Skip to main content
Customers with an enterprise or paid support plan can contact support@retellai.com for step-by-step guidance to connect with your Avaya infrastructure.

​
Overview

This guide covers connecting Avaya Aura to Retell using Avaya Session Border Controller for Enterprise (SBCE) as the SIP border element between Retell and the Avaya core (Session Manager and Communication Manager). Architecture: 
Retell ↔ Avaya SBCE (A-side) ↔ Avaya SBCE (B-side) ↔ Session Manager ↔ Communication Manager
The SBCE handles topology hiding, codec interworking, and security policy between the external Retell SIP trunk and your internal Aura infrastructure. All configuration flows through System Manager (the central management UI for Aura). Retell SIP details:
  • SIP server URI: sip.retellai.com
  • IP ranges: 18.98.16.120/30 (all regions), 143.223.88.0/21 (certain US traffic), 161.115.160.0/19 (certain US traffic)
  • Recommended transport: TCP (also supports UDP and TLS/SRTP)
  • Supported audio codecs: PCMU (G.711 µ-law), PCMA (G.711 A-law), G.722
Official Avaya documentation references:
1

Firewall Considerations

The SBCE has two network interfaces:
  • A-side (external / untrusted) — faces the internet / Retell.
  • B-side (internal / trusted) — faces Session Manager and Communication Manager.
Apply the following rules on your perimeter firewall and on the SBCE’s built-in packet filter.Allow inbound to SBCE A-side from Retell IP ranges:
CIDR BlockCoverage
18.98.16.120/30All regions
143.223.88.0/21Certain US traffic
161.115.160.0/19Certain US traffic
Ports to open on the SBCE A-side (from/to Retell):
ProtocolPortPurpose
TCP / UDP5060SIP signaling
TCP5061SIP over TLS (if using TLS transport)
UDP1024–65535RTP / SRTP media (configurable on SBCE)
Ports to open on the SBCE B-side (toward Session Manager):
ProtocolPortPurpose
TCP / UDP5060SIP signaling to Session Manager
TCP5061SIP/TLS to Session Manager (if TLS internally)
UDP1024–65535RTP media toward Communication Manager
The SBCE’s media port range is configurable under SBCE > Global Profiles > Media Interface. Match your firewall rules to whatever range you configure there.
2

Enable SIP Trunking on the Avaya System

Before creating the trunk, verify SIP trunking is enabled across the Aura stack.On Communication Manager (via System Manager):
  1. Log in to Avaya System Manager (https://<smgr-ip>/SMGR).
  2. Navigate to Elements > Communication Manager > select your CM instance > System Parameters > Customer Options.
  3. Confirm SIP Trunking is set to y (enabled). If not, contact your Avaya partner to activate the license.
  4. Confirm Maximum Administered SIP Trunks is set high enough to accommodate expected concurrent calls.
On Session Manager:
  1. In System Manager, go to Elements > Session Manager > System Status > Security Module Status.
  2. Verify the Session Manager instance shows Registered and the SIP signaling service is active.
3

Configure the SBCE — Server Interworking and Interfaces

All SBCE configuration is done through the Avaya SBCE EMS (Element Management System) web UI (https://<sbce-ip>/). Refer to Administering Avaya SBCE for full field-level reference.1. Create a Server Interworking Profile for RetellThe Server Interworking Profile defines how the SBCE adapts SIP behavior for Retell.
  1. In the SBCE EMS, go to Configuration Profiles > Server Interworking.
  2. Click Add and name the profile Retell-Interworking.
  3. Configure the following:
    • Hold Support: RFC 3264
    • REFER Support: Enable if you plan to use call transfer.
    • Delayed SDP Offer: No
    • T.38 Support: No (unless fax is required)
    • Record Route: Yes
    • Topology Hiding: Yes — prevents internal IP addresses from leaking to Retell.
  4. Leave remaining fields at defaults and click Finish.
2. Create a Signaling Interface (A-side — facing Retell)
  1. Go to Network & Flows > Network Configuration > Signaling Interface.
  2. Click Add and configure:
    • Name: Retell-Sig
    • IP Address: The SBCE A-side IP (the public or DMZ IP facing Retell).
    • UDP Port: 5060
    • TCP Port: 5060
    • TLS Port: 5061 (configure if using TLS — see TLS step below)
  3. Save.
3. Create a Media Interface (A-side — facing Retell)
  1. Go to Network & Flows > Network Configuration > Media Interface.
  2. Click Add and configure:
    • Name: Retell-Media
    • IP Address: The SBCE A-side IP.
    • Port Range: e.g., 35000–40000 (adjust to match your firewall rules).
  3. Save.
4

Configure the SIP Trunk on SBCE — Server Configuration and Routing

1. Create a Server Configuration for RetellThe Server Configuration represents Retell as an external SIP endpoint from the SBCE’s perspective.
  1. In the SBCE EMS, go to Configuration Profiles > Server Configuration.
  2. Click Add and name it Retell-Server.
  3. Under the General tab:
    • Server Type: Trunk Server
    • IP Address / FQDN: sip.retellai.com
    • Port: 5060 (or 5061 for TLS)
    • Transport: TCP (recommended) or TLS
    • SIP Domain: sip.retellai.com
  4. Under the Authentication tab: leave blank unless Retell requires credentials (not required by default).
  5. Under the Heartbeat tab: optionally enable SIP OPTIONS ping to monitor trunk health.
  6. Click Finish.
2. Create an End Point Policy Group for RetellThe End Point Policy Group bundles security, media, and signaling policies applied to traffic from/to Retell.
  1. Go to Configuration Profiles > End-Point Policy Groups.
  2. Click Add and name it Retell-Policy.
  3. Assign:
    • Application Rule: default or create one that permits INVITE, BYE, OPTIONS, REFER, NOTIFY.
    • Border Rule: default.
    • Media Rule: select a rule that allows Retell’s supported codecs: PCMU, PCMA, and G.722. Create a new Media Rule under Configuration Profiles > Media Rules if needed.
    • Security Rule: default (or a TLS/SRTP-enforcing rule if using encrypted transport — see TLS step).
    • Signaling Rule: default.
    • Time of Day Rule: default.
  4. Save.
3. Create a Routing Profile toward Retell (outbound from SBCE to Retell)
  1. Go to Configuration Profiles > Routing.
  2. Click Add and name it Route-to-Retell.
  3. Set:
    • SIP Server: Retell-Server (created above).
    • Next Hop IP: sip.retellai.com
    • Transport: TCP (or TLS).
    • Port: 5060 (or 5061).
  4. Save.
4. Create a Routing Profile toward Session Manager (inbound from Retell)
  1. Click Add again and name it Route-to-SessionManager.
  2. Set:
    • Next Hop IP: Session Manager’s IP address.
    • Transport: TCP (or TLS, matching your internal SM configuration).
    • Port: 5060.
  3. Save.
5. Create Server FlowsServer Flows tie the signaling interface, media interface, routing profile, and policy group together for each direction.Go to Network & Flows > End-Point Flows > Server Flows.Flow 1 — Inbound from Retell to Avaya:
FieldValue
NameRetell-Inbound
Server ConfigurationRetell-Server
Received InterfaceRetell-Sig (A-side)
Signaling InterfaceB-side signaling interface (toward SM)
Media InterfaceRetell-Media (A-side)
End-Point Policy GroupRetell-Policy
Routing ProfileRoute-to-SessionManager
Interworking ProfileRetell-Interworking
Flow 2 — Outbound from Avaya to Retell:
FieldValue
NameRetell-Outbound
Server ConfigurationSession Manager server config
Received InterfaceB-side signaling interface (from SM)
Signaling InterfaceRetell-Sig (A-side)
Media InterfaceRetell-Media (A-side)
End-Point Policy GroupRetell-Policy
Routing ProfileRoute-to-Retell
Interworking ProfileRetell-Interworking
5

Configure Session Manager — SIP Entities and Routing

Session Manager configuration is done through System Manager (https://<smgr-ip>/SMGR). Navigate to Elements > Routing.1. Add a SIP Entity for the SBCE (if not already present)
  1. Go to SIP Entities > New.
  2. Configure:
    • Name: SBCE-Retell-Trunk
    • FQDN or IP: SBCE B-side IP address.
    • Type: SIP Trunk
    • Adaptation: leave blank unless header manipulation is needed.
    • Location: select your site location.
  3. Under Port, add:
    • Port: 5060, Protocol: TCP
  4. Save.
2. Add an Entity Link between Session Manager and the SBCE
  1. Go to Entity Links > New.
  2. Configure:
    • Name: SM-to-SBCE-Retell
    • SIP Entity 1: your Session Manager instance.
    • Protocol: TCP (or TLS).
    • Port: 5060.
    • SIP Entity 2: SBCE-Retell-Trunk.
    • Connection Policy: Trusted.
  3. Save.
3. Create a Routing Policy for Retell
  1. Go to Routing Policies > New.
  2. Configure:
    • Name: Route-via-Retell
    • SIP Entity: SBCE-Retell-Trunk.
    • Retries: 1.
  3. Save.
4. Configure Dial Patterns (Incoming Call Route)Dial patterns map DIDs arriving from Retell to the correct destination within Aura (e.g., a Communication Manager trunk group or a SIP entity).
  1. Go to Dial Patterns > New.
  2. Configure:
    • Pattern: your DID or DID range (e.g., +1212555 prefix or full E.164 +12125551234).
    • Min / Max: set to match the digit length.
    • SIP Domain: your internal SIP domain.
    • Routing Policy: Route-via-Retell (for outbound to Retell) or a policy pointing to Communication Manager (for inbound).
  3. Save and Commit the routing configuration.
6

Configure Communication Manager — Trunk Group and Incoming Route

Communication Manager configuration is accessed through System Manager > Elements > Communication Manager > Launch Element Manager, or directly via SAT terminal.1. Create a SIP Signaling Group
  1. In CM Element Manager, go to Telephony > Trunks > Signaling Groups > Add.
  2. Configure:
    • Group Type: sip
    • Transport Method: tcp (or tls)
    • Near-end Node Name: the CM node name for your processor interface.
    • Near-end Listen Port: 5060
    • Far-end Node Name: the node name for Session Manager (defined under IP Node Names).
    • Far-end Listen Port: 5060
    • Far-end Network Region: assign to the network region used for Retell traffic.
    • Direct IP-IP Audio Connections: y (enables media hairpinning bypass where possible).
    • DTMF over IP: rtp-payload (RFC 2833 — compatible with Retell).
  3. Save.
2. Create a Trunk Group
  1. Go to Telephony > Trunks > Trunk Groups > Add.
  2. Configure:
    • Group Type: sip
    • Group Name: Retell-Trunk
    • COR: assign an appropriate Class of Restriction.
    • Signaling Group: the signaling group number from the previous step.
    • Number of Members: set to your expected max concurrent calls.
  3. Under the Trunk Parameters tab:
    • Codecs: ensure PCMU/PCMA is included (CM negotiates via SDP with Session Manager).
    • Incoming Destination: leave blank or set to a default VDN/extension.
  4. Save.
3. Configure Incoming Call Handling (Incoming Call Route)Map inbound DIDs to extensions, VDNs, or hunt groups in CM.
  1. Go to Telephony > Trunks > Trunk Groups > select your trunk group > Incoming Call Handling.
  2. Add entries mapping your DID numbers:
    • Trunk Group: your Retell trunk group number.
    • Incoming Destination: the VDN, extension, or hunt group to ring.
    • Delete Digits / Insert: modify dialed digits if your routing requires digit translation.
  3. Save.
4. Configure Outbound Routing (AAR / ARS)To route outbound calls from CM agents through the Retell trunk:
  1. Go to Routing > AAR Analysis (for internal routing) or ARS Analysis (for PSTN routing).
  2. Add a route pattern:
    • Route Pattern: assign a route pattern number.
    • Grp No: your Retell trunk group number.
    • FRL: set the Facility Restriction Level.
    • Numbering Format: public (E.164).
  3. Update your Dial Plan and ARS Digit Analysis to steer calls to this route pattern.
  4. Save.
7

TLS and SRTP with Retell

Use TLS and SRTP when end-to-end signaling and media encryption is required between Retell and the Avaya SBCE.How it works:
  • TLS encrypts the SIP signaling between Retell and the SBCE A-side.
  • SRTP encrypts the RTP media. Retell requires TLS transport to enable SRTP.
  • The SBCE terminates TLS on the A-side and can re-encrypt or pass media unencrypted on the B-side (toward Session Manager), depending on your internal security policy.
Retell SIP URI for TLS:
sip:sip.retellai.com;transport=tls
Use this URI when configuring the Server Configuration on SBCE (port 5061) and when importing the number into Retell.SBCE TLS configuration:
  1. In the SBCE EMS, go to TLS Management > Certificates.
  2. Import the Retell Root CA and intermediate CA so the SBCE trusts Retell’s certificate during TLS handshake:
  3. In Signaling Interface (Retell-Sig), ensure TLS Port 5061 is configured.
  4. In Server Configuration (Retell-Server), set Transport to TLS and Port to 5061.
  5. Under Security Rules (used in the End Point Policy Group), create or select a rule that enforces:
    • TLS: enabled.
    • SRTP: enabled.
    • SRTP Cipher: AES_CM_128_HMAC_SHA1_80 (recommended and compatible with Retell).
Session Manager TLS (internal leg):If you also want TLS between the SBCE B-side and Session Manager, update the Entity Link to use TLS on port 5061 and ensure the Session Manager identity certificate is trusted by the SBCE.Firewall additions for TLS/SRTP:
ProtocolPortPurpose
TCP5061SIP/TLS between Retell and SBCE A-side
UDP1024–65535SRTP media (same port range as RTP)
8

Save and Commit Configuration

Changes across the Aura stack must be saved and committed before they take effect.SBCE:
  • Most changes in the SBCE EMS take effect immediately on save, but verify under Monitoring > Server Status that the SBCE service is active and no alarms are raised.
Session Manager / System Manager:
  1. In System Manager, after saving routing changes (SIP Entities, Entity Links, Dial Patterns, Routing Policies), click Commit in the top-right of the Routing module.
  2. Confirm the commit succeeds and Session Manager shows the updated routing in Elements > Session Manager > System Status.
Communication Manager:
  1. If using SAT terminal: type save translation to persist changes.
  2. If using CM Element Manager: changes are saved per screen — verify all trunk group and signaling group entries show the expected values.
  3. For busy production systems, schedule a maintenance window before committing trunk group changes.
9

Import the Number into Retell

After the Avaya side is configured, import the phone number into Retell so Retell knows which trunk to use for outbound calls and which agent to assign for inbound.
  1. In the Retell dashboard, go to Phone Numbers > Import Number.
  2. Fill in:
    • Phone Number: E.164 format (e.g., +12137771234).
    • Termination SIP URI: The SBCE A-side IP or FQDN with port (e.g., <sbce-public-ip>:5060 or <sbce-fqdn>:5060). For TLS: <sbce-fqdn>:5061 and ensure you use sip:...;transport=tls.
    • SIP Username / Password: Only required if you enabled inbound digest authentication on the SBCE End Point Policy Group.
  3. Save the number and assign a Retell agent to it.
You can also import numbers programmatically via the Import Number API.Once imported, the number works for both inbound and outbound calls — see Make Outbound Calls and Receive Inbound Calls.
10

Test the SIP Trunk

Inbound test (external call → Avaya DID → Retell agent):
  1. Call the DID from an external phone.
  2. Verify the call traverses: PSTN → CM → SM → SBCE → Retell.
  3. Confirm the call appears in Retell’s Calls dashboard and the correct agent handles it.
  4. Verify bidirectional audio and clean call termination.
Outbound test (Retell → SBCE → CM → PSTN):
  1. Place an outbound call via the Retell dashboard or Create Phone Call API using the imported number.
  2. Confirm the receiving party sees the correct caller ID (E.164 format).
  3. Verify audio quality in both directions.
SIP OPTIONS ping test: If you enabled heartbeat/OPTIONS on the SBCE Server Configuration, check SBCE EMS > Monitoring > Server Status to confirm the trunk shows as Active based on OPTIONS responses from sip.retellai.com.
11

Debug Call Issues

1. SBCE Trace (SIP and Media)The SBCE provides packet-level and SIP-level traces via the EMS.
  • Go to Monitoring > Incidents for active alarms and recent error events.
  • Go to Monitoring > Tracing > Packet Capture to capture SIP and RTP packets on the A-side interface during a test call.
  • Go to Monitoring > Tracing > Call Trace (if available on your SBCE release) to see SIP message flow per call.
Look for:
  • 403 Forbidden → Retell IP not in SBCE’s trusted source list. Check End-Point Policy Group and Server Flow source matching.
  • 480 Temporarily Unavailable / 503 → SBCE cannot reach sip.retellai.com. Verify DNS resolution and firewall on port 5060/5061.
  • 488 Not Acceptable Here → Codec mismatch in SDP. Ensure PCMU or PCMA is in the SBCE Media Rule.
  • No audio / one-way audio → RTP being blocked. Check SBCE media port range firewall rules and verify SDP c= lines in the trace show the correct SBCE A-side IP (topology hiding should replace internal IPs).
2. Session Manager LogsIn System Manager, go to Elements > Session Manager > System Status > Call Routing Test to simulate a call and verify dial pattern matching.Check SM logs under Elements > Session Manager > System Logs for SIP routing rejections or entity link failures.3. Communication ManagerOn CM, use the SAT commands:
  • list trace tac <tac> — trace calls on a specific trunk access code.
  • status trunk <group>/<member> — check the state of individual trunk members.
  • list measurements trunk-group <group> last-hour — view call volume and failure stats per trunk group.
4. Common Issues
SymptomLikely CauseFix
403 on inbound from RetellSBCE rejecting Retell IPAdd Retell CIDRs to SBCE trusted source / Server Flow
503 to RetellDNS failure or firewall blocking egressCheck DNS for sip.retellai.com, open port 5060 outbound
No audioRTP port range blockedOpen UDP media ports on perimeter firewall and SBCE
One-way audioNAT / topology hiding issueVerify SBCE A-side IP is in SDP c=; check topology hiding profile
488 codec mismatchNo shared codec in SDPAdd PCMU/PCMA to SBCE Media Rule
TLS handshake failureMissing CA cert on SBCEImport Amazon Root CA 1 and intermediate into SBCE TLS store
Trunk shows DownOptions ping failingCheck firewall allows SIP OPTIONS from SBCE to Retell IPs
Calls drop at ~30sSIP re-INVITE blocked mid-callAllow mid-call SIP signaling through firewall
If you cannot resolve the issue, collect the SBCE packet capture, the SM call routing test result, the CM trace, and the Retell Call ID from the Retell dashboard, and send them to support@retellai.com.