VoIP Access External
Technical Guide
Disclosure / Confidentiality
The information contained in this document provides technical guidance on Colt’s VoIP
Access service and is provided for information only. It does not form part of any contract with
Colt. This document may be distributed external to Colt with written permission
Copyright © Colt Group
No part of this document may be reproduced or adapted in any form, including photocopying or storing
it by electronic means, except as is necessary for the purpose of the recipient's dealings with Colt,
without the written permission of Colt. Any copies made of any part of this document shall include the
notice:
© 2016 Colt Technology Services. The Colt name and logos are trademarks. All rights reserved.
No information contained in this document shall be disclosed to any third party without the written
permission of Colt.
VoIP Access External Technical Guide
1. Document Information
1.1
Overview
Document Name:
VoIP Access External Technical Guide
Version Number:
Issue Date:
Authors:
Richard Taylor, Harsha Hegde, Rama Vidyasankar
Owner:
File Name & Location:
1.2
Version History
Version
Issue Date
Author
Reason for change
Page 2 of 44
VoIP Access External Technical Guide
1.3
1.
Contents
Document Information .............................................................................................................. 2
1.1
Overview .............................................................................................................................. 2
1.2
Version History ..................................................................................................................... 2
1.3
Contents ............................................................................................................................... 3
2.
Glossary ..................................................................................................................................... 5
3.
Overview .................................................................................................................................... 6
4.
Numbering & CLI Features ....................................................................................................... 7
5.
6.
7.
8.
4.1
Number Formats .................................................................................................................. 7
4.2
SIP URI Format .................................................................................................................... 7
4.3
CLI Features ........................................................................................................................ 7
4.4
DNs resolution Support ...................................................................................................... 10
4.5
Emergency Call handling ................................................................................................... 10
Signalling ................................................................................................................................. 11
5.1
SIP Protocol Support.......................................................................................................... 11
5.2
Supported Call Flows ......................................................................................................... 14
Bearer Services ....................................................................................................................... 18
6.1
Codecs ............................................................................................................................... 18
6.2
Media Path ......................................................................................................................... 18
6.3
Transcoding ....................................................................................................................... 18
6.4
Fax ..................................................................................................................................... 19
6.5
Modem ............................................................................................................................... 19
6.6
DTMF ................................................................................................................................. 19
6.7
Clear Channel .................................................................................................................... 19
6.8
Call Admission Control (CAC) ............................................................................................ 20
6.9
Tones & Announcements ................................................................................................... 20
6.10
Echo Cancellation .......................................................................................................... 20
Access Technologies.............................................................................................................. 21
7.1
Overview ............................................................................................................................ 21
7.2
Internet ............................................................................................................................... 21
7.3
IP VPN ............................................................................................................................... 23
7.4
Ethernet .............................................................................................................................. 24
7.5
Quality of Service ............................................................................................................... 24
Multi-Trunk & Resilient Configurations ................................................................................ 26
8.1
Trunk Topologies ............................................................................................................... 26
8.2
Trunk Resiliency................................................................................................................. 28
8.3
Call Diversion features ....................................................................................................... 29
Page 3 of 44
VoIP Access External Technical Guide
9.
Security .................................................................................................................................... 30
9.1
10.
Encryption .......................................................................................................................... 30
Platform Features ................................................................................................................ 33
10.1
Resilience ....................................................................................................................... 33
10.2
Security........................................................................................................................... 33
10.3
Voice quality (MOS) ....................................................................................................... 34
11.
Appendix A - CLI Reference ............................................................................................... 35
12.
Appendix B – Call Flows ..................................................................................................... 38
12.1
Outgoing National Call ................................................................................................... 38
12.2
Outgoing International Call ............................................................................................. 38
12.3
Incoming National or International Call .......................................................................... 38
13.
Appendix C - Example Access Topologies ....................................................................... 40
13.1
Internet – Single Site – Voice & Data ............................................................................. 40
13.2
Internet – Multi-Site – Dedicated .................................................................................... 40
13.3
Ethernet – Single Site – Dedicated ................................................................................ 41
13.4
Ethernet – Multi Site – Dedicated (simple) ..................................................................... 41
13.5
Ethernet – Multi Site – Dedicated (complex) .................................................................. 42
13.6
IP-VPN – Single Site - Dedicated ................................................................................... 43
13.7
IP-VPN – Multi Site - Shared .......................................................................................... 43
Page 4 of 44
VoIP Access External Technical Guide
2. Glossary
CC
CdPN
CgPN
CLI
CLIP
CLIR
DN
EPN
FQDN
GN
ICR
MGW
NAT
NP
NSN
PAI
PDD
PI
PN
PNR
PPI
RDN
RPI
SBC
SDES
SI
SIP
SRTP
TLS
Trunk
Trunkgroup
Country Code
Called Party Number or ‘B’ Number
Calling Party Number or ‘A’ Number
Calling Line Identification
Calling Line Identification Presentation (or Caller ID)
Calling Line Identification Restriction
Default Number
Ethernet Private Network
Fully Qualified Domain name
Generic Number (ISUP)
Inbound Call Re-Routing (Product Feature)
Media Gateway
Network Address Translation
Network Provided (Screening)
National Significant Number
P-Asserted-Identity (SIP)
Post Dial Delay
Presentation Indicator (ISUP)
Presentation Number
Partial Number Replacement (Product Feature)
P-Preferred-Identity (SIP)
Redirecting Number
Remote Party Id (SIP)
Session Border Controller
Secure Descriptions
Screening Indicator (ISUP)
Session Initiation Protocol
Secure Real Time Protocol
Transport Layer Security
A logical entity used for VoIP signalling and media, defined between a
unique pair of IP addresses on the Colt SBC and Customer IP-PBX
Equipment.
A group of trunks that share the same DDI number ranges and typically
used for resiliency
Page 5 of 44
VoIP Access External Technical Guide
3. Overview
Figure 1. VoIP Access Overview
VoIP Access is a SIP Trunking service that provides PSTN Connectivity for customers with an IPPBX.
This document describes the technical specification of service including:

SIP protocol support – IETF RFC and other standards compliance, supported protocol
features and call flows

Bearer Services support – Codecs, Fax, Modem, DTMF, and Transcoding

Numbering & Routing – Supported number / URI formats, CLI handling, Emergency Call
Handling, Call Re-routing

Access Technologies -IP Addressing, NAT traversal, QoS

Security – Security features, SIP-TLS and SRTP encryption
Page 6 of 44
VoIP Access External Technical Guide
4. Numbering & CLI Features
4.1
Number Formats
4.1.1 Outgoing Calls (Customer  Colt)
For outgoing calls, the A Number and B Number can be sent in the following formats.
National Call
International Call
A Number
B Number
00 CC NSN
00 CC NSN
+CC NSN
+CC NSN
0 NSN*
0 NSN*
NSN
NSN
Extension Digits
00 CC NSN
+CC NSN
*In countries where national dialling prefix 0 is used
Note: Short-code emergency and special numbers should not be prefixed by a national dialling
prefix or country code
4.1.2 Incoming Calls (Colt  Customer)
For incoming calls, the A and B number can be sent in the following formats (configurable)
Defaults are highlighted
National Call
International Call
A Number
B Number
0 NSN
00 CC NSN
+CC NSN
+CC NSN
00 CC NSN
+CC NSN
0 NSN
NSN
Extension Digits
4.2
SIP URI Format
Both sip: and tel: (RFC2806) URI formats are supported.
For sip URI formats, the user part must be a valid telephone number in one of the formats
described above OR ‘anonymous’. The user=phone parameter may or may not be included. The
host part can be an IP address (of the SBC) or a domain name.
4.3
CLI Features
4.3.1 CLIP Screening and CLIR per Call (Default Setting)
This is the default CLI setting on VoIP Access trunks. The CLI from the ingress SIP call leg is
normalised and screened to ensure it belongs to a number range allocated to the trunk. If
screening fails then the customer Default Number is sent in the Calling Party Number (CgPN) on
the egress leg. CLI restriction (CLIR) can be set per call using SIP privacy extensions, by inserting
an anonymous From header, or by using a dialling prefix.
SIP Header Usage
Page 7 of 44
VoIP Access External Technical Guide
For CLIP Screening, The CLI is taken from the following SIP headers in order of precedence:
1. P-Asserted-Identity (PAI)
2. P-Preferred-Identity (PPI)
3. Remote-Party-Id (RPI)
4. From
Example SIP INVITE including From and P-Asserted-Id
In this example the CgPN is taken from the P-Asserted-Identity header
INVITE sip:00442033535324@10.9.0.36:5060 SIP/2.0
Via: SIP/2.0/UDP 10.91.115.42:5065;branch=z9hG4bK-9796-1-0
From: <sip:+4979667740172@10.91.115.42;user=phone>;tag=9796SIPpTag001
To: Pstn <sip:00442033535324@10.9.0.36:5060>
Call-ID: 1-9796@10.91.115.42
CSeq: 1 INVITE
Contact: sip:+4979667740172@10.91.115.42:5065
P-Asserted-Identity: <sip:+496910001142@10.91.115.42;user=phone>
Max-Forwards: 70
Subject: P Asserted Id Test
Content-Type: application/sdp
Content-Length:
135
CLIR per call
CLIR per call can be signalled as follows
1. Using a dialling prefix: 141 (UK, Ireland) or 067 (Spain)
2. By inserting P-Asserted-Identity header and Privacy: Id header (RFC3323/3325)
3. By inserting an Anonymous From header e.g. sip:anonymous@anonymous.invalid
1
(RFC3323)
The above results the CgPN being set to “presentation restricted” on the egress leg
Call Forwarding
If a call is forwarded by the customer, the Redirecting Number (RDN) should be populated in the
Diversion Header (RFC5806). If present, this header is used for screening and allows the original
calling party number (Colt or Other CLI) to be sent to the far end.
The Redirecting Number can be sent in international (+CC NSN or 00CC NSN), national (NSN with
or without national dialling prefix) format.
Example SIP INVITE including Diversion header
INVITE sip:00442033535324@10.9.0.36:5060 SIP/2.0
Via: SIP/2.0/UDP 10.91.115.42:5065;branch=z9hG4bK-9817-1-0
From: <sip: +496910001142@10.91.115.42;user=phone>;tag=9817SIPpTag001
To: Pstn <sip:00442033535324@10.9.0.36:5060>
Call-ID: 1-9817@10.91.115.42
CSeq: 1 INVITE
Contact: sip:+4979667740172@10.91.115.42:5065
1
The user part of the From URI can also be ‘Unknown’ or ‘Restricted’ or ‘Unavailable’ (First letter lower case
also supported)
Page 8 of 44
VoIP Access External Technical Guide
P-Asserted-Identity: <sip:+496910001142@10.91.115.42;user=phone>
Diversion: <sip:+496910001150@10.91.115.42>
Max-Forwards: 70
Subject: P Asserted Id Test
Content-Type: application/sdp
Content-Length:
135
Special Cases
Some types of equipment make use of Referred-by or History-Info headers to capture the
redirecting number information. These types of header are currently not supported but can be
accommodated on request by applying SIP Message Manipulation rules that copy the content of
these headers to the Diversion header.
4.3.2 CLIR Permanent
A trunk can be configured to permanently mark the Calling Party Number as restricted. By default,
the redirecting number or generic number (if present) are not marked as restricted.
4.3.3 CLIP No Screening
Calling Line Identification No Screening (CLIPNOSCN) allows an additional CLI to be sent for
display purposes. The customer sends the display CLI in the SIP From header and the COLT CLI
(used for screening, CDRs, emergency calls) in SIP P-Asserted-Identity header. If the customer
is not able to send a P-Asserted-Id header, the display CLI can still be sent in the From header but
the Calling Party Number (Network CLI) will be set to the customer default number.
The display CLI can be sent in international (+CC NSN or 00CC NSN) or national (NSN with or
without national dialling prefix) format only.
Note: This feature does not guarantee that the display CLI is presented to the called party. Support
may vary depending on the country and the other network operators used to route the call.
4.3.4 Presentation Number
Presentation Number allows an alternative CLI that has been pre-authorised by Colt to be sent for
display purposes.
The Presentation Number can be sent in international (+CC NSN or 00CC NSN), national (NSN
with or without national dialling prefix) format.
Note: This feature does not guarantee that the display CLI is presented to the called party. Support
may vary depending on the country and the operators involved.
4.3.5 Multi-site Configurations
Multi-site configurations are those with two or more DDI ranges (usually with different LACs)
configured on the same trunk. It is assumed that each DDI range associated with a different
customer site or location.
Multisite configurations involve 2 stages of CLI screening i) check CLI belongs to valid site ii) check
CLI is valid for given site. This applies to the standard CLIP Screening feature and also applies to
calls which include a Redirecting Number. The CLIP No screening feature is also supported for
multisite on the condition that the customer is able to send the display CLI and Colt CLI in the From
and PAI headers respectively. Presentation Number is also supported without any restrictions
Page 9 of 44
VoIP Access External Technical Guide
In order to support emergency call handling, the customer is required to send a valid Colt CLI so
that the site that originated the call can be identified. To enforce this requirement, if Colt receives a
call with an invalid CLI, the call will be blocked.
The CLI can be sent in international (+CC NSN or 00CC NSN), national (NSN with or without
national dialling prefix) format only.
4.4
DNs resolution Support
In general, sending or receiving Fully Qualified Domain Names (FQDN) in SIP messages is not
supported - FQDNs will not be resolved to an IP address or vice versa. The host portion of SIP
URIs contained in SIP headers used for routing of SIP messages (e.g. Request-URI , Contact,
Record-Route, Via, and Route headers) MUST contain numeric IPv4 addresses. FQDNs in other
URIs of a SIP message will be ignored.
DNS support for resolving FQDNs based on RFC 3263 (Locating SIP Servers) may be possible as
part of a bespoke design
4.5
Emergency Call handling
Emergency calls should be sent using the national short code format e.g. 112, 999 and should not
be prefixed by a national dialling prefix or country code
For multi-site configurations, the customer is required to send a valid Colt CLI so that the site that
originated the call can be identified and the call routed correctly. If the CLI is invalid the call may be
blocked or routed incorrectly
Page 10 of 44
VoIP Access External Technical Guide
5. Signalling
5.1
SIP Protocol Support
5.1.1 Standard Compliance
The VoIP Access service is complaint with the following standards for basic SIP interoperability:
RFCs
RFC 3261
SIP
RFC 3264
Offer/Answer
RFC 3311
UPDATE
RFC 3262
100rel / PRACK (configurable per trunk)
RFC 4028
SIP Session Timers (configurable per trunk, INVITE or UPDATE method)
RFC 3323/3325
SIP Privacy extensions (Privacy/P-Asserted-Id)
RFC 5806
Diversion Header
RFC 4244
History-Info*
RFC 3515
SIP REFER*
RFC 3892
Referred-By Header*
RFC 3326
SIP Reason Header
*Restrictions apply
Other Specifications
SIP-ISUP interworking according to ITU-T Q.1912.5 and RFC 3398
SIP Connect 1.0 – Compliant
SIP Connect 1.1 – Partially Complaint

Registration mode is not supported

TLS is optional (not mandatory)

The following RFCs are not supported by Sonus: RFC 4967 (Dialstring URI parameter), RFC
5031 (Emergency services URN), RFC 5280 (X.509 PKI CRLs), RFC6140 ("Registration for
Multiple Phone Numbers), RFC5876(Updates to Asserted Identity in the SIP protocol),
RFC4566 (RFC2327 SDP is supported)
Table 1. Supported SIP Methods
Method
Supported?
INVITE
Y
ACK
Y
BYE
Y
CANCEL
Y
UPDATE
Y
PRACK
Y
OPTIONS
Y
REGISTER
N
Page 11 of 44
VoIP Access External Technical Guide
SUBSCRIBE
Y*
NOTIFY
Y*
INFO
Y*
REFER
Y*
*Supported but normally not used and not used as part of standard product feature set
5.1.2 Transport Types
The following SIP transport types are supported:
SIP-TCP (Port 5060)
SIP-UDP (Port 5060)
SIP-TLS (Port 5061)
The TCP/UDP port is fixed on the SBC but can be customised for requests sent towards the
customer
The maximum SIP PDU size is 5000bytes
5.1.3 SIP Trunking Modes
VoIP Access supports Static Mode SIP trunking whereby a SIP trunk is established between a
fixed source and destination IP address on the Colt SBC and Customer IP-PBX.
Registration Mode, where the IP-PBX registers to the network and does not require fixed source
IP address, is currently not supported.
5.1.4 SIP Timers
SIP Timers protocol retransmission timers are set to the default values recommended in RFC3261
– T1=500ms, T2=4000ms.
The INVITE retransmission, Timer B, applicable for SIP-UDP, is set to T1*64 by default. For
resilient services it is reduced to T1*3=1.5s (1 retransmission)
An answer supervision timer is set to 300s on Colt gateways (timeout for interval between first 18x
and the call being answered). Note that it is possible that calls may be released earlier by an
answer timeout elsewhere in the network
The Long Duration Call timer is set to 2880mins (48hrs)
5.1.5 Session Timers
By default SIP Session Timers (RFC4028) are supported using the Re-INVITE method and
Session-Expires 1800s (30mins) and MinSE=90s. If the session refresh causes issues e.g. call
dropped or muted it can be disabled on request. Note that the IP-PBX does not need to support
Session Timers (Colt SBC will act as Refresher in this scenario).
5.1.6 SIP Release to Cause Code Mappings
The table below describes the default mappings (based on RFC3398) between ISUP release
cause and SIP error response message sent to and from the customer IP-PBX
In some cases a (country specific) announcement is played before a SIP release is sent
Page 12 of 44
VoIP Access External Technical Guide
If a call is released due to a script e.g. call barring the release cause is determined by the script
and mapping to SIP release will be as per table below.
Table 2. ISUP CPC-to-SIP mapping
ISUP
Definition
SIP Announcement
1 Unallocated Number
404
yes
2 No Route to Specified Network
404
3 No Route to Destination
404
yes
4 Send Special Info Tone
500
16 Normal Call Clearing
480
17 User Busy
486
18 No User Responding
408
19 No Answer From User
480
20 Subscriber Absent
480
21 Call Rejected
403
22 Number Changed
410
27 Destination Out of Order
502
yes
28 Address Incomplete
484
yes
29 Facility Rejected
501
31 Normal Unspecified
480
34 No Circuit Available
503
yes
38 Network Out Of Order
503
yes
41 Temporary Failure
503
42 Switching Equipment Congestion
503
yes
47 Resources Unavailable Unspecified
503
55 Incoming Call Barred
403
57 Bearer Capability Not Authorised
403
58 Bearer Capability Presently Not Available 503
65 Bearer Capability Not Implemented
488
87 Not Member of CUG
503
88 Incompatible Destination
503
yes
102 Recovery On Timer Expiry
504
110 Unrecognised Parameter
488
2
Table 3. SIP to ISUP CPC Mapping
SIP
400
401
402
403
404
405
406
407
408
409
410
2
3
Definition
Bad Request
Unauthorized
Payment Required
Forbidden
Not Found
Method Not Allowed
Not Acceptable
Proxy Authentication Required
Request Timeout
Conflict
Gone
ISUP
41
21
21
21
1
63
79
21
102
41
22
Crankback
yes
yes
Announcement will be followed by SIP response
Call will be re-routed to an alternate SIP trunk if available
Page 13 of 44
3
VoIP Access External Technical Guide
411
413
414
415
416
420
421
423
480
481
482
483
484
485
486
487
488
500
501
502
503
504
505
513
600
603
604
606
N/A
N/A
N/A
N/A
N/A
5.2
Length Required
Request Entity Too Large
Requested URL Too Large
Unsupported Media Type
Unsupported URI1 Scheme
Bad Extension
Extension Required
Interval Too Brief
Temporarily Not Available
Call Leg or Transaction Does Not
Exist
Loop Detected
Too Many Hops
Address Incomplete
Ambiguous
Busy Here
Request Terminated
Not Acceptable Here
Internal Server Error
Not Implemented
Bad Gateway
Service Unavailable
Server Timeout
SIP Version Not Supported
Message Too Large
Busy Everywhere
Decline
Does Not Exist Anywhere
Not Acceptable
Internal: No Route to Specified
Network
Internal: No Route to Destination
Internal: No Circuit Available
Internal: Switching Equipment
Congestion
Internal: INVITE Request timeout/IP
Addresss unreachable
127
127
127
79
127
127
127
127
18
41
25
25
28
1
17
31
31
41
79
38
41
102
127
127
17
21
1
31
2
yes
yes
yes
yes
yes
3
34
42
yes
yes
yes
151
yes
Supported Call Flows
5.2.1 Early Offer
This is the typical call flow for an outgoing call where the SDP Offer is sent in the initial INVITE
request (early offer). PRACK/100 rel is enabled by default. Depending on the terminating call leg,
there may be one or more UPDATEs sent before answer or RE-INVITE after answer to modify
media parameters
Page 14 of 44
VoIP Access External Technical Guide
Figure 2. Example Early Offer SIP INVITE (Outgoing Call)
5.2.2 Late Offer
Late Offer is where the initial INVITE request does not include an SDP offer. In this case the Colt
SBC makes the initial SDP offer in the 183 (rel) and includes the codecs configured on the trunk
The SDP answer is expected in the PRACK. In case there is no 183 rel/PRACK, the SDP Offer will
be sent in the 200OK (INVITE) and SDP answer is expected in the ACK (INVITE)
Figure 3. Example Late Offer INVITE (Outgoing Call)
5.2.3 Call Hold
Call Hold/Resume is supported using Re-INVITE with SDP a=sendonly/inactive/sendrecv as well
as the older method with SDP c=0.0.0.0
5.2.4 Call Forward
5.2.4.1
Call Forward using INVITE
In This scenario the IP-PBX initiates a second call leg by sending a new INVITE back to the SBC.
For the CLI to be handled correctly, the redirecting number (a valid number range from the
Page 15 of 44
VoIP Access External Technical Guide
customer DDI range) must be populated in the Diversion header. Both the signaling and media are
anchored at the IP-PBX
Figure 4. Example Call Forward using INVITE
5.2.4.2
Call Forward using INVITE with optimized media
nd
In this scenario, a late offer SDP exchange on the 2 call leg, is used to optimize the media path
between the 2 call legs (the source and destination of the media stream are the same physical
media interface on the SBC). Releasing the media path back to the SBC reduces bandwidth
resources. The signaling remains anchored at the IP-PBX
Figure 5. Example Call Forward using INVITE with Optimized Media
5.2.4.3
Call Forward using SIP Re-direct
Call forward based on a SIP 3xx Redirection Response is not supported.
Page 16 of 44
VoIP Access External Technical Guide
5.2.5 Call Transfer
The SIP REFER (RFC3515) method allows an IP-PBX to request the network to transfer a call leg
and be notified of the outcome. It is typically used for consultative or non-consultative(blind) call
transfer and allows the IP-PBX/endpoint initiating the transfer to drop-out of the call (also known as
‘Take back and Transfer’). This feature is available on request and is subject to the limitations
outlined below
Figure 6. Example SIP REFER for Non-Consultative Transfer between IP Endpoints
Since there are a lot variations in the usage of SIP REFER, it is advisable to provide a call trace to
validate the call flow and header content and ensure in can be supported properly.
Limitations

REFER target must be an IP endpoint on the same or alternate trunk. REFER to PSTN is not
supported

In general, only non-consultative(blind) transfer is supported. Consultative transfer which
relies on the Replaces header (RFC3891) is not supported.

The Referred-By header (RFC3892) is used to capture the CLI of the IP-PBX/endpoint
transferring. Since a CLI in the Referred-By header cannot be screened by Colt, the
transferred-to party will see the default CLI configured on the Colt trunk.
5.2.6 Mid Call codec renegotiation, via SIP RE-INVITE
Mid-call codec re-negotiation is supported. If the INVITE does not contain an SDP offer, then all
codecs configured on the trunk will be offered.
5.2.7 Forked Calls
The Colt network does not fork SIP request or responses
When upstream forked requests are received, the original request is processed as normal and
other requests are rejected with a 482 (Loop Detected)
When a request is forked downstream, the most recent SDP from forked provisional responses and
the SDP from the first 200 (as the final SDP) are used.
Page 17 of 44
VoIP Access External Technical Guide
6. Bearer Services
6.1
Codecs
The following audio codecs are supported for VoIP Access. Not all codecs are enabled by default.
Codec
Sample Size
Enabled by Default? Transcode Support?
1
G.729A
20ms
Y
Y
2
G.711alaw
20ms
Y
Y
3
G.726 (32Kbps)
20ms
Y
Y
4
G.722
20ms
N
Passthrough Only
5
G.722.1
20ms
N
Passthrough Only
6
G.711ulaw
20ms
N
Y
7
iLBC (15.2Kbps)*
20ms*
N
Y
*iLBC can fallback to lower bit rate 13.33Kbps/30ms depending on mode parameter in offer/answer
Silence suppression and comfort noise based on RFC3389 (for codecs that do not support
discontinuous transmission) are not enabled by default. Note that Colt gateways may insert comfort
noise towards the PSTN in case of discontinuous transmission.
Wideband codecs G.722 and G.722.1 are only supported for IP-IP calls, they cannot be transcoded
or used for PSTN breakout calls.
Video codecs are currently not supported.
RTCP
RTCP is disabled by default but can be enabled on request. RTCP-XR is not supported
6.2
Media Path
RTP ports used on the Colt SBC are dynamically allocated from UDP port range 5000 to 28998
excluding ports 5060/5061 which are reserved for signalling. This is a global setting and cannot be
adapted per trunk. There is no restriction on peer RTP port range.
The media path for IP-IP calls between trunks is always anchored at the SBC. Media bypass (also
known as media optimisation or direct media) where the media path is established directly between
customer endpoints, is not supported.
For security, by default, if the source IP address of incoming RTP packets differs from the
outbound RTP IP address (negotiated in the SDP Offer/Answer), the traffic will be discarded by the
Colt SBC (resulting in one-way audio). This feature can be disabled on request.

Media IP addresses are negotiated during call setup

On the SBC, one or more IP addresses are allocated for media. Media addresses are separate
from signalling addresses but are in the same subnet and VLAN.

On the Customer Site, media IP addresses belong to the IP-PBX and IP Phones. They do
need to be configured on the Colt trunks but must be reachable from the Colt SBCs
6.3
Transcoding
Transcoding is an optional feature and is disabled by default. It allows customers to connect
equipment that supports only a limited set of codecs. Transcoding involves translating the media
stream from one encoding format on ingress, to another encoding format on egress and vice versa.
Transcoding ensures that calls can be established even when there is no common end-to-end
codec.
Page 18 of 44
VoIP Access External Technical Guide

In general, transcoding will only be required where the customer has endpoints that do not
st
support G.711alaw (either 1 choice codec or as a fallback)

It only applies to IP-to-IP call flows (see exceptions below)

When transcoding is enabled, it is applied selectively, on a call-by-call basis.

Transcoding only occurs as a last resort when the network and endpoints cannot agree a
common codec end- to-end. Usually, this occurs regardless of codec priorities configured in the
network and on the endpoints (see exceptions below)

Transcoding consumes additional DSP resources on the SBC and is only configured when
explicitly required
Note that transcoding is enabled by default when the codec list supported on a trunk is customised
(codecs removed or added) and is done to ensure interoperability with other endpoints in the Colt
network.
Transcoding for Fax
For customers that support fax passthrough and not T.38 transcoding will not be configured since it
most cases fallback from T.38 to G.711 will work. Transcoding can be enabled manually if a fault is
raised.
Transcoding for DTMF and sample size
In some cases a mismatch of DTMF or sample size encoding may cause a less preferred codec to
be selected or a call to fail. In this case, manually configuring ‘Different DTMF Relay’ or ‘Different
Packet Size’
6.4
Fax
Group 3 Fax (V.27 ter, V.29, and V.17) is supported using the T.38 protocol. Typically, the answer
side will detect the Fax tone (2100Hz CED answer tone) and initiate a Re-INVITE for T.38. Fallback
to G.711 is also supported for endpoints that do not support T.38.
Super Group 3 (V.34) is detected as modem call and will use G.711 passthrough.
Fax ECM (Error Correction Mode) is disabled by default (requires additional DSP resources) but
can be enabled on request.
For IP-PBXs that only support G.711 Fax passthrough, fax transcoding (G.711<->T.38) can be
enabled to ensure interoperability.
6.5
Modem
Modem Passthrough (V.34) is supported with codec up-speed to G.711 using Re-INVITE. Echo
cancellers and Non-linear processing are disabled on detection of a 2100Hz phase reversing
modem tone.
6.6
DTMF
Out-of-band DTMF is supported using RFC4733 (updates RFC2833) which defines the RTP
Payload for DTMF Digits, Telephony Tones and Telephony Signals. The default payload type is
101. Use of RFC4733 avoids distortion that may be caused by compressed audio codecs and
avoids signalling path delay associated other out-of-band DTMF techniques such as SIP INFO.
6.7
Clear Channel
64k unrestricted data channel over RTP can be supported using RFC4040 (Clearmode). The
default payload type is 125
Page 19 of 44
VoIP Access External Technical Guide
Caveats

Customer endpoints need an accurate clock source to prevent bit errors.

Clear Channel does not work with applications that require channel bonding e.g. ISDN video
6.8
Call Admission Control (CAC)
Call Admission Control (CAC) defines the maximum call rate and maximum number of concurrent
calls that can be supported on a trunk.
A default call-limit of 200 concurrent calls is applied to all trunks unless otherwise specified. There
is also a default call rate limit (CRL) of 20 calls per sec applied to all trunks. Both limits can be
increased on request.
When the call limit or CRL is exceeded on a trunk, the Colt SBC returns a Q.850 release cause 34
or SIP 503 service unavailable error response. When the call limit is exceeded and resilient
trunks are available, calls may overflow onto the other trunks.
The call rate limiting uses a token bucket policer which allows the call rate to temporarily burst
above the defined limit. Only the calls that exceed the limit are dropped and there is no temporary
lockout.
6.9
Tones & Announcements
The following country-specific tones & announcements are supported

Local ring back tones played to calling party upon receipt of an alert indication without a media
stream or without an indication of in-band tones e.g. 18x with no SDP.

Tone or announcement played when a call fails - see Section 5 SIP Release to Cause Code
Mappings
6.10 Echo Cancellation
VoIP Gateways are equipped with ITU G.165 complaint echo cancellers. These are configured
globally (cannot be adjusted per trunk) with an echo tail of 128ms
Page 20 of 44
VoIP Access External Technical Guide
7. Access Technologies
7.1
Overview
The figure below describes the high level network setup and IP addressing between the Colt VoIP
POP and customer equipment.
Figure 7. VoIP Access IP Addressing
For all types of access technology, the following IP address information is required to setup a VoIP
Access SIP trunk:
IP-PBX IP Address - the host IP address that initial SIP Requests are sent to.
IP-PBX IP Range -
the host or subnet from which SIP requests/responses may originate in the
customer network (often the same as IP-PBX IP Address).
Except for NAT customers, both of these addresses must be reachable from the Colt SBC i.e.
routable over the Internet, IP-VPN, or Ethernet service
Any subnets used to terminate RTP media e.g. phones, music-on-hold server, conference servers
etc must also be reachable from the Colt SBC.
Additional IP addressing may be required depending on the access type used. These are
described below.
7.2
Internet
Colt VoIP POPs are connected to the Colt Internet backbone and allows trunks to be established
over the public Internet . A set of shared signalling and media public IP addresses are configured
on each SBC and are reachable from the Internet.
Colt SBC IP Addressing
Page 21 of 44
VoIP Access External Technical Guide
Each VoIP POP is configured with Public IPv4 subnet used for Internet connected trunks. Each
SBC is configured one or more public SIP signalling and media IP addresses which are shared by
all customers and trunks.
NAT Traversal
If the customer IP-PBX and/or IP phones are located behind NAT/NAPT devices , additional
configuration is required.
Figure 8 NAT Traversal
Static Port Mapping
The IP-PBX must be reachable via external public IP Address on TCP/UDP port 5060 (or a
different port if specified). If the IP-PBX is behind NAT, this will be the external Public IP Address of
the NAT device and static NAT ip address/ port mapping will required to forward SIP traffic to the
internal private IP address of the IP-PBX.
The static ip/port mapping must be configured on the NAT device and this could be a Colt CPE
(configured for NAT) or a customer device (router, firewall etc)
Note: dynamic ip/port mapping using SIP Registration is not supported.
In addition to the above configuration on the customer premise, the Colt SBC must also be
configured for NAT traversal
NAT Traversal for Media & Signalling
This feature ensures that the SBC can handle media and signalling to devices located behind
NAT/NAPT devices. For signalling it ensures SIP requests within a dialog are routed to the public
IP/port of the NAT device instead of the private address in Contact/Route Set. For media, it
enables media latching, whereby the SBC waits for the endpoint to send RTP in order to learn the
IP address/port to send on instead of using the information negotiated in SDP
NAT Qualification
NAT Qualification is designed to avoid scenarios where media NAT traversal results in media
deadlock (no audio in send or receive direction). For example this occurs where a call is forwarded
by the IP-PBX, back to the same Colt Trunk, and the media path is via a device is behind NAT. In
this case both media ports try to perform latching and prevent RTP being sent in either direction.
To minimise the occurrence of this scenario, the NAT Qualification Table is used to selectively
disable NAT traversal techniques for media end points that are not behind NAT but which belong to
a trunk which is configured for NAT traversal.
By the default, when NAT Traversal is enabled, the NAT Qualification table is configured with the
default RFC1918 private addresses unless otherwise specified
SIP Request URI formatting for NAT
Page 22 of 44
VoIP Access External Technical Guide
By default, when NAT Traversal is enabled, the host part of the SIP Request-URI is modified to
include the private IP address of the IP-PBX.
7.3
IP VPN
Connectivity to customers with IP VPN makes use of the MPLS enabled access switches in Colt
VoIP POPs. The Customer IP VPN is terminated on the access switch and presented on a
dedicated VLAN interface towards the SBC. A Host Equipment Subnet is configured between the
SBC and the access switch which hosts the SIP signalling and media addresses that the customer
uses to connect to the VoIP POP from their VPN.
Figure 9. VoIP POP Configuration for IP-VPN
The Host Equipment Subnet is allocated a /27 IP Address range from the customers address
space. This is typically an RFC1918 private address range that is routable from the customer a
4
5
network. The subnet should be a /27 due to a design constraint on the Colt SBC .
If multiple trunks are required on the same SBC e.g. for resiliency or multi-country support, up to
26 trunks can be setup with separate SIP signalling IP addresses on the SBC sharing the same
customer signalling IP address.
For each additional POP, or if more than 26 signalling IP addresses are required on the same
POP, a separate /27 subnet is required.
SBC Host Equipment Subnet IP Address Allocation e.g. 10.0.0.0/27
First Useable IP
SBC NEXT HOP
.1
Second Useable IP
RESERVED
.2
Third Useable IP
RESERVED
.3
Fourth Useable IP
SBC MEDIA / INTERFACE ADDRESS
.4
st
Last Non Broadcast IP N
1 SBC SIP SIGNALLING ADDRESS
.30
N-n
nth SBC SIP SIGNALLING ADDRESS (1 ≤ n ≤ 26)
.(31-n)
4
The one exception is where public IP addresses are used in which case there are no restrictions on the
subnet mask
5
The design constraint requires that all (potentially) overlapping subnets (across different customers on the
SBC) must use the same subnet mask. The subnet size has been standardised to /27 for this purpose.
Page 23 of 44
VoIP Access External Technical Guide
7.4
Ethernet
Similar to IP VPN, Ethernet connectivity is terminated on access routers in the VoIP POP and
presented on a dedicated VLAN interface towards the SBC. In this case 2 subnets are required:
Figure 10. VoIP POP Configuration for EPN
A Host Equipment Subnet is configured between the SBC and the access switch which hosts the
SIP signalling and media addresses. This subnet MUST be a /27 IP Address range from the
customers address space – the same rules as for IP-VPN apply
An Ethernet Private Network or EPN Subnet configured between the customer equipment and the
access router(s) in the VoIP POP. This subnet MUST also be from the customer address space
and must be a minimum /29 (or larger if the same EPN will connect to multiple VoIP POPs). Three
host addresses from this subnet are reserved for use on the VoIP POP Access routers
For each additional POP, or if additional signalling IP addresses are required on the same POP, a
separate /27 subnet is required. Likewise for each additional EPN e.g. if separate EPNs are used
to connect to different POPs, a separate EPN subnet is required
IP Routing
If static routing is used, any static routes required to reach the customer equipment are added to
the VoIP POP access routers. The next hop for these routes must be within the EPN subnet. The
customer is responsible to add static routes for the SBC Host Equipment Subnet with a next hop of
the virtual IP address assigned to the VoIP POP Access routers within the EPN subnet
Alternatively eBGP routing can be used. In this case eBGP peering will be between the pair VoIP
POP Access routers and the customer Layer 3 equipment. Colt will use AS number 8220 and the
customer must provide their own AS number and peer IP addresses.
Note that for security reasons and design constraints, the EPN terminates on the VoIP POP access
router(s) and not the directly on the SBC. For this reason, two separate subnets are required.
7.5
Quality of Service
The Colt VoIP network supports Diffserv QoS marking for VoIP traffic. Voice payload is marked
with DSCP 46 (EF) and signalling with DSCP 26 (AF31). This allows voice payload and signalling
traffic priority over other kinds of traffic across the Colt IP backbone and customer access circuit.
The DSCP markings correspond to the Premium and Business-1 Class of Service used with the
existing COLT IP VPN product.
Page 24 of 44
VoIP Access External Technical Guide
Table 4. DSCP Markings
Class of Service
DSCP Marking (codepoint
name)
IP VPN CoS Mapping
Premium (Voice)
46 (EF)
Premium
Business-1 (Signalling)
26 (AF31)
Business-1
Within the COLT IP network only markings from QoS enabled customers are trusted. All other
For customers with Colt managed Internet Access, end-to-end QoS is provided across the Colt IP
backbone using Diffserv markings applied by the Colt SBC and managed CPE. For Internet
customers connected outside of the Colt IP backbone (via peerings) traffic (e.g. VoIP over public
Internet) is re-marked to DSCP 0 on ingress to the COLT IP network and no QoS is provided
For IP-VPN customers QoS is applied differently depending on the whether the IP-VPN is
dedicated for voice or used for both voice and data. For a dedicated service, the bandwidth
delivered to each VPN site is dedicated to VoIP and there is no QoS applied on the access link.
QoS marking is still applied and is used prioritise traffic across the Colt IP backbone. If the IP-VPN
shared for data and voice, the bandwidth delivered to each site must be dimensioned according to
the overall voice and data traffic. Class of Service must be applied on IP VPN sites to ensure voice
traffic is prioritised and the appropriate bandwidth assigned to each QoS clas.
For Ethernet services, bandwidth is dedicated end-to-end and no QoS or CoS marking is required
Page 25 of 44
VoIP Access External Technical Guide
8. Multi-Trunk & Resilient Configurations
8.1
Trunk Topologies
The options below describe how multiple SIP trunks can be can be connected to the same VoIP
Access service e.g. for resiliency or multiple country trunks. For a given access network, the
combination of the customer IP-PBX IP and SBC IP must be unique for each trunk.
Single POP Topologies
Multiple trunks on the same POP may be used to connect equipment or sites with separate DDIs,
or for multi-country support where a separate trunk is required for each country. It may also be
used for load sharing or resilient configurations where hierarchical call admission control is
required (only supported on single SBC).
If multiple trunks are configured on the same POP and share the same access network, by default,
all trunks share the same SBC IP address. In this case a separate IP-PBX IP address is required
for each trunk. This is the default configuration for multiple trunks on same POP.
SBC IP#1
PBX IP#1
Trunk 1
VoIP POP #1
IP-PBX
Trunk N
PBX IP#N
IP-VPN, Ethernet,
Internet
Figure 11. Multiple Trunks - Single POP & Separate IP-PBX IP per Trunk
Alternatively, if a single IP-PBX IP is shared for all trunks, a separate SBC IP must be used for
each trunk as shown in the figure below. For this option This option is only supported for customers
with a IP-VPN or Ethernet connection and a maximum of 26 trunks can be configured per SBC
subnet.
SBC IP#1
PBX IP#1
Trunk 1
VoIP POP #1
IP-PBX
Trunk N
SBC IP#N
Up to 26 Trunks per
SBC Subnet
IP-VPN, Ethernet
Only
Figure 12. Multiple Trunks - Single POP & Single IP-PBX IP
Multi POP Topologies
Multi-POP topologies are typically used for trunks in a resilient configuration since they protect
against the failure of a single POP or SBC. The examples below show how groups of resilient
trunks can be built across separate POPs. These examples assume separate SBC IP address are
setup on the same POP to handle multiple trunks to the same IP-PBX IP (see above).
Page 26 of 44
VoIP Access External Technical Guide
SBC IP#1
Trunk 1-A
VoIP POP #1
Trunk N-A
PBX IP#1
SBC IP#N
Trunkgroup 1
Trunkgroup N
IP-VPN, Ethernet,
Internet
IP-PBX
SBC IP#1
Trunk 1-B
VoIP POP #2
Trunk N-B
SBC IP#N
Figure 13. Multiple Trunks - Dual POP, Single IP-PBX
SBC IP#1
PBX IP#1
Trunk 1-A
IP-PBX
VoIP POP #1
Trunk N-A
SBC IP#N
Trunkgroup 1
Trunkgroup N
IP-VPN, Ethernet,
Internet
SBC IP#1
Trunk 1-B
IP-PBX
VoIP POP #2
Trunk N-B
PBX IP#2
SBC IP#N
Figure 14. Multiple Trunks - Dual POP, Separate IP-PBX
SBC IP#1
Trunk 1A
PBX IP#1
Trunk 1B
VoIP POP #1
IP-PBX
Trunk NA
Trunk NB
SBC IP#N
Trunkgroup 1
Trunkgroup N
SBC IP#1
IP-VPN, Ethernet,
Internet
Trunk 1C
Trunk 1D
VoIP POP #2
Trunk NC
SBC IP#N
Trunk ND
IP-PBX
PBX IP#2
Figure 15. Multiple Trunks - Dual POP, Separate IP-PBX (Meshed)
Page 27 of 44
VoIP Access External Technical Guide
8.2
Trunk Resiliency
Trunk resiliency secures communication against any failure between the customer IP-PBX and Colt
SBC. Resilient trunks can also be used for load sharing across multiple SIP peers. One primary
trunk can have maximum up to 26 secondary or resilient trunks.
Any of the trunk topologies described in the previous section can be used to provide resiliency or
load sharing. For geographic redundancy, secondary trunks can be built on a separate SBC and
POP.
8.2.1 Call Routing
Outgoing Call Distribution (Customer  Colt)
For outgoing calls, resilient trunks operate in active/active configuration – calls can be sent to any
trunk. The customer decides the outgoing call distribution
Incoming Call Distribution (Colt  Customer)
For incoming calls, resilient trunks can operate as follows

Active/Standby - In this method a sequential route selection is used. Calls will first be
attempted on the primary or active trunk. In the event of primary trunk is unreachable (no
response to SIP Invite or TCP timer expiry) or the number of calls exceeds the call limit set,
calls will be attempted on the next available secondary(or standby) trunk.

Load share - In this method round-robin route selection is used routing call which results in
50:50 load-share across available trunks. Therefore it is also called as load sharing. Whenever
trunk exceeds call limit set or unreachable will be put off from selection till it restored to
normal.
8.2.2 Trunk Out of Service and Recovery Methods
Resilient trunks make use of the following failure detection and recovery mechanism
Failure Detection
st
1 Call (Failure Detected): The Colt SBC attempts call on Trunk 1. When the SIP INVITE
transaction or TCP connection timer expires the SBC attempts the call on Trunk 2. An additional
PDD is incurred. The SBC blacklists the endpoint ip address belonging to Trunk 1
Subsequent Calls: SBC attempts call on Trunk 2, no additional PDD
The following timers are configured

SIP-UDP: INVITE retry timer expires – 1.5s (1 retry)

SIP-TCP: TCP Timeout – 5 Secs
Failure detection using SIP OPTIONs ping is also possible as bespoke configuration.
Recovery Mechanism
Two types of recovery methods are supported a) timer based b) SIP OPTION ping.
When a trunk endpoint is blacklisted a recovery timer is used to determine when the endpoint can
be removed from the black list. The recovery timer is set to 180sec (3mins)
After the recovery timer expires calls are attempted again on Trunk 1.
An alternative recovery algorithm is available which uses a SIP OPTION Ping. When an endpoint is
blacklisted, the SBC sends a SIP OPTION message every 3s. As soon as the endpoint responds
with 200 OK, trunk will be put back into in-service.
Page 28 of 44
VoIP Access External Technical Guide
8.3
Call Diversion features
Inbound call re-routing (ICR) and Partial Number Replacement (PNR) are call diversion features
that allow calls to be automatically forwarded to a preselected number or number range in the
event that a trunk is down due to connectivity failure.
These features are only invoked when all trunks (primary and secondary) are down due to nonreachability. The same trunk failure detection and recovery mechanisms apply.
Page 29 of 44
VoIP Access External Technical Guide
9. Security
9.1
Encryption
For additional security, VoIP Access also supports SIP-TLS and SRTP to encrypt signalling and
media between the customer equipment and Colt SBC. The following modes of encryption are
supported:

TLS on, SRTP off – only signalling encrypted

TLS on, SRTP on – signalling and media encrypted
9.1.1 SIP-TLS
SIP-TLS is used to secure SIP signalling between the Colt SBC and the customer IP-PBX. The
implementation is based on TLSv1.0 and uses certificate-based authentication based on RSA
public/private key pairs and X.509 digital certificates.
Separate TLS (and TCP sessions) are established for incoming and outgoing directions. By default,
client authentication is enabled on the SBC, and when the SBC acts in server mode, it will send a
certificate request to the client.
The following TLS cipher suites are supported:

TLS_RSA_WITH_AES_128_CBC_SHA (Priority 1)

TLS_RSA_WITH_3DES_EDE_CBC_SHA (Priority 2)
TLS uses TCP port 5061.
9.1.2 SRTP
SRTP ( Secure Real-time Transport Protocol) / RFC 3711 is used to encrypt the RTP media
stream. The Secure Descriptions (SDES RFC4568) protocol is used to negotiate SRTP crypto keys
within the SDP Offer/Answer exchange and relies on SIP-TLS to secure the key exchange.
The following cipher suite is supported for SRTP:

AES_CM_128_HMAC_SHA1_80
9.1.3 Certificate Administration
TLS makes use certificate-based authentication based on RSA public/private key pairs and X.509
digital certificates. The TLS implementation relies on mutual authentication and requires that both
Colt and the customer equipment exchange certificates during the TLS handshake. The figure
below describes the certificates and keys that must be installed on the Colt SBC and Customer IPPBX
Page 30 of 44
VoIP Access External Technical Guide
Customer
Certificates
Colt
Certificates
Remote Certificates
Remote Certificate
Colt
Verisign
Thawte
Entrust
GTE Cybertrust
etc
*CA Root/Self-Issue
*.der format
*Colt CA Root Certificate
*.der or .pem
* Provided by Colt for
each install
Local Certificate
Local Certificate
*Issued by Colt CA
*.p12 PKCS#12 format
*Public & Private Keys
*One-time install
*Issued by CA/Colt/Self-Issue
*Public & Private Keys
*.p12 PKCS#12 format
SIP-TLS
Colt SBC
IP-PBX
SRTP
Figure 16. SIP-TLS Certificate Administration
Local (or subject) certificates are credentials belonging to the local system itself, which it may
present to peers in order to prove its identity. Each local certificate has a corresponding private
key. PKCS#12 (.p12) is the common format for importing and exporting local certificates with
private keys, which are protected with a password. Local certificates are typically obtained by
generating a Certificate Signing Request (CSR) which must then be signed by the certificate
authority.
Remote certificates are credentials belonging to Certificate Authorities e.g. Colt Internal Root CA
or Third Party CA certificates. Copies of these certificates are installed on a local system because
they are part of a chain of certificates the local system will present to peers, or because the
corresponding CAs are trust anchors for the local system. Certificates belonging to non-CA remote
systems (e.g. using self-signed certificates) may also be installed as trust anchors in this manner.
The Certificate Authority (CA) certificates and other trusted remote certificates are not distributed
with private keys and thus do not require any confidentiality protection. There is no associated
password or pass phrase. Certificates can be distributed in Base64 encoded ASCII PEM format
(.pem, .crt, .cer), PKCS#7 (.p7b), or binary DER format (.der).
Colt SBC Certificates
Two types of SBC certificate are currently in use which differ in the content of Common Name(CN)
in the Subject field

Internet Customers: CN=Public SIP Signalling IP address

VPN/Ethernet Customers: CN=SBC Hostname (not resolvable)
The Colt CA Public Root certificate (and optionally the certificate chain between the root and leaf
6
certificate on the GSX ) is distributed to the customer so that it can be installed as a Remote
certificate on the IP-PBX
Customer Certificates
There are 2 options for administering customer certificates
6
The certificate chain is sent as part of the TLS handshake and normally only the root certificate is
required to validate the peer.
Page 31 of 44
VoIP Access External Technical Guide
OPTION A - Colt issues the customer certificate (PREFERRED OPTION)
The customer must generate a Certificate Signing Request (CSR) and send to Colt. The customer
certificate is signed by the Colt Private CA. The customer must install this certificate (along with
private key generated with CSR) and the Colt CA Public Root certificate on their IP-PBX.
OPTION B – Customer own certificate
rd
In this case the customer obtains a certificates from a 3 party Certificate Authority (Verisign, Quo
Vadis etc) or creates a self-signed certificate. The customer must provide Colt the CA Public Root
corresponding to the certificate installed on their equipment.
Certificate Restrictions

On the Colt SBC the leaf of the local certificate chain is limited to 1024 key bit length (other
certificates in the local certificate chain e.g. COLT CA root can be 2048 bit). 2048bit certificates
are planned to be supported in 2H 2016.

Customer certificates can be either 1024 or 2048 bit Key length – applies to both the certificate
installed on the customer equipment and any customer public certificates that need to be
installed on the Colt SBC (in case customer is using their own CA).

Whilst Colt can support customer certificates with 2048bit keys, customers should be aware
that the TLS key exchanged may only be secured with a 1024bit key.

Note that the Colt only supports the SHA1 or MD5 message integrity cipher for SIP-TLS –
SHA2 is not supported.
Page 32 of 44
VoIP Access External Technical Guide
10. Platform Features
10.1 Resilience
Within the VoIP network all call processing and network components (SBC cards, switches,
uplinks) are fully redundant. In the event of a single failure e.g. link down, card failure, switch
failure, power failure etc – transient calls may be dropped but stable calls are preserved and there
should be no other impact on service.
Call processing servers are located are located in geographically separate locations and operate in
in an active/active configuration. SBCs and gateways failover transparently between call servers
without affecting calls.
To protect against the failure of a single POP, the trunk resiliency feature can be used (see below).
A POP will only go down in a disaster scenario (double failure, fire, earthquake etc). In this case all
calls on the failed POP will be dropped but can be re-established via the remaining POP
10.2 Security
Figure 17. Platform Security
Session Border Controllers (SBC), hosted in the Colt VoIP POPs, are used to provide border
security between customer networks and the Colt VoIP network. The SBC provides the following
functions:

Aggregates different customer networks (Internet, VPN, Ethernet) on separate 802.1q VLAN
tags that terminate on logical sub-interfaces on the SBC

Provides secure relay of SIP and RTP traffic between customer networks and the Colt VoIP
network. Non-VoIP traffic cannot traverse the SBC

Provides full Topology Hiding between customer IPv4/IPv6 address realms and the Colt VoIP
network. There is no routing between address realms

Protects against Denial of Service attacks using hardware-based policing for signalling and
media

Discards any unauthorised or malformed SIP or media traffic.

Provides other functions including Hosted NAT traversal and SIP header manipulation
In addition to the security provided by the SBC:
Page 33 of 44
VoIP Access External Technical Guide

Access Lists on MPLS PE routers provide additional security by blocking low TCP and UDP
ports (<1024) and ICMP unreachable towards the SBC

Customer premise routers deployed by Colt, do not apply any firewalling or traffic filtering for
customer traffic (including VoIP) other than to protect the device itself and Colts management
network
10.3 Voice quality (MOS)
We use MOS (Mean Opinion Score) to determine the call quality.MOS is measured between
customer CPE and our SBC and our average MOS score over VoIP Network is 4.39.
MOS is determined manly by factors like delay, packet loss and jitter. We provide near real-time
statistics to customers via an online portal. IP statistics require an IP VPN and includes packet loss,
latency, jitter, round trip delay and calculated MOS.
Page 34 of 44
VoIP Access External Technical Guide
11. Appendix A - CLI Reference
Key:
COLT CLI – CLI within valid range configured on the customer trunk
DISP CLI – non-Colt Presentation CLI within valid range configured on the customer trunk
OTHER CLI - CLI not within valid range configured on the customer trunk
DEFAULT CLI – Default CLI for the number range or trunk
INVALID – CLI is missing or has invalid syntax
Egress PSTN Leg
Calling Party Number
PAI
COLT CLI
From
Generic Number
Redirecting Number
Diversion Privacy
CgPN
SI
PI
GN
SI
PI
RDN
SI
PI
COLT CLI
COLT CLI
UPVP All.
N
OTHER CLI
COLT CLI
UPVP All.
N
OTHER CLI OTHER CLI
DEFAULT CLI
NP
All.
Y
INVALID
INVALID
DEFAULT CLI
NP
Res.
Y
ANONYMOUS
DEFAULT CLI
NP
Res.
Y
COLT CLI
ANONYMOUS
COLT CLI
UPVP Res.
N
COLT CLI
OTHER CLI
COLT CLI
UPVP Res.
N
OTHER CLI
UPVP All.
OTHER CLI OTHER CLI
Id
COLT CLI
COLT CLI
Multisite?
Ingress SIP Leg
Blocked for
Table 5. CLIP Screening and CLIR per Call – SIP-PSTN Examples
N

PAI
Egress SIP Leg
From
Privacy PAI
COLT CLI
COLT CLI
OTHER CLI
OTHER CLI OTHER CLI
INVALID
From
Diversion
Blocked for
Ingress SIP Leg
Privacy
COLT CLI
N
COLT CLI
COLT CLI
N
OTHER CLI
DEFAULT CLI
Y
INVALID
Y
ANONYMOUS
COLT CLI
ANONYMOUS
COLT CLI
OTHER CLI
OTHER CLI OTHER CLI
Multisite?
Table 6. CLIP Screening and CLIR per Call – SIP-SIP Examples
Id
COLT CLI
ANONYMOUS
Y
COLT CLI
ANONYMOUS
N
COLT CLI
ANONYMOUS
OTHER CLI
OTHER CLI
Id
N
COLT CLI
N
Egress PSTN Leg
Calling Party Number
PAI
From
COLT CLI
Generic Number
Redirecting Number
Diversion Privacy
CgPN
SI
PI
GN
SI
PI
COLT CLI
UPVP
All.
COLT CLI
NP
All.
Page 35 of 44
RDN
SI
PI
N
Multisite?
Ingress SIP Leg
Blocked for
Table 7. CLIP No Screening – SIP-PSTN Examples
VoIP Access External Technical Guide
COLT CLI
OTHER CLI
COLT CLI
UPVP
All.
COLT CLI
NP
All.
N
COLT CLI
NP
All.
Y
OTHER CLI OTHER CLI
DEFAULT CLI NP
All.
INVALID
INVALID
DEFAULT CLI NP
All.
Y
ANONYMOUS
DEFAULT CLI NP
Res.
Y
COLT CLI
UPVP
Res.
COLT CLI
UPVP
Res.
OTHER CLI NP
All.
OTHER CLI
UPVP
All.
OTHER CLI UPNV
All.
COLT CLI
ANONYMOUS
COLT CLI
OTHER CLI
OTHER CLI OTHER CLI
Id
COLT CLI
N
N
COLT CLI
N


PAI
From
Egress SIP Leg
Diversion Privacy PAI
COLT CLI
COLT CLI
OTHER CLI
OTHER CLI OTHER CLI
INVALID
From
Diversion
Privacy
COLT CLI
N
COLT CLI
OTHER CLI
N
OTHER CLI
OTHER CLI
Y
INVALID
Y
ANONYMOUS
COLT CLI
ANONYMOUS
COLT CLI
OTHER CLI
OTHER CLI OTHER CLI
Multisite?
Ingress SIP Leg
Blocked for
Table 8. CLIP No Screening – SIP-SIP Examples
Id
COLT CLI
ANONYMOUS
Y
COLT CLI
ANONYMOUS
N
COLT CLI
OTHER CLI
OTHER CLI
OTHER CLI
Id
N
COLT CLI
N
Egress PSTN Leg
Calling Party Number
PAI
From
Generic Number
Redirecting Number
Diversion Privacy
CgPN
SI
PI
COLT CLI
COLT CLI
UPVP
All.
DISP CLI
DEFAULT CLI NP
All.
COLT CLI
DISP CLI
COLT CLI
All.
DISP CLI
DISP CLI
DEFAULT CLI NP
All.
COLT CLI
OTHER CLI
COLT CLI
All.
DISP CLI
OTHER CLI
DEFAULT CLI NP
All.
OTHER CLI OTHER CLI
DEFAULT CLI NP
All.
Y
INVALID
INVALID
DEFAULT CLI NP
Res.
Y
ANONYMOUS
DEFAULT CLI NP
Res.
Y
COLT CLI
ANONYMOUS
COLT CLI
Res.
N
DISP CLI
ANONYMOUS
DEFAULT CLI NP
Res.
COLT CLI
OTHER CLI
Id
COLT CLI
Res.
DISP CLI
OTHER CLI
Id
UPVP
UPVP
UPVP
UPVP
GN
SI
PI
RDN
SI
PI
N
DISP CLI
UPVP
All
N
N
DISP CLI
UPVP
All
N
N
DISP CLI
DISP CLI
UPVP
UPVP
All
N
All
N
N
DEFAULT CLI NP
Res.
DISP CLI
UPVP
All
OTHER CLI OTHER CLI
COLT CLI
OTHER CLI
UPVP
All.
OTHER CLI UPNV
All.
OTHER CLI OTHER CLI
DISP CLI
OTHER CLI
UPVP
All.
Page 36 of 44
N
COLT CLI
N
DEFAULT
N
CLI
Multisite?
Ingress SIP Leg
Blocked for
Table 9. Presentation Number – SIP-PSTN Examples
VoIP Access External Technical Guide


Table 10. CLI for PSTN to SIP Calls - PAI/Privacy not sent (DEFAULT)
Ingress PSTN Leg
Egress SIP Leg
Calling Party Number
Generic Number
Redirecting Number
PAI
GN
SI
PI
OTHER CLI 1
*
All.
OTHER CLI 1
OTHER CLI 1
*
Res.
ANONYMOUS
OTHER CLI 1
*
All..
OTHER CLI 1
*
All.
OTHER CLI 2
SI
*
PI
RDN
SI
From
CgPN
Diversion
Privacy
PI
All.
OTHER CLI 2
OTHER CLI
2
*
OTHER CLI 1 OTHER CLI 2
All
Table 11. CLI for PSTN to SIP Calls – PAI/Privacy is sent
Ingress PSTN Leg
Egress SIP Leg
Calling Party Number
Generic Number
Redirecting Number
PAI
From
All.
OTHER CLI 1
OTHER CLI 1
*
Res.
OTHER CLI 1
ANONYMOUS
OTHER CLI 1
*
All..
OTHER CLI 1
OTHER CLI 2
OTHER CLI 1
*
All.
OTHER CLI 1
OTHER CLI 1 OTHER CLI 2
CgPN
SI
PI
OTHER CLI 1
*
OTHER CLI 1
GN
OTHER CLI 2
SI
*
PI
RDN
SI
All.
OTHER CLI
2
*
Diversion
Privacy
PI
All
Page 37 of 44
Id
VoIP Access External Technical Guide
12. Appendix B – Call Flows
12.1 Outgoing National Call
E.g. National Call: Italy VoIP  Italy PSTN
Call will stay on same SBC/MGW to optimise routing if a route is available
12.2 Outgoing International Call
E.g. International Call: VoIP Italy  PSTN UK
Call will ingress Italy SBC, traverse Colt VoIP backbone, then egress an SBC in UK or France
(50:50 call distribution) towards UK PTT according to least cost routing rules
12.3 Incoming National or International Call
E.g. National Call: PSTN Italy or RoW  VoIP Italy
Call will ingress SBC/MGW in Italy or Zurich (50:50 Call Distribution) from Italy PTT and egress
SBC in Italy
Page 38 of 44
VoIP Access External Technical Guide
Page 39 of 44
VoIP Access External Technical Guide
13. Appendix C - Example Access Topologies
13.1 Internet – Single Site – Voice & Data
PSX
IP-PBX
IP Phones
MAS1
SBC
QoS
Colt Internet
Colt CPE
MAS2
Customer Site
VoIP POP
Table 12 - Internet - Single Site - Voice & Data
•
•
•
•
•
Colt IP Access - Single Site
Single SIP trunk
Shared Voice & Data + QoS
No NAT
Phones & IP-PBX co-located
Variations
•
•
•
Voice-Only (QoS classification & marking only)
NAT (SBC performs hosted NAT traversal)
IP-PBX relays RTP
13.2 Internet – Multi-Site – Dedicated
MAS1
SBC-1
IP-PBX-1
Colt CPE
MAS2
Customer Site A
Colt Internet
PSX
VoIP POP A
MAS1
SBC-2
Internet
IP-PBX-2
NAT
Colt CPE
MAS2
Customer Site B
Endpoint 1
Endpoint 2
VoIP POP B
Table 13 - Internet - Multi-Site - Dedicated
•
•
•
rd
Multi-site – mixed Colt & 3 party Internet
Redundant SIP trunks
Mixed NAT / no NAT (Hosted NAT Traversal & NAT Qualification on SBC)
Page 40 of 44
VoIP Access External Technical Guide
•
•
Phones & IP PBX across multiple sites (e.g. Centrex Scenario)
QoS marking on managed sites (dedicated for voice)
Variations
•
•
RTP relayed via PBX on managed sites
Multiple trunks to same PBX (for multi-country or additional redundancy)
13.3 Ethernet – Single Site – Dedicated
PSX
IP-PBX
IP Phones
MAS1
SBC
MSP
MAS2
Customer Site
VoIP POP
Table 14 - Ethernet - Single Site - Dedicated
•
•
•
Colt EPN - Single Site, Dedicated
Single SIP trunk
Phones & IP-PBX co-located
Variations
•
•
•
Managed L3 CPE
IP-PBX relays RTP
Multiple Trunks to same PBX
IP Phones 1
13.4 Ethernet – Multi Site – Dedicated (simple)
IP-PBX-1
MAS1
SBC-1
MAS2
IP Phones 2
Customer Site A
IP-PBX-2
MSP
VoIP POP A
MAS1
SBC-2
MAS2
VoIP POP B
Customer Site B
Table 15 - Ethernet - Multi Site – Dedicated (simple)
•
Colt EPN - Dual Site, Dedicated
Page 41 of 44
PSX
VoIP Access External Technical Guide
•
•
2 SIP trunks – 1 per site
Phones & IP-PBX co-located
Variations
•
•
•
•
Voice & Data (separate EPNs)
Managed L3 CPE
IP-PBX relays RTP
Multiple Trunks to same PBX (multi-country)
13.5 Ethernet – Multi Site – Dedicated (complex)
IP Phones
IP-PBX-1
MAS1
SBC-1
VLAN X
MAS2
PSX
Customer Site A
VoIP POP A
MSP
MAS1
IP Phones
IP-PBX-2
SBC-2
MAS2
VoIP POP B
Customer Site B
Table 16 - Ethernet - Multi Site - Dedicated (complex)
•
•
•
Colt EPN - Dual Site, Dedicated – 2 EPN per site
4 SIP trunks – 1 per site per POP
Phones & IP-PBX co-located
Variations
•
•
•
•
Voice & Data (separate EPNs)
Managed L3 CPE
IP-PBX relays RTP
Additional trunks for Multi-country
Page 42 of 44
VoIP Access External Technical Guide
13.6 IP-VPN – Single Site - Dedicated
PSX
IP-PBX
IP Phones
MAS1
SBC
Colt IP-VPN
(IP/MPLS Network)
Colt CPE
MAS2
Customer Site
VoIP POP
Table 17 - IP-VPN - Single Site – Dedicated
•
•
•
•
Colt IP VPN - Single Site, Dedicated
Single SIP trunk
Phones & IP-PBX co-located
QoS Marking - SIP: Business-1, RTP: Premium
Variations
•
•
•
Multiple Sites
IP-PBX relays RTP
Multiple Trunks to same PBX (multi-country)
13.7 IP-VPN – Multi Site - Shared
MAS1
IP-PBX-1
SBC-1
QoS
Endpoint 1
Colt CPE
Customer Site A
Colt IP-VPN
MAS2
(IP/MPLS Network)
VoIP POP A
PSX
MAS1
IP-PBX-2
QoS
SBC-2
Endpoint 2
Colt CPE
QoS
Customer Site B
MAS2
Endpoint 3 Colt CPE
Customer Site C
Table 18 - IP-VPN - Multi Site - Shared
•
•
IP-VPN Shared for Voice & Data
Redundant Trunks to separate IP-PBXs on separate sites
Page 43 of 44
VoIP POP B
VoIP Access External Technical Guide
•
•
Endpoints distributed across multiple sites
QoS on all sites
Variations
•
•
RTP relayed via PBX on managed sites
Multiple trunks to same PBX (additional redundancy or multi-country)
Page 44 of 44