and be signed by a CA in the Microsoft Trusted Root Program with the Server Authentication EKU.

    Plan Direct Routing · Public trusted certificate for the SBC · Checked 2026-10-14
50. 50
    Microsoft recommends allocating at least two media ports per concurrent call on a Direct Routing SBC.

    Plan Direct Routing · Media ports, Tip · Checked 2026-10-14
51. 51
    An SBC on an Azure Standard public IP receives no inbound SIP or RTP until an NSG explicitly allows the Teams signaling and media ranges and the carrier's addresses.inferred

    Upgrade Basic Public IP Address to Standard SKU in Azure · Basic SKU vs. Standard SKU table, Security row · Checked 2026-10-14
52. 52
    Microsoft's certified list does not explicitly name Catalyst 8000V, so whether CUBE on a cloud-hosted Catalyst 8000V falls under the Catalyst 8000 Edge Platforms certification needs confirmation from Cisco.inferred

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Cisco rows · Checked 2026-10-14
53. 53
    A cloud SBC HA design whose failover changes the media IP address mid-call is unlikely to preserve Teams Direct Routing media on in-progress calls, because Teams does not follow mid-call media re-targeting.inferred

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Final Note at end of page (Media re-targeting isn't supported) · Checked 2026-10-14
54. 54
    Because a cloud VM only sees its private address behind the provider's one-to-one NAT, a cloud-hosted SBC must be configured to write its public address into SIP and SDP, or remote peers receive unroutable private addresses.inferred

    Enable internet access for a VPC using an internet gateway · Internet gateway basics, IP addresses and NAT · Checked 2026-10-14
55. 55
    Sustained SBC media on small EC2 instances should be sized against baseline network bandwidth and packet-rate allowances, not the burstable up-to figure, because burst lasts only minutes.inferred

    Amazon EC2 instance network bandwidth · Available instance bandwidth · Checked 2026-10-14
56. 56
    Auto-assigned AWS public IPs and Azure default outbound IPs are unsuitable as SBC signaling addresses that carriers or Microsoft must reach, so a cloud SBC should use an Elastic IP or a Standard static public IP.inferred

    Amazon EC2 instance IP addressing · Public IPv4 addresses, release cases and persistent-address paragraph · Checked 2026-10-14
57. 57
    Oracle says which public clouds support the Oracle Communications SBC depends on the product release and directs customers to the SBC Release Notes.

    Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0) · Public Cloud Platforms chapter introduction · Checked 2026-10-14
58. 58
    Oracle tells customers to use the cloud providers' own documentation for specifications, requirements, caveats and known issues before deploying the SBC in a public cloud.

    Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0) · Public Cloud Platforms chapter introduction · Checked 2026-10-14
59. 59
    Oracle warns that changing the machine shape or size of a cloud SBC deployment may leave it unable to accommodate the original entitlements, and says to check show platform limits and reboot after any change.

    Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0) · Public Cloud Platforms chapter introduction · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Running a virtual SBC in Azure or AWS. WarmTransfer. https://warmtransfer.net/knowledge/cloud-hosted-sbc

@misc{warmtransfer-cloud-hosted-sbc,
  title  = {Running a virtual SBC in Azure or AWS},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cloud-hosted-sbc},
  note   = {Verified 2026-10-14}
}