AudioCodes Mediant 4000 SBC User manual

User's Manual
AudioCodes Series of Session Border Controllers (SBC)
Mediant 4000 SBC
Version 7.2

Notice Mediant 4000 SBC | User's Manual
Notice
Information contained in this document is believed to be accurate and reliable at the time of
printing. However, due to ongoing product improvements and revisions, AudioCodes can-
not guarantee accuracy of printed material after the Date Published nor can it accept
responsibility for errors or omissions. Updates to this document can be downloaded from
https://www.audiocodes.com/library/technical-documents.
This document is subject to change without notice.
Date Published: April-29-2019
WEEE EU Directive
Pursuant to the WEEE EU Directive, electronic and electrical waste must not be disposed of with
unsorted waste. Please contact your local recycling authority for disposal of this product.
Customer Support
Customer technical support and services are provided by AudioCodes or by an authorized
AudioCodes Service Partner. For more information on how to buy technical support for AudioCodes
products and for contact information, please visit our website at
https://www.audiocodes.com/services-support/maintenance-and-support.
Documentation Feedback
AudioCodes continually strives to produce high quality documentation. If you have any comments
(suggestions or errors) regarding this document, please fill out the Documentation Feedback form
on our website at https://online.audiocodes.com/documentation-feedback.
Stay in the Loop with AudioCodes
Notes and Warnings
The device is an indoor unit and therefore, must be installed only INDOORS.
The scope of this document does not fully cover security aspects for deploying the
device in your environment. Security measures should be done in accordance with your
organization’s security policies. For basic security guidelines, refer to the
Recommended Security Guidelines document.
- ii -

Notice Mediant 4000 SBC | User's Manual
Throughout this manual, unless otherwise specified, the term device refers to your
AudioCodes product.
Before configuring the device, ensure that it is installed correctly as instructed in the
Hardware Installation Manual.
OPEN SOURCE SOFTWARE. Portions of the software may be open source software
and may be governed by and distributed under open source licenses, such as the terms
of the GNU General Public License (GPL), the terms of the Lesser General Public
License (LGPL), BSD and LDAP , which terms are located at
https://www.audiocodes.com/services-support/open-source and all are incorporated
herein by reference. If any open source software is provided in object code, and its
accompanying license requires that it be provided in source code as well, Buyer may
receive such source code by contacting AudioCodes, by following the instructions
available on AudioCodes website.
●Some of the features described in this document are licensed features and are
available only if the installed License Key contains these features.
●This device includes software developed by the OpenSSL Project for use in the
OpenSSL Toolkit (http://www.openssl.org/ ).
●This device includes cryptographic software written by Eric Young
([e-mail]).
Related Documentation
Document Name
SBC-Gateway-MSBR Series Release Notes
Mediant 4000B SBC Hardware Installation Manual
Complementary Guides
CLI Reference Guide
SNMP User's Guide
SBC Design Guide
Recommended Security Guidelines Configuration Note
Syntax for SIP Message Manipulation Reference Guide
Utility Guides
INI Viewer & Editor Utility User's Guide
- iii -

Notice Mediant 4000 SBC | User's Manual
Document Name
CLI Wizard User's Guide
Document Revision Record
LTRT Description
41727 Initial document release for Version 7.2.
41729 ■Updated patch version 7.20A.001.
■Updated sections: Computer Requirements (supported browsers); CLI-
Based Management (permitted user levels); Configuring TLS Certificate
Contexts (TLS versions); Configuring Physical Ethernet Ports (show
command); Configuring Underlying Ethernet Devices (max. VLANs);
SIP Signaling Messages (procedure); First Incoming Packet
Mechanism (NAT by Signaling); Robust Receipt of Media Streams by
Media Latching (procedure); Configuring Firewall Settings (note);
Configuring General Security Settings (Web path); Viewing IDS Alarms
(show command); Viewing and Deleting DHCP Clients (show
command); Configuring the Device's LDAP Cache; Centralized Third-
Party Routing Server (SIP messages and credentials for
authentication); Configuring Call Setup Rules (dial plan queries); Call
Setup Rule Examples; Registration Refreshes; Using Dial Plan Tags
for IP-to-IP Routing (example); Enabling Interworking of SIP and SIP-I
Endpoints (SPIROU and SIP header X-AC-Action); Configuring
WebRTC (Web path); Configuring BroadSoft's Shared Phone Line Call
Appearance for Survivability (example); Automatic Provisioning (CLI
Script file); Configuring RTCP XR (IP Group); Enabling Same Call
Session ID over Multiple Devices (removed); Configuring Test Call
Endpoints (typo); CLI (illustration); Accessing the Web Interface (note).
■New sections: VoIPerfect; Using Dial Plan Tags for Call Setup Rules;
Using Dial Plan Tags for Message Manipulation.
■New parameters: WebLoginBlockAutoComplete;
EnforcePasswordComplexity; IPGroup_SBCKeepOriginalCallID;
IPGroup_SBCDialPlanName; IPGroup_CallSetupRulesSetId;
CallSetupRules_QueryType; CallSetupRules_QueryTarget; IpProfile_
SBCVoiceQualityEnhancement; IpProfile_SBCMaxOpusBW;
IpProfile_SBCISUPVariant; AUPDCliScriptURL;
PublicationIPGroupID.
■Updated parameters: Web password (EnforcePasswordComplexity);
TLSContexts_TLSVersion; InterfaceTable_InterfaceName;
CallSetupRules_AttributesToQuery (Web name and description);
IPProfile_SBCRTCPFeedback (values); IpProfile_
MediaIPVersionPreference; ConditionTable_Name (max. chars);
Test_Call_RouteBy (default); NATMode (values);
SendAcSessionIDHeader (removed); QOEPort (removed);
MaxGeneratedRegistersRate; CLIPrivPass;
GeneratedRegistersInterval; RTPOnlyMode (removed);
SBCUserRegistrationGraceTime; SBCKeepOriginalCallId.
- iv -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
41731 ■Updated sections: Changing Index Position of Table Rows; Searching
for Configuration Parameters; Configuring TLS Certificate Contexts
(IPSec removed); Enabling the HTTP Proxy Application (license);
Direct Media; Configuring SBC IP-to-IP Routing (IP Group load
balancing); MAC Address Placeholder in Configuration File Name;
VoIPerfect; Technical Specifications (AMR-WB removed).
■New sections: Configuring IP Group Sets.
■Updated parameters: SIPInterface_SBCDirectMedia; IPProfile_
SBCDirectMediaTag; IpProfile_DisconnectOnBrokenConnection;
IP2IPRouting_DestType; IPOutboundManipulation_
PrivacyRestrictionMode; BrokenConnectionEventTimeout.
■New parameters: IP2IPRouting_IPGroupSetName; EnableNonCallCdr;
PGroupSet; IPGroupSetMember; NoRTPDetectionTimeout;
DisconnectOnBrokenConnection; BrokenConnectionEventTimeout.
41733 ■Patch version 7.20A.100.
■Updated sections: CLI (telnet removed); Areas of the GUI (SBC
Wizard); Assigning Rows from Other Tables (search, add new, and
view); Invalid Value Indications; Creating a Login Welcome Message;
Configuring Management User Accounts (CLI); Enabling SSH with
RSA Public Key for CLI (public key); Configuring TLS Certificate
Contexts (DTLS); Assigning CSR-based Certificates to TLS Contexts;
Generating Private Keys for TLS Contexts; Configuring Underlying
Ethernet Devices (max.); Configuring IP Network Interfaces (max.);
Configuring Media Realms (max.); SRTP using DTLS Protocol;
Building and Viewing your Network Topology; SIP-based Media
Recording (multiple SRSs); Enabling SIP-based Media Recording;
Configuring SIP Recording Rules; Configuring Proxy Sets (keep-alive);
WebRTC (RFCs); Configuring WebRTC; VoIPerfect; Pre-Configured
IP Groups; Normal Mode (CRP); Emergency Mode (CRP); Auto
Answer to Registrations (CRP); Network Topology Types and Rx/Tx
Ethernet Port Group Settings; License Key; Viewing the License Key;
Obtaining License Key for Feature Upgrade (removed); Installing the a
New License Key; Installing License Key through Web Interface;
Upgrading SBC Capacity Licenses by OVOC License Pool; Viewing
Device Information; Viewing Call Routing Status (removed);
Configuring RTCP XR (IP Group); Configuring RADIUS Accounting
(typo for Accounting-Request); Automatic Provisioning (Startup CLI
Script File).
■New sections: Customizing the Web Interface; Replacing the
Corporate Logo; Replacing the Corporate Logo with an Image;
Replacing the Corporate Logo with Text; Customizing the Product
Name; Customizing the Favicon; SRTP using DTLS Protocol; SBC
Wizard; Viewing the Device's Product Key; Saving Configuration to a
File; Loading a Configuration File; Viewing Proxy Set Status.
- v -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated parameters: TLSContexts_ServerCipherString; TLSContexts_
ClientCipherString; NATTranslation_SourceStartPort; NATTranslation_
SourceEndPort; NATTranslation_TargetStartPort; NATTranslation_
TargetEndPort; SNMPSysOid; SNMPTrapEnterpriseOid;
EnableCoreDump (typo); HTTPSCipherString (removed);
SSHAdminKey; SessionExpiresDisconnectTime;
BrokenConnectionEventTimeout; RADIUSRetransmission (default);
RadiusTO (default); SIPRecRouting_RecordedIPGroupName;
SIPRecRouting_SRSIPGroupName.
■New parameters: WebUsers_SSHPublicKey; TLSContexts_
DTLSVersion; TLSContexts_DHKeySize; SIPRecRouting_
SRSRedundantIPGroupName; ProxySet_SuccessDetectionRetries;
ProxySet_SuccessDetectionInterval; ProxySet_Fail-
ureDetectionRetransmissions; ProxySet_MinActiveServersLB;
WebUsers; WebFaviconFileUrl; AUPDStartupScriptURL.
41736 ■Updated sections: Configuring VoIP LAN Interface for OAMP (CLI);
Configuring Management User Accounts (typo); Enabling SNMP;
Configuring IP Network Interfaces; SIP-based Media Recording
(multiple SRS); Configuring LDAP Servers (max. and cache);
Configuring Call Setup Rules; Configuring SBC IP-to-IP Routing (note);
Configuring SIP Response Codes for Alternative Routing Reasons;
SBC Wizard (screens); Auxiliary Files (SBC Wizard); Viewing IP
Connectivity (typo); Creating Core Dump and Debug Files upon Device
Crash (reset); Configuring IP Group Sets (max)
■New sections: Debugging Remote HTTP Services
■Updated parameters: IpProfile_SBCUseSilenceSupp (removed):
SIPRecRouting_SRSIPGroupName; SIPInterface_InterfaceName
(max. char); ProxySet_ProxyName (max. char);
MessageManipulations_ManipulationName (max. char);
MessagePolicy_Name (max. char); AllowedAudioCodersGroups_
Name (max. char); AllowedVideoCodersGroups_Name (max. char); _
ManipulationName (max. char); SBCAdmissionControl_
AdmissionControlName (max. char); Classification_
ClassificationName (max. char); IP2IPRouting_RouteName (max.
char); SBCRoutingPolicy_Name (max. char); IPGroupSet_Name (max.
char); IPInboundManipulation_ManipulationName (max. char);
IPOutboundManipulation_ManipulationName (max. char);
SBCAdmissionControl_Rate; EnableWebAccessFromAllInterfaces;
ResetWebPassword; DisableSNMP; EnableCoreDump;
SSHMaxLoginAttempts; IgnoreAlertAfterEarlyMedia;
ECNLPMode; PremiumServiceClassMediaDiffServ; Premi-
umServiceClassControlDiffServ; IsFaxUsed; EnableAGC
■New parameters: HTTPProxySyslogDebugLevel
41739 ■Updated with patch version 7.20A.150.
- vi -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated sections: Areas of the GUI (Configuration Wizard button);
Enabling Disabling SNMP; Viewing Certificate Information (screen);
Assigning Externally Created Private Keys to TLS Contexts (pass-
phrase); Generating Private Keys for TLS Contexts (pass-phrase);
Importing Certificates into Trusted Certificate Store (bulk import);
Configuring Underlying Ethernet Devices (MTU); Configuring Firewall
Settings (note); SIP-based Media Recording (max.); Configuring
Remote Web Services (QoS routing); Centralized Third-Party Routing
Server (QoS); Configuring Proxy Sets; Alternative Routing Based on IP
Connectivity; Configuring SBC IP-to-IP Routing; Configuring IP Group
Sets (dial plan tags); Configuring Dial Plans; Software Upgrade;
Installing License Key through Web Interface; Upgrading SBC Capacity
Licenses by OVOC License Pool; SBC Configuration Wizard;
Configuring RADIUS Accounting (typo); Configuring DTMF Tones for
Test Calls; Configuring Basic Test Calls; Configuring SBC Test Call
with External Proxy (removed).
■New sections: Configuring QoS-Based Routing by Routing Server;
Microsoft Skype for Business Presence of Third-Party Endpoints;
Registrar Stickiness; Configuring Pre-Parsing Manipulation Rules;
Configuring Private Wire Interworking; Configuring Rerouting of Calls to
Fax Destinations; Using Dial Plan Tags for Routing Destinations;
Disconnecting and Reconnecting HA; Viewing the License Key;
Installing a License Key String; Viewing the Device's Product Key;
Debugging Web Services.
■Updated parameters: AccessList_Source_IP; AccessList_Source_
Port; AccessList_Start_Port; AccessList_End_Port;
HTTPRemoteServices_HTTPType (option 5); IPGroup_
SBCDialPlanName (note); ProxySet_IsProxyHotSwap; ProxyIp_
IpAddress; IpProfile_SBCRemoteReferBehavior (4); IpProfile_
SBCPlayHeldTone; IP2IPRouting_Trigger (6); IP2IPRouting_DestType
(12/13); DialPlanRule_Tag; SBCCDRFormat_FieldType (818); Test_
Call_RouteBy; Test_Call_Play (tone); KeepAliveTrapPort (default);
SBCtestID (removed); ProxyIPListRefreshTime;
RegistrationRetryTime (note); EnablePChargingVector (removed);
EnableSBCApplication (default); SNMPReadOnlyCommunityString_x
(max. char.); SNMPReadWriteCommunityString_x (max. char.);
SNMPTrapCommunityString (max. char.).
■New parameters: DeviceTable_MTU; SRD_SBCDialPlanName;
SIPInterface_PreParsingManSetName; IPGroup_Tags; Account_
RegistrarStickiness; Account_RegistrarSearchMode; Account_
RegEventPackageSubscription; IpProfile_SBCFaxReroutingMode;
IP2IPRouting_RoutingTagName; IP2IPRouting_InternalAction;
IPGroupSet_Tags; CustomerSN; MaxRegistrationBackoffTime;
MaxSDPSessionVersionId; UseRandomUser; UnregisterOnStartup;
PresencePublishIPGroupId; EnableMSPresence;
PreParsingManipulationSets; PreParsingManipulationRules;
MWINotificationTimeout; RoutingServerQualityStatus; Rout-
ingServerQualityStatusRate.
40201 ■Updated with patch version 7.20A.152.
- vii -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated sections: Configuring the LDAP Search Filter Attribute (Web
path); Enabling LDAP Searches for Numbers with Characters;
Microsoft Skype for Business Presence of Third-Party Endpoints;
Configuring the Device for Skype for Business Presence (example);
Configuring Media Realm Extensions; Configuring Firewall Allowed
Rules; Configuring SBC IP-to-IP Routing (back to the sender);
Prerecorded Tones File; Installing on HA Devices (note); Loading a
Configuration File (note)
■Updated parameters: MediaRealmExtension_IPv4IF;
MediaRealmExtension_IPv6IF; ProxySet_EnableProxyKeepAlive;
SIPSDPSessionOwner
■New parameters: IPGroup_SBCUserStickiness; IPProfile_
LocalRingbackTone; IPProfile_LocalHeldTone
42022 ■Updated with patch Version 7.20A.154.007
■Updated sections: Silence Suppression (removed); Fax / Modem
Transparent Mode (silnce suppression removed); Configuring SIP
Recording Rules (view sessions in CLI); Configuring RTP Base UDP
Port (note removed re SIP Interface); Centralized Third-Party Routing
Server (call preemption added); Locking and Unlocking the Device
(typos); Viewing Active Alarms (max display)
■New sections: Configuring Additional Management Interfaces;
Configuring Specific UDP Ports using Tag-based Routing
■Updated parameters: WebUsers_Password (note); InterfaceTable_
ApplicationTypes; CpMediaRealm_PortRangeStart (note removed);
SIPInterface_UDPPort (note removed); ProxySet_
SuccessDetectionRetries (max); ProxySet_SuccessDetectionInterval
(max); Account_RegistrarSearchMode (phys link); AudioCoders_Sce
(global parameter removed); IpProfile_SCE (removed); IpProfile_
SBCRemoteReferBehavior (new option 5); IPProfile_
SBCRemoteHoldFormat (new option 6); IP2IPRouting_InternalAction;
SBCCDRFormat_Title (max. char.); WebUsers (CLI name); EnableWe-
bAccessFromAllInterfaces; FaxBypassPayloadType;
ModemBypassPayloadType; EnableSilenceCompression (removed)
■New parameters: SIPInterface_AdditionalUDPPorts; IPProfile_
SBCSupportMultipleDTMFMethods; AdditionalManagementInterfaces;
DefaultTerminalWindowHeight; ActiveAlarmTableMaxSize; SBCRe-
moveSIPSFromNonSecuredTransport
42023 ■Updated with patch Version 7.20A.156.009
■Updated sections: Configuring Management User Accounts; Device
Located behind NAT; Configuring a Static NAT IP Address for All
Interfaces (removed); SIP-based Media Recording (URL of France reg.;
note on SRS redundancy); Configuring SIP Recording Rules (note re
timestamp); Configuring the OVOC Server (note re report mode);
Configuring Call Setup Rules (ENUM); Call Setup Rule Examples
(e.g., 5); Interworking SIP Early Media (figure); Prerecorded Tones File;
Automatic Configuration Methods; DHCP-based Provisioning (note re
resets)
- viii -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■New sections: Using Conditions for Starting a SIPRec Session; Using
the Proprietary SIP X-AC-Action Header; Handling Registered AORs
with Same Contact URIs; Configuring Dual Registration; Provisioning
the Device using DHCP Option 160; Enabling SIP Call Flow Diagrams
in OVOC
■Updated parameters: WebUsers_SessionLimit; WebUsers_
SessionTimeout; SRD_BlockUnRegUsers (option 2 updated);
SIPInterface_AdditionalUDPPorts; SIPInterface_
BlockUnRegUsers; IPGroup_SIPConnect; CallSetupRules_
QueryType (OPTION 3); CallSetupRules_QueryTarget;
CallSetupRules_AttributesToQuery; CallSetupRules_Condition;
IpProfile_SBCSDPPtimeAnswer; IpProfile_SBCPreferredPTime;
IpProfile_SBCRemoteRepresentationMode (0 updated);
DialPlanRule_Tag; LoggingFilters_LogDestination (new option 3);
LoggingFilters_CaptureType (new option 6); WebSessionTimeout
(range); StaticNatIP (removed); SBCDBRoutingSearchMode;
SBCKeepContactUserinRegister
■New parameters: WebUsers_CliSessionLimit; SIPRecRouting_
ConditionName;IPGroup_UserUDPPortAssignment;
CallFlowReportMode; DhcpOption160Support; SIPRecTimeStamp
■Miscellaneous: EMS/SEM replaced with One Voice Operations Center
(OVOC) – text and screenshots
42025 ■Updated with Patch Version 7.20A.158
■Updated sections: Replacing the Corporate Logo with an Image (logo
width removed); Replacing the Corporate Logo with Text; Customizing
the Favicon (default); Creating a Login Welcome Message (no reset);
Configuring Secured (HTTPS) Web; Disabling SNMP (reset);
Configuring Underlying Ethernet Devices (Ethernet Output Device
field); Configuring NAT Translation per IP Interface; Configuring Media
(SRTP) Security (validation, no reset); Configuring Invalid RTP Packet
Handling; LDAP-based Management and SIP Services (managed
services); Configuring LDAP Server Groups (managed services);
Configuring Registration Accounts; Configuring Rerouting of Calls to
Fax Destinations; Configuring Call Preemption for SBC Emergency
Calls (note removed); Configuring Call Survivability Mode (path);
Configuring PSTN Fallback; Configuring Firewall Allowed Rules;
Monitoring IP Entities and HA Switchover upon Ping Failure; Automatic
Update from Remote Servers (AutoUpdatePredefinedTime); Viewing
SBC CDR History; CDR Field Description; CDR Fields for SBC
Signaling (removed); Configuring CDR Reporting; Storing CDRs on the
Device; Enabling SIP Call Flow Diagrams in OVOC (note)
■New sections: Restoring the Default Corporate Logo Image;
Customizing the Browser Tab Label; Configuring SNMP for OVOC;
Enabling Same Call Session ID over Multiple Devices; Customizing
CDRs for Test Calls
- ix -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated parameters: LdapServerGroups_ServerType (2);
SIPInterface_AdditionalUDPPorts; IPGroup_AuthenticationMode;
ProxySet_ProxyName (forward slash); IpProfile_TranscodingMode ;
IP2IPRouting_DestType (note); IP2IPRouting_DestIPGroupName
(note); SBCCDRFormat_FieldType (442, 635); TelnetServerEnable;
DisableSNMP; EnableLanWatchDog (removed);
CDRLocalMaxFileSize (name change, max.);
CDRLocalMaxNumOfFiles (name change); CDRLocalInterval (name
change); SyslogOptimization (def); HAPingEnabled;
HAPingDestination (removed); HAPingSourceIfName (removed);
HAPingTimeout (removed); HAPingRetries (removed);
EnableMediaSecurity (no reset)
■New parameters: Account_RegByServedIPG; Account_
UDPPortAssignment; IpProfile_SBCAd-
aptRFC2833BWToVoiceCoderBW; TimeZoneFormat;
CallDurationUnits; SendAcSessionIDHeader;
HaNetworkMonitorThreshold; HaNetworkMonitor; SRTPTun-
nelingValidateRTPRxAuthentication; SRTPTun-
nelingValidateRTCPRxAuthentication; RTPFWInvalidPacketHandling;
RtpFWNonConfiguredPTHandling
■Miscellaneous: New AudioCodes logo; '.content' removed fom
manipulation syntax
42026 ■Updated to Patch Version 7.20A.200.019
■Updated Sections: Default OAMP IP Address; Configuring
Management User Accounts (max.); Assigning CSR-based Certificates
to TLS Contexts (SAN); Creating Self-Signed Certificates for TLS
Contexts (SAN); DNS; Configuring Remote Web Services (Capture
removed); HTTP-based Proxy Services; Debugging Remote HTTP
Services; Configuring an HTTP-based OVOC Service; Configuring
User Information; Configuring SBC User Info Table from a Loadable
File; Configuring SIP Message Manipulation (max.); Interworking Media
Security Protocols; Enabling the SBC Application (removed);
Configuring Admission Control; Enabling the CRP Application
(removed); Configuration while HA is Operational (resets); Auxiliary
Files (User Info): User Information File; Viewing the License Key;
Upgrading SBC Capacity Licenses by OVOC License Pool; Restoring
Factory Defaults through CLI (keep-network); Viewing Active Alarms
(refresh and order); Viewing History Alarms (refresh and order); Viewing
Proxy Set Status (name); Configuring RTCP XR (note); Configuring
Reporting of Management User Activities (select all); Configuring Test
Call Endpoints (max.)
- x -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■New Sections: Configuring Default DNS Servers; Configuring a DNS
Server for HTTP Services; Configuring HTTP Proxy Servers;
Configuring HTTP Locations; Configuring TCP/UDP Proxy Servers;
Configuring Upstream Groups; Configuring Upstream Hosts;
Configuring HTTP Directive Sets; Configuring HTTP Directives;
Troubleshooting NGINX; Configuring SBC MoH from External Media
Source; Saving and Loading an ini Configuration to a File; Viewing IDS
Active Blacklist; Saving and Loading a Configuration Package File;
Quick-and-Easy Initial HA Configuration; Backing Up and Restoring HA
Configuration
■Updated Parameters: WebUsers_SessionLimit (max/def);
HTTPRemoteServices_HTTPType (Capture removed);
CallSetupRules_AttributesToQuery; CallSetupRules_Condition;
CallSetupRules_ActionSubject; CallSetupRules_ActionValue;
MessageManipulations_MessageType; MessageManipulations_
Condition; MessageManipulations_ActionValue; ConditionTable_
Condition; PreParsingManipulationRules_MessageType;
PreParsingManipulationRules_ReplaceWith; AudioCoders_Sce;
IpProfile_SBCMediaSecurityMethod (2 removed); IPProfile_
SBCRemoteHoldFormat; IPProfile_ReliableHoldToneSource;
IpProfile_SBCPlayHeldTone; IP2IPRouting_InternalAction;
MaliciousSignatureDB_Pattern; SSHServerEnable (def);
NoRTPDetectionTimeout; SBCAdmissionControl (removed);
DialPlanRule; HTTPProxySyslogDebugLevel (options);
HARevertiveEnabled; HAPriority; HARemotePriority; MediaChannels
■New Parameters: SRD_AdmissionProfile; MessageManipulations_
ActionSubject SIPInterface_AdmissionProfile; IPGroup_
AdmissionProfile; SBCAdmissionRule_MaxBurstPerUser; Rate Per
User; SBCUserInfoFileUrl; UserInfoFileURL; ConfPackageURL;
DefaultPrimaryDnsServerIp; DefaultSecondaryDnsServerIp;
MaxStreamingCalls; SBCAdmissionProfile; SBCAdmissionRule;
SBCUserInfoTable; ExternalMediaSource; HTTPPrimaryDNS;
HTTPSecondaryDNS; HTTPServer; HTTPLocation; TcpUdpServer;
UpstreamGroup; UpstreamHost; HTTPDirectiveSets;
HTTPDirectives; OVOCService; HALocalMAC; HARemoteMAC;
MaxStreamingCalls
42028 ■Updated to Patch Version 7.20A.200.112
- xi -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated Sections: Accessing the Web Interface (remember me);
Configuring Additional Management Interfaces (CLI removed);
Configuring TLS Server Certificate Expiry Check
(acCertificateExpiryAlarm); Fax / Modem NSE Mode (removed);
Configuring SIP Recording Rules; Building and Viewing SIP Entities in
Topology View (access via logo); Remotely Resetting Device using
SIP NOTIFY (SBC also); VoIPerfect (Managed G.729); Locking and
Unlocking the Device (cancel); Software Upgrade (fallback); License
Key (floating); Viewing the License Key (floating / Device Type /
License Server Status / Remote License Server Status - deleted /
Remote License Server IP - deleted); Local License Key; SBC Capacity
Licenses from Fixed License Pool; Saving and Loading an ini File
(License Key of Redundant); Saving and Loading a Configuration
Package File (SFTP); Triggers for Automatic Update (NOTIFY for SBC
also); Viewing Active Alarms (HA / format); Viewing History Alarms
(HA / format); CDR Field Description (Alerting Time [443]); Patterns for
Denoting Phone Numbers and SIP URIs
■New Sections: Remotely Resetting Device using SIP NOTIFY;
Remotely Disconnecting Calls using SIP NOTIFY; SBC Capacity
Licenses from Floating License; Applying Downloaded ini File after
Graceful Timeout; Debug Recording on VoIP Interfaces
■Updated Parameters: SNMPUsers_PrivProtocol (4 and 5 removed);
InterfaceTable_InterfaceName (default); "Prefix" replaced with
"Pattern" for Web parameters and CLI commands and descriptions
updated; CpMediaRealm_MediaRealmName (range); CpMediaRealm_
PortRangeStart (note); MediaRealmExtension_PortRangeStart (note);
SIPInterface_UDPPort (note); SIPInterface_TCPPort (note);
SIPInterface_TLSPort (note); SIPInterface_AdditionalUDPPorts (note);
IPGroup_ContactUser (val); IPGroup_Username (max. val); Account_
ContactUser (max. val); SBCUserInfoTable_LocalUser (max value);
SBCUserInfoTable_Username (max. val); IpProfile_
SBCMediaSecurityMethod (Both value added); IpProfile_
SBCRemoteUpdateSupport (option 3 added); SBCAdmissionRule_
RequestType; IP2IPRouting_DestType (Internal rules);
SBCCDRFormat_FieldType (443); Test_Call_UserName (max.
values); Test_Call_Play (note removed); UserName (max. val);
UseRandomUser (description); MgmtUseLocalUsersDatabase
(description); EnableSIPRemoteReset; SBCRandomizeExpires
(description); TLSExpiryCheckStart; MediaChannels
■New Parameters: IpProfile_SBCRemoveUnKnownCrypto;
DisableDualImageFeature; AdminStateLockControl;
EnableFloatingLicense; AllocationProfile; AllocationRegisteredUsers;
AllocationMediaSessions; AllocationSignalingSessions;
LimitRegisteredUsers; LimitMediaSessions; LimitSignalingSessions;
LimitTranscodingSessions; AupdGracefulShutdown; MPLSMode;
RetryAfterMode; SIPDigestAuthorizationURIMode;
EnableSIPRemoteReset
42029 ■Updated to Patch Version 7.20A.204.015
- xii -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated Sections: TLS for SIP Clients (no reset); Configuring Physical
Ethernet Ports; First Incoming Packet Mechanism; Configuring TLS for
SIP; Enabling IDS (no reset); SIP-based Media Recording (RFC s
updated); Enabling SIP-based Media Recording (removed); Configuring
Proxy Sets; Configuring Call Setup Rules (max.); Supported Audio
Coders (G.722); Alternative Routing Based on SIP Responses;
Classification and Routing of Registered Users; Configuring Call
Preemption for SBC Emergency Calls; Configuring Firewall Allowed
Rules; Locking and Unlocking the Device (TLS sockets); Installing on
HA Devices; SBC Capacity Licenses from Floating License; Viewing
Average Call Duration; Event Representation in Syslog Messages;
Creating Core Dump and Debug Files upon Device Crash
■New Sections: Configuring CSRF Protection; Configuring Firewall
Rules to Allow Incoming OVOC Traffic; Configuring Format of SIPRec
Metadata; Configuring an HTTP GET Web Service; Configuring
Classification Based on Tags; Accessing Files on Redundant from
Active Device through SSH; Viewing Floating License Reports;
Configuring CDR Reporting to REST Server
■Updated Parameters: EtherGroupTable_Mode; HTTPRemoteServices_
HTTPType (8); HTTPRemoteServices_Policy;
HTTPRemoteServices_PersistentConnection;
HTTPRemoteServices_NumOfSockets (removed);
HTTPRemoteServices_LoginNeeded (removed); IPGroup_Tags;
ProxySet_EnableProxyKeepAlive; ProxySet_ProxyRedundancyMode;
ProxySet_IsProxyHotSwap; ProxySet_ProxyLoadBalancingMethod;
ProxySet_DNSResolveMethod; CallSetupRules_RulesSetID;
CallSetupRules_QueryType (4); CallSetupRules_QueryTarget;
IPGroupSet_Tags; IPOutboundManipulation_SrcTags;
TelnetServerIdleDisconnect; SNMPEngineIDString; NATMode (4);
SIPSRequireClientCertificate (no reset); EnableIDS (no reset);
EnableSIPRec (removed); IpProfile_SBCRFC2833Behavior;
IpProfile_SBCAlternativeDTMFMethod
■New Parameters: HTTPRemoteServices_BetweenGroupsPolicy;
AdditionalUDPPortsMode; SIPInterface_CallSetupRulesSetId;
ProxyKeepAliveUsingIPG; ProxyIp_Priority; ProxyIp_Weight;
Classification_IPGroupSelection; Classification_IpGroupTagName;
AdminState; AdminStateRestrictConnections; CSRFProtection;
RestCdrReportLevel; RestCdrHttpServer; SSHRedundantProxyPort;
SBCURIComparisonExcludedParams; SbcRoutingTimeout;
SIPRecMetadataFormat; HTTPRemoteHosts_GroupID;
HTTPRemoteHosts_PriorityInGroup
42030 ■Updated to Patch Version 7.20A.204.108
■Updated Sections: Enabling SSH with RSA Public Key for CLI (Admin
key removed); Interfaces Table Configuration Guidelines (31); Device
Located behind NAT; Configuring Firewall Rules to Allow Incoming
OVOC Traffic (note); Enabling the User Info Table; Configuring SBC
User Information (note); Call Setup Rule Examples (ENUM); Using the
Proprietary SIP X-AC-Action Header (REFER); Storing CDRs on the
Device (HA note)
- xiii -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■New Sections: Configuring a Static NAT IP Address for All Interfaces
(returned)
■Updated Parameters: WebUsers_Password (\); WebUsers_
SSHPublicKey; InterfaceTable_PrefixLength (31); InterfaceTable_
Gateway; IPGroup_AuthenticationMode; IPGroup_Username;
IPGroup_Password; ProxySet_ProxyRedundancyMode (note);
CallSetupRules_QueryType (ENUM address); CallSetupRules_
QueryTarget (ENUM); IpProfile_SBCRemoteReferBehavior;
IP2IPRouting_DestType (note); SSHAdminKey (removed);
SSHRequirePublicKey; DisableICMPUnreachable
■New Parameters: StaticNatIP; ForceGenerateToTag;
LdapConfiguration_NoOpTimeout
42031 ■Updated sections: Configuring Voice Mail; Call Processing of SIP
Dialog Requests; RADIUS-based Management User Authentication
(CLI); Enabling LDAP-based Web/CLI User Login Authentication and
Authorization; Media Cluster (time); Collecting Debug Recording
Messages; Viewing SBC Registered Users; Interworking SIP Diversion
and History-Info Headers
■Updated parameters: IpProfile_SBCISUPBodyHandling (new value);
LogoWidth (removed); LocalStorageMedia (removed- only SD card
storage)
■New parameters: GWInboundManipulationSet;
GWOutboundManipulationSet
42033 Updated for software update Version 7.20A.250.
■Updated sections: Alternative Routing Based on SIP Responses (806
updated); Fax and Modem Capabilities (removed); CDR Field
Description (SIP Local/Remote Tag); CLI-Based Management (user
levels); Configuring Charge Codes (CLI command); Accessing Web
(Log In button name); Configuring Management User Accounts (user
level descriptions); Configuring Media (SRTP) Security (AES-256);
Configuring SIP Recording Rules (note for SRTP-SRTP recording);
Configuring the Internal DNS Table (note); Configuring the Internal SRV
Table (max); Configuring Default DNS Servers; Configuring the Trunk
Group Settings Table (max); Event Detection and Notification using X-
Detect Header (note re CPT); HTTP Proxy Parameters (CLI);
Monitoring IP Entities and HA Switchover upon Ping Failure
(hostname); Prerecorded Tones File ("acUserDefine" and description);
Restoring Factory Defaults through Web Interface (check box name);
Storing CDRs on the Device (note re HA); Viewing Device Information
(device uptime format);WebRTC (sessions); Configuring HTTP
Directive Sets (values changed of limit_conn and limit_rate); File
Location for Automatic Update (username-password);
■New sections: onfiguring a Public IP Address for NGINX NAT
Traversal; Configuring SIP Response Codes to Exclude from IDS;
- xiv -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated parameters: CliScriptURL (typo); CLIStartupScriptUrl (typo);
AccessList_Protocol ("sip" removed); IDSRule_Reason (CAC,
exclusion of SIP cause codes); IPGroup_SIPConnect (options and
descriptions); IPGroup_MethodList ("setup-invite"); IpProfile_
SBCRemote3xxBehavior (new options 3 and 4); IPProfile_
LocalRingbackTone (PRT userdefine); IPProfile_LocalHeldTone (PRT
userdefine); LoggingFilters_CaptureType (option 7 added, note added
for option 4); WebUsers_PwAgeInterval (description and note);
ProxySet_ClassificationInput (note); ProxySet_ClassificationInput
(note and example); ProxySet_DNSResolveMethod (max. hostnames);
ProxyIp_IpAddress (note for IP addresses); HTTPRemoteServices_
KeepAliveTimeOut (description and note removed); RTCPInterval (Web
name changed); SIPInterface_PreClassificationManipulationSet (note if
classification fails); SBCCDRFormat_FieldType (445 and 446 added);
GWInboundManipulationSet (CLI); GWOutboundManipulationSet (CLI);
HaNetworkMonitor_DestAddress (hostname); NTPServerUTCOffset
(range); UdpPortSpacing (default); T38FaxMaxBufferSize (default);
VQMonEnable (reset M1K); NumOfSubscribes (note removed);
SBCServerAuthMode (note re IPGroup_TypeSBCServerAuthType);
SRTPofferedSuites (AES-256); SSHRedundantProxyPort (CLI);
TelnetServerEnable (note); AUPDDigestUsername (removed);
AUPDDigestPassword (removed); Account_RegistrarStickiness;
IP2IPRouting_RequestType (note); ActivityListToLog (ard removed)
■New parameters: CallSetupRules_RulesSetName; IPGroup_
TypeSBCServerAuthType; IPGroup_OAuthHTTPService; Account_
AccountName; SBCAlternativeRoutingReasons_AltReasonName;
PPreferredIdListMode; HttpProxyGlobalAddress; DialPlanCSVFileUrl;
Account_ReRegisterOnInviteFailure; Accoun-
tInviteFailureTriggerCodes
42034 Updated to Patch Version 7.20A.252.011.
- xv -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■Updated sections: Accessing Files on Redundant Device from Active
through SSH (note added); Areas of the GUI (password on toolbar and
hostname); Assigning CSR-based Certificates to TLS Contexts;
Assigning Externally Created Private Keys to TLS Contexts (Status
field); Assigning IDS Policies (fields renamed); CDR Field Description
(Media List and Call Success added); Centralized Third-Party Routing
Server (Call Forking added); Configuring Call Admission Control (note);
Configuring Basic Test Calls (note); Configuring Call Setup Rules
(HTTP Post Notification); Configuring CDR Filters and Report Level
(CDR End parameters); Configuring Classification Rules (capacity);
Configuring Coder Groups (note re G.729ab); Configuring Dial Plans
(capacity and range); SBC Configuration Wizard (not for HA);
Configuring Ethernet Port Groups (device reset); Configuring Physical
Ethernet Ports (device reset); Configuring Gateway User Information
Table through Web Interface (table name); Configuring ICMP Messages
(parameter names); Configuring IDS Policies (editable
defaults/WebSocket failures); Configuring IP Groups (capacity);
Configuring Management User Accounts; Configuring Password
Display in ini File; Configuring Proxy Sets (edit and capacity);
Configuring SBC Routing Policy Rules (capacity); Configuring SIP
Interfaces (capacity); Configuring SIP Response Codes for Alternative
Routing Reasons; Configuring SNMP Trap Destinations with IP
Addresses; Configuring SRDs (capacity); Configuring Static IP Routes
(reset removed); Configuring Syslog Debug Level (typo); Configuring
Test Call Endpoints; Configuring the Device's LDAP Cache (typo);
Configuring the OVOC Server for QoE (table renamed); Configuring the
Syslog Server Address (path); Configuring TLS Certificate
Contexts;Connectivity and Synchronization between Devices; Creating
Core Dump and Debug Files upon Device Crash (note); Creating Self-
Signed Certificates for TLS Contexts (CN); CRP Configuration (note); ;
Customizing CDRs for SBC Calls and Test Calls (JSON); Dial Plan
(backward compatibility sections removed); Enabling SIP Call Flow
Diagrams in OVOC; Enabling Syslog (path); Initial Registration
Request Processing; Installing a License Key String; Network Topology
Types and Rx/Tx Ethernet Port Group Settings; No-Op Packets (DSP
note removed); Saving and Loading CLI Script Files (optional reset);
Saving and Loading a Configuration Package File; Saving and Loading
an ini Configuration File; SBC Capacity Licenses from Floating License
(note on ignore licenses); Viewing IDS Alarms (WebSocket failures);
Viewing Logged-In User Information; Changing OAMP Address through
Web Interface
■New sections: Changing Login Password by All User Levels;
Configuring a Hostname for the Device; Configuring DiffServ for HA
Maintenance Traffic; Configuring Password Display in CLI; Configuring
User-Defined Performance Monitoring MIBs; Configuring Syslog
Message Severity Level; Customizing Access Levels per Web Page;
Customizing SNMP Alarm Severity; Exporting Dial Plans; Idle CLI
Session Timeout for RS-232 Connections; Importing Dial Plans;
Miscellaneous CDR Configuration; Syslog Message Description for
CPU Overload; Viewing CDR History of SBC and Test Calls
- xvi -

Notice Mediant 4000 SBC | User's Manual
LTRT Description
■New parameters: MatrixCsvFileUrl; IpProfile_
CreatedByRoutingServer; HTTPRemoteServices_LoginNeeded;
HTTPRemoteServices_VerifyCertificateSubjectName; Test_Call_
OfferedCodersGroupName; Test_Call_
AllowedAudioCodersGroupName; Test_Call_AllowedCodersMode;
Test_Call_MediaSecurityMode; Test_Call_PlayDTMFMethod; Test_
Call_MediaSecurityMode; QOESettings_
VerifyCertificateSubjectName; Hostname;
HAMaintenanceIFDiffServValue; HAOperationalStateDelayInSec;
ShortCallSeconds; SyslogLogLevel; CallEndCDRSIPReasonsFilter;
CallEndCDRZeroDurationFilter; CLIEnableModePassword;
CliObscuredPassword
■Updated parameters: CallSetupRules_QueryType (HTTP POST Query
/ HTTP POST Notification); CallSetupRules_QueryTarget (Web name
changed); CallSetupRules_AttributesToQuery (Web name changed);
CallSetupRules_ActionType (None value added); InterfaceTable_
PrefixLength (values); IpProfile_SBCRemoteReferBehavior (Keep URI
(user@host)); IpProfile_AMDMaxPostSilenceGreetingTime (default);
LoggingFilters_Value (Any removed); LoggingFilters_CaptureType
(note added to 2 and 4); WebUsers_Password (note); IP2IPRouting_
DestTyp (Gateway value update); SNMPTrapCom-
munityStringPassword (name change); SNMPReadWriteCom-
munityStringsPassword (name change);
SNMPReadOnlyCommunityStringsPassword (name change);Test_
Call_DestTransportType (SCTP added); Test_Call_PlayDTMFMethod
(In Band value); Test_Call_Play (PRT and NetAnn); QOESettings
(parameters renamed); TLSContexts_ServerCipherString (default);
TLSContexts_ClientCipherString (default); ntpAuthMd5KeyPassword
(renamed); PM_EnableThresholdAlarms
- xvii -

Content Mediant 4000 SBC | User's Manual
Table of Contents
1 Introduction 1
Product Overview 1
Typographical Conventions 1
Getting Familiar with Configuration Concepts and Terminology 2
SBC Application 2
Part I 7
Getting Started with Initial Connectivity 7
2 Introduction 8
3 Default IP Address 9
4 Configuring VoIP LAN Interface for OAMP 10
Changing OAMP Address through Web Interface 10
Changing OAMP Address through CLI 11
Changing OAMP Address through ini File 13
Part II 15
Management Tools 15
5 Introduction 16
6 Web-Based Management 17
Getting Acquainted with the Web Interface 17
Computer Requirements 17
Accessing the Web Interface 17
Areas of the GUI 18
Accessing Configuration Pages from Navigation Tree 21
Configuring Stand-alone Parameters 23
Configuring Table Parameters 24
Adding Table Rows 25
Assigning Rows from Other Tables 26
Modifying Table Rows 27
Deleting Table Rows 27
Invalid Value Indications 28
Viewing Table Rows 30
Sorting Tables by Column 30
Changing Index Position of Table Rows 31
Searching Table Entries 31
Searching for Configuration Parameters 32
Getting Help 33
Logging Off the Web Interface 33
Customizing the Web Interface 34
Replacing the Corporate Logo 34
Replacing the Corporate Logo with an Image 35
Replacing the Corporate Logo with Text 35
- xviii -

Content Mediant 4000 SBC | User's Manual
Restoring the Default Corporate Logo Image 36
Customizing the Browser Tab Label 36
Customizing the Product Name 37
Customizing the Favicon 38
Creating a Login Welcome Message 39
Configuring Additional Management Interfaces 40
Configuring Management User Accounts 41
Customizing Access Levels per Web Page 47
Displaying Login Information upon Login 49
Viewing Logged-In User Information 50
Configuring Web Session and Access Settings 50
Changing Login Password by All User Levels 51
Configuring Secured (HTTPS) Web 52
Configuring CSRF Protection 53
Web Login Authentication using Smart Cards 53
Configuring Web and Telnet Access List 54
7 CLI-Based Management 55
Enabling CLI 55
Enabling Telnet for CLI 55
Enabling SSH with RSA Public Key for CLI 56
Configuring Maximum Telnet/SSH Sessions 57
Establishing a CLI Session 58
Viewing Current CLI Sessions 59
Terminating a User's CLI Session 59
Configuring Displayed Output Lines in CLI Terminal Window 60
Idle CLI Session Timeout for RS-232 Connections 60
Configuring Password Display in CLI 61
8 SNMP-Based Management 62
Disabling SNMP 62
Configuring SNMP Community Strings 62
Configuring SNMP Trap Destinations with IP Addresses 64
Configuring an SNMP Trap Destination with FQDN 66
Configuring SNMP Trusted Managers 66
Enabling SNMP Traps for Web Activity 67
Configuring SNMP V3 Users 67
Customizing SNMP Alarm Severity 69
9 INI File-Based Management 73
INI File Format 73
Configuring Individual ini File Parameters 73
Configuring Table ini File Parameters 73
General ini File Formatting Rules 75
Configuring an ini File 75
Loading an ini File to the Device 76
- xix -

Content Mediant 4000 SBC | User's Manual
Secured Encoded ini File 76
Configuring Password Display in ini File 76
INI Viewer and Editor Utility 77
10 REST-Based Management 78
Part III 80
General System Settings 80
11 Date and Time 81
Configuring Automatic Date and Time using SNTP 81
Configuring Date and Time Manually 82
Configuring the Time Zone 82
Configuring Daylight Saving Time 83
12 Configuring a Hostname for the Device 84
Part IV 85
General VoIP Configuration 85
13 Network 86
Building and Viewing your Network Topology 86
Configuring Physical Ethernet Ports 89
Configuring Ethernet Port Groups 91
Configuring Underlying Ethernet Devices 94
Configuring IP Network Interfaces 96
Networking Configuration Examples 101
Configuring Static IP Routes 104
Configuration Example of Static IP Routes 106
Troubleshooting the Static Routes Table 107
Network Address Translation Support 107
Device Located behind NAT 108
Configuring NAT Translation per IP Interface 108
Remote UA behind NAT 110
SIP Signaling Messages 110
Media (RTP/RTCP/T.38) 111
Robust Receipt of Media Streams by Media Latching 114
Configuring Quality of Service 115
Configuring Class-of-Service QoS 115
Configuring DiffServ-to-VLAN Priority Mapping 117
Configuring ICMP Messages 118
DNS 119
Configuring Default DNS Servers 119
Configuring the Internal DNS Table 120
Configuring the Internal SRV Table 121
IP Multicasting 123
14 Security 124
Configuring SSL/TLS Certificates 124
- xx -