Documentation
Connect an AudioCodes SBC to Open Voice Shield
Ask AI about this page
On your AudioCodes Mediant, create a Proxy Set for sip.ovs.telecomsxchange.com port 5060, an IP Group with an IP Profile offering G.711 as plain RTP, and an IP-to-IP Routing rule sending the calls you want analyzed to it; whitelist the SBC's public IP on the Network page first.
Before you start#
- An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
- The public IP address your AudioCodes SBC sends SIP from, the egress address after any NAT, not the one on its interface.
- A destination, the carrier or switch the calls were already going to. We relay each accepted call on to it.
- Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for the RTP your media endpoints exchange with our relay. See the firewall rules.
Step 1: whitelist your SBC's egress IP#
Open the Network page in the portal and add the public address your AudioCodes SBC sends from as a CIDR entry, a single host is a /32. The whitelist is the authentication: there are no credentials, and an INVITE from any other address is answered 403.
Step 2: create the Proxy Set and IP Group#
On a Mediant, the far end lives in a Proxy Set naming the peer's address, an IP Group wrapping it as a routable entity, and an IP Profile that fixes the media behaviour. Create all three for Open Voice Shield. Your existing groups stay untouched.
| Field | Value |
|---|---|
| Proxy address | sip.ovs.telecomsxchange.com:5060, confirm the address on your Network page |
| Transport type | UDP or TCP |
| Field | Value |
|---|---|
| Type | Server |
| Proxy Set | the Open Voice Shield Proxy Set above |
| IP Profile | the profile below |
| Field | Value |
|---|---|
| Coders | G.711 U-law (PCMU) and G.711 A-law (PCMA) first |
| Media security | the field enforcing plain RTP: no SRTP towards the ingress |
Screen names follow AudioCodes documentation conventions. Menus vary by model and firmware, so consult your version's manual.
- The INVITE must carry SDP, an early offer. An INVITE without SDP is answered 488.
- Offer G.711 (PCMU or PCMA) first. G.722, G.729 and G.723.1 are decoded as well. Any other codec is relayed but produces no transcript and no verdict.
- Send no REGISTER at the ingress. It is answered 403. Calls are authorized by source IP alone.
Step 3: add an IP-to-IP Routing rule#
Routing on the SBC application is the IP-to-IP Routing table: a rule matches where a call comes from and names the IP Group it leaves through. Route the calls you want analyzed to the Open Voice Shield IP Group. The dialled number and caller ID pass through unchanged unless you add a manipulation, so add none.
| Field | Value |
|---|---|
| Source IP Group | the group your traffic arrives from |
| Destination IP Group | the Open Voice Shield IP Group from step 2 |
Screen names follow AudioCodes documentation conventions. Menus vary by model and firmware, so consult your version's manual.
Or route a prefix subset#
You do not have to move all your traffic, sampling is a supported pattern. Where your firmware supports weighted or percentage distribution across routing destinations, give the analyzed route a share, one call in ten is a common start, and your direct carrier the rest. Otherwise sample deterministically with a subset: place a rule above your catch-all whose destination username pattern matches only a prefix range, for example 44161*, so that only calls to Manchester take the analyzed hop, or route one source IP Group through Open Voice Shield and leave the others direct.
Both paths deliver the call: the analyzed share reaches the same destination through one extra hop, and every sampled call comes back with a recording, per-channel transcript and verdict.
Step 4: place a test call#
Send a real call through the new rule and keep both parties talking for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.
- Rejected 403? The source address is not whitelisted. Compare your own SIP trace with the CIDR entries on the Network page.
- Rejected 488? The INVITE carried no SDP, or offered SRTP. Send an early offer as plain RTP.
- One-way audio? A firewall rule on UDP 30000–40000 between your media endpoints and the ingress, not a signalling problem.
Anything else: Troubleshooting lists every rejection code and the check that clears it.
Frequently asked questions#
Does my AudioCodes SBC register to Open Voice Shield?
No. Nothing registers in either direction. A REGISTER sent to the ingress is answered 403, and calls are authorized by the source IP you whitelist on the Network page, so the Proxy Set carries no credentials.
Why pin G.711 in the IP Profile?
The analysis transcribes G.711 (PCMU, PCMA), G.722, G.729 and G.723.1 audio. G.711 first keeps the best transcription quality. Pinning the coders in the IP Profile attached to the Open Voice Shield IP Group guarantees every analyzed call offers them first. A call that negotiates another codec is still relayed, but produces no transcript and no verdict.
Which AudioCodes models does this guide cover?
The worked example is the Mediant line, the Proxy Set, IP Group and IP-to-IP Routing model its SBC application uses. Any AudioCodes SBC that can send an INVITE with SDP to a next hop as plain RTP can connect the same way.
Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.