This guide assumes your Mitel OpenScape Session Border Controller (SBC) is already installed, licensed and working, with its network, certificates and phone system connection in place. It provides guidance on how to add a Voice AI SIP trunk - but you should establish the best route based on your own requirements.

Before configuring the SBC for Voice AI, the SBC must be reachable from the public internet on a publicly routable IP address, preferably with a DNS name that resolves to it. This is a fundamental networking requirement and is not specific to Voice AI — it applies to any external SIP trunk requiring connectivity across a network boundary.

Voice AI is delivered over a SIP trunk from a cloud platform. The platform sends transfers (SIP REFER) and any new call back into your phone system to the address the SBC presents in its SIP Contact header, so that must be a public address. An internal private address (RFC 1918) is unreachable from the public internet, and signalling, transfers and media would fail. If the SBC sits behind a device that translates addresses (NAT), such as a cloud provider's public IP address mapping, the SBC must be told its public address so that it presents that address to the Voice AI platform. Enter the public address in Security → Firewall → Firewall Settings: select the row for the access IP address and choose Edit. Tick External Firewall and enter the public address in Firewall external IP. Leave the other fields in that section at their defaults unless your signalling and media use different public addresses. With this set, the SBC puts the public address in the From header, the Contact header and the audio connection address that it sends to the platform. Before continuing, also check the following.

You are given the signalling and media addresses of the Voice AI platform for your trunk, with the ports and transport it uses. Allow all of the signalling and media ranges you are given, because a call can use any of them. Apply the rules below to whatever firewall or security group sits in front of the SBC.

The SBC connects to your phone system in one of two modes, set by Comm System Type under VoIP → SIP Server Settings. In Simplex mode the SBC connects to a single gateway board. In Clustered mode it connects to several, and each one is listed as a node.

Voice AI uses its own gateway board (see the prerequisites above), so the SBC connects to at least two boards: the one that carries your existing trunks and the one that carries Voice AI. Set the SBC to Clustered and list every board that has a trunk to the SBC, including the Voice AI board.

If the Voice AI board is not listed, calls to Voice AI can still connect, but the messages that the platform sends later in the same call are delivered to the wrong board. That board has no record of the call and answers 500 Server Internal Error. The transfer (SIP REFER) fails, and the platform's hang-up message (SIP BYE) is refused.

To check the result, take a network capture on the SBC while you place a test call that Voice AI transfers. The platform's transfer message should be delivered to the address of the Voice AI board, not to the other board.

Open the SBC management portal over https. The connection to the Voice AI service is configured under Features and then selecting Configure to the right of Enable Remote Endpoints

Changes are only temporary until you select Apply Changes on the General page. Applying changes restarts the SBC's SIP server, so any calls in progress are ended. Group your changes and apply them once.

A SIP service provider (SSP) profile controls how the SBC formats SIP messages towards a provider. Create one for Voice AI: in the SIP Service Provider Profile section, select Add. The Default SSP profile list contains presets for named providers. None of them matches Voice AI, so leave it blank. Selecting a preset loads that provider's settings into the page and overwrites anything you have entered. The SIP Service Address options further down decide which headers the SBC fills with the Voice AI domain. The Request-URI and To headers should carry it. The From header should carry your own SBC's address.

The remote endpoint configuration is the connection to the Voice AI service. In the Remote endpoint configuration section, select Add. The settings are in three groups.

In the Remote Location domain list, select Add and enter the connection details. You will have been provided the address with your Voice AI service.

You are given the address of the Voice AI platform for your trunk. Some platforms offer a choice of regions, each with its own addresses. If yours does, ask your Voice AI provider which region to use, and allow the signalling addresses of every region on your firewall so that calls keep working if one region is unavailable. If your call data has to stay in a particular country or region, ask your Voice AI provider what is available. Inbound calls are matched by address. The SBC recognises a call that the Voice AI platform sends to it by the addresses that the Remote URL resolves to, and a platform with several regions can place the call from any of them. A call from an address that the Remote URL does not resolve to is silently ignored: the TLS handshake completes and the INVITE is acknowledged at the network level, but the SBC sends no SIP response and, at the default log level, writes nothing to the log. If you see this, use a Remote URL whose addresses include the region the call comes from (a regional name, if the platform offers one), then apply and retest. If two remote endpoints point at the same platform, they can resolve to the same addresses, and the SBC then picks one of them for every inbound call from those addresses. TLS and encryption must be enabled on the Voice AI side. Please ask your Voice AI provider to confirm that TLS and encrypted audio are enabled on your trunk. Where they are, the platform rejects any call that is not encrypted.

The SBC identifies which remote endpoint an outgoing call is for by the core realm port on which the call arrives. Every remote endpoint therefore needs its own port, and it must not be used for anything else. This was confirmed in testing with two endpoints on two different ports: a call sent to each port went to the provider of the endpoint that owns that port. The port must be the same on both sides, as the core realm port on the SBC and as the proxy port in the phone system's trunk profile. If the trunk profile uses the port of a different endpoint, calls go to the wrong provider.

Voice AI trunks are normally protected by credentials. You are given a user name and password for your trunk. When a call arrives, the platform can answer with a SIP 407 challenge, and the call is then sent again with the credentials. Mitel's SBC guide describes the SBC passing a provider's challenge to the system behind it, which answers from its own configuration, so the credentials belong in the phone system's trunk profile (the account), not on the SBC.

IP address authentication can be set up on request, instead of or as well as credentials. Give your Voice AI provider the public IP address that the platform sees when the SBC connects (the address your DNS name resolves to, or the address of your cloud provider's public IP mapping), so that it can be added to the allowed list on your trunk, which is an access control list (ACL). If the address is not on the list, the platform rejects the call, typically with a SIP 403 Forbidden response, and the SBC passes that response back to your phone system. Some platforms state the reason in a response header, so check the headers when a call is refused.

A media profile controls how the SBC handles the audio streams: whether they are encrypted, how the encryption keys are exchanged, and which codecs are allowed. Because the SBC ends the audio on both sides of a call, the two legs do not have to use the same settings.

The settings of the Voice AI leg are set by the Voice AI platform, so ask your Voice AI provider for them: whether the audio must be encrypted (SRTP), how the keys are exchanged, which crypto suites are offered and which codecs are allowed. The PBX leg depends on how your phone system is configured. The values below are the ones that worked in testing with a Voice AI trunk through an OpenScape SBC.

Media profiles are listed under VoIP → Media. The Core Side Media Configuration at the top of that page selects the profile for the phone system side. The profile for the Voice AI side is chosen on the remote endpoint, in the Media profile row of the Remote Location domain list.

Voice AI connects over TLS, so the Voice AI remote endpoint needs a certificate profile. As your SBC is already working, it will already have a profile for the SIP-TLS certificate service, and no new certificate is needed. In Security → General → Certificate Management, find that SIP-TLS entry in the table at the top of the page, and select it as the Certificate profile on the Voice AI remote endpoint. Check the following.

The settings in this guide come from the Mitel document below, and from the phone system guide it works with. Page numbers refer to the PDF.

Plain-English meanings of the abbreviations and technical terms used in this guide.