Universal Telecom
Contact

Glossary · VoIP and call quality

SBC (session border controller)

In one sentence

A session border controller (SBC) sits at the edge of a network and controls SIP calls going in and out: it filters traffic, hides the internal network, handles NAT and can transcode or encrypt calls.

Also known as : SBC · SBCs · session border controller · session border controllers

Where the SBC sits between the PBX and the carrierA four-step flow. 1: the internal PBX sends a SIP call. 2: the SBC, at the network edge, filters traffic, hides the internal topology and fixes NAT. 3: it can transcode between codecs and encrypt the stream. 4: the call goes out cleanly to the carrier's SIP trunk.1 · Internal PBXSends the SIP call2 · SBC (network edge)Filters, hides the internalnetwork, handles NAT3 · Normalises the streamTranscoding, TLS/SRTPencryption4 · Carrier SIP trunkReceives clean,compliant traffic
The SBC is the firewall for voice: it lets legitimate calls through and blocks the rest.

What is an SBC?

A session border controller is the border checkpoint for voice over IP. It sits between a company’s (or a carrier’s) network and the outside world and inspects every SIP call that crosses: both the signalling that sets the call up and the audio stream that carries the conversation.

You usually meet one in three places: an on-premises PBX connected to a SIP trunk from behind a firewall, a Microsoft Teams Direct Routing set-up, and inside carrier networks, where SBCs guard every interconnection with partners.

How it works

An SBC does several jobs at once:

  • Security: it only accepts calls from authorised sources, rate-limits attempts and shuts down the SIP account scanning that hits any PBX exposed to the internet. This is the main defence against toll fraud.
  • Topology hiding: internal addresses of the PBX and handsets never leave the building; the carrier only ever sees the SBC.
  • NAT traversal: it rewrites addresses inside SIP messages so audio finds its way through the router’s address translation, the usual cause of one-way audio.
  • Interoperability: every vendor reads the SIP standard slightly differently, and the SBC fixes headers so both sides understand each other.
  • Transcoding and encryption: it can convert between codecs and encrypt signalling (TLS) and media (SRTP).

Example

A Dublin-based logistics company with offices in Cork and Belfast wants its 120 staff to make and take calls in Microsoft Teams while keeping its existing numbers. Direct Routing needs a certified SBC, so its IT provider deploys one as a virtual machine in Azure, connects it to the Teams tenant over TLS on one side and to the carrier’s SIP trunk on the other. Calls flow through the SBC, which translates between the two platforms and drops anything that comes from neither Microsoft nor the carrier.

SBCs at Universal Telecom

Our platform sits behind its own SBCs, so with our virtual PBX there is nothing for you to install. If you bring your own PBX over our SIP trunk, an SBC on your side is still a good idea for complex networks or Teams deployments. Carriers and integrators who interconnect with us through wholesale do so SBC to SBC.

Frequently asked questions

Isn't a normal firewall enough?

A firewall filters ports and addresses but doesn't understand what is inside SIP messages. An SBC reads the signalling, opens the audio ports for each call only while it lasts, and blocks toll fraud and flooding attempts.

Do I need an SBC for Microsoft Teams calling?

For Direct Routing, yes: Microsoft requires a certified SBC between Teams and the carrier. It can run on your premises, in a cloud environment, or be provided as a managed service.

Is an SBC a physical box?

Not necessarily. Dedicated appliances exist, but most modern SBCs are software running on a virtual machine or in a hosting provider's cloud.

Related terms

  • SIP

    SIP (Session Initiation Protocol) is the standard signalling protocol that sets up, changes and ends VoIP calls. It handles ringing, answering and hanging up; the voice itself travels separately.

  • SIP trunk

    A SIP trunk is a voice-over-IP connection between a business phone system and a carrier. It replaces ISDN lines and carries calls and numbers over your internet connection.

  • PBX

    A PBX (private branch exchange) is a business's own telephone switch. It connects internal extensions to each other and to the public network, and runs features such as IVR menus, queues and voicemail.

  • QoS (quality of service)

    QoS (quality of service) is the set of network settings that give time-sensitive traffic, such as voice, priority over other data, so calls avoid delay, jitter and packet loss when the link is busy.

  • Codec

    A codec is the algorithm that digitises and compresses your voice during a VoIP call and turns it back into sound at the other end. It sets both the audio quality and the bandwidth used.

  • WebRTC

    WebRTC is an open standard built into web browsers that lets people make voice and video calls from a web page with no plug-in or app to install, with encryption always switched on.

Updated on

← Back to the glossary