11 · TLS, certificates, SIP
The service tells the SBC which proxy is nearest and fails between them. Your firewall has to allow all of them.
Commercial clouds use sip.pstnhub.microsoft.com, sip2, and sip3, on TCP 5061. IPv6 names exist on the plan page. GCC High uses sip.pstnhub.gov.teams.microsoft.us. DoD uses sip.pstnhub.dod.teams.microsoft.us. Those government clouds do not use the commercial trio.
Checked 15 October 2026. The Direct Routing plan page lists commercial SBC signaling and media in 52.112.0.0/14 and 52.120.0.0/14. IPv6 signaling is 2603:1063:400::/40, and IPv6 media adds 2603:1063:100::/40. The Teams client optimize ranges on the Office 365 URLs article and the worldwide endpoints feed are 52.112.0.0/14 and 52.122.0.0/15, plus 2603:1063::/38. 52.120.0.0/14 does not appear on that client list, and 52.122.0.0/15 does not appear on the commercial SBC list. Allow the list that matches the traffic. Re-read both pages when you change the firewall.
Signal to all three commercial PSTN hubs on 5061, and allow the published IP ranges.
Three commercial proxies, government clouds have their own names, firewall the ranges.
If it fails: The firewall allows only today’s DNS answer and the trunk fails after a resolver change.
Which description of Microsoft trusted root is accurate?
The SBC certificate must come from a CA in Microsoft’s trusted root program. A private lab CA is not enough for production pairing. Lab trunks that use a private CA teach the wrong lesson. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
A colleague reports: The trunk works in the lab and fails the morning you point it at sip.pstnhub. Where do you start?
The trunk works in the lab and fails the morning you point it at sip.pstnhub. Use a public CA for the production FQDN. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Which description of Server Authentication EKU is accurate?
The certificate should include the server authentication extended key usage. A client-auth-only certificate is the wrong object. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Around the call: compliance recording, workforce management, emergency location, analytics, CRM screen pop, and an agent with a human escape. Each one has its own failure.
The firewall allows only today’s DNS answer and the trunk fails after a resolver change.
Cisco CUBE is one of the SBC families named in this lab’s certification lesson. A certified release can be the Direct Routing SBC between Unified CM and Teams.
The tenant still needs a verified domain on the SBC FQDN, and the user still needs Teams Phone. The studio translator does not open a live AXL session. Confirm the current certified release before you build.
Teams Phone and Webex Calling are separate clouds. This lab does not describe a feature that registers a Webex Calling user into a Teams tenant.
A number move is usually a carrier port, a certified SBC, or a meetings interop product. Confirm before relying.
Unified CCE stays the ACD until you migrate it. Microsoft’s contact-center articles name Connect, Extend, and Unify. They do not name a UCCE connector in the notes this lab cites.
Voice into Teams is still Direct Routing or Operator Connect. The routing script stays on the contact-center product you bought. Confirm the vendor’s current model. Source: https://learn.microsoft.com/en-us/microsoftteams/teams-contact-center.
Copilot Studio, Azure Communication Services, and Graph are later tracks in this lab. Treat any uncited limit as confirm before relying.
Opened 2026-10. A row marked confirm did not open. Wikipedia is background. The Teams blog row is the community index.
