Azure Direct Routing – Unable to connect Yeastar SBC to ACS

Question

We are trying to configure Direct Routing between Azure Communication Services (ACS) and a Yeastar PBX (acting as Session Border Controller).

Current setup:

• Azure Communication Services resource created

Custom domain verified:XXXXX

Direct Routing enabled

Yeastar PBX configured as SBC

TLS 5061 configured

Public FQDN and DNS A record created

Public SSL certificate installed on Yeastar matching the FQDN

Issue:

The Yeastar SBC is not successfully connecting to Azure Direct Routing. The connection does not show as healthy, and SIP signaling does not appear to be established.

We would like clarification on:

Exact SBC requirements for Azure Direct Routing with ACS

Required certificate format and trust requirements

Whether Yeastar PBX is officially supported as SBC for ACS Direct Routing

Required TLS and SRTP configuration parameters

Required firewall ports and IP ranges to whitelist

Any additional configuration needed on the Azure side after domain verification

Our goal is to establish SIP connectivity between Yeastar and Azure ACS for routing calls to our voice application.

Please advise on required configuration steps or compatibility limitations.We are trying to configure Direct Routing between Azure Communication Services (ACS) and a Yeastar PBX (acting as Session Border Controller).

Current setup:

Azure Communication Services resource created

Custom domain verified:XXXX

Direct Routing enabled

Yeastar PBX configured as SBC

TLS 5061 configured

Public FQDN and DNS A record created

Public SSL certificate installed on Yeastar matching the FQDN

Issue:

The Yeastar SBC is not successfully connecting to Azure Direct Routing. The connection does not show as healthy, and SIP signaling does not appear to be established.

We would like clarification on:

Exact SBC requirements for Azure Direct Routing with ACS

Required certificate format and trust requirements

Whether Yeastar PBX is officially supported as SBC for ACS Direct Routing

1. Required TLS and SRTP configuration parameters

Any additional configuration needed on the Azure side after domain verification

Our goal is to establish SIP connectivity between Yeastar and Azure ACS for routing calls to our voice application.

Please advise on required configuration steps or compatibility limitations.

Answer 1

HI @Anvenssa AI

Thank you for sharing your setup details. It appears you have configured most aspects on Azure and SBC correctly.

According to Microsoft’s documentation, the main issue is SBC supportability.

Azure Communication Services (ACS) Direct Routing only supports certified Session Border Controllers (SBCs). Microsoft specifies that uncertified SBCs are not supported, so connectivity or health status cannot be guaranteed.

Currently, Yeastar PBX is not a certified SBC for ACS Direct Routing. That’s why the TLS connection isn’t healthy and SIP signaling isn’t establishing, which is consistent with Microsoft’s support guidelines.

For the official list of supported SBCs, please refer to: https://learn.microsoft.com/en-us/azure/communication-services/concepts/telephony/certified-session-border-controllers

ACS Direct Routing depends on mutual TLS with strict certificate validation, SIP OPTIONS health checks, and specific SIP/SRTP behaviors, which are only verified on certified SBCs. Microsoft does not guarantee interoperability for SBCs outside their certified list, even if basic configurations are correct. See the infrastructure requirements here: https://learn.microsoft.com/en-us/azure/communication-services/concepts/telephony/direct-routing-infrastructure

For ACS Direct Routing, Microsoft requires a publicly trusted certificate from a Microsoft‑trusted CA, the SBC FQDN matching the certificate CN or SAN, TLS signaling over TCP 5061, and a successful SIP OPTIONS exchange. More details are documented here: https://learn.microsoft.com/en-us/azure/communication-services/concepts/telephony/direct-routing-provisioning

Even with a valid certificate on Yeastar, ACS may still reject or only partially establish the connection if the SBC does not meet Microsoft’s certified requirements.

To ensure a supported and stable setup, Microsoft recommends deploying a certified SBC, reusing your ACS Direct Routing configuration, and validating TLS and SIP OPTIONS health in the Azure portal after pairing. If you continue with Yeastar, please note this is outside Microsoft support, and troubleshooting would need to be handled directly with the SBC vendor.

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you