AudioCodes Mediant CE in Azure: Step-by-Step Teams Direct Routing Setup Guide

As enterprise IT departments decommission on-premises datacenters, voice infrastructure is rapidly shifting to the public cloud. Deploying an AudioCodes Mediant Cloud Edition (CE) Session Border Controller (SBC) inside Microsoft Azure provides a carrier-grade, highly available bridge between your SIP trunk providers, legacy PBXs, and Microsoft Teams Direct Routing without requiring physical datacenter rack space.

However, running an SBC in a public cloud introduces unique architectural challenges not present on bare-metal hardware: Azure Virtual Network (VNet) asymmetric routing, Network Address Translation (NAT) traversal where private IP addresses leak into SIP Contact headers, Accelerated Networking (SR-IOV) requirements to prevent jitter, and strict Network Security Group (NSG) port filters for Microsoft SIP proxies.

This deployment runbook details the end-to-end architecture and configuration required to deploy, secure, and validate an AudioCodes Mediant CE SBC in Microsoft Azure for Microsoft Teams Direct Routing.

Table of Contents

1. Azure VNet & Dual-NIC Architecture

Azure virtual machines exist behind a hypervisor Virtual Filtering Platform (VFP) that performs 1:1 NAT between the Azure Public IP address and the private IP assigned to the network interface. For robust security and separation of concerns, structure your Azure resource group with a dedicated VNet containing two subnets:

2. Azure Network Security Group (NSG) Port Hardening

Attach a dedicated Network Security Group to the sbc-wan-subnet. Lock down inbound traffic strictly to Microsoft Teams Direct Routing signaling subnets and your SIP carrier endpoints:

3. Deploying the Mediant CE Virtual Machine in Azure

AudioCodes provides official marketplace images for the Mediant CE SBC running on Azure. For production workloads supporting up to 250 concurrent sessions with transcoding, deploy using the Standard_D4s_v5 or Standard_D2s_v5 VM size.

# 1. Create Public IP for WAN interface
az network public-ip create \
  --resource-group rg-voice-prod \
  --name pip-sbc-wan \
  --sku Standard \
  --allocation-method Static \
  --dns-name sbc-teams-hq

# 2. Create WAN NIC with Accelerated Networking enabled
az network nic create \
  --resource-group rg-voice-prod \
  --name nic-sbc-wan \
  --vnet-name vnet-voice \
  --subnet sbc-wan-subnet \
  --network-security-group nsg-sbc-wan \
  --public-ip-address pip-sbc-wan \
  --private-ip-address 10.100.1.4 \
  --accelerated-networking true

# 3. Create LAN NIC with Accelerated Networking enabled
az network nic create \
  --resource-group rg-voice-prod \
  --name nic-sbc-lan \
  --vnet-name vnet-voice \
  --subnet sbc-lan-subnet \
  --private-ip-address 10.100.2.4 \
  --accelerated-networking true

# 4. Deploy the AudioCodes Mediant CE Virtual Machine
az vm create \
  --resource-group rg-voice-prod \
  --name vm-sbc-mediant-ce \
  --image audiocodes:mediant-sbc:mediant-cloud-edition:latest \
  --size Standard_D4s_v5 \
  --admin-username AdminSbc \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --nics nic-sbc-wan nic-sbc-lan

4. AudioCodes Network & NAT Traversal Configuration

Log in to the AudioCodes Web GUI over your secure internal LAN interface (https://10.100.2.4). Because Azure enforces 1:1 NAT, the SBC operating system sees its private IP (10.100.1.4), but external Microsoft proxies communicate with the Azure Public IP (e.g., 20.105.45.10). You must configure NAT Traversal to instruct the SBC to rewrite SIP headers.

A. Configure IP Interfaces

1. Navigate to Setup ➔ IP Network ➔ Core Entities ➔ IP Interfaces.
2. Edit your WAN interface (e.g., Interface_WAN):
   • Application Type: Media + Control
   • IP Address: 10.100.1.4
   • Prefix Length: 24
   • Default Gateway: 10.100.1.1 (Azure default subnet router)
   • NAT Traversal: Enable
   • Public IP Address: 20.105.45.10 (Your static Azure Public IP)
3. Edit your LAN interface (e.g., Interface_LAN):
   • Application Type: Media + Control
   • IP Address: 10.100.2.4
   • Prefix Length: 24
   • Default Gateway: Leave blank (Route via Static Routing Table to avoid asymmetric routing)

5. TLS Certificate Enrollment (CSR & Root CA Chain)

Microsoft Teams Direct Routing strictly enforces mutual TLS (mTLS) on TCP port 5061. The SBC must present an X.509 certificate signed by a Microsoft-approved public Certificate Authority (e.g., DigiCert, Sectigo, GlobalSign). Self-signed certificates are rejected immediately.

A. Generate CSR on AudioCodes

1. Navigate to Setup ➔ IP Network ➔ Security ➔ TLS Contexts.
2. Select TLS Context 0 (Default) ➔ Click Change Certificate.
3. Under Certificate Signing Request (CSR), populate:
   • Common Name (CN): sbc.yourdomain.com (Must match your registered DNS A record)
   • Subject Alternative Name (SAN): sbc.yourdomain.com
   • Key Size: 2048 (RSA)
4. Click Generate CSR, copy the output, and submit it to your public CA.

B. Import Trusted Root Certificates

To validate Microsoft’s SIP proxy certificates, upload Microsoft’s intermediate and root CAs into the AudioCodes Trusted Root Certificate Store:

• DigiCert Global Root CA
• DigiCert Global Root G2
• Microsoft RSA Root Certificate Authority 2017

6. AudioCodes SIP Entities (IP Groups, Proxy Sets & Routing)

With IP routing and certificates established, bind AudioCodes logical SIP entities to the Microsoft Teams SIP proxy infrastructure.

A. Proxy Set Configuration

1. Navigate to Setup ➔ Signaling & Media ➔ Core Entities ➔ Proxy Sets.
2. Create Proxy Set ID 1 (Name: ProxySet_Teams):
   • SBC IPv4 SIP Interface: Interface_WAN
   • TLS Context: 0
   • Proxy Address: sip.pstnhub.microsoft.com:5061;transport=tls
   • Proxy Keep-Alive: SIP Options (Frequency: 60 seconds)
   • Redundancy Mode: Parking

B. IP Group Configuration

1. Navigate to Setup ➔ Signaling & Media ➔ Core Entities ➔ IP Groups.
2. Create IP Group ID 1 (Name: IPG_Teams):
   • Type: Server
   • Proxy Set: ProxySet_Teams
   • Media Realm: MediaRealm_WAN
   • SIP Profile: Teams_SIP_Profile

7. Microsoft Teams Direct Routing PowerShell Pairing

Connect to the Microsoft Teams PowerShell module to create the PSTN Gateway pairing, configure SIP OPTIONS heartbeats, and bind voice routing:

# 1. Connect to Microsoft Teams PowerShell
Connect-MicrosoftTeams

# 2. Register the AudioCodes Azure SBC FQDN
New-CsTeamsPstnGateway -Fqdn "sbc.yourdomain.com" `
  -SIPSignallingPort 5061 `
  -SendSipOptions $true `
  -MaxConcurrentSessions 150 `
  -Enabled $true `
  -ForwardCallHistory $true `
  -ForwardPai $true

# 3. Verify SIP OPTIONS Heartbeat Status in Teams
Get-CsTeamsPstnGateway -Identity "sbc.yourdomain.com" | Format-List Fqdn, SIPSignallingPort, SendSipOptions, Codecs

Within 15 minutes of executing this command, log in to the Microsoft Teams Admin Center (admin.teams.microsoft.com) ➔ Voice ➔ Direct Routing ➔ SBCs. The SBC status must display a green checkmark indicating Active with successful SIP OPTIONS heartbeats.

8. Common Azure SBC Failure Modes & Debugging

1. Teams Admin Center Shows SBC Status “Inactive”

Root Cause: Mutual TLS handshake failure. Either the Azure NSG is blocking inbound TCP 5061 from Microsoft IP ranges, the public SSL certificate does not match the FQDN, or Microsoft root certificates are missing from the AudioCodes trust store.

Diagnostic: Run an AudioCodes Syslog / Message Tracer capture (filtering on SIP port 5061). Search for SSL_ERROR_SSL or certificate unknown alert codes.

2. One-Way Audio on Outbound PSTN Calls

Root Cause: Symmetric RTP failure. Azure NSG allowed outbound UDP media, but carrier RTP packets returning on ports 10000-20000 were dropped by default inbound deny rules.

Diagnostic: Verify that the NSG rule for carrier media explicitly covers the full port range configured in the AudioCodes Media Realm (typically UDP 6000-6999 for Teams and UDP 10000-20000 for PSTN carriers).

3. High Audio Jitter and Call Choppiness Under Load

Root Cause: Accelerated Networking was not enabled during VM NIC creation. Standard Azure synthetic network drivers introduce CPU interrupts under heavy RTP packet serialization.

Fix: Deallocate the VM in Azure, enable Accelerated Networking via Azure CLI or Portal, and start the VM:

az vm deallocate --resource-group rg-voice-prod --name vm-sbc-mediant-ce
az network nic update --resource-group rg-voice-prod --name nic-sbc-wan --accelerated-networking true
az network nic update --resource-group rg-voice-prod --name nic-sbc-lan --accelerated-networking true
az vm start --resource-group rg-voice-prod --name vm-sbc-mediant-ce

9. Frequently Asked Questions (FAQ)

Related Microsoft Teams & SBC Guides

• How to Configure AudioCodes SBC for Microsoft Teams Direct Routing (On-Premises Runbook)
• Teams Direct Routing SIP 503 Service Unavailable: Troubleshooting SBC & Trunk Outages
• Teams Direct Routing SIP 403 Forbidden: Voice Routing Policies & FQDN Gotchas
• Teams Direct Routing 488 Not Acceptable Here: SDP, Codecs & SRTP Negotiation
• Media Bypass vs Local Media Optimization: When Teams Skips the SBC
• Teams Direct Routing vs Operator Connect: Enterprise Architecture Comparison