00 · Header

T7 · SIP, routing, and queues

SIP Fundamentals for Webex

The Local Gateway speaks SIP to Webex Calling over TLS, and media is SRTP. This room is the dial-peer and the debug, not another PSTN overview. Sample passwords from the configuration guide are not here.

Expand all sections

01 · Executive summary

Five lines, then why it matters

• The trunk to Webex Calling is SIP over TLS. Media is SRTP. Commercial gateways offer AES_CM_128_HMAC_SHA1_80. [cite:1]
• Registration trunks are CUBE only and stop at 250 calls. Certificate trunks go past 250 and need OPTIONS from the gateway FQDN. [cite:2]
• The Webex dial-peer matches inbound calls with incoming uri request. BAD.BAD is a dummy destination-pattern, and max-conn 250 belongs on a registration trunk. [cite:1]
• Inbound SIP matching checks URI headers before called number. Outbound hunt 0 prefers the longest match, then the lower preference number. [cite:3]
• The routing article prints debug voip ccapi inout. The Local Gateway article wants diagnostic signatures, and DS 64224 turns debugs off at 75 percent CPU. [cite:3] [cite:1]

02 · Architecture map

Two call legs

flowchart LR
  Webex[Webex Calling] --> CUBE
  CUBE --> PSTN

03 · Core concepts

Match rules that change the peer

Inbound SIP order, document 211306

04 · Ecosystem & sister technologies

Glossary, map, sisters, edges

Glossary

Local Gateway

The customer SBC that trunks to Webex Calling. SIP TLS secures the signaling. SRTP secures the media. [cite:1]

Registration trunk

Digest authentication, CUBE only, up to 250 concurrent calls. The sample dial-peer sets max-conn 250 and the article says that is the maximum for a registration trunk. [cite:1] [cite:2]

Certificate trunk

Certificate authentication and FQDN checks. Concurrent calls above 250. Every SIP transaction the gateway starts, including OPTIONS, needs a Contact header with the gateway FQDN or Control Hub will not show the gateway online. [cite:2]

Webex for Government

Certificate-based only, and CUBE is the only SBC the get-started article names for it. The commercial SHA1_80 step is marked not applicable. GCM is mandatory. [cite:1] [cite:2]

voice class tenant

Groups the trunk’s registrar or sip-server, transport, and SRTP crypto so the dial-peer can inherit them. [cite:1]

SRTP SHA1_80

Commercial Webex Calling: the article’s crypto class offers AES_CM_128_HMAC_SHA1_80 and says Webex Calling only supports SHA1_80. [cite:1]

SRTP GCM

Webex for Government: AEAD_AES_256_GCM is mandatory. Do not paste the commercial cipher onto a Government gateway. [cite:1]

incoming uri request

Matches the inbound INVITE to the Webex dial-peer. The article’s uri class looks for the trunk’s dtg= value from Control Hub. [cite:1]

BAD.BAD

A dummy destination-pattern on the Webex dial-peer. The article says a dummy is required when outbound calls are routed with an inbound dial-peer group. It is not a number your users dial. [cite:1]

session target sip-server

Sends the outbound leg to the SIP server inherited from the tenant. [cite:1]

OPTIONS keepalive

A voice class sip-options-keepalive profile. Certificate trunks depend on OPTIONS for the Control Hub online state. The article’s sample uses transport tcp tls. [cite:1] [cite:2]

Inbound SIP order

IOS XE checks URI via, then URI request, then URI to, then URI from, then called number, then calling number, then destination-pattern against the ANI. The first criterion that matches wins. It is not digit-by-digit. [cite:3]

dial-peer hunt 0

The default hunt: longest match, then explicit preference, then random. Preference 0 is better than preference 1. [cite:3]

huntstop

Stops the gateway from trying the next outbound dial-peer after a failure. [cite:3]

show dial-peer voice summary

The IOS routing article prints this command. The summary line includes the hunt scheme. [cite:3]

debug voip ccapi inout

The same article prints this debug when a call fails on the first dial-peer and hunts. It is not the Local Gateway article’s first troubleshooting step. [cite:3] [cite:1]

Diagnostic signature

The Local Gateway article’s troubleshooting method. TAC-authored, signed XML. A high-CPU signature disables debugs. [cite:1]

DS 64224

The article tells you to install this high-CPU signature so that at 75 percent CPU it disables all debugs and uninstalls diagnostic signatures. [cite:1]

Config Validation

A Control Hub check for registration-based Local Gateways only. It validates the Webex-facing dial-peers, tenant, and trustpoint. It does not validate the PSTN dial plan. [cite:4]

ICE-Lite

stun usage ice lite on Webex-facing dial-peers so media can optimize. The article says recording and other cloud media services cannot be optimized. [cite:1]

Mind map

mindmap
  root((Local Gateway SIP))
    TLS
    SRTP
    Dial peers
    OPTIONS

Sister-technology matrix

Integration map

Cross-platform bridges

Future-integration hooks

• Canon plan: T7-R02 can go deeper on translation rules. This room already fixes the match order those notes must use.
• Firewall ports from the current port reference, as of 2026-10-14, b2exve: certificate-trunk destination TCP 5062, registration-trunk destination TCP 8934. Phone signaling source ports 5060–5280 sit under Call signaling to Webex Calling (SIP TLS). The parent protocol cell is TCP. The devices protocol cell is blank, so this room does not call that range TCP. The history line September 07, 2026 expanded 5060–5080 to 5060–5280. [cite:5] Do not revive BRKCOL-2812’s 2024 port list as an ACL.
• IOS-XE minimum for the trunk type is as of 2026-10-14, t9xctu header September 10, 2026: registration CUBE minimum Bengaluru 17.6.1a; certificate CUBE minimum Cupertino 17.9.1a; Secure Router rows in that table list IOS XE 26.2.1. [cite:2] per platform in the CUBE matrix.

Ecosystem troubleshooting

05 · Flow

One inbound Webex call, then one outbound PSTN call

06 · Config

The lines worth typing, without the sample password

1. In Control Hub, create the trunk and copy the registrar or sip-server, the OTG/DTG, and the credentials into a private store. Do not copy them from the guide’s example. [cite:1]
2. Install the Cisco core trust bundle the article names: crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b. [cite:1]
3. Create the commercial SRTP class, the dtg= URI class, and dial-peer 100 as below. Set max-conn no higher than 250 on a registration trunk. [cite:1]
4. On a certificate trunk, add the OPTIONS keepalive profile and make sure Contact carries the gateway FQDN. [cite:1] [cite:2]
5. On Webex for Government, skip the SHA1 class and configure AEAD_AES_256_GCM. Use CUBE and a certificate trunk. [cite:1] [cite:2]
6. Confirm hunt with show dial-peer voice summary. If a call hunts, debug voip ccapi inout is the command 211306 prints. Install DS 64224 first so 75 percent CPU disables debugs. [cite:3] [cite:1]
7. Run Config Validation only as a registration-trunk check. Then test the PSTN peer yourself. [cite:4]

Commercial Webex Calling, from jr1i3r. Passwords and sample user names omitted.

voice class srtp-crypto 100
 crypto 1 AES_CM_128_HMAC_SHA1_80

voice class uri 100 sip
 pattern dtg=<OTG/DTG from Control Hub>

dial-peer voice 100 voip
 description Inbound/Outbound Webex Calling
 max-conn 250
 destination-pattern BAD.BAD
 session protocol sipv2
 session target sip-server
 incoming uri request 100
 voice-class stun-usage 100
 no voice-class sip localhost
 voice-class sip tenant 100
 srtp
 no vad

voice class sip-options-keepalive 100
 description Keepalive for Webex Calling
 up-interval 5
 transport tcp tls

Webex for Government replaces the crypto line:
 crypto 1 AEAD_AES_256_GCM

07 · Limits

Numbers these articles state

08 · Troubleshooting

Ten failures

09 · Self-question ladder

Twelve rungs

10 · Lab

Paper match, then the Labs page

• Goal: match one inbound and one outbound call on paper, using the IOS XE order. The interactive version is the CUBE panel on the Labs page.
• Prereq: no production gateway. Sample passwords in jr1i3r stay out of your notes.
• Step 1. Write the inbound SIP order from URI via through destination-pattern.
• Step 2. Give an INVITE a dtg= value and a called number. Expected: the URI peer wins.
• Step 3. Give two outbound patterns for the same digits, lengths different, hunt 0. Expected: the longer pattern.
• Step 4. Set huntstop on the first peer and fail it. Expected: the second peer is not tried.
• Evidence: the peer id, the criterion that matched, and the hunt scheme.
• Break it: turn on a debug in your notes without DS 64224. Recovery: write the 75 percent CPU stop next to the debug name.
• Reflection: which cipher you would refuse to put on a Government gateway.

The zero-key matcher is the CUBE panel on Labs. It follows the 211306 order for a fixed set of peers.

11 · Quiz

Twelve questions

12 · Audio

Slots for Studio

13 · Interview

Oral answers

30 seconds. Local Gateway is a SIP TLS trunk with SRTP. [cite:1] Registration is CUBE and up to 250 calls, and registration trunks digest-authenticate. [cite:2] Certificate trunks use the getting-started “greater than 250” sentence. Table 5 is not flattened into it. They send OPTIONS with their FQDN or Control Hub marks them down. [cite:2]

2 minutes. Inbound SIP matching is URI via, request, to, from, then called number, then calling number, then destination-pattern on the ANI. [cite:3] The Webex sample peer matches incoming uri request on dtg= and uses BAD.BAD only as a dummy. [cite:1] Outbound, hunt 0 takes the longest pattern and then the lower preference. [cite:3] Read the hunt order in the SBC vendor’s own guide. This room only cites CUCM closest-match and CUBE preference, and those two engines already differ.

30 seconds, ciphers. Commercial is AES_CM_128_HMAC_SHA1_80. Webex for Government is AEAD_AES_256_GCM, certificate, CUBE only. [cite:1] [cite:2]

2 minutes, debugs. show dial-peer voice summary shows the hunt. debug voip ccapi inout shows a failed leg that hunts. debug voip uri is for URI matching. Before those stay enabled, jr1i3r wants DS 64224 so 75 percent CPU shuts debugs off. [cite:1]

What you will not say. You will not recite the sample password, and you will not build a firewall ACL from memory.

14 · Citations

1. Configure Local Gateway on Cisco IOS XE for Webex Calling — help.webex — article jr1i3r — help.webex.com article jr1i3r — retrieved 2026-10-14. SIP TLS and SRTP. Commercial crypto AES_CM_128_HMAC_SHA1_80. Government crypto AEAD_AES_256_GCM. Sample dial-peer with max-conn 250, destination-pattern BAD.BAD, incoming uri request, srtp. OPTIONS keepalive class. Diagnostic signatures and DS 64224 at 75 percent CPU. The article’s sample usernames and passwords are not reproduced here.
2. Get started with Local Gateway — help.webex — article t9xctu — help.webex.com article t9xctu — retrieved 2026-10-14. Registration trunks up to 250 and CUBE only. Certificate trunks above 250 in the getting-started wording. Table 5 is not flattened into that sentence. T6-R01 quotes the bands from the same article. OPTIONS and the FQDN in Contact for Control Hub status. Webex for Government is certificate-based and CUBE only.
3. Understand IOS and IOS XE Call Routing — Cisco — cisco.com document 211306 — retrieved 2026-10-14. Inbound SIP order from incoming uri via through destination-pattern. Default dial-peer hunt 0. huntstop. show dial-peer voice summary. debug voip ccapi inout. debug voip uri.
4. Validate Cisco Local Gateway configuration through Control Hub — help.webex — article 2zx7fg — help.webex.com article 2zx7fg — retrieved 2026-10-14. Config Validation is for registration-based Local Gateways. It checks the Webex-facing tenant, sip profile, and dial-peers. It does not validate the PSTN or PBX dial plan.
5. Port Reference for Cisco Webex Calling — help.webex — article b2exve — help.webex.com article b2exve — retrieved 2026-10-14. Revision history September 07, 2026. Certificate destination TCP 5062, registration destination TCP 8934, phone source TCP 5060–5280.

15 · Re-engineer later

• Open questions: which third-party SBCs are on the certificate device list this month; the current port reference.
• Firewall ports and IOS-XE minimums are cited as of 2026-10-14. Other-SBC match order stays marked in the sister row.
• Assets missing: a sanitized running-config with the password lines removed, audio, trunk screenshot.
• Ideas for v1.0: a side-by-side of registration tenant versus certificate tenant, still without secrets.
• Next review: re-check jr1i3r if a cipher line changes.