SIP Proxy Architecture: VoIP Security, Uptime and Latency

How a load-balanced SIP proxy layer at the network edge improves VoIP security, availability and call quality — and where its limits are.

If you run business phones for customers in more than one city — let alone more than one country — one of the most consequential decisions in your VoIP architecture is what sits at the edge: the layer that phones and carriers talk to first. This article explains how an edge proxy layer works, what it genuinely buys you in security, availability and speed, where its limits are, and how the principles shape the way we run YonderTele's network.

A note on honesty before the diagrams: YonderTele does not operate a dedicated SIP proxy or session border controller layer today. Our customers run on isolated tenants on regional phone servers in the United States and India, behind host firewalls, with two upstream carriers. This is the architecture we build toward, and the principles below already drive how we route calls, provision phones and plan for failure.

Two conversations in every call

Every phone call over the internet is two conversations. SIP (Session Initiation Protocol, RFC 3261) is the signalling: who is calling, who is being called, which codecs to use, when to hang up. RTP carries the audio once the call is connected. They can take different network paths, and a design that improves one does not automatically improve the other.

In the simplest design, every desk phone and softphone registers straight to the PBX that owns its extension, and that PBX also talks to the carrier. The PBX is the edge. For one office and one server this is perfectly reasonable. It gets harder as you add phones in many networks and time zones, because the PBX is now doing three jobs at once — accepting untrusted traffic from the public internet, running call logic, and relaying audio — and it is the one machine every phone registered to it depends on.

What an edge layer is, precisely

"Edge proxy" is shorthand for several functions that are often, but not always, co-located:

A SIP proxy routes signalling. It decides which server should handle a request and forwards it. It does not touch audio.
A registrar / location service stores where each phone is reachable. Proxies consult it.
A media relay forwards RTP when two endpoints cannot exchange audio directly (usually because of NAT), or when you want the audio path under your control.
A session border controller (SBC) bundles signalling control, media handling, security policy and interoperability fixes into one element, typically built as a back-to-back user agent rather than a transparent proxy (RFC 5853 describes the functions). Carriers and enterprises say "SBC"; the open-source world builds the same functions from a proxy (Kamailio, OpenSIPS) plus a media relay (rtpengine).

When this article says "edge layer", it means that combination: signalling proxy and registrar at the front, media relays alongside, and PBXs behind.

Security: shrink what the internet can reach

A SIP server on a public address is scanned within minutes of coming online. The scanners are after extensions with weak passwords, so they can pump international calls through your trunk at your expense — we covered the damage in Toll Fraud Can Cost Your Business $20,000 in a Weekend. An edge layer changes the shape of that problem rather than eliminating it:

The PBXs stop being the public SIP surface. Their firewalls accept SIP and RTP only from the edge addresses. Scanners that find the edge find a component whose job is to authenticate and refuse. (The PBXs still need patching and host firewalls for every other protocol they expose; the proxy protects the SIP front door, not the whole house.)
Rate limiting and blocklisting move in front of call logic. A burst of registration attempts from one network is dropped at the edge instead of each attempt reaching a PBX, hitting its database and writing a log line.
Encryption is handled per leg. Phones can use SIP over TLS for signalling and SRTP for audio to the edge. Between edge and PBX, inside the provider's network, the traffic may be re-encrypted or carried on an isolated network — a private address alone is not encryption, so the design has to say which it is for each hop.
One place to watch. Registrations, failed authentications and blocked sources flow through one layer, so an attack pattern across many tenants is visible in one log instead of twenty.

What the edge does not do: stop fraud from a stolen valid credential (that needs per-extension calling limits and anomaly alerts), or absorb a volumetric DDoS on its own (that needs upstream capacity and filtering).

Availability: separate "new calls recover" from "this call survives"

The second job of the edge is to limit the blast radius of any one machine failing. It is worth being precise about what it can promise.

New calls recover. Because phones register to the edge rather than to a PBX, the registrar still knows where every phone is when a PBX fails or is taken down for maintenance. If a standby server has the same tenant configuration — extensions, voicemail, routes, replicated from the primary — the proxy can send the next call there and the phones never re-register. That is the real win: an outage or a patch window becomes a short, bounded interruption to new calls — how short depends on how fast the failure is detected, on SIP transaction timeouts (which can run to 32 seconds in the standard), and on the standby being genuinely ready — instead of handsets showing "No Service" until someone fixes a server. A provider should be able to tell you the recovery time they have actually measured.

Calls in progress usually do not survive the loss of the server handling them, unless the media and call state are also replicated or the call is anchored on the edge rather than the PBX. Designs that promise otherwise are describing something more expensive than a proxy.

Health checks have to test what matters. A proxy sends SIP OPTIONS to each PBX and pulls one out of rotation when it stops answering. That catches a dead server; it does not catch a server whose database is wedged, whose media is failing, or whose upstream trunk is down. Good designs probe those separately and feed the result into the routing decision.

Carrier redundancy is two different problems. Outbound, a second carrier is straightforward: if the first rejects or times out, retry on the second. Inbound is harder: calls to a number arrive from whichever carrier hosts that number. A second carrier only helps if the number-hosting carrier can forward to an alternate destination when your primary is unreachable, or if the number itself is hosted redundantly. Ask your provider which of these they have for your numbers.

Regional independence. Edges in different regions mean a problem in one data centre — a fibre cut, a provider outage, a regional network event — does not take down phones registered elsewhere. Phones can be given a list of edges to try (most desk phones support a primary and backup registrar), so when one disappears they move to another on their own.

Speed: put the audio where the people are

Voice is unforgiving about delay. The common planning guideline is to keep one-way latency under about 150 ms (ITU-T G.114); conversations stay natural well below that and get awkward well above it. Jitter and packet loss do their own damage, which we walked through in Why Do My VoIP Calls Sound Choppy?. An edge layer helps with latency in specific, bounded ways:

Signalling to the nearest edge. A team in Bangalore and a team in Dallas can share one phone system while each registers to an edge nearby. Call setup is snappier. This does not, by itself, shorten the audio path — that is the next point.
Media relays in-region. When endpoints cannot exchange audio directly — common for office phones behind NAT — the edge can relay through a media server in the same region as the callers, instead of hair-pinning across a continent to wherever the PBX lives. Where direct media is possible, a good edge lets it happen and stays out of the audio path.
Fewer transcoding hops. If the edge includes a media element, codec negotiation can be arranged so that each leg uses a codec the other side supports — wideband (G.722 or Opus) between modern endpoints, G.711 toward carriers — without the PBX transcoding in the middle. A pure signalling proxy cannot transcode; this is specifically a media-layer feature.

The office's own internet access still contributes latency that no provider architecture can remove, and traffic between regions still crosses real distance. The edge layer removes unnecessary detours; it does not change physics.

How these principles shape YonderTele's network

Without a dedicated proxy layer, we still apply the principles above:

Isolation by tenant. Every customer is a separate tenant on a regional server, with its own extensions, routing and recordings, and host firewalls in front.
Regional presence. Servers in the United States and in India keep phones close to the people using them and keep one region's problem from becoming everyone's.
Provisioning by secure URL, never by hand. Phones pull their configuration over HTTPS, authenticated per device. That is what lets us move a phone to a different server, or change a credential fleet-wide, without visiting a desk — a point we also make in How to Port Your Business Phone Number Without Downtime.
No single-path routes. After a 2026 incident in which a routing fault between one of our cloud regions and a carrier network silently blackholed outbound calls for several hours, "every outbound route has an explicit second gateway" became a rule we audit the fleet against.
Two upstream carriers, with the inbound caveat above understood rather than papered over.

The edge layer is the next step in that progression, and the measure of it will be the one that matters to customers: whether a server failure is something they read about in a status note or something they experience.

What to ask any VoIP provider

Whether you talk to us or someone else, these questions tell you more than a feature list:

Where do my phones register — to a proxy layer, or directly to the PBX?
If the server hosting my extensions fails, what happens to a call in progress, and to the next incoming call?
Which carrier delivers each of my numbers, and what happens to inbound calls when that carrier or your server is unreachable?
Where is the audio relayed for a call between two of my offices?
Is SIP over TLS with SRTP available on desk phones as well as softphones?

The quality of an architecture is in the answers, and in the tested failure behaviour behind them — not in whether a particular component appears on the diagram.

Frequently asked questions

Is a SIP proxy the same as an SBC? No. A SIP proxy routes signalling only. An SBC combines signalling control, media handling, security policy and interoperability functions, usually as a back-to-back user agent, and is commonly deployed at carrier and enterprise borders. You can assemble SBC-like functions from a proxy plus a media relay, which is how most open-source edges are built.

Does an edge proxy add latency? A nearby, adequately provisioned proxy adds little processing delay to call setup; total setup time still depends on the whole signalling path, including retries and congestion. For audio, an in-region media relay typically shortens the path compared with phones relaying through a distant PBX; a badly placed relay can lengthen it. Placement is the whole game.

Do I need this for a five-person office? You do not need to build it, and you should not pay a premium for the word. You benefit when your provider has designed for failure — whichever components they use — because the same protections apply to the smallest tenant as to the largest.

Will my existing desk phones work with an edge design? Any standards-based SIP phone — Grandstream, Yealink, Poly, Cisco in SIP mode — registers to a proxy exactly as it would to a PBX, and most current models support TLS, SRTP and a backup registrar.

Want to talk through how your phones would be set up? Tell us about your business or call (512) 333-2227 — during business hours, Central time, that number reaches an engineer.