EdgeMarc SBC — SIP Decryption Installation Guide

Edgewater EdgeMarc SBC - SIP Decryption Configuration Guide

🖶 Print / Save as PDF

Edgewater EdgeMarc SBC — SIP Decryption Configuration Guide

Document TypeEnd-User Installation & Configuration Guide

Applies ToEdgewater Networks EdgeMarc Series (2900, 4550, 4600, 4700, 7301)

CallerID.com DeviceVertex Series (VoIP Caller ID)

AuthorCallerID.com

DateFebruary 2026

Version1.0

Table of Contents Overview & Purpose

Prerequisites

Network Diagram

Step 1 — Access the EdgeMarc Admin Interface

Step 2 — Configure LAN Network Settings

Step 3 — Configure LAN-Side SIP Settings

Step 4 — Disable Secure Signaling (TLS)

Step 5 — Enable Transparent Proxy Mode

Step 6 — Configure WAN-Side SIP Trunk

Step 7 — Disable SIP ALG on Upstream Firewall

Step 8 — Configure Local PBX / IP Phones

Step 9 — Connect the CallerID.com Vertex Unit

Step 10 — Verify and Test

Troubleshooting

Security Considerations

Glossary

1. Overview & Purpose

Many hosted VoIP providers encrypt SIP signaling using TLS (Transport Layer Security) over port 5061. While this protects call signaling data in transit over the internet (WAN side), it also prevents LAN-side devices—such as the CallerID.com Vertex—from reading the SIP INVITE packets needed to extract Caller ID information.

The Edgewater EdgeMarc Session Border Controller (SBC) sits at the boundary between your local network and your VoIP provider. It can be configured to:

WAN side: Maintain encrypted TLS communication with your VoIP provider (secure)

LAN side: Deliver unencrypted UDP/TCP SIP signaling on port 5060 to local devices

This allows the Vertex unit to passively monitor SIP traffic on the LAN and capture Caller ID data from inbound calls without interfering with the encrypted WAN connection.

How the EdgeMarc Works: The EdgeMarc acts as a B2BUA (Back-to-Back User Agent). It terminates the encrypted TLS session from the VoIP provider on the WAN side and creates a new, unencrypted SIP session on the LAN side. Your phones and the Vertex unit communicate with the EdgeMarc's LAN IP address using standard UDP port 5060.

2. Prerequisites

Before you begin, confirm you have the following:

Item Details

EdgeMarc SBC Edgewater EdgeMarc 2900, 4550, 4600, 4700, or 7301 series with current firmware

Admin Access Username and password for the EdgeMarc web interface (default: root / default)

Network Info LAN subnet, gateway IP, and available static IP address for the EdgeMarc LAN interface

VoIP Provider Info SIP trunk credentials, registrar address, and port from your VoIP provider

CallerID.com Vertex Vertex unit connected to the same LAN as the EdgeMarc

Computer A computer on the same LAN for accessing the EdgeMarc web interface

Ethernet Cables Cat5e or Cat6 cables for WAN, LAN, and Vertex connections

Important: Have your VoIP provider's SIP trunk credentials ready before starting. You will need the registrar/proxy address, port, authentication username, and password. Contact your provider if you do not have these.

3. Network Diagram

The following diagram shows how the EdgeMarc SBC fits into your network. The key concept is that encrypted traffic stays on the WAN side, while unencrypted SIP flows on the LAN side where the Vertex can read it.

INTERNET (WAN Side) LOCAL NETWORK (LAN Side) ================== =========================

4. Step 1 — Access the EdgeMarc Admin Interface

Log In to the EdgeMarc

Connect your computer to the same LAN as the EdgeMarc's LAN port.

Open a web browser and navigate to the EdgeMarc's default LAN IP address: https://192.168.1.1 (or the IP address assigned to your EdgeMarc LAN interface)

You may see a certificate warning — this is normal for self-signed certificates. Click Advanced and proceed.

You will land on the EdgeMarc Dashboard or Status page.

Security: If you are still using the default password, change it immediately after logging in. Navigate to System > Administration to update the password.

5. Step 2 — Configure LAN Network Settings

Set a Static IP on the LAN Interface

Navigate to the Network tab in the EdgeMarc interface.

Select the LAN interface.

Ensure the LAN interface is set to a static IP address (not DHCP).

Configure the following fields:

IP Address: 192.168.1.2 (example — use an available IP on your LAN)

Subnet Mask: 255.255.255.0

Default Gateway: 192.168.1.1 (your router's IP)

DNS Server: 8.8.8.8 (or your preferred DNS)

Click Apply to save the settings.

Note: Record the LAN IP address you assign to the EdgeMarc. All local IP phones, PBX systems, and the Vertex unit will reference this address.

6. Step 3 — Configure LAN-Side SIP Settings

This is the most critical step. You need to configure the EdgeMarc to use unencrypted SIP on the LAN side so that local devices can communicate using standard UDP port 5060.

Set SIP Signaling to UDP on the LAN

Navigate to VoIP > SIP in the EdgeMarc interface.

Locate the LAN-side SIP profile or Internal SIP Settings section.

Configure the following settings:

Signaling Protocol: UDP

SIP Port: 5060

Transport: UDP (or TCP if your phones require it)

Local SIP Domain: (your LAN IP, e.g., 192.168.1.2)

Click Apply to save.

UDP vs TCP: UDP is the preferred protocol for SIP signaling on the LAN. It has lower overhead and is the standard for most IP phones and PBX systems. Use TCP only if your specific phones or PBX require it. Do not select TLS for the LAN-side profile.

7. Step 4 — Disable Secure Signaling (TLS)

Turn Off TLS on the LAN-Facing Profile

Still within VoIP > SIP, locate the security settings for the LAN-side profile.

Ensure the following options are disabled or set as shown:

Secure Signaling (TLS): Disabled

SRTP (Secure RTP): Disabled (for LAN side)

SIP over TLS: Disabled

Certificate Validation: Disabled (LAN profile only)

Click Apply to save.

WAN Side Must Stay Encrypted: Only disable TLS on the LAN-side profile. The WAN-side profile that connects to your VoIP provider should remain encrypted with TLS/SRTP as required by your provider. The EdgeMarc handles the translation between encrypted (WAN) and unencrypted (LAN) automatically.

8. Step 5 — Enable Transparent Proxy Mode

Allow Unencrypted SIP Traffic to Pass Through

Within the VoIP > SIP settings, locate the Proxy Mode or SIP Processing section.

Enable Transparent Proxy Mode (sometimes labeled "SIP Passthrough" or "B2BUA Transparent Mode").

Transparent Proxy Mode: Enabled

SIP Passthrough: Enabled

Click Apply to save.

What This Does: Transparent Proxy Mode allows the EdgeMarc to pass unencrypted SIP signaling to all devices on the LAN, including the Vertex unit. Without this, the EdgeMarc may modify or block SIP headers that the Vertex needs to extract Caller ID data.

9. Step 6 — Configure WAN-Side SIP Trunk

The WAN side maintains the encrypted connection to your VoIP provider. This is where you enter your SIP trunk credentials.

Set Up the VoIP Provider Connection

Navigate to VoIP > SIP Trunks (or VoIP > Service Provider).

Create a new trunk or edit the existing one.

Enter your VoIP provider's settings:

Registrar / Proxy Address: (from your VoIP provider)

Registrar Port: 5061 (TLS) or as specified by provider

Transport Protocol: TLS

Authentication Username: (from your VoIP provider)

Authentication Password: (from your VoIP provider)

SRTP: Enabled (if required by provider)

Click Apply to save.

Verify the trunk registers successfully by checking the Status page — you should see "Registered" next to the trunk.

10. Step 7 — Disable SIP ALG on Upstream Firewall

If the EdgeMarc is behind another router or firewall, SIP ALG (Application Layer Gateway) on that device can interfere with SIP packets. It must be disabled.

Disable SIP ALG on Your Router/Firewall

Locate the SIP ALG, SIP Inspection, or SIP Transformation setting. Common locations: Firewall > Security Features > SIP ALG

NAT > ALG > SIP

Advanced > Application Layer Gateway

Set all of the following to Disabled:

SIP ALG: Disabled

SIP Inspection: Disabled

SIP Transformations: Disabled

Save and reboot the router if required.

Why This Matters: SIP ALG modifies SIP packets as they pass through the router. This can corrupt SIP headers, cause one-way audio, registration failures, and prevent the Vertex from reading Caller ID data correctly. Always disable SIP ALG when using an SBC.

11. Step 8 — Configure Local PBX / IP Phones

Your local IP phones and PBX must be pointed at the EdgeMarc's LAN IP address instead of directly at the VoIP provider.

Point Phones to the EdgeMarc

On each IP phone or PBX system, update the SIP settings:

SIP Proxy / Registrar: 192.168.1.2 (EdgeMarc LAN IP)

SIP Port: 5060

Transport: UDP

Outbound Proxy: 192.168.1.2 (EdgeMarc LAN IP)

Use the same SIP credentials (username/password) that your VoIP provider issued.

Save the phone configuration and reboot the phone.

Verify the phone registers successfully — the phone's display should show "Registered" or a solid line indicator.

Repeat for all phones on the network.

PBX Systems (FreePBX, Asterisk, 3CX, etc.): If you use a PBX, configure the PBX trunk to point at the EdgeMarc LAN IP (192.168.1.2) instead of the VoIP provider's address. The PBX handles the phones; the EdgeMarc handles the provider connection.

12. Step 9 — Connect the CallerID.com Vertex Unit

The Vertex unit needs to see the unencrypted SIP traffic on the LAN. There are two ways to accomplish this:

Option A: Port Mirroring (Recommended)

Use a Managed Switch with Port Mirroring

Connect the EdgeMarc LAN port to a managed network switch.

Connect the Vertex unit to a port on the same switch.

Configure port mirroring (also called SPAN): Source port: The port connected to the EdgeMarc LAN interface

Destination port: The port connected to the Vertex unit

Direction: Both (ingress and egress) or Rx only

Save the switch configuration.

Option B: Network Tap

Use a Passive Network Tap

Place a passive network tap (such as a Dualcomm DCSW-1005PT) between the EdgeMarc LAN port and the switch/phone.

Connect the tap's monitor port to the Vertex unit.

The tap passively copies all traffic without affecting network performance.

Configure the Vertex

Vertex Unit Settings

Power on the Vertex unit and connect it to your network (via the mirrored port or tap).

The Vertex will begin monitoring SIP traffic automatically.

Configure the Vertex to connect to your CallerID.com dashboard: Set the Server URL to your CallerID.com endpoint

Enter your API Key from the CallerID.com dashboard

Verify the Vertex is receiving SIP packets by checking its status indicator (solid green = receiving traffic).

13. Step 10 — Verify and Test

Complete System Verification

EdgeMarc Dashboard: Log in to the EdgeMarc and verify: WAN-side trunk shows "Registered"

LAN-side SIP profile shows UDP / port 5060

Active calls appear in the call status table

Phone Test: Make a test call from an external phone to your number: Verify the phone rings

Verify two-way audio works

Verify Caller ID displays on the phone

Vertex Verification: Check the Vertex status light (solid green = receiving SIP data)

Check the CallerID.com dashboard for the incoming call event

Verify Caller ID name and number appear correctly

Outbound Test: Make an outbound call from a local phone: Verify the call connects through the EdgeMarc

Verify two-way audio

Success: If the Vertex is capturing Caller ID data from inbound calls and all phones are working with two-way audio, your configuration is complete!

14. Troubleshooting

Symptom Possible Cause Solution

Phone shows "Registration Failed" Phone is pointed at wrong IP or credentials are incorrect Verify the phone's SIP proxy is set to the EdgeMarc's LAN IP (192.168.1.2). Double-check SIP credentials.

One-way audio on calls SIP ALG is enabled on the upstream router Disable SIP ALG, SIP Inspection, and SIP Transformations on your firewall/router. See Step 7.

Vertex not capturing Caller ID Port mirroring not configured or Vertex not on mirrored port Verify port mirroring is active on the switch. Ensure the Vertex is connected to the destination/monitor port.

Vertex shows traffic but no Caller ID SIP traffic is still encrypted (TLS) on the LAN Verify TLS is disabled on the EdgeMarc LAN-side SIP profile. Check that Transparent Proxy Mode is enabled.

Calls drop after 30 seconds SIP ALG is modifying packets, or NAT timeout is too short Disable SIP ALG. Increase NAT session timeout on your router to 300+ seconds.

EdgeMarc WAN trunk not registering WAN-side credentials or TLS settings incorrect Verify VoIP provider credentials. Ensure WAN-side transport is set to TLS (port 5061). Check firewall allows outbound 5061.

Intermittent call quality issues Network congestion or QoS not configured Enable QoS on the EdgeMarc: Network > QoS. Prioritize SIP (port 5060) and RTP (ports 10000-20000).

Cannot access EdgeMarc admin page IP address changed or browser cache Try the default IP 192.168.1.1. If changed, check your DHCP server's lease table or perform a factory reset (hold reset button 10 seconds).

15. Security Considerations

Important: Using unencrypted SIP (UDP/TCP 5060) on your LAN means that SIP signaling traffic—including phone numbers, call metadata, and SIP credentials—can be captured by anyone with access to the local network. This is an accepted trade-off for enabling Caller ID monitoring, but you should be aware of the implications.

Recommended Security Measures

Measure Action

Physical Security Keep the EdgeMarc, switch, and Vertex in a locked server room or network closet.

Network Segmentation Place VoIP devices on a dedicated VLAN to isolate SIP traffic from general network traffic.

Strong Passwords Change the EdgeMarc default password immediately. Use strong, unique passwords for all SIP accounts.

WAN Encryption Always maintain TLS/SRTP on the WAN side. Only the LAN side should be unencrypted.

Firewall Rules Block external access to port 5060 on your firewall. Only LAN devices should communicate on this port.

Firmware Updates Keep the EdgeMarc firmware updated. Check System > Firmware for available updates.

Access Logging Enable logging on the EdgeMarc (System > Logging) to monitor for unauthorized access attempts.

16. Glossary

Term Definition

SBC Session Border Controller — a network device that controls SIP sessions at the border between networks (LAN/WAN).

B2BUA Back-to-Back User Agent — the SBC terminates one SIP session and creates a new one, acting as an intermediary.

SIP Session Initiation Protocol — the signaling protocol used to set up, manage, and tear down VoIP calls.

TLS Transport Layer Security — encrypts SIP signaling to prevent eavesdropping (port 5061).

SRTP Secure Real-time Transport Protocol — encrypts the audio/media stream of a call.

UDP User Datagram Protocol — a lightweight, connectionless transport used for standard SIP (port 5060).

SIP ALG Application Layer Gateway — a router feature that modifies SIP packets as they pass through NAT. Usually causes problems and should be disabled.

Port Mirroring / SPAN A switch feature that copies traffic from one port to another, allowing a monitoring device to see all traffic.

RTP Real-time Transport Protocol — carries the actual audio (voice) data during a call.

QoS Quality of Service — network traffic prioritization to ensure voice traffic gets priority over data traffic.

For technical support, contact Info@CallerID.com or call 770.263.7111