Documentation
Connect a Ribbon SBC to Open Voice Shield
Ask AI about this page
On your Ribbon SBC Edge, create a SIP Server Table entry for sip.ovs.telecomsxchange.com port 5060, reference it from a SIP Signaling Group, and route the calls you want analyzed to that group through a pass-through Transformation Table. Whitelist the SBC's public IP on the Network page first.
Before you start#
- An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
- The public IP address your Ribbon SBC sends SIP from: the egress address after any NAT, not the one on its interface.
- A destination, the carrier or switch the calls were already going to. We relay each accepted call on to it.
- Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for the RTP your media endpoints exchange with our relay. See the firewall rules.
Step 1: whitelist your SBC's egress IP#
Open the Network page in the portal and add the public address your Ribbon SBC sends from as a CIDR entry (a single host is a /32). The whitelist is the authentication: there are no credentials, and an INVITE from any other address is answered 403.
Step 2: build a Signaling Group towards the ingress#
On an SBC Edge, the far end lives in two objects: a SIP Server Table naming the peer, and a SIP Signaling Group that references it and owns the media behaviour. Create both for Open Voice Shield. Your existing groups stay untouched.
| Field | Value |
|---|---|
| Host | sip.ovs.telecomsxchange.com, confirm the address on your Network page |
| Port | 5060 |
| Protocol | UDP or TCP |
| Field | Value |
|---|---|
| SIP Server Table | the Open Voice Shield table above |
| Federated IP/FQDN | the ingress address shown on your Network page, the far end this group trusts |
| Media list | one that offers G.711 (PCMU, PCMA) first, as plain RTP, no SRTP towards the ingress |
| Registration | none: leave outbound registration off; a REGISTER at the ingress is answered 403 |
Screen names follow Ribbon documentation conventions. Menus vary by model and firmware, so consult your version's manual.
- The INVITE must carry SDP, an early offer. An INVITE without SDP is answered 488.
- Offer G.711 (PCMU or PCMA) first. G.722, G.729 and G.723.1 are decoded as well. Any other codec is relayed but produces no transcript and no verdict.
- Send no REGISTER at the ingress. It is answered 403. Calls are authorized by source IP alone.
Step 3: route calls to the new Signaling Group#
Routing on the Edge goes through a Call Routing Table, and every entry needs a Transformation Table, here a pass-through, so the dialled number and caller ID arrive at the ingress unchanged.
| Field | Value |
|---|---|
| Input field | Called Address/Number, pattern (.*) |
| Output field | Called Address/Number, value \1, the number passes through unchanged |
| Field | Value |
|---|---|
| Transformation Table | the pass-through table above |
| Destination Signaling Group | the Open Voice Shield Signaling Group from step 2 |
Screen names follow Ribbon documentation conventions. Menus vary by model and firmware, so consult your version's manual.
On SBC Core#
An SBC Core builds the same next hop with its trunk-group CLI instead of these screens: define Open Voice Shield as a peer whose signalling address is the ingress, put it in a trunk group that offers G.711 with an early SDP offer and plain RTP, and route the calls you want analyzed to that trunk group. The objects differ, but the requirements on this page are the same.
Or route a deterministic sample#
You do not have to move all your traffic. Sampling is a supported pattern. Where your firmware supports weighted or percentage distribution across routes, give the analyzed route a share (one call in ten is a common start) and your direct carrier the rest. Otherwise sample deterministically with a subset: add a routing entry above your catch-all whose Transformation Table matches only a prefix range, for example an input pattern of (44161.*) so that only calls to Manchester take the analyzed hop, or route one trunk's traffic through the Open Voice Shield Signaling Group and leave the others direct.
Both paths deliver the call: the analyzed share reaches the same destination through one extra hop, and every sampled call comes back with a recording, per-channel transcript and verdict.
Step 4: place a test call#
Send a real call through the new route and keep both parties talking for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.
- Rejected 403? The source address is not whitelisted. Compare your own SIP trace with the CIDR entries on the Network page.
- Rejected 488? The INVITE carried no SDP. Configure the Signaling Group for an early offer.
- One-way audio? A firewall rule on UDP 30000–40000 between your media endpoints and the ingress, not a signalling problem.
Anything else: Troubleshooting lists every rejection code and the check that clears it.
Frequently asked questions#
Does my Ribbon SBC register to Open Voice Shield?
No. Nothing registers in either direction: a REGISTER sent to the ingress is answered 403, and calls are authorized by the source IP you whitelist on the Network page, so the Signaling Group needs no credentials.
Which Ribbon models does this guide cover?
The worked example is the SBC Edge line, the former Sonus Edge products with the Signaling Group and Call Routing Table model. SBC Core builds the same next hop with its trunk-group CLI, and any Ribbon SBC that can send an INVITE with SDP to a next hop can connect.
Why must the media list offer G.711 first?
The analysis transcribes G.711 (PCMU, PCMA), G.722, G.729 and G.723.1 audio. G.711 first keeps the best transcription quality. A call that negotiates another codec is still relayed to its destination, but it produces no transcript and no verdict.
Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.