Ribbon SBC 1000/2000 Configuration for Teams Direct Routing: Step-by-Step Guide

Along with AudioCodes, Ribbon Communications (formerly Sonus Networks) represents the gold standard in certified enterprise Session Border Controllers for Microsoft Teams Direct Routing. Whether deploying an appliance-based Ribbon SBC 1000 or SBC 2000 or a virtualized Ribbon SBC SWe Lite (in Azure, AWS, VMware, or Hyper-V), setting up Direct Routing requires strict adherence to Microsoft’s mutual TLS (mTLS), ICE Lite, and SIP normalization standards.

While Ribbon provides an “Easy Configuration Wizard” for standard setups, enterprise voice deployments with multi-carrier failover, analog integration, or custom Caller ID policies require manual object configuration.

This technical guide details the complete manual configuration blueprint: network interfaces, public TLS certificates, SIP Profiles, Signaling Groups, Transformation Tables, Microsoft Teams PowerShell integration, and debugging via the Ribbon LX diagnostic tool.

Ribbon SBC Architecture for Direct Routing

Phase 1: Ribbon TLS Profile & Certificate Setup

Direct Routing strictly mandates mutual TLS (mTLS). Microsoft validates the SBC’s certificate against public CAs, and the SBC must validate Microsoft’s certificate against Microsoft’s root CA chain.

1. Generate the Certificate Signing Request (CSR)

In the Ribbon WebUI:

1. Navigate to Settings → Security → Node Interfaces → Certificates → Generate Certificate Signing Request.
2. Fill in the cryptographic parameters:
   • Common Name (CN): sbc01.contoso.com
   • Subject Alternative Name (SAN): DNS:sbc01.contoso.com (Mandatory: Microsoft rejects certificates where the FQDN is only in the CN).
   • Key Length: 2048 bit (RSA).
3. Click Generate CSR. Copy the text block and submit it to a Microsoft-approved public CA (DigiCert, Sectigo, GlobalSign, or Entrust).

2. Import Trusted Root & Intermediate Certificates

Before installing your device certificate, you must import the Microsoft CA chain into Ribbon:

1. Go to Settings → Security → Node Interfaces → Certificates → Trusted Root Certificates.
2. Click Import and upload:
   • Baltimore CyberTrust Root
   • DigiCert Global Root G2
   • Your public CA’s Intermediate and Root certificates.
3. Go to Import Certificate and upload your public .cer or .pem device certificate.

3. Create the Teams TLS Profile

Navigate to Settings → Security → TLS Profiles. Click + (Create TLS Profile):

Phase 2: Ribbon Core SIP & Media Profiles

1. Create the Teams SIP Profile

Navigate to Settings → SIP → SIP Profiles. Click + (Create SIP Profile):

• Profile Name: SIP_Teams_Profile
• Contact Header FQDN: Select Custom FQDN and enter sbc01.contoso.com. (Crucial: If left on default IP, Microsoft drops calls with SIP 403 Forbidden (Gateway Not Found)).
• Support ICE: Set to Enabled. (Required for Media Bypass).
• Send Quality-of-Experience: Set to Enabled.

2. Configure the Media List & SRTP

Navigate to Settings → Media → Media Profiles:

1. Verify that G.711u, G.711a, and SILK are active.
2. Under Settings → Media → Media List, create Teams_Media_List:
   • Set Media Security to SRTP Required.
   • Add Crypto Suite: AES_CM_128_HMAC_SHA1_80.

Phase 3: Signaling Groups & Call Routing

1. Create the Teams Signaling Group

Navigate to Settings → Signaling Groups. Click + (Create Signaling Group):

• Name: SG_Microsoft_Teams
• Signaling Protocol: SIP
• SIP Profile: SIP_Teams_Profile
• TLS Profile: TLS_Teams_Profile
• Port: 5061
• Call Routing Table: From_Teams_Routing_Table
• Federated / FQDN: Under Federated IP / FQDN, add Microsoft’s three regional endpoints:
  • sip.pstnhub.microsoft.com (Port 5061)
  • sip2.pstnhub.microsoft.com (Port 5061)
  • sip3.pstnhub.microsoft.com (Port 5061)
• Admin State: Set to Enabled.

2. Create Transformation Tables (E.164 Normalization & PAI)

Navigate to Settings → Call Routing → Transformation. Create two key tables:

A. Inbound Normalization (PSTN → Teams)

Translates 10-digit national dials into full E.164 (+1) before routing to Microsoft:

Input Field: Called Address
Match Regex: ^(\d{10})$
Output Translation: +1\1

B. Outbound PAI / Caller ID Normalization (Teams → PSTN)

Ensures outbound calls present an authorized DID on the carrier SIP trunk to avoid carrier anti-spoofing rejections:

Input Field: Calling Address / PAI
Match Regex: ^\+1(\d{10})$
Output Translation: +1\1

Phase 4: Microsoft Teams Tenant Provisioning in PowerShell

With the Ribbon SBC listening on port 5061, register the gateway in Microsoft Teams PowerShell:

# 1. Connect to Microsoft Teams
Connect-MicrosoftTeams

# 2. Register the Ribbon SBC Gateway
New-CsOnlinePSTNGateway `
  -Identity "sbc01.contoso.com" `
  -SipSignalingPort 5061 `
  -SendSipOptions $true `
  -MaxConcurrentSessions 150 `
  -Enabled $true

# 3. Create PSTN Usage & Voice Route
Set-CsOnlinePstnUsage -Identity Global -Usage @{Add="US-National"}

New-CsOnlineVoiceRoute `
  -Identity "VR-Ribbon-National" `
  -NumberPattern "^\+1(\d{10})$" `
  -OnlinePstnGatewayList "sbc01.contoso.com" `
  -Priority 1 `
  -OnlinePstnUsages "US-National"

# 4. Assign Voice Routing Policy to User
New-CsOnlineVoiceRoutingPolicy -Identity "VRP-Ribbon-Users" -OnlinePstnUsages "US-National"
Grant-CsOnlineVoiceRoutingPolicy -Identity "telecom.engineer@contoso.com" -PolicyName "VRP-Ribbon-Users"

# 5. Assign Phone Number & Enable Enterprise Voice
Set-CsPhoneNumberAssignment `
  -Identity "telecom.engineer@contoso.com" `
  -PhoneNumber "+14155550188" `
  -PhoneNumberType DirectRouting

Set-CsPhoneNumberAssignment `
  -Identity "telecom.engineer@contoso.com" `
  -EnterpriseVoiceEnabled $true

Phase 5: Real-Time Debugging with Ribbon LX

The Ribbon LX Logging Tool is the primary diagnostic suite for Ribbon SBCs. Rather than guessing why a call failed, stream live traces from Diagnostics → Capture Log.

Frequently Asked Questions (FAQ)

Related Microsoft Teams Direct Routing & Hardware Guides

• AudioCodes Mediant SBC Configuration for Teams Direct Routing: Tenant to First Call
• AudioCodes vs Ribbon vs anynode: Best SBC for Teams Direct Routing
• Deploying Teams Survivable Branch Appliance (SBA): Offline Calling Architecture
• Direct Routing vs Operator Connect vs Teams Phone Mobile: 2026 Architecture Guide
• Teams Direct Routing SIP 503 Service Unavailable: Troubleshooting SBC & Trunk Outages
• Teams Direct Routing SIP 403 Forbidden: Packet Traces, FQDN Gotchas & Carrier Fixes
• Teams Direct Routing 488 Not Acceptable Here: SDP, Codecs, SRTP