11 · TLS, certificates, SIP

Codecs and SRTP

An empty codec list is a 488. Missing media ports is silence after a 200.

Room HTMLAll downloads

Learn it in 5 minutes

Direct Routing lists SILK, G.711, G.722, G.729, and AMR-WB for non-bypass calls. Offer a codec both sides have. G.711 µ-law and A-law both belong if the carrier is vague. Media is SRTP. A trunk that offers only plaintext RTP is not the design.

DTMF has to survive every hop or the IVR never hears 1. Test digits through the carrier, not only Teams-to-Teams. If bypass is on, do not depend on AMR-WB.

Agree a codec, keep SRTP, and prove DTMF through the SBC. AMR-WB is not a bypass codec.

Room HTML

Visual

SIP over TLS toward the carrierTeamsProxySBC-AINVITE100INVITE180200ACK
Signaling for Codecs and SRTP. Teams keeps the dialog. A 488 is codecs, not a greeting.
Safe minimumG.711 · OfferSRTP · RequiredDTMF · Test
What to offer unless you measured a reason not to. Counts in this drawing are teaching order, not customers.

SVGPNGHTML

Worked example

I offer G.711, I use SRTP, and I test DTMF through the carrier.

  1. Offer Shared codec
  2. SRTP Not plaintext
  3. DTMF Test a digit
  4. 488 Empty intersection

If it fails: The SBC allows only a codec Teams will not use on that path, and every call is 488.

Checklist HTML

Quiz

Which description of SIP options timer teaching model is accurate?

A colleague reports: Someone sets a script to fail over after one missed packet and flaps the trunk. Where do you start?

Which description of Failover rehearsal is accurate?

Flashcards

Ecosystem

Glossary

  • SRTP The media encryption Direct Routing uses. Signaling is TLS. A successful INVITE with plaintext RTP is not the design. Config: Allow the UDP media range. Do not strip SRTP on the SBC. Fault: The SBC offers RTP/AVP only and the call fails or is unsupported.
  • TLS 1.2 Direct Routing signaling expects modern TLS. TLS 1.0 is not a compatible offer. Config: Upgrade firmware and offer TLS 1.2 or newer toward the proxies. Fault: The handshake dies before OPTIONS.
  • Certificate SAN The name on the SBC certificate must match the FQDN you paired. Wildcards are allowed when they follow RFC 2818. Config: Issue the certificate for the paired name. Include the chain. Fault: TLS fails with a name mismatch and someone restarts the SBC.
  • Microsoft trusted root The SBC certificate must come from a CA in Microsoft’s trusted root program. A private lab CA is not enough for production pairing. Config: Use a public CA for the production FQDN. Fault: The trunk works in the lab and fails the morning you point it at sip.pstnhub.

Sister technologies

Around the call: compliance recording, workforce management, emergency location, analytics, CRM screen pop, and an agent with a human escape. Each one has its own failure.

Config and troubleshooting

The SBC allows only a codec Teams will not use on that path, and every call is 488.

Cross-platform bridges

CUCM

Cisco CUBE is one of the SBC families named in this lab’s certification lesson. A certified release can be the Direct Routing SBC between Unified CM and Teams.

The tenant still needs a verified domain on the SBC FQDN, and the user still needs Teams Phone. The studio translator does not open a live AXL session. Confirm the current certified release before you build.

Webex

Teams Phone and Webex Calling are separate clouds. This lab does not describe a feature that registers a Webex Calling user into a Teams tenant.

A number move is usually a carrier port, a certified SBC, or a meetings interop product. Confirm before relying.

UCCE

Unified CCE stays the ACD until you migrate it. Microsoft’s contact-center articles name Connect, Extend, and Unify. They do not name a UCCE connector in the notes this lab cites.

Voice into Teams is still Direct Routing or Operator Connect. The routing script stays on the contact-center product you bought. Confirm the vendor’s current model. Source: https://learn.microsoft.com/en-us/microsoftteams/teams-contact-center.

Future hooks

Copilot Studio, Azure Communication Services, and Graph are later tracks in this lab. Treat any uncited limit as confirm before relying.

BridgesEcosystem

Sources and go deeper

Opened 2026-10. A row marked confirm did not open. Wikipedia is background. The Teams blog row is the community index.

  • Plan Direct Routing — Microsoft Learn — last checked 2026-10.
  • RFC 3261 — RFC — last checked 2026-10.
  • RFC 8446 — RFC — last checked 2026-10.
  • RFC 4566 — RFC — last checked 2026-10.
  • Transport Layer Security — Wikipedia — last checked 2026-10. Wikipedia fallback for background. Confirm the vendor page before you change a tenant
  • Session Initiation Protocol — Wikipedia — last checked 2026-10. Wikipedia fallback for background. Confirm the vendor page before you change a tenant
  • Microsoft Teams blog index — Community — last checked 2026-10. Community index for the Microsoft Teams blog. This is the index, not a claim that a post discusses this room

sources.json