Direct Routing for Microsoft Phone System with Cisco Unified Border

[dbrinker]

Anyone know where I can find the firewall rules required to allow Direct Routing for Microsoft
Phone System with Cisco Unified Border Element?  They have a nice configuration guide but it does not define the network IP/ports and services required.  

[Roger Kallberg]

If you’re using a ISR4K router the default srtp ports used are 8000 to 48200 (UDP), if it’s an older model it’s 16384 to 32767 (UDP). Apart from these the router uses port 5061 for the TLS (TCP) connection that is used for SIP signaling.

[dbrinker]

Hi Roger,
Thanks for the reply, however I need more information such as all the subnets needed to connect to the M365 phone system. We only white list exactly what is needed, we'd actually prefer spinning up a VPN tunnel if possible?

[Elliot Dierksen]

As long as the firewall is application aware of SIP, the media ports shouldn't make a difference. That might not be the case with SIP over TLS since the firewall wouldn't be able to see the signaling process. @Roger Kallberg is correct about the port range. I can't say about MS teams, but I have seen some SIP service providers get annoyed by the default port range that ISR4K's use. You can make it act like the older models this way.

voice service voip
 rtp-port range 16384 32766

[b.winter]

https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
Section "Skype for Business Online und Microsoft Teams"

[Scott Leport]

Plan Direct Routing - Microsoft Teams | Microsoft Learn

Sections "SIP signaling: Ports" and "All environments" under the Media traffic port ranges section.