One SBC serving several calling platforms

See also

Sources

1. 1
   Microsoft's Direct Routing certified SBC list includes AudioCodes Mediant SBC models, including Virtual Edition and Cloud Edition, supported at 7.40A.600 with 7.40A.500 recommended for most models.

   Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes rows · Checked 2026-10-14
2. 2
   Zoom's certified hardware list includes AudioCodes Mediant SBC models, including Mediant Software SBC VE and CE, at firmware 7.40A.605.092.

   Zoom Phone certified hardware · Session Border Controllers > AudioCodes · Checked 2026-10-14
3. 3
   On CUBE, each listen port and bind combination must be unique across global and tenant configuration and across secure and nonsecure ports, and nonsecure tenant listen ports are limited to 5000-5500.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Restrictions for listen port per tenant · Checked 2026-10-14
4. 4
   Microsoft's Direct Routing certified SBC list includes Cisco Unified Border Element on Catalyst 8000 Edge Platforms, supported from IOS XE 17.3.2 with 17.6.1a recommended.

   Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Cisco rows · Checked 2026-10-14
5. 5
   A tenant-level listen port on CUBE requires IOS XE 17.8.1a or later and an interface bind configured for that tenant.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Configure listen port per tenant; Feature information · Checked 2026-10-14
6. 6
   On CUBE, a tenant listen port can be configured only when the associated dial-peers have no active calls, and changing the bind or tenant configuration closes the associated active connections.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Restrictions for listen port per tenant · Checked 2026-10-14
7. 7
   On CUBE, when a dial-peer references a tenant, configuration is applied in the order dial-peer, then tenant, then global; without a tenant the order is dial-peer, then global.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Precedence of configuration · Checked 2026-10-14
8. 8
   On Cisco CUBE, a voice class tenant acts as a configuration template for dial-peers, letting one platform hold different SIP settings for each trunk and, when bound to VRF interfaces, for each customer.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Multi-tenancy overview · Checked 2026-10-14
9. 9
   Zoom's certified hardware list for Zoom Phone includes Cisco Unified Border Element at version 17.3.3 under Session Border Controllers.

   Zoom Phone certified hardware · Session Border Controllers > Cisco · Checked 2026-10-14
10. 10
    A single SBC that serves Teams hosting, Zoom BYOC-P and a certificate-based Webex Calling Local Gateway cannot use only a wildcard certificate: Webex LGW rejects wildcards, so the Webex trunk needs its own non-wildcard identity even if Teams and Zoom share a wildcard.inferred

    Get started with Local Gateway · Certificate and TLS requirements; combined with ms-learn-dr-sbc-multiple-tenants 'Register a base domain and subdomains - Overview' and zoom-kb0079203 'Certificate requirements' · Checked 2026-10-14
11. 11
    On CUBE, the natural way to host Teams, Zoom and Webex trunks side by side is one voice class tenant per platform trunk, with tenant-level bind, listen port and TLS profile (17.8.1a or later). Cisco's HTML documentation does not show this three-platform combination.inferred

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Multi-tenancy overview; Configure listen port per tenant · Checked 2026-10-14
12. 12
    Teams Direct Routing and Zoom BYOC-P both reject INVITEs without SDP, so an SBC carrying calls into either platform from a delayed-offer source must convert delayed offer to early offer on that leg.inferred

    BYOC-P or BYOP-P call processing · Incoming calls to Zoom (SDP requirements); combined with ms-learn-dr-protocols-sip 'Non-media bypass flow' note · Checked 2026-10-14
13. 13
    Because Teams sends REFER to an SBC that advertises it while Zoom BYOC-P never sends REFER, an SBC bridging Teams and Zoom must complete Teams-originated transfers itself or stop advertising REFER on the Teams leg. The SBC cannot simply relay REFER to Zoom.inferred

    Teams Phone System Direct Routing: SIP protocol · Call transfer; combined with zoom-kb0079205 'Transfer / REFER handling' · Checked 2026-10-14
14. 14
    Cisco CUBE and AudioCodes Mediant appear on the Teams certified list, the Zoom certified list and the Webex LGW material, but at different versions, so a shared SBC's firmware must fall within every platform's listed range at once.inferred

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table; combined with zoom-kb0060242 'Session Border Controllers' and cisco-help-t9xctu third-party table · Checked 2026-10-14
15. 15
    The Microsoft certified SBC page says firmware versions higher than those documented are supported as long as the major.minor version is the same.disputed

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Introductory Note, last paragraph · Checked 2026-10-14
16. 16
    The Microsoft certified SBC page's closing note says certification is granted to a major version, so firmware with any number after the major version is supported.disputed

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Direct Routing and analog devices interoperability, closing note · Checked 2026-10-14
17. 17
    Microsoft supports Teams Phone with Direct Routing only when a Microsoft-certified SBC is used, and may decline support requests involving non-certified SBCs.

    Plan Direct Routing · Support boundaries; Supported Session Border Controllers (SBCs) · Checked 2026-10-14
18. 18
    Direct Routing supports SILK, G.711, G.722, G.729 and AMR-WB (AMR-WB non-bypass only) between Teams and the SBC; Opus is not in the list.

    Plan Direct Routing · Supported codecs · Checked 2026-10-14
19. 19
    On an inbound INVITE, the Teams Direct Routing proxy finds the destination tenant from the FQDN in the Contact header (full FQDN first, then the FQDN without its host part), and that FQDN must match the certificate CN or SAN.

    Teams Phone System Direct Routing: SIP protocol · Processing the incoming request: finding the tenant and user, steps 1-3 · Checked 2026-10-14
20. 20
    Number translation rules applied on a Teams carrier trunk do not apply to derived trunks. Microsoft lists this as a known issue, so translation rules must be created in each customer tenant.

    Configure a Session Border Controller for multiple tenants · Create a trunk and provision users > Note after the provisioning examples · Checked 2026-10-14
21. 21
    In the Teams carrier model, a derived trunk in a customer tenant takes all of its configuration from the carrier trunk. SIP OPTIONS are sent only to the carrier trunk FQDN, and its health status applies to every derived trunk.

    Configure a Session Border Controller for multiple tenants · Create a trunk and provision users > Provisioning logic and example · Checked 2026-10-14
22. 22
    For the Teams SBC hosting scenario, the carrier requests a certificate with CN and/or SAN of *.base_domain (for example *.sbc1.adatum.biz) to authenticate connections to multiple tenants from one SBC.

    Configure a Session Border Controller for multiple tenants · Register a base domain and subdomains - Overview · Checked 2026-10-14
23. 23
    If an INVITE or OPTIONS sent to the Teams SIP proxy carries an IP address rather than an FQDN as the Contact hostname, the connection is refused with 403 Forbidden.

    Teams Phone System Direct Routing: SIP protocol · Detailed requirements for Contact header and Request-URI > Contact header · Checked 2026-10-14
24. 24
    Direct Routing lets one SBC serve multiple Microsoft 365 tenants, and Microsoft describes this scenario as designed for Microsoft partners and PSTN carriers.

    Configure a Session Border Controller for multiple tenants · Introduction and first Note · Checked 2026-10-14
25. 25
    Teams Direct Routing does not support a Delayed Offer INVITE, meaning an INVITE without SDP.

    Teams Phone System Direct Routing: SIP protocol · Inbound call: SIP dialog description > Non-media bypass flow (note) · Checked 2026-10-14
26. 26
    As of the page update on 2026-09-28, Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · Paragraph before 'Certified SBC vendors' · Checked 2026-10-14
27. 27
    For inbound calls to Teams Direct Routing, the phone number in the Request-URI and in the From header must include a leading plus sign.

    Teams Phone System Direct Routing: SIP protocol · Detailed requirements for Contact header and Request-URI > Request-URI; From Header · Checked 2026-10-14
28. 28
    Teams Direct Routing picks its transfer method from the SBC's advertised capabilities: if the SBC lists REFER in Allow, the proxy sends REFER to the SBC to complete the transfer; otherwise the proxy completes the transfer itself.

    Teams Phone System Direct Routing: SIP protocol · Call transfer · Checked 2026-10-14
29. 29
    Microsoft tells administrators to make sure the SBC does not use Replaces headers in SIP requests, because Direct Routing rejects SIP requests that define Replaces headers.

    Teams Phone System Direct Routing: SIP protocol · Processing the incoming request: finding the tenant and user (note, third bullet) · Checked 2026-10-14
30. 30
    For Teams Direct Routing the SBC FQDN must belong to a verified domain in the Microsoft 365 tenant; the default *.onmicrosoft.com domain cannot be used.

    Plan Direct Routing · SBC domain names · Checked 2026-10-14
31. 31
    The Teams Direct Routing SIP protocol page states that the SBC must support Invite with Replaces.

    Teams Phone System Direct Routing: SIP protocol · Replaces option · Checked 2026-10-14
32. 32
    In the Teams hosting model, each customer subdomain must match both the FQDN of the trunk configured for that customer and the FQDN the SBC puts in the Contact header when it sends the INVITE.

    Configure a Session Border Controller for multiple tenants · Register a base domain and subdomains - Overview · Checked 2026-10-14
33. 33
    A certificate-based Webex Calling Local Gateway trunk supports more than 250 concurrent calls per trunk and several SBC device types, using certificate authentication with Local Gateway FQDN verification.

    Get started with Local Gateway · Registration-based versus certificate-based trunk comparison · Checked 2026-10-14
34. 34
    The Webex Calling Local Gateway third-party SBC table lists AudioCodes Mediant CE, VE and appliances as tested at 7.40A.250.440 for certificate-based trunks, with a noted ICE interoperability limitation.

    Get started with Local Gateway · Third-party SBC support table (certificate-based) · Checked 2026-10-14
35. 35
    A registration-based Webex Calling Local Gateway on Cisco IOS XE requires 17.6.1a or later; a certificate-based one requires 17.9.1a or later and a device certificate signed by a public CA.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure your Local Gateway (registration-based and certificate-based prerequisites) · Checked 2026-10-14
36. 36
    Wildcard certificates are not supported for the Webex Calling Local Gateway; the gateway needs a certificate signed by one of the listed certificate authorities.

    Get started with Local Gateway · Certificate and TLS requirements for certificate-based trunks · Checked 2026-10-14
37. 37
    Webex Calling currently does not support running both CME and Local Gateway on a single instance of vCUBE.

    Get started with Local Gateway · Local Gateway requirements / limitations · Checked 2026-10-14
38. 38
    A registration-based Webex Calling Local Gateway trunk supports up to 250 concurrent calls per trunk, works only with Cisco CUBE, and uses digest authentication.

    Get started with Local Gateway · Registration-based versus certificate-based trunk comparison · Checked 2026-10-14
39. 39
    For a registration-based Webex Calling Local Gateway, only SRV-based addresses are supported on the tenant side that connects to Webex Calling.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling trunk (registration-based), tenant configuration note · Checked 2026-10-14
40. 40
    In Cisco's Local Gateway configuration for Webex Calling, voice class tenants hold trunk-specific configuration: tenant 100 carries the Webex Calling registrar, credentials, sip-server and outbound proxy, and the Webex dial-peer inherits them.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Design overview; Configure Webex Calling trunk · Checked 2026-10-14
41. 41
    In Cisco's Local Gateway design with an existing Unified CM, all calls are routed through Unified CM: calls from Unified CM on port 5060 go to the PSTN and calls on port 5065 go to Webex Calling, using separate dial-peer groups for each path.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment · Checked 2026-10-14
42. 42
    Webex for Government does not currently support any third-party SBC as a Local Gateway, and does not support registration-based Local Gateway trunks.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure your Local Gateway; third-party SBC note · Checked 2026-10-14
43. 43
    Zoom BYOC-P prefers Opus, G.722, G.711 A-law/mu-law and G.729, in that order, and on inbound calls uses the first encryption standard and codec offered by the SBC that Zoom supports.

    BYOC-P or BYOP-P call processing · Audio codecs · Checked 2026-10-14
44. 44
    For Zoom BYOC-P, phone numbers must be assigned to a Common SIP Group to enable both inbound and outbound calling.

    BYOC-P or BYOP-P configuration guide · Assign SIP Groups to phone numbers · Checked 2026-10-14
45. 45
    Zoom BYOC calls should carry the destination in E.164 format; Zoom accepts SIP URIs but not tel: or sips: URIs.

    BYOC-P or BYOP-P call processing · Incoming calls to Zoom (number format) · Checked 2026-10-14
46. 46
    Zoom BYOC-P requires the SBC to send INVITEs with an SDP offer (early offer); an INVITE without SDP receives 488 Not Acceptable Here.

    BYOC-P or BYOP-P call processing · Incoming calls to Zoom (SDP requirements) · Checked 2026-10-14
47. 47
    Zoom fails over from an SBC when OPTIONS marks it down or when it answers an INVITE with 403, 408, 480, 488, 500, 502, 503, 504 or 606. It then tries the other active SBCs in the route group, then the backup route group, then the backup region.

    BYOC-P or BYOP-P call processing · Failover routing · Checked 2026-10-14
48. 48
    During mutual TLS, Zoom does not validate the CN or SAN of the SBC certificate against an expected hostname or FQDN.

    BYOC-P or BYOP-P infrastructure requirements · Certificate requirements (mutual TLS hostname validation) · Checked 2026-10-14
49. 49
    Zoom BYOC-P does not use REFER or SUBSCRIBE/NOTIFY toward the SBC, and does not use the Replaces header for redirection, even though REFER appears in its Allow header.

    BYOC-P or BYOP-P call processing · Transfer / REFER handling · Checked 2026-10-14
50. 50
    When enabled, Zoom sends SIP OPTIONS to the SBC every 30 seconds and marks the trunk down after four consecutive failures (detection about 90-120 seconds); recovery needs three consecutive successes.

    BYOC-P or BYOP-P call processing · Options Keepalive · Checked 2026-10-14
51. 51
    Zoom does not accept SDP offers or media streams that specify an SRTP Media Key Identifier (MKI).

    BYOC-P or BYOP-P infrastructure requirements · Cipher requirements · Checked 2026-10-14
52. 52
    Creating a Zoom BYOC-P route group, which selects the region whose Zoom data centers terminate the SBC trunks, may take up to 48 hours to complete.

    BYOC-P or BYOP-P configuration guide · How to manage Route Groups · Checked 2026-10-14
53. 53
    Zoom Phone endpoints always initiate connectivity into Zoom data centers, but BYOC-P SBCs require bidirectional connectivity.

    Bring Your Own Carrier - Premises Peering (BYOC-P) | Zoom Technical Library · Zoom Phone Premises Peering Network Design, Note · Checked 2026-10-14
54. 54
    In the Zoom admin portal, a BYOC-P SBC is added by display name, public IP address and port, and only TLS is supported as the transport.

    BYOC-P or BYOP-P configuration guide · Add a Session Border Controller (SBC) · Checked 2026-10-14
55. 55
    For Zoom BYOC-P peering over the internet, the SBC must support TLS 1.2 and SRTP, plus SIP (RFC 3261), RFC 2833 DTMF and RFC 5853 topology hiding.

    BYOC-P or BYOP-P infrastructure requirements · Session Border Controllers (SBCs) requirements list · Checked 2026-10-14
56. 56
    Zoom BYOC-P accepts wildcard SBC certificates when the appropriate domain names are configured, provided the certificate comes from a listed CA, includes the SBC FQDN in CN or SAN, and the SBC presents the full chain.

    BYOC-P or BYOP-P infrastructure requirements · Certificate requirements · Checked 2026-10-14
57. 57
    Any SBC certified for Zoom Phone can also be used with the Zoom Phone Local Survivability module, so existing BYOC customers do not need a separate SBC for survivability.

    PSTN Integration Considerations | Zoom Technical Library · Any Zoom Phone BYOC-certified SBC can be used · Checked 2026-10-14
58. 58
    With Zoom Phone Local Survivability, the SBC must route inbound PSTN calls to Zoom data centers as its first and second choices and to the ZPLS module only third.

    PSTN Integration Considerations | Zoom Technical Library · SBCs must route inbound calls to Zoom Phone data centers as first and second routing choices, and the ZPLS module third · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). One SBC serving several calling platforms. WarmTransfer. https://warmtransfer.net/knowledge/multi-platform-sbc-design

@misc{warmtransfer-multi-platform-sbc-design,
  title  = {One SBC serving several calling platforms},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/multi-platform-sbc-design},
  note   = {Verified 2026-10-14}
}