A session border controller (SBC) is a device or software that sits at the edge of a VoIP network and controls every SIP call that crosses it. It protects the PBX or softswitch from attacks, hides the internal network, fixes NAT and interoperability problems, and can transcode audio and limit calls per second.
What is an SBC in VoIP?
An SBC is a SIP-aware firewall and gateway in one. A normal firewall only looks at IP addresses and ports; an SBC reads the SIP messages and the SDP inside them, understands each call, and can change, allow or reject it. It usually handles both signalling (SIP) and media (RTP), so it sees the whole session from setup to hang-up. SBCs exist as hardware appliances, virtual machines and cloud services, and many open-source options (such as Kamailio with RTPengine) can play the same role.
What does a session border controller do?
| Function | What it means in practice |
|---|---|
| Security | Blocks SIP scanners and floods, enforces IP access lists, rate-limits registrations and calls, helps stop toll fraud |
| Topology hiding | Rewrites headers so outside parties never see internal IP addresses or server names |
| NAT traversal | Fixes private IPs in SIP and SDP, which avoids one-way audio |
| SIP normalisation | Adjusts headers and number formats so two systems from different vendors can talk |
| Media handling | Relays RTP, can transcode between codecs (see G.711 vs G.729) and convert DTMF modes |
| Admission control | Limits concurrent calls and CPS per trunk or customer |
| Encryption | Terminates TLS for signalling and SRTP for audio |
| Routing and failover | Sends calls to the right trunk and switches to a backup when one fails |
Do you need an SBC for a SIP trunk?
Not always, but it is strongly recommended once your PBX connects to the internet. A small office with a hosted PBX does not need one. A business running its own PBX on a public IP is exposed to constant SIP scanning, and an SBC or at least a SIP-aware firewall with strict IP rules is the standard protection. Some platforms require one: Microsoft Teams Direct Routing, for example, only works through a certified SBC. Carriers and call centers with many trunks almost always use SBCs at their edge. For how trunks work, see what is SIP trunking.
SBC vs softswitch: what is the difference?
A softswitch decides where calls go and what they cost: routing tables, rate decks, least cost routing, billing and CDRs. An SBC decides whether a call may enter or leave and in what form: security, normalisation and media. In a wholesale network the SBC is the door and the softswitch is the brain. Many products combine both, especially in smaller deployments. The classes of softswitch are explained in Class 4 vs Class 5 softswitch, and routing logic in least cost routing.
SIP trunk vs SBC
These are not alternatives. The SIP trunk is the service from the provider: a connection that carries your calls. The SBC is equipment on your side (or the provider's side) that terminates that connection safely. A typical setup is PBX, then SBC, then SIP trunk to the carrier. If you interconnect with several carriers, the SBC holds one trunk per carrier and applies the IP rules, codecs and number formats each one expects (see SIP peering and interconnects).
What should you look for in an SBC?
- Capacity: concurrent sessions, CPS and transcoding sessions, which are often licensed separately.
- Interoperability: tested with your PBX and your carriers, and certified where a platform demands it.
- Security features: access lists, rate limiting, automatic blocking of scanners, TLS and SRTP.
- High availability: an active and standby pair, so one failure does not stop all calls.
- Visibility: SIP traces and call statistics, so you can diagnose SIP error codes quickly.
Connecting your SBC to wholesale routes
Once your edge is secured, you can connect trunks from several carriers and route each destination to the best one. VoIPMatcher sources VoIP termination routes from its carriers and manages them for you, with IP authentication toward your SBC. Request a VoIP route.
Frequently asked questions
Is an SBC a firewall?
Partly. An SBC does firewall work for voice, such as blocking unknown IPs and rate-limiting attacks, but it also understands SIP and RTP, so it can rewrite messages, fix NAT, transcode audio and enforce call limits. A normal firewall cannot do that, and SIP ALG features in routers often break calls instead of helping.
Does 3CX need an SBC?
Not for a typical setup. 3CX connects directly to supported SIP trunk providers, and its own documentation describes when its SBC component is useful, mainly for connecting phones at remote sites through one point. For larger or exposed deployments, a separate SBC or a strict firewall policy in front of the PBX adds protection.
What is the difference between an SBC and a SIP proxy?
A SIP proxy forwards signalling and usually leaves the audio path alone. An SBC is a back-to-back user agent: it ends one call leg and starts a new one, so it can change any header, hide the network, relay and transcode media and enforce policies. A proxy is lighter, an SBC gives far more control.
Can an SBC run in the cloud?
Yes. Most vendors offer virtual SBCs for public clouds and private virtualisation, and some providers sell SBC as a service. A cloud SBC is common in front of hosted PBXs, contact center platforms and Teams Direct Routing. Size the virtual machine for your peak sessions, and for transcoding if you need it.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.