Prerequisites – Network Configuration & MBG WAN Mode
Before configuring any SIP trunk on the MiVoice Border Gateway (MBG), it is essential that the MBG is correctly deployed as a true border device with both LAN and WAN interfaces configured, running in gateway mode. This is a fundamental networking requirement and is not specific to Talkative — it applies to any external SIP trunk requiring connectivity across a network boundary.
The MBG must have a WAN interface configured with a publicly routable IP address. Without this, the MBG has no basis on which to rewrite SIP Contact headers for outbound traffic, meaning internal RFC 1918 private IP addresses will be presented to external parties such as Twilio. These addresses are unreachable from the public internet, which will cause SIP signalling to fail — including ACKs, in-dialog requests such as REFER, and media streams.
LAN mode and custom mode without a configured WAN interface are not supported configurations for external SIP trunking. If the MBG status page does not show a populated WAN interface with a public IP address, do not proceed with SIP trunk configuration until this is resolved.
To validate the MBG is correctly configured, navigate to the MBG status page and confirm the network profile shows gateway mode with both LAN and WAN interfaces populated before proceeding.
Trunk Setup
Navigate to the MBG server manager. In the left-hand menu, click MiVoice Border Gateway under the applications header.
Select SIP trunking to open the dropdown menu and then select SIP trunks - this will open the SIP trucks page. Click the + icon to begin adding a new SIP trunk.
This will open a manage SIP trunk page where you can configure your SIP trunk.
Profile
In the profile you should set the trunk to be enabled and add a name to identify the trunk, for example “TalkativeVAI” is a common name used.
Option | Value |
Enabled | Checked |
Name | TalkativeVAI |
Connection
Set the connection details, you will have been provided these by your Talkative account manager or obtained from within the Engage platform.
Option | Value |
Transport protocol | UDP - TLS if using encryption |
Remote trunk endpoint address | {uuid}.sip.twilio.com (this may be regionalised) |
Remote trunk endpoint port | 5060 (5061 if using enryption) |
The remote trunk endpoint by default will use the Twilio US1 region for signalling. If you want to choose a different default region, you may change the format to be {uuid}.sip.{region}.twilio.com - a list of the signalling IPs can be found here: https://www.twilio.com/docs/sip-trunking/ip-addresses - there are 4 per region and should all be added to the whitelist to allow for resiliency should any region be unavailable.
The default connection will be UDP - if you require encryption, please ask Twilio support to enable this on your account.
Authentication
This trunk does not require authentication here. The connection will be between the MBG and the Talkative VAI server.
Option | Value |
Authentication username | Leave blank |
Authentication password | Leave blank |
Confirm authentication password | Leave blank |
Require mediasec | Leave unchecked |
SIP Adaptation
There are no sip adaptations needed for this Trunk
Option | Value |
Receive pipeline | Leave unselected |
Send pipeline | Leave unselected |
Protocol
Options keepalives can be enabled, however we have observed inconsistent behaviour and failures associated with them, so opt to keep them disabled.
Option | Value |
PRACK support | Use master setting (default) |
Options keepalives | Never |
Options interval | 60 (default) |
Rewrite host in PAI | Leave checked (default) |
Idle timeout (s) | 3000 (default) |
Use source port in contact header | Leave unchecked (default) |
Media
The settings in this section remain unchanged from default.
Option | Value |
Local streaming between trunk calls | Leave unchecked (default) |
RTP address override | Leave unselected (default) |
RTP Security Configuration
RTP security configuration configures how the MBG will handle media streams between the various legs of the call - it describes what connections it will accept, negotiate and if it can upgrade or downgrade them.
The PBX administrator should map out the expected media flow for each call scenario, identifying which trunks operate as SRTP and which as RTP. Each trunk's security settings should then be configured to give the MBG the flexibility to perform the necessary protocol conversion — for instance, using SRTP or RTP rather than a strict single-protocol setting where conversion may be required.
If your environment has multiple trunks with differing security requirements — for example, a carrier trunk configured as SRTP-only, and the Talkative Voice AI trunk configured as RTP-only — the MBG must be able to upgrade or downgrade the media protocol as calls traverse it. Setting all trunks to a single rigid protocol when the actual traffic mix is more varied will result in audio issues or failed calls.
Trunk-side RTP Security
The trunk-side RTP security controls the protocols used for traffic between the MBG and the Talkative/Twilio trunk. These settings must be considered in the context of your full media path — not in isolation.
If you wish to have a fully encrypted connection end-to-end and all trunks in the path support SRTP, these may be set to SRTP only. Otherwise, the default values below are a safe starting point — review them against your specific environment.
Important — consider your entire trunk configuration before setting these values.
Option | Value |
Inbound | SRTP or RTP (default) |
Outbound | RTP only (default) (SRTP only if secure) |
Preferred cipher | Default value |
Icp-side RTP Security
The ICP-side RTP security controls the protocols used between the MBG and the inner PBX (MiVB, MX-One, MV5000 etc). As with the trunk-side settings above, these must be configured with the full call flow in mind.
If a call arrives from a carrier trunk as SRTP and needs to be passed to an internal extension or onward to the Voice AI trunk as RTP (or vice versa), the MBG handles that conversion — but only if the ICP-side settings permit it. Restricting this interface to a single protocol when the internal PBX or other connected trunks use a different one will break audio. In testing, RTP Only or AVP+crypto works correctly for insecure trunks originating calls externally, but the administrator should confirm this matches the security posture of the internal PBX.
Important — consider your entire trunk configuration before setting these values.
Option | Value |
Inbound | RTP Only (default) |
Outbound | AVP+crypto |
Preferred cipher | Default value |
Trunk Rules
You must add a SIP trunk rule to match incoming traffic directed to this SIP Trunk. To do this, save the Trunk configuration and click the “Quick add rule” button.
Option | Value |
Header match | Request URI |
Rule | * (match all) |
Primary ICP | Your configured ICP |
Secondary ICP | Leave blank unless required |
Description | Optionally add a description |
TLS Certificate Configuration
The default 1024-bit SHA-1 Mitel Root CA cannot be used with MX-ONE - as the OpenSSL configuration on MX-ONE 8.x will reject certificates shorter than 2048 bits with a X509_V_ERR_CA_KEY_TOO_SMALL error in the SIP traxce.
Glossary of terms
Plain-English meanings of the abbreviations and technical terms used in this guide.
Term | Stands for | What it means |
ACK | Acknowledgement | A SIP message that confirms a call has been answered. |
AVP+crypto | (a media setting) | Offers the call audio with encryption keys, so it can be encrypted if the other side supports it. Audio Video Profile (AVP) is the standard way of carrying unencrypted audio. |
CA | Certificate Authority | The organisation that issues and signs certificates, so that others can trust them. |
Cipher | (a security term) | The method used to encrypt data. |
Contact header | (a SIP term) | The part of a SIP message where the sender gives the address that the other side should use for later messages in the call. |
Engage | (a product name) | The Talkative platform where you manage Voice AI bots and voice routes. |
Gateway mode | (an MBG network mode) | The MBG works as a border device with both a LAN and a WAN interface. It is the mode needed for an external SIP trunk. |
ICP | Integrated Communications Platform | The phone system behind the MBG, such as MiVB, MX-One or MV-5000. |
IP | Internet Protocol | The addressing system networks use. An IP address is the number that identifies a device on the network, for example 192.168.10.25. |
LAN | Local Area Network | Your internal network. |
MBG | MiVoice Border Gateway | The Mitel device at the edge of your network that connects your phone system to an outside network, such as the Voice AI platform. |
Mediasec | (a SIP security option) | A SIP option that requires secure media to be negotiated. Leave it unchecked for this trunk. |
OPTIONS keepalive | (a SIP message type) | A SIP message sent at regular intervals to check that the other end is still reachable. |
PAI | P-Asserted-Identity | A piece of information sent with a call that says who the caller is. |
PBX | Private Branch Exchange | Your phone system. |
Pipeline | (a SIP adaptation term) | A set of rules that change SIP messages as they pass through the MBG. |
PRACK | Provisional Response Acknowledgement | A SIP message that confirms an early progress message, such as ringing, has been received. |
REFER | (a SIP message type) | A SIP message that asks the other side to start a new call, used to transfer a call. |
Request URI | (a SIP term) | The address that a SIP call is sent to. |
RFC 1918 | (a standard name) | The standard that sets aside private IP address ranges, such as 10.x.x.x, 172.16.x.x to 172.31.x.x and 192.168.x.x. These addresses cannot be reached from the public internet. |
RTP | Real-time Transport Protocol | The way the voice audio itself is carried during a call. |
SHA-1 | Secure Hash Algorithm 1 | An older method of signing certificates. Some systems no longer accept it. |
SIP | Session Initiation Protocol | The standard way of starting, managing and ending calls over an IP network. A SIP trunk is a connection that carries many calls using SIP. |
SRTP | Secure Real-time Transport Protocol | The encrypted version of RTP, so nobody listening on the network can hear the call. |
TLS | Transport Layer Security | Encryption that protects a connection, the same technology that protects secure websites. |
Trunk rule | (an MBG term) | A rule that matches incoming calls to a SIP trunk and says which phone system (ICP) they go to. |
UDP | User Datagram Protocol | A faster way of sending data that does not set up a connection or check delivery. |
WAN | Wide Area Network | The external side of the MBG, which faces the public internet. It needs a public IP address. |
X509_V_ERR_CA_KEY_TOO_SMALL | (an error name) | The error that OpenSSL reports when the key of a certificate authority is too short to be accepted. |