Debian-SBC Mediant

Active Sessions

concurrent

SRTP Encrypted:

Transcoding DSP

/ 48 slots

DSP Equiv. Load:

↑ UP Trunks (ISP)

Online

Carrier Gateway:

↓ DOWN Trunks (PBX)

Online

Internal LAN PBX:

Vertical SBC Topology Map (UP / DOWN)

Live Signaling & Media

Top: ↑ UP (Carriers / ISP) | Middle: Debian SBC Core | Bottom: ↓ DOWN (PBX / LAN)

↑ UP (ISP / Carrier SIP Trunks)

No UP Trunk (ISP) configured.

SIP Ingress Signalling & RTP Media

DEBIAN-SBC Core Appliance

B2BUA / Topology Hiding / Transcoder

SIP Proxy: 5060 (Active)

Media DSP: 2223 (Active)

Active Calls:

Transcode:

SIP Egress Signalling & Transcoded RTP

↓ DOWN (Internal PBX & LAN Trunks)

No DOWN Trunk (PBX) configured.

SBC Core Engines & Hardware Health

All Core Daemons Active

SIP Proxy Daemon

Kamailio 6.0

Listening: 0.0.0.0:5060 (UDP/TCP)

STATE: ACTIVE

Media Relay / Transcoder

RTPEngine 12.5

Control NG: 127.0.0.1:2223

STATE: ACTIVE

Appliance Board

Interface eth0 I/O

SIP Trunks (UP / DOWN Topology)

AudioCodes Topology Matrix

↑ UP = Uplink / ISP / Carrier Trunk | ↓ DOWN = Downlink / Internal PBX / LAN

Topology	Trunk Type	Trunk Name	SIP Profile	Egress Interface	Gateways / Registrar Endpoint	Status	Actions
			SRTP

No SIP Trunks configured yet.
Add your first Trunk by selecting direction (UP = ISP or DOWN = PBX).

AudioCodes-grade SIP Trunk configuration supporting all trunk topologies: Peer-to-Peer, Carrier Registration, Inbound Registrar & Digest Authentication.

Select Trunk Topology & Registration Mode *:

Trunk Name *:

Unique alphanumeric label for this trunk.

Topology Direction *:

AudioCodes Matrix: UP for Carriers, DOWN for Enterprise PBX.

SIP Profile (Signaling Rules): Manage

Defines PRACK, Session Timers, and signaling normalization.

Egress Network Interface:

Automates Linux kernel static host routes (/32) for this trunk.

Media Realm (RTP Ports & Interface): Manage Realms

Couples this trunk with dedicated RTP ports and network interface.

SIP OPTIONS Keepalive Probe:

Periodic SIP OPTIONS pinging to monitor gateway liveness and auto-failover.

Standard P2P Peering Authentication

Standard Peer-to-Peer SIP trunks authenticate via IP Access Control / Firewall rules without SIP digest credentials.
If your provider or PBX challenges outgoing calls with 401 Unauthorized or 407 Proxy Authentication Required, switch the Trunk Topology above to "Digest Auth" or "Registration".

Account Username / DID *:

SIP Account Phone Number, DID, or Trunk Username.

Password / Secret *:

SIP Digest authentication password.

Authentication Realm / Domain:

Matches the realm in 401/407 challenge header.

Contact User (Optional):

Custom user in Contact header (defaults to Account DID).

Assigned SIP Profile (Media & Codec Authority):

All voice codecs, RTPEngine transcoding rules, SRTP encryption, and timers are governed by this SIP Profile.

Voice Codecs (Priority Order)

RTPEngine Transcoding

Transcode on codec mismatch Strict transcode to profile codecs Direct RTP pass-through

Media Encryption (SRTP)

Mandatory SDES / DTLS-SRTP Offer SRTP & Accept RTP Plain RTP (Unencrypted Audio)

DTMF Signaling Relay

Packet Time (ptime)

RTP Anchoring & Topology

•

TLS Security Profile & Certificate Context: Manage TLS Contexts

Automatically applies dedicated RSA/ECDSA Certificate, Root CA validation bundle, TLS version, and Ciphers when connecting via TLS.

All SBC Trunks & Real-Time Status

Complete topology matrix of all connections (UP Carriers & DOWN PBX) with live status

Topology	Trunk Name	SIP Profile	Redundancy	Endpoints (IP / FQDN:Port)	Transport	Status

No Trunks found matching criteria.

SIP Profiles & Signaling Definitions

AudioCodes IP Profile Engine

Codecs, Transcoding Policy, RTP Anchoring, DTMF Relay (RFC2833/INFO/Inband), SIP Extensions (PRACK / 100rel, Re-INVITE, UPDATE) and RFC 4028 Session Timers.

Trunk Binding Strategy

Each SIP Trunk is bound to a SIP Profile. Kamailio & RTPEngine automatically enforce these policies on each call leg.

Total Profiles:

Transcoding: DSP Dynamic

PRACK & RFC4028: Active

Profile Name & Description	Allowed Codecs	Media / Transcoding	DTMF Relay	SIP Extensions	Session Timers (RFC4028)	Assigned Trunks	Actions
Default SRTP		DSP: RTP: •		PRACK: UPDATE:	Disabled	None

No SIP Profiles configured.
Add a new profile by clicking the "Add SIP Profile" button.

Media Realms (RTP Per-Interface Management)

AudioCodes Mediant Multi-Homed RTP

Couple logical media realms with network interfaces, allocate dedicated UDP port ranges per interface, configure NAT public addresses, and enforce QoS.

Configured Realms

Coupled Interfaces

Allocated RTP Ports

UDP Ports

Audio Session Capacity

Concurrent

Couple network interface, assign dedicated RTP UDP port range, and set media parameters.

1. Realm Identification

Media Realm Name: *

Unique identifier referenced by Kamailio and RTPEngine for routing.

Description:

Set as Default Fallback Media Realm Active / Enabled

2. Network Interface Coupling (Πάντρεμα Interface)

Coupled Network Interface: *

Marries this media realm to a specific Linux physical, VLAN, or alias interface.

Bound Media IP (Auto-detected):

Advertised External IP (NAT Traversal / 1:1 Public IP):

Advertised in outgoing SDP c= (Connection) and o= (Origin) lines when SBC sits behind 1:1 NAT (AWS EIP, carrier NAT).

3. RTP Port Allocation per Interface

Quick Standard Presets (Non-Overlapping Blocks):

RTP Low Port (Min): *

RTP High Port (Max): *

Allocated UDP Sockets:

Concurrent Call Capacity:

4. Media Protocols, Latching & QoS

RTCP Multiplexing (RFC 5761 rtcp-mux): Multiplexes RTP and RTCP on the same single port pair.

Symmetric RTP / Media Latching:

Controls how RTPEngine learns and relays media for remote endpoints behind NAT.

RTP Silence Timeout (sec):

RTCP Timeout (sec):

Audio DSCP (TOS):

Default 46 (Expedited Forwarding EF)

Video DSCP (TOS):

Default 34 (Assured Forwarding AF41)

TLS Contexts & Certificates

AudioCodes Mediant PKI

Manage Digital Certificates (Server / Client), Root CAs, Cipher Suites and TLS Profiles for SIP Trunks

Context Name & Description	Min TLS	Server / Client Certificate	Root CA Bundle	Verification / mTLS	Ciphers	Bound SIP Trunks	Actions
Default SNI Domain:			None (No CA verify)		(Click to view all)	No trunks assigned

No TLS Contexts configured.

Total Certificates:

Certificate Name & Type	Common Name (CN)	Issuer	SANs (Alt Names)	Key Size / Fingerprint	Validity & Days Left	In Use	Actions
Auto-Renew			-

No installed digital certificates or Root CAs.

CSR Name	Subject Common Name (CN)	SANs (Alt Names)	Key Size	Generated Date	Status	Actions
					Pending Signed Cert

No pending Certificate Signing Requests (CSR).

/etc/kamailio/tls.cfg Configuration File

Live production Kamailio TLS configuration file, synced from TLS Contexts and Certificates

AudioCodes Mediant PKI

Configure TLS encryption profile, create or attach certificates directly, Root CA and Cipher Suite policies.

Context Name *:

Min TLS Protocol Version:

Description / Notes:

Server Name Indication (SNI Domain - Optional):

Server / Client Certificate

Issue, generate or attach a digital certificate for this TLS Context

Subject CN:

Issuer:

Valid Until:

Primary Domain (FQDN) *:

Contact Email *:

Validation Method:

Key Algorithm:

Subject Alt Names (SANs) - Optional:

Use Let's Encrypt Staging (Test without limits) Daily Auto-Renewal

Common Name (CN / FQDN) *:

Organization:

SANs (Comma-separated):

Validity (Days):

Key Size:

Certificate PEM (-----BEGIN CERTIFICATE-----):

Private Key PEM (-----BEGIN RSA PRIVATE KEY-----):

Common Name (CN / FQDN) *:

SANs (Comma-separated):

Choose Existing Certificate from Library:

Trusted Root CA Bundle

Select an existing Root CA or import a new Root CA bundle

| |

Root CA Bundle Name:

Root CA PEM (-----BEGIN CERTIFICATE-----):

Verify Peer Certificate

Verifies peer cert is signed by Root CA.

Require Client Cert (mTLS)

Enforces mutual TLS authentication.

Verify Depth:

Cipher Suites List:

Presets:

Communicating with PKI / Let's Encrypt...

Automated Let's Encrypt Certificate (ACME v2)

ACME v2 Automated PKI

Issue automated SSL/TLS certificates with zero-downtime Kamailio SIP integration and daily auto-renewal.

Certificate Alias / Name *:

Primary Domain (FQDN) *:

Contact Email *:

Subject Alt Names (SANs) - Optional:

ACME Validation Method *:

Key Algorithm:

HTTP-01 Standalone: Certbot binds port 80 to complete ACME token validation. Ensure public port 80 is forwarded to this SBC appliance.

HTTP-01 Webroot: Challenges are served via the appliance web server at /.well-known/acme-challenge/. Ideal when reverse proxies forward port 80.

DNS-01 Challenge: You will be given a DNS TXT record (_acme-challenge.<domain>) to add to your DNS zone. No inbound port 80 required!

Auto-create TLS Context

Automatically generates a TLS Context named TLS_<Name> and reloads Kamailio.

Use Let's Encrypt Staging

Use testing environment without rate limits. (Uncheck for real production cert).

Action Required: Add DNS TXT Record

Please create the following TXT record at your DNS provider (e.g., Cloudflare, Route53, GoDaddy, BIND). Once added, wait 30 seconds for DNS propagation, then click "Verify & Complete".

Communicating with Let's Encrypt ACME...

Generate Self-Signed Certificate

Generate a new RSA Private Key and self-signed X.509 certificate for TLS/SIP.

Certificate Alias / Name *:

Common Name (CN / FQDN) *:

Organization:

Subject Alternative Names (SANs) - Comma-separated:

Add all IP addresses and FQDN domain names that will be used by Trunks.

Country (ISO):

Validity (Days):

Key Size:

Generate Certificate Signing Request (CSR)

Generates RSA Private Key on the SBC and produces a CSR to submit to an external CA.

CSR Request Alias *:

Common Name (CN / FQDN) *:

Organization:

Subject Alternative Names (SANs) - Comma-separated:

Country (ISO):

Key Size:

Import Certificate or Root CA Bundle

Import an existing Server/Client certificate or Trusted Root CA.

Name / Alias *:

Certificate Type:

Certificate PEM (-----BEGIN CERTIFICATE-----) *:

Private Key PEM (-----BEGIN RSA PRIVATE KEY----- / PRIVATE KEY):

Required for Server or Client certificates to complete the TLS handshake.

Telephony Routing

Sequential routing engine organized into serial Groups and serial Rules with Drag & Drop or direct Number Order ID.

Sequential Group & Rule Execution Architecture

Groups execute in serial order (Group 1 → Group 2 → ...). Inside each group, rules are evaluated sequentially (Order 1, 2, ...). The first matching rule executes the Route To Trunk action. Reorder items with Drag & Drop (⠿) or pin an exact position with the Order ID input (existing rules automatically shift down by +1).

Assign routing group, set order ID, configure match attributes and target trunk.

Group & Sequential Execution Order

Routing Group:

Assign rule to a serial routing execution group.

Execution Order Position (Number ID):

★ Auto-shift: If this Order ID exists, that rule and all below it shift down by +1.

Route Name / Description (Optional):

Human-friendly route name.

Match Attributes

1. Source Trunk:

Originating SIP Trunk, or ANY (*) for all.

2. Destination Host:

Matches SIP Request-URI Host / Domain ($rd). Use * for any host.

3. Destination Pattern: Dialed ($rU)

Quick:

Regex:

4. Source Pattern: Caller ($fU)

Quick:

Regex:

5. Message Type:

SIP request method ($rm) to match.

Action

Route To (Destination) Trunk:

The destination SIP Trunk to forward and dispatch matched SIP messages.

Define serial routing group execution order and descriptive metadata.

Group Name:

Execution Order ID:

Auto-shift: If occupied, existing groups shift down by +1.

Description:

Enabled (Active in SIP Routing Engine)

Digit Manipulation

AudioCodes-style telephone number manipulation (Strip digits left/right, add prefix/suffix on Destination or Source patterns organized in sequential groups)

Assign manipulation group, set order ID, configure match rules and digit transformation.

Group & Sequential Execution Order

Manipulation Group:

Assign rule to a serial manipulation execution group.

Execution Order Position (Number ID):

★ Auto-shift: If this Order ID exists, that rule and all below it shift down by +1.

Rule Name / Description (Optional):

Human-friendly rule description.

Match Rules

1. Source Trunk:

Ingress SIP Trunk from which call arrives.

2. Destination Trunk:

Egress destination SIP Trunk determined by Telephony Routing.

3. Source Pattern: Caller ($fU)

Quick:

Regex:

4. Destination Pattern: Dialed ($rU)

Quick:

Regex:

5. Source Host:

Originating IP address ($si) or Host. Use * for any host.

6. Destination Host:

Target SIP Request-URI Host / Domain ($rd). Use * for any host.

Action (Digit Manipulation)

Selection (Target to Manipulate):

Destination Pattern (Dialed Number)

Manipulate SIP Request-URI ($rU)

Source Pattern (Caller ID)

Manipulate SIP From URI ($fU)

Strip Digits from Left:

Number of digits to remove from start (left).

Strip Digits from Right:

Number of digits to remove from end (right).

Prefix Add:

String / digits to prepend to the number.

Suffix Add:

String / digits to append to the number.

Live Interactive Transformation Preview Type any test number:

Test Number:

Transformed Result:

Define serial digit manipulation group execution order and descriptive metadata.

Group Name:

Execution Order ID:

Auto-shift: If occupied, existing groups shift down by +1.

Description:

Enabled (Active in SIP Engine Manipulation Route)

Header Manipulation

AudioCodes-style SIP message header normalization and manipulation (Inbound / Outbound serial groups assigned to SIP Trunks)

No header manipulation groups configured for .

Assign group, select RFC SIP Header & parameter, and configure transformation action.

Group & Sequential Execution Order

Manipulation Group:

Assign rule to a serial manipulation group.

Execution Order Position (Number ID):

★ Auto-shift: If this Order ID exists, that rule and all below it shift down by +1.

Rule Name / Description (Optional):

Human-friendly rule description.

Target SIP Header & Parameter Component

1. Target SIP Header (RFC Standards):

Select any standard RFC SIP header or choose Custom.

2. Target Component / Parameter:

Specify which component of the header to evaluate or modify.

Custom Header Name:

Enter exact SIP header name.

Action (Header Transformation)

Action Type:

Modify / Replace

Regex match and parameter rewrite

Add / Insert

Append header to message

Remove / Strip

Delete header from message

Match Regex Pattern: Condition

Quick:

Define direction, trunk assignment, serial execution order, and metadata.

Group Name:

Execution Order ID:

Auto-shift: If occupied, existing groups shift down by +1.

Direction (Traffic Flow):

Inbound Outbound

Assigned SIP Trunk (IP Group):

Select ALL Trunks or restrict this group to a specific SIP Trunk.

Description:

Enabled (Active in SIP Engine Manipulation Route)

Interactive Call Route Simulator

Simulate any dialed number or call in real-time to inspect matched rules, required transcoding, and SIP header modifications!

Simulate Ingress SIP Call

Source IP Group (Calling Trunk):

Caller ID (From):

Dialed Number (R-URI):

Offered Audio Codec:

SBC Routing & Transcoding Decision

Select call parameters and click "Test Routing & Media" to view call routing analysis.

Matched Route:

Destination IP & Port:

Destination Number ($rU):

Caller ID ($fU):

Applied Digit Manipulation Rules:

DSP Media Relay & Transcoding:

Applied SMM Rules (Header Rewrites):

Call Routing Decision: REJECTED (404 Not Found)

Evaluated Destination ($rU):

Calling Caller ID ($fU):

ROUTING TROUBLESHOOTING:

• Check if a rule exists in Telephony Routing matching pattern .

• Ensure the rule is Enabled and allows the selected Ingress Trunk.

• Check if caller ID pattern restriction matches (or is *).

Network Interfaces

Network interfaces management

Network Interfaces List

Interface	Type	Status	IPv4 Address & Subnet	Gateway	MAC / MTU	Role / Trunk Binding	Traffic (RX / TX)	Actions
						-	RX: TX:

Add Network Interface / VLAN

Create an 802.1Q VLAN (e.g. Carrier Voice VLAN 835/100) or an IP Alias (secondary IP on same NIC).

Interface Type:

Physical NIC

Parent IP (eth0, eth1)

802.1Q VLAN

Tagged (eth0.100)

IP Alias

2nd IP (eth0:1)

Physical Parent Device:

Configure or change primary IP directly on physical parent interface ().

Parent Physical NIC:

VLAN ID (Tag 1-4094):

Alias Identifier:

Parent () IP:

Target Interface Name:

IPv4 Address *:

Netmask / Subnet:

Default Gateway (Optional):

DNS Servers (Optional):

Configure Interface:

Edit IP address, netmask, gateway and DNS. Applied live to the kernel and to /etc/network/interfaces.

Configuration Method:

IPv4 Address *:

Netmask / Subnet:

Default Gateway (Optional):

DNS Nameservers:

MTU:

Auto bring up on system boot

Changes are applied immediately to network interfaces without disconnecting current sessions and saved to /etc/network/interfaces.

Routing Table Management

Linux kernel routing table and automated Trunk static routes

Routing Table Management

Includes default gateways, connected subnets, and automated host routes (/32) generated by each Trunk.

Destination	Gateway	Interface	Routing Type	Actions
				-

Add Static Route

Add a kernel static route via a Gateway IP, an Output Interface, or both.

Destination Network / Host IP *

Specify destination CIDR prefix (e.g. 192.168.100.0/24) or single host IPv4.

Gateway IP (via)

Next-hop router IP address.

Interface (dev)

Direct egress network interface.

You can specify a Gateway IP, an Interface, or both together.

Metric (Optional)

Description / Tag (Optional)

VoIP Diagnostics, Live PCAP & Call Ladder

AudioCodes-grade diagnostic tools: Live Packet Capture (Wireshark) and SIP Call Flow Diagrams

Live Wireshark Packet Capture (SIP & RTP)

Real-time packet capture for Wireshark traffic inspection

Recording to:

Size:

Saved PCAP Captures:

No saved pcap capture files yet.

Interactive SIP Call Flow (Ladder Diagram)

User & Access Management

Manage local operator accounts and configure Active Directory / LDAP corporate directory integration.

Local database accounts stored securely with PBKDF2-SHA256 password hashing.

User	Full Name / Email	Role	Status	Auth Source	Last Login	Actions

Active Directory & LDAP Corporate Authentication

Authenticate operators directly against Microsoft Active Directory, OpenLDAP, or FreeIPA with RBAC group mapping.

Enable LDAP

Quick Schema Presets:

1. Server & Base Directory

LDAP Server URI:

Specify protocol (ldap:// or ldaps://), hostname or IP, and port (389 for plain/STARTTLS, 636 for LDAPS).

Use STARTTLS (TLS handshake on port 389)

Search Base DN:

Root Distinguished Name for all directory searches.

2. Service Account (Bind DN)

Bind DN / User Principal:

Account used to query user entries and group memberships. Leave blank for Anonymous bind.

Bind Password:

Service account password. Masked for security.

3. User Search Query

User Search Sub-Tree (OU):

User Search Filter:

Use {username} as the placeholder for the input login name.

4. Role & Group Mapping (RBAC)

Administrator Groups (Full Control):

Comma-separated list of group names or DNs granted the admin role.

Operator Groups (Read/Write Config):

Viewer Groups (Read Only):

Group Attribute:

Default Fallback Role:

5. Access Whitelist & Fallback Rules

Allowed Groups Filter (Optional Restriction):

If set, users MUST belong to at least one of these groups to be granted login access.

Allowed Users Filter (Optional User Whitelist):

Restrict login to specific directory usernames.

Fallback to Local User Authentication if LDAP is unreachable or user is not found

Vertical SBC Topology Map (UP / DOWN)

SBC Core Engines & Hardware Health

SIP Trunks (UP / DOWN Topology)

All SBC Trunks & Real-Time Status

SIP Profiles & Signaling Definitions

Media Realms (RTP Per-Interface Management)

1. Realm Identification

2. Network Interface Coupling (Πάντρεμα Interface)

3. RTP Port Allocation per Interface

4. Media Protocols, Latching & QoS

TLS Contexts & Certificates

/etc/kamailio/tls.cfg Configuration File

Server / Client Certificate

Trusted Root CA Bundle

Automated Let's Encrypt Certificate (ACME v2)

Generate Self-Signed Certificate

Generate Certificate Signing Request (CSR)

Import Certificate or Root CA Bundle

Telephony Routing

Digit Manipulation

Header Manipulation

Interactive Call Route Simulator

Simulate Ingress SIP Call

SBC Routing & Transcoding Decision

Network Interfaces

Network Interfaces List

Add Network Interface / VLAN

Configure Interface:

Routing Table Management

Routing Table Management

Add Static Route

VoIP Diagnostics, Live PCAP & Call Ladder

Live Wireshark Packet Capture (SIP & RTP)

Saved PCAP Captures:

Interactive SIP Call Flow (Ladder Diagram)

Generated Kamailio Configuration

SIP Syslog Analyzer

User & Access Management

Active Directory & LDAP Corporate Authentication

1. Server & Base Directory

2. Service Account (Bind DN)

3. User Search Query

4. Role & Group Mapping (RBAC)

5. Access Whitelist & Fallback Rules

SBC Fault & Alarm Management Center

No Active Alarms Detected

Add Local User Account

Edit User:

Change Password:

Test LDAP / Active Directory Connection