# Running a virtual SBC in Azure or AWS

Canonical: https://warmtransfer.net/knowledge/cloud-hosted-sbc

Last verified: 2026-10-14

A virtual SBC on AWS runs on an EC2 instance that is only aware of its private VPC address, and the internet gateway applies 1:1 NAT so traffic carries the instance's public IPv4 or Elastic IP address[^12]. For Teams Direct Routing, Microsoft lists a public IP address reachable by Microsoft Teams as an SBC infrastructure requirement, and its certified list includes virtual SBC editions from AudioCodes, Ribbon, Oracle and Cisco[^46][^35][^41][^40][^36].

## How cloud NAT affects SBC addressing

An EC2 instance only knows its private VPC address[^12]. For outbound traffic, the internet gateway performs 1:1 NAT to the instance's public IPv4 or Elastic IP address[^12]. For inbound traffic sent to that public or Elastic IP, the internet gateway translates the destination to the instance's private IPv4 address before delivery[^11].

On Azure, all Cisco Catalyst 8000V interfaces sit in private subnets[^33]. A public IP can be assigned to any of those interfaces, typically the first one (NIC0)[^33].

WarmTransfer's reading of the sources is that a cloud-hosted SBC must be configured to write its public address into SIP and SDP, because remote peers otherwise receive unroutable private addresses[^54].

AudioCodes documents a NAT Translation table for the Mediant Software SBC[^4]. The table replaces the source IP of SIP messages from an IP interface with a public address in the Via and Contact headers and in the SDP o= and c= fields[^4]. AudioCodes states that the table applies to both the signaling and media interfaces[^5].

AudioCodes gives the following Target IP Mode guidance:[^1][^6]

- On AWS with an Elastic IP, set the NAT rule Target IP Mode to Automatic so the device learns the public address itself[^1].
- On AWS with an external NAT device, use Manual[^1].
- On cloud platforms other than AWS, set Target IP Mode to Manual and configure the public IP address explicitly[^6].

For Mediant Cloud Edition behind NAT, AudioCodes says 2 NAT Translation rows are typically needed: a row for the signaling interface and a row for the Media Components' media interfaces[^3].

## Choosing a stable public IP

### AWS

AWS releases an instance's auto-assigned public IPv4 address when the instance is stopped, hibernated or terminated, and assigns a new one on start[^7]. AWS directs customers who need a persistent public IP address that can move between instances to use an Elastic IP address[^9]. AWS charges for all public IPv4 addresses, including those on running instances and Elastic IP addresses[^15]. By default, AWS does not assign a public IP address to instances launched into a nondefault subnet[^13].

### Azure

When a VM has no explicit outbound method, Azure assigns a default outbound access IP[^23]. That IP is owned by Microsoft and can change without notice[^23].

For the Azure API version released after 31 March 2026, subnets in new virtual networks default to private (defaultOutboundAccess false), so VMs need an explicit outbound method[^26]. Existing virtual networks are unchanged[^26].

Azure's explicit outbound methods are:[^24]

- a NAT gateway on the subnet[^24]
- a Standard load balancer with outbound rules[^24]
- a Standard public IP on the VM NIC[^24]
- an NVA or firewall reached through a user-defined route[^24]

Changing a subnet between private and non-private only takes effect on existing VMs after they are stopped and deallocated[^30]. Microsoft lists multiple NICs on a VM yielding inconsistent outbound IPs as a configuration that does not work with default outbound access[^25].

Microsoft retired Basic SKU public IP addresses on 30 September 2025 and advises upgrading to Standard SKU[^21]. Basic public IPs remain operational after that date[^22]. Customers who keep them accept that the service is unsupported and not covered by SLA guarantees[^22].

Standard SKU public IP addresses have these properties:[^28][^29][^27]

- They use static allocation[^28].
- They can be non-zonal, zonal or zone-redundant, while Basic SKU did not support availability zones[^29].
- They are secure by default and closed to inbound traffic, and a network security group is required to allow traffic[^27].

### Recommendations from the sources

We infer that auto-assigned AWS public IPs and Azure default outbound IPs are unsuitable as SBC signaling addresses that carriers or Microsoft must reach[^56]. WarmTransfer's reading of the sources is that a cloud SBC should therefore use an Elastic IP or a Standard static public IP[^56].

This is inferred: an SBC on an Azure Standard public IP receives no inbound SIP or RTP until an NSG explicitly allows the Teams signaling and media ranges and the carrier's addresses[^51].

## Teams Direct Routing network requirements

Microsoft lists a public IP address reachable by Microsoft Teams as an SBC infrastructure requirement[^46].

The SBC FQDN must belong to a verified domain in the Microsoft 365 tenant and cannot use the default *.onmicrosoft.com domain[^42].

The SBC certificate must meet these conditions:[^49]

- It carries the SBC FQDN in the CN or SAN[^49].
- It is signed by a CA in the Microsoft Trusted Root Program[^49].
- It has the Server Authentication EKU[^49].

Direct Routing SIP connection points for commercial clouds resolve to 52.112.0.0/14 and 52.120.0.0/14[^47]. Microsoft says firewalls must allow all Teams ranges rather than only the addresses returned by DNS[^47].

Signaling from the SBC to the Microsoft SIP proxy uses SIP/TLS to destination port 5061[^48]. The proxy-to-SBC destination port is whatever is configured on the SBC[^48].

Media between Microsoft media processors and the SBC uses UDP/SRTP on ports 3478-3481 and 49152-53247 in both directions[^43]. Microsoft recommends allocating at least 2 media ports per concurrent call on a Direct Routing SBC[^50].

Microsoft supports Teams Phone with Direct Routing only with certified SBCs and may decline support requests that involve non-certified SBCs[^45].

## Certified virtual SBCs

Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice[^39]. Certification covers documented SBC firmware versions[^38]. Higher firmware is supported as long as the major.minor version is the same[^38].

| Product on Microsoft's certified list | Releases as listed |
|---|---|
| AudioCodes Virtual Edition SBC | Supported from 7.40A.600, 7.40A.500 recommended; with and without media bypass[^35] |
| AudioCodes Mediant Cloud Edition SBC | Supported from 7.40A.600, 7.40A.500 recommended; with and without media bypass[^34] |
| Ribbon SBC SWe, all variants including hosted offers | 11.1 and later, 10.1, 9.2 and 7.2; with and without media bypass[^41] |
| Oracle VME | 9.x and 10.x; with and without media bypass[^40] |
| Cisco CUBE for Catalyst 8000 Edge Platforms | Supported from IOS XE 17.3.2, 17.6.1a recommended[^36] |
| Cisco CUBE for 1000V Series Cloud Services Router | Supported from IOS XE 17.2.1r, 17.3.3 recommended[^37] |

Cisco Catalyst 8000V on Azure can be licensed in these ways:[^32]

- BYOL through Cisco Smart Licensing[^32]
- pay-as-you-go hourly instances from the Azure Marketplace[^32]

Oracle says which public clouds support the Oracle Communications SBC depends on the product release, and directs customers to the SBC Release Notes[^57]. Before deploying, Oracle tells customers to use the cloud providers' own documentation for specifications, requirements, caveats and known issues[^58]. Oracle also warns that changing the machine shape or size of a cloud SBC deployment may leave it unable to accommodate the original entitlements[^59]. After any such change, Oracle says to check show platform limits and reboot[^59].

## Sizing and network performance

### AWS

Multi-flow traffic through an AWS internet gateway is limited to 5 Gbps for instance types with fewer than 32 vCPUs[^10].

EC2 instances with 16 vCPUs or fewer have a baseline bandwidth[^8]. They can burst above that baseline using network I/O credits for a limited time, typically 5 to 60 minutes[^8].

AWS notes that an instance may not achieve its listed bandwidth if it exceeds instance-level allowances such as packets per second or tracked connections[^14].

WarmTransfer's reading of the sources is that sustained SBC media on small EC2 instances should be sized against baseline network bandwidth and packet-rate allowances, not the burstable up-to figure, because burst lasts only minutes[^55].

### Azure

Azure Accelerated Networking enables SR-IOV so traffic bypasses the host virtual switch[^19]. Microsoft says this lowers latency, raises packets per second and reduces jitter[^19].

Accelerated Networking cannot be enabled on a running VM; it can be enabled only when the VM is stopped and deallocated[^18].

Most general-purpose and compute-optimized Azure VM sizes with 2 or more vCPUs support Accelerated Networking[^20]. On hyperthreaded sizes, 4 or more vCPUs are required[^20].

## High availability

### AWS

Secondary private IPv4 addresses on EC2 can be reassigned from one instance to another[^16]. AWS cites redirecting traffic to a standby instance as a use case for this[^16].

EC2 security groups attach to network interfaces, not to individual IP addresses[^17]. As a result, every IP on an interface is subject to that interface's security groups[^17].

### Azure

For Mediant VE in HA mode on Azure, AudioCodes says to create 2 NAT rules using the local source IP addresses of the active and redundant devices[^2]. AudioCodes also says not to use the Source Interface parameter in that setup[^2].

### Teams media during failover

Microsoft does not support media re-targeting during an active Direct Routing call[^44]. If the SBC sends a new media IP mid-call, the change is negotiated in SIP but Teams never sends media to the new address[^44].

We infer that a cloud SBC HA design whose failover changes the media IP address mid-call is unlikely to preserve Teams Direct Routing media on in-progress calls[^53].

## See also

- [Session border controller selection and certification](https://warmtransfer.net/knowledge/sbc-selection)
- [Teams Phone Direct Routing and SBC certification](https://warmtransfer.net/knowledge/teams-direct-routing)
- [AudioCodes Mediant SBC](https://warmtransfer.net/knowledge/audiocodes-mediant-sbc)
- [Ribbon SBC Edge and SBC SWe](https://warmtransfer.net/knowledge/ribbon-sbc)
- [Cisco Unified Border Element configuration and licensing](https://warmtransfer.net/knowledge/cube-configuration)
- [SIP trunk capacity and concurrent call planning](https://warmtransfer.net/knowledge/sip-trunk-capacity-planning)
- [SIP trunk redundancy and failover design](https://warmtransfer.net/knowledge/sip-trunk-redundancy-design)

## Applicability

Applies to: Microsoft Teams Direct Routing, AudioCodes Mediant VE SBC, AudioCodes Mediant CE SBC, Ribbon Communications SBC SWe, Oracle Communications Session Border Controller, Cisco Unified Border Element, Amazon Web Services Amazon VPC, Amazon Web Services Amazon EC2, Microsoft Azure Public IP, Microsoft Azure Virtual Network, Microsoft Azure Accelerated Networking, AudioCodes Mediant Software SBC, and Cisco Catalyst 8000V Edge Software. Deployments: multi-tenant and iaas. Sources checked 2026-10-14. The Direct Routing signaling ranges given here apply to commercial clouds[^47]. The certified releases are:[^35][^34][^41][^40][^36][^37]

- AudioCodes Virtual Edition and Mediant Cloud Edition: supported from 7.40A.600[^35][^34]
- Ribbon SBC SWe: 11.1 and later, 10.1, 9.2 and 7.2[^41]
- Oracle VME: 9.x and 10.x[^40]
- Cisco CUBE for Catalyst 8000 Edge Platforms: from IOS XE 17.3.2[^36]
- Cisco CUBE for 1000V Series Cloud Services Router: from IOS XE 17.2.1r[^37]

The Azure private-subnet default applies to the API version released after 31 March 2026[^26]. The Basic SKU public IP retirement took effect on 30 September 2025[^21].

## What remains uncertain

Whether the Cisco CUBE listings are certified with or without media bypass is not covered by the sources below. Azure VM bandwidth and packet-rate limits for sizing SBC media are not covered by the sources below. Whether any specific certified SBC keeps the same media address across HA failover on Azure or AWS is not covered by the sources below.

## Sources

[^1]: For a Mediant Software SBC on AWS using an Elastic IP, AudioCodes says to set the NAT rule Target IP Mode to Automatic so the device learns the public address itself, and to use Manual when an external NAT device is involved. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, Target IP Mode parameter notes for AWS. Checked 2026-10-14.
[^2]: For Mediant VE in HA mode on Azure, AudioCodes says to create two NAT rules using the local source IP addresses of the active and redundant devices and not to use the Source Interface parameter. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, note for Mediant VE HA on Azure. Checked 2026-10-14.
[^3]: For Mediant Cloud Edition behind NAT, AudioCodes says two NAT Translation rows are typically needed, one for the signaling interface and one for the Media Components' media interfaces. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, note for Mediant CE. Checked 2026-10-14.
[^4]: The AudioCodes Mediant Software SBC NAT Translation table replaces the source IP of SIP messages from an IP interface with a public address in the Via and Contact headers and the SDP o= and c= fields. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, opening description. Checked 2026-10-14.
[^5]: AudioCodes states the NAT Translation table applies to both signaling and media interfaces of the Mediant Software SBC. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, note on signaling and media. Checked 2026-10-14.
[^6]: For Mediant Software SBC on cloud platforms other than AWS, AudioCodes says to set Target IP Mode to Manual and configure the public IP address explicitly. Source: [Configuring NAT Translation per IP Interface (Mediant Software SBC User's Manual Ver. 7.4)](https://techdocs.audiocodes.com/session-border-controller-sbc/mediant-software-sbc/user-manual/version-740/Content/UM/Configuring NAT Translation per IP Interface.htm), Configuring NAT Translation per IP Interface, Target IP Mode parameter notes. Checked 2026-10-14.
[^7]: AWS releases an instance's auto-assigned public IPv4 address when the instance is stopped, hibernated or terminated, and assigns a new one on start. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Public IPv4 addresses, first bullet of release cases. Checked 2026-10-14.
[^8]: EC2 instances with 16 vCPUs or fewer have a baseline bandwidth and can burst above it using network I/O credits for a limited time, typically 5 to 60 minutes. Source: [Amazon EC2 instance network bandwidth](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html), Available instance bandwidth, paragraph on up to bandwidth. Checked 2026-10-14.
[^9]: AWS directs customers who need a persistent public IP address that can be moved between instances to use an Elastic IP address. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Public IPv4 addresses, paragraph after release cases. Checked 2026-10-14.
[^10]: Multi-flow traffic through an AWS internet gateway is limited to 5 Gbps for instance types with fewer than 32 vCPUs. Source: [Amazon EC2 instance network bandwidth](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html), Multi-flow traffic table. Checked 2026-10-14.
[^11]: Traffic sent to an EC2 instance's public IPv4 or Elastic IP address has its destination translated by the internet gateway to the instance's private IPv4 address before delivery. Source: [Enable internet access for a VPC using an internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html), Internet gateway basics, IP addresses and NAT. Checked 2026-10-14.
[^12]: An EC2 instance is only aware of its private VPC address; the internet gateway provides one-to-one NAT so outbound traffic carries the instance's public IPv4 or Elastic IP address. Source: [Enable internet access for a VPC using an internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html), Internet gateway basics, IP addresses and NAT. Checked 2026-10-14.
[^13]: By default AWS does not assign a public IP address to instances launched into a nondefault subnet. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Public IPv4 addresses, second paragraph. Checked 2026-10-14.
[^14]: AWS notes an instance may not achieve its listed bandwidth if it exceeds instance-level allowances such as packets per second or tracked connections. Source: [Amazon EC2 instance network bandwidth](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html), Available instance bandwidth, first paragraph. Checked 2026-10-14.
[^15]: AWS charges for all public IPv4 addresses, including those associated with running instances and Elastic IP addresses. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Public IPv4 addresses, Considerations, first bullet. Checked 2026-10-14.
[^16]: Secondary private IPv4 addresses on EC2 can be reassigned from one instance to another, and AWS cites redirecting traffic to a standby instance as a use case. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Private IPv4 addresses paragraph and Multiple IP addresses, Use cases. Checked 2026-10-14.
[^17]: EC2 security groups attach to network interfaces, not individual IP addresses, so every IP on an interface is subject to that interface's security groups. Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Multiple IP addresses, How multiple IP addresses work. Checked 2026-10-14.
[^18]: Accelerated Networking cannot be enabled on a running Azure VM; it can be enabled only when the VM is stopped and deallocated. Source: [Azure Accelerated Networking Overview and Benefits](https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview), Limitations and constraints, third bullet. Checked 2026-10-14.
[^19]: Azure Accelerated Networking enables SR-IOV so traffic bypasses the host virtual switch, which Microsoft says lowers latency, raises packets per second and reduces jitter. Source: [Azure Accelerated Networking Overview and Benefits](https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview), Introduction and Benefits. Checked 2026-10-14.
[^20]: Most general-purpose and compute-optimized Azure VM sizes with two or more vCPUs support Accelerated Networking, and on hyperthreaded sizes four or more vCPUs are required. Source: [Azure Accelerated Networking Overview and Benefits](https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview), Supported VM instances. Checked 2026-10-14.
[^21]: Microsoft retired Basic SKU public IP addresses in Azure on 30 September 2025 and advises upgrading to Standard SKU. Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), Important banner at top of page. Checked 2026-10-14.
[^22]: Basic public IPs remain operational after 30 September 2025, but customers who keep them accept that the service is unsupported and not covered by SLA guarantees. Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), FAQ, What will happen to my Basic public IP resource post-retirement. Checked 2026-10-14.
[^23]: The default outbound access IP Azure assigns to a VM with no explicit outbound method is owned by Microsoft and can change without notice. Source: [Default Outbound Access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), How and when default outbound access is provided. Checked 2026-10-14.
[^24]: Azure's explicit outbound methods are a NAT gateway on the subnet, a Standard load balancer with outbound rules, a Standard public IP on the VM NIC, or an NVA or firewall reached through a user-defined route. Source: [Default Outbound Access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), Add an explicit outbound method. Checked 2026-10-14.
[^25]: Microsoft lists multiple NICs on a VM yielding inconsistent outbound IPs as a configuration that does not work with default outbound access. Source: [Default Outbound Access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), Why is disabling default outbound access recommended, list of configurations that don't work. Checked 2026-10-14.
[^26]: For the Azure API version released after 31 March 2026, subnets in new virtual networks default to private (defaultOutboundAccess false), so VMs need an explicit outbound method; existing virtual networks are unchanged. Source: [Default Outbound Access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), Retirement of default outbound access: scope and impact, What's affected and What isn't affected. Checked 2026-10-14.
[^27]: An Azure Standard SKU public IP is secure by default and closed to inbound traffic; a network security group is required to allow traffic. Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), Basic SKU vs. Standard SKU table, Security row. Checked 2026-10-14.
[^28]: Azure Standard SKU public IP addresses use static allocation. Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), Basic SKU vs. Standard SKU table, Allocation method row. Checked 2026-10-14.
[^29]: Azure Standard SKU public IPs can be non-zonal, zonal or zone-redundant, while Basic SKU did not support availability zones. Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), Basic SKU vs. Standard SKU table, Availability zones row. Checked 2026-10-14.
[^30]: Changing an Azure subnet between private and non-private only takes effect on existing VMs after they are stopped and deallocated. Source: [Default Outbound Access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), How to configure private subnets, Important note after the tabs. Checked 2026-10-14.
[^31]: Cisco's Azure overview says Accelerated Networking must be enabled for a Catalyst 8000V to reach its licensed throughput performance. Source: [Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure](https://www.cisco.com/c/en/us/td/docs/routers/C8000V/Azure/deploying-cisco-catalyst-8000v-on-microsoft-azure/c8000v_microsoftazure_overview.html), Licensing section, PAYG paragraph. Checked 2026-10-14.
[^32]: Cisco Catalyst 8000V on Azure can be licensed BYOL through Cisco Smart Licensing or as pay-as-you-go hourly instances from the Azure Marketplace. Source: [Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure](https://www.cisco.com/c/en/us/td/docs/routers/C8000V/Azure/deploying-cisco-catalyst-8000v-on-microsoft-azure/c8000v_microsoftazure_overview.html), Licensing section (BYOL and PAYG). Checked 2026-10-14.
[^33]: On Azure all Catalyst 8000V interfaces sit in private subnets, and a public IP can be assigned to any interface, typically the first (NIC0). Source: [Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure](https://www.cisco.com/c/en/us/td/docs/routers/C8000V/Azure/deploying-cisco-catalyst-8000v-on-microsoft-azure/c8000v_microsoftazure_overview.html), Network interface and public IP notes. Checked 2026-10-14.
[^34]: AudioCodes Mediant Cloud Edition SBC is listed as certified for Direct Routing with and without media bypass, supported from 7.40A.600 with 7.40A.500 recommended. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, AudioCodes row Mediant Cloud Edition SBC. Checked 2026-10-14.
[^35]: AudioCodes Virtual Edition SBC is listed as certified for Direct Routing with and without media bypass, supported from 7.40A.600 with 7.40A.500 recommended. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, AudioCodes row Virtual Edition SBC. Checked 2026-10-14.
[^36]: Microsoft lists Cisco CUBE for Catalyst 8000 Edge Platforms as certified for Direct Routing, supported from IOS XE 17.3.2 with 17.6.1a recommended. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Cisco row CUBE for Catalyst 8000 Edge Platforms. Checked 2026-10-14.
[^37]: Microsoft lists Cisco CUBE for 1000V Series Cloud Services Router as certified for Direct Routing, supported from IOS XE 17.2.1r with 17.3.3 recommended. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Cisco row CUBE for 1000 V Series Cloud Services Router. Checked 2026-10-14.
[^38]: Direct Routing certification covers documented SBC firmware versions, and higher firmware is supported as long as the major.minor version is the same. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Note in introduction, firmware version example. Checked 2026-10-14.
[^39]: Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Introductory paragraphs above Certified SBC vendors. Checked 2026-10-14.
[^40]: Oracle VME is listed as certified for Direct Routing with and without media bypass on software 9.x and 10.x. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Oracle row VME. Checked 2026-10-14.
[^41]: Microsoft's certified list covers all Ribbon SBC SWe variants including hosted offers, with and without media bypass, on 11.1 and later, 10.1, 9.2 and 7.2. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Ribbon row All SBC SWe variants, including hosted offers. Checked 2026-10-14.
[^42]: The Direct Routing SBC FQDN must belong to a verified domain in the Microsoft 365 tenant and cannot use the default *.onmicrosoft.com domain. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), SBC domain names. Checked 2026-10-14.
[^43]: Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP on ports 3478-3481 and 49152-53247 in both directions. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Media ports table. Checked 2026-10-14.
[^44]: Microsoft does not support media re-targeting during an active Direct Routing call: a new media IP sent by the SBC mid-call is negotiated in SIP but Teams never sends media to it. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Final Note at end of page (Media re-targeting isn't supported). Checked 2026-10-14.
[^45]: Microsoft supports Teams Phone with Direct Routing only with certified SBCs and may decline support requests involving non-certified SBCs. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Support boundaries. Checked 2026-10-14.
[^46]: Microsoft lists a public IP address reachable by Microsoft Teams as an infrastructure requirement for the SBC in a Direct Routing deployment. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Infrastructure requirements table, row Public IP. Checked 2026-10-14.
[^47]: Direct Routing SIP connection points for commercial clouds resolve to 52.112.0.0/14 and 52.120.0.0/14, and Microsoft says firewalls must allow all Teams ranges rather than only addresses returned by DNS. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), SIP signaling: FQDNs, range list and Important note. Checked 2026-10-14.
[^48]: Direct Routing signaling from the SBC to the Microsoft SIP proxy uses SIP/TLS to destination port 5061, while the proxy-to-SBC destination port is whatever is configured on the SBC. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), SIP signaling ports table. Checked 2026-10-14.
[^49]: The Direct Routing SBC certificate must carry the SBC FQDN in the CN or SAN and be signed by a CA in the Microsoft Trusted Root Program with the Server Authentication EKU. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Public trusted certificate for the SBC. Checked 2026-10-14.
[^50]: Microsoft recommends allocating at least two media ports per concurrent call on a Direct Routing SBC. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Media ports, Tip. Checked 2026-10-14.
[^51]: An SBC on an Azure Standard public IP receives no inbound SIP or RTP until an NSG explicitly allows the Teams signaling and media ranges and the carrier's addresses (inferred). Source: [Upgrade Basic Public IP Address to Standard SKU in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance), Basic SKU vs. Standard SKU table, Security row. Checked 2026-10-14.
[^52]: Microsoft's certified list does not explicitly name Catalyst 8000V, so whether CUBE on a cloud-hosted Catalyst 8000V falls under the Catalyst 8000 Edge Platforms certification needs confirmation from Cisco (inferred). Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Cisco rows. Checked 2026-10-14.
[^53]: A cloud SBC HA design whose failover changes the media IP address mid-call is unlikely to preserve Teams Direct Routing media on in-progress calls, because Teams does not follow mid-call media re-targeting (inferred). Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Final Note at end of page (Media re-targeting isn't supported). Checked 2026-10-14.
[^54]: Because a cloud VM only sees its private address behind the provider's one-to-one NAT, a cloud-hosted SBC must be configured to write its public address into SIP and SDP, or remote peers receive unroutable private addresses (inferred). Source: [Enable internet access for a VPC using an internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html), Internet gateway basics, IP addresses and NAT. Checked 2026-10-14.
[^55]: Sustained SBC media on small EC2 instances should be sized against baseline network bandwidth and packet-rate allowances, not the burstable up-to figure, because burst lasts only minutes (inferred). Source: [Amazon EC2 instance network bandwidth](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html), Available instance bandwidth. Checked 2026-10-14.
[^56]: Auto-assigned AWS public IPs and Azure default outbound IPs are unsuitable as SBC signaling addresses that carriers or Microsoft must reach, so a cloud SBC should use an Elastic IP or a Standard static public IP (inferred). Source: [Amazon EC2 instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html), Public IPv4 addresses, release cases and persistent-address paragraph. Checked 2026-10-14.
[^57]: Oracle says which public clouds support the Oracle Communications SBC depends on the product release and directs customers to the SBC Release Notes. Source: [Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0)](https://docs.oracle.com/en/industries/communications/session-border-controller/9.0.0/installation/public-cloud-platforms.html), Public Cloud Platforms chapter introduction. Checked 2026-10-14.
[^58]: Oracle tells customers to use the cloud providers' own documentation for specifications, requirements, caveats and known issues before deploying the SBC in a public cloud. Source: [Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0)](https://docs.oracle.com/en/industries/communications/session-border-controller/9.0.0/installation/public-cloud-platforms.html), Public Cloud Platforms chapter introduction. Checked 2026-10-14.
[^59]: Oracle warns that changing the machine shape or size of a cloud SBC deployment may leave it unable to accommodate the original entitlements, and says to check show platform limits and reboot after any change. Source: [Public Cloud Platforms (Oracle Communications Session Border Controller Platform Preparation and Installation Guide S-Cz9.0.0)](https://docs.oracle.com/en/industries/communications/session-border-controller/9.0.0/installation/public-cloud-platforms.html), Public Cloud Platforms chapter introduction. Checked 2026-10-14.