00 · Header

T7 · SIP, routing, and queues

Codecs, media, and NAT

Color-coded sequence: Phone → CUBE → Control Hub → PSTN. A packet moves along the arrows. Reduced motion keeps every step visible.

Media optimization, the G.711 class, and the port reference. SIP ALG is a recommendation on b2exve whose revision line is January 21, 2025, so that sentence stays re-check. Retrieved 2026-10-14.

Room T7-R03 Version v0.1 last-verified: TODO Difficulty L3 Est. time 100–130 min Prereq T7-R02 Reading 17 min

Key takeaways

Media optimization uses ICE. Desk phones except DECT and ATA, the Webex App, and Local Gateway are the supported set. It is on by default for desk phones and the Webex App. [cite:1]
Local Gateway uses ICE-lite. Minimum CUBE software in that article is 17.3 or 16.12.5. The gateway needs a public address or same-network reachability. Interorganization calls send media through the PSTN. [cite:1]
If call recording is enabled, recorded-call media goes to the cloud and is not optimized. ICE and recording each add a small initial audio delay. Together the delay is longer. [cite:1]
jr1i3r’s codec class is g711ulaw then g711alaw. b2exve, retrieved 2026-10-14, puts successful ICE media for the Webex App on 8500–8699 and for devices on 19560–19661. [cite:2] [cite:3]
b2exve recommends turning SIP ALG off. The revision history dates that addition at January 21, 2025. re-check [cite:3]

01 · Executive summary

ICE is a path, G.711 is the guide’s codec list

Media optimization uses ICE. Desk phones except DECT and ATA, the Webex App, and Local Gateway are the supported set. It is on by default for desk phones and the Webex App. [cite:1]
Local Gateway uses ICE-lite. Minimum CUBE software in that article is 17.3 or 16.12.5. The gateway needs a public address or same-network reachability. Interorganization calls send media through the PSTN. [cite:1]
If call recording is enabled, recorded-call media goes to the cloud and is not optimized. ICE and recording each add a small initial audio delay. Together the delay is longer. [cite:1]
jr1i3r’s codec class is g711ulaw then g711alaw. b2exve, retrieved 2026-10-14, puts successful ICE media for the Webex App on 8500–8699 and for devices on 19560–19661. [cite:2] [cite:3]
b2exve recommends turning SIP ALG off. The revision history dates that addition at January 21, 2025. re-check [cite:3]

Why it matters. The exam mistake is one port range for every device, or a recorded call used as proof of ICE.

02 · Architecture map

Direct media is conditional

Mermaid source (not rendered)

flowchart LR
  STUN --> SIP
  SIP --> Media

03 · Core concepts

Four ICE phases, then the port table

Four phases

nt6eyxb: candidate discovery, candidate exchange over SIP, connectivity checks, then media path optimization with a reinvite. The server-reflexive address comes from a STUN server in the Webex Calling cloud. [cite:1]

Recording defeats the shortcut

The same article says recorded media is routed to the cloud and is not optimized. [cite:1]

Signaling still needs the internet

To route calls, signaling goes to the Webex Calling cloud. An active internet connection is always required. Media is most of the traffic. [cite:1]

ALG and NAT pools are different sentences

August 13, 2026 on b2exve: validate NAT pool size so PAT does not exhaust ports. The SIP ALG recommendation is the January 21, 2025 addition. Keep those dates apart. [cite:3]

Ports this room will quote

Flow	Source ports	Destination	Protocol	Cite
Call media to Webex Calling	Local Gateway external NIC 8000–48199	5004, 9000, 8500–8699, 19560–65535	UDP	[cite:3]
Optimized Webex App	Audio 8500–8599, video 8600–8699	The other app, when ICE succeeds	UDP	[cite:3]
Optimized devices	19560–19661	The other device, when ICE succeeds	UDP	[cite:3]
Media from Webex Calling to a certificate Local Gateway	19560–65535	The customer’s chosen media ports	UDP	[cite:3]
Signaling to Webex Calling	Local Gateway source 8000–65535, protocol TCP on that row. Devices source 5060–5280. The devices protocol cell is blank, so this room does not label that range TCP.	Parent destinations 5062 and 8934. The devices row destination is 8934.	Parent TCP. Devices cell blank.	[cite:3]

04 · Ecosystem & sister technologies

Glossary, map, sisters, edges

Mini map of the neighbors named on this room’s sequence. Orientation sketch, not a new product claim.

Glossary

ICE: Interactive Connectivity Establishment. The method nt6eyxb uses to find a direct media path. [cite:1]
ICE-lite: What CUBE supports. The article points at further restrictions on CUBE and does not paste them into the Webex page. [cite:1]
STUN: Session Traversal Utilities for NAT. Used to learn a server-reflexive address. [cite:1]
Candidate: A local address or a server-reflexive address where the endpoint can receive media. [cite:1]
Reinvite: The SIP request that starts media on the optimized path after checks succeed. [cite:1]
Default on: Desk phones and Webex App. DECT and ATA are excluded. [cite:1]
Local Gateway command: The article’s words are “STUN usage lite,” reviewed in the Local Gateway registration article. jr1i3r prints voice class stun-usage 100. [cite:1] [cite:2]
CUBE minimum for this feature: 17.3 or 16.12.5, in nt6eyxb. That is not the trunk-registration minimum in t9xctu. [cite:1]
Same organization: Calls optimize only inside one organization. Interorganization media goes through the PSTN for regulatory reasons. [cite:1]
Recording path: Cloud path. Not optimized. [cite:1]
G.711 class: jr1i3r preference 1 g711ulaw, preference 2 g711alaw. [cite:2]
SIP ALG: b2exve recommends turning it off because some ALG implementations break firewall traversal even though signaling is encrypted. Revision line January 21, 2025. re-check [cite:3]
NAT pool: August 13, 2026 update: size the pool so users and devices are not stuck when ports run out. [cite:3]
DSCP: b2exve: Webex App audio Expedited Forwarding (46) on 8500–8599. Video Assured Forwarding 41 (34) on 8600–8699. Device signaling Class Selector 3 (24). [cite:3]
Certificate media return: Call media from Webex Calling toward a certificate-based Local Gateway uses 19560–65535 UDP. [cite:3]
Phone source signaling: Devices row 5060–5280 toward 8934. The September 07, 2026 history line expanded 5060–5080 to 5060–5280. [cite:3]

Mind map

Mermaid source (not rendered)

mindmap
  root((T7-R03))
    Core
    Sisters

Sister-technology matrix

Sister	What it is	Why it matters here	Config touchpoint	Typical failure	Cite
Webex App	A supported ICE endpoint. On by default.	Audio and video port ranges differ.	No extra toggle in the article’s default case.	Expecting DECT to optimize.	[cite:1]
Desk phone	Supported, except DECT and ATA.	Device media ports are 19560–19661 when optimized.	MPP and room devices in the port table.	Using the app range on a phone.	[cite:3]
Local Gateway	ICE-lite, with reachability rules.	Public IP or same network.	stun-usage, codec class.	A private address the phone cannot reach.	[cite:1]
Recording	Forces cloud media.	Delay note when combined with ICE.	Turn recording off for a path test.	Calling a recorded call “direct media.”	[cite:1]
Firewall	b2exve is the port reference.	ALG off is a separate recommendation.	Manufacturer steps to disable ALG.	An ACL from a 2024 slide.	[cite:3]
NAT	PAT pools can exhaust.	August 13, 2026 procedure.	Count public addresses against users and devices.	One public IP for a large site with no pool check.	[cite:3]
PSTN	Interorganization media uses it.	Regulatory sentence in nt6eyxb.	Do not expect ICE across two orgs.	Opening device ports to another company’s phones.	[cite:1]
SRTP	jr1i3r and the colocation article offer AES_CM_128_HMAC_SHA1_80 for commercial Webex Calling.	That suite is not a UDP port.	voice class srtp-crypto.	Quoting a port as a cipher.	[cite:2]

Integration map

From	To	Mechanism	What moves	Cite
Endpoint	STUN server	STUN	Server-reflexive candidate.	[cite:1]
Endpoint	Endpoint	SIP	Candidate exchange.	[cite:1]
Endpoint	Endpoint	Connectivity checks	The chosen path.	[cite:1]
Endpoint	Endpoint	Reinvite	Media on the optimized path.	[cite:1]
Recorded call	Cloud	Media	Not optimized.	[cite:1]
Local Gateway	Webex	UDP SRTP	8000–48199 toward the cloud media ports.	[cite:3]
Webex	Certificate Local Gateway	UDP	19560–65535 toward customer media ports.	[cite:3]
Router	SIP	ALG	b2exve says turn that function off. re-check	[cite:3]

Cross-platform bridges

Webex behavior	Legacy habit	Peer orientation	Cite
ICE inside one Webex Calling org	CUCM MTP and TRP are not this feature.	Teams media bypass is not cited here. TODO-verify as a peer.	[cite:1]
G.711 on the gateway	A phone codec list can contain G.722 and Opus. njwkamr lists preference orders for third-party devices. That is not voice class codec 100.	Do not paste device codec order onto CUBE.	[cite:4]
SIP ALG off	Some carriers want ALG. b2exve’s recommendation is for Webex Calling traversal.	Follow the firewall vendor’s disable steps. The article does not name every vendor.	[cite:3]

Future-integration hooks

Canon plan: T7-R04 is the trunk and certificate design. Ports quoted here stay tied to b2exve’s September 07, 2026 history line for the phone source range.
Government GCM is jr1i3r’s other crypto block. This room’s SHA1_80 line is the commercial sample in the colocation article. [cite:2]
ICE-lite restrictions that live only on the CUBE ICE-lite page were not copied. Read that page before you teach a CUBE limitation nt6eyxb does not print.

Ecosystem troubleshooting

Symptom	Likely sister-system cause	Check	Fix	Cite
Two companies’ users do not go direct	Interorganization media is through the PSTN.	nt6eyxb regulatory sentence.	Stop expecting ICE.	[cite:1]
DECT media stays on the relay	DECT is excluded.	Supported-device sentence.	Use a supported desk phone or the app for the test.	[cite:1]
Users drop when the office is busy	NAT pool exhaustion. August 13, 2026.	Public IP and port count.	Enlarge the pool. Do not only disable ALG.	[cite:3]
One-way audio after a new firewall	SIP ALG still rewrites signaling.	b2exve ALG section. re-check	Turn ALG off using the vendor’s steps.	[cite:3]

05 · Flow

One optimized call

Step	From	To	Mechanism	Notes	Cite
1	Endpoint	Cloud STUN	Binding	Learn the server-reflexive address.	[cite:1]
2	Caller	Callee	SIP	Exchange candidates.	[cite:1]
3	Both	Candidates	Checks	Pick a path.	[cite:1]
4	Both	Media	Reinvite	Send on the optimized path.	[cite:1]
5	If recording	Cloud	Media	Skip optimization.	[cite:1]
6	Local Gateway	Webex	UDP	Source 8000–48199 toward the listed destinations.	[cite:3]
7	Firewall	SIP ALG	Disable	January 21, 2025 line. re-check.	[cite:3]
8	NAT	Pool	Size	August 13, 2026. Prevent exhaustion.	[cite:3]

06 · Config

What you enable, and what you turn off

On desk phones and Webex App, leave media optimization at the default unless you are in a case the article excludes. [cite:1]
On the Local Gateway, configure voice class stun-usage and the G.711 codec class from jr1i3r. Confirm CUBE is at least 17.3 or 16.12.5 before you promise optimization. [cite:1] [cite:2]
Give the gateway a public address or put the phones on a network that can reach it. [cite:1]
Open b2exve before any ACL. Quote 5062, 8934, and the media ranges from the current table. [cite:3]
Turn SIP ALG off. Mark that recommendation re-check because the history line is January 21, 2025. [cite:3]
Validate NAT pool size. That procedure was updated August 13, 2026. [cite:3]

07 · Limits

Numbers these articles state

Item	Value	Source	Verified?
ICE on Local Gateway	CUBE 17.3 or 16.12.5 minimum, in nt6eyxb	[cite:1]	Quoted
Optimized app ports	8500–8699, audio 8500–8599 and video 8600–8699	[cite:3]	Quoted
Optimized device ports	19560–19661	[cite:3]	Quoted
LGW media source to cloud	UDP 8000–48199	[cite:3]	Quoted
Certificate return media	UDP 19560–65535	[cite:3]	Quoted
Phone signaling source	5060–5280, expanded September 07, 2026	[cite:3]	Quoted
SIP ALG addition	January 21, 2025	[cite:3]	re-check
Peer media-bypass parity	TODO-verify	Not in nt6eyxb	Open

08 · Troubleshooting

Failures

Symptom	Likely cause	Evidence	Fix	Cite
Internal calls hairpin	ICE failed, or the gateway is unreachable.	Troubleshooting path field. nt6eyxb reachability.	Public IP or same network.	[cite:1]
Cross-org calls hairpin	They are required to use the PSTN.	Organization boundary.	Do not file that as an ICE bug.	[cite:1]
Recorded calls hairpin	Recording disables optimization.	Recording flag.	Expect cloud media.	[cite:1]
DECT will not optimize	Excluded.	Device type.	Stop the test.	[cite:1]
Audio delay at answer	ICE, recording, or both.	The delay sentence.	Tell the user which features are on.	[cite:1]
ALG “helps SIP”	b2exve recommends off.	Firewall SIP awareness.	Disable it. re-check the 2025 line.	[cite:3]
Random failures at peak	Port exhaustion.	NAT pool.	Add public addresses.	[cite:3]
ACL allows 5061 only	Trunk destinations in this table are 5062 and 8934. 5061 is not that row.	b2exve signaling row.	Fix the destination.	[cite:3]
App video blocked	Video is 8600–8699, not the audio range.	DSCP and port rows.	Allow both.	[cite:3]
Cipher taught as a port	AES_CM_128_HMAC_SHA1_80 is the commercial sample suite.	w0qmeu / jr1i3r.	Keep it out of the ACL.	[cite:2]

09 · Self-question ladder

Twelve rungs

L1Which devices does nt6eyxb include?

Desk phones except DECT and ATA, Webex App, and Local Gateway. [cite:1]

L1Is optimization on by default for the app?

Yes. The article says it usually needs no extra configuration. [cite:1]

L2Name the four phases.

Candidate discovery, candidate exchange, connectivity checks, media path optimization. [cite:1]

L2What minimum does that article give for CUBE?

17.3 or 16.12.5. [cite:1]

L2Where does interorganization media go?

Through the PSTN. [cite:1]

L3What happens to a recorded call?

Media goes to the cloud and is not optimized. [cite:1]

L3Webex App optimized audio ports?

8500–8599. Video is 8600–8699. [cite:3]

L3Device-to-device optimized ports?

19560–19661. [cite:3]

L4What did September 07, 2026 change?

Phone source signaling from 5060–5080 to 5060–5280. [cite:3]

L4Why is SIP ALG marked re-check?

The revision line that added it is January 21, 2025, more than 12 months before 2026-10-14. The sentence is still on the page. [cite:3]

L5What is the August 13, 2026 NAT sentence?

Validate NAT pool size so port exhaustion does not stop users and devices. [cite:3]

L5What will you not teach?

A Teams media-bypass equivalent. TODO-verify.

10 · Lab

Paper lab

Goal: label one call optimized or not, using only nt6eyxb’s exclusions.
Prereq: no production firewall change until b2exve is open.
Step 1. Write the four ICE phases.
Step 2. Mark DECT, ATA, recording, and a second organization as not optimized.
Step 3. Copy the app audio range and the device range from b2exve.
Step 4. Write the ALG recommendation and the date January 21, 2025 next to re-check.
Evidence: the label and the two port ranges.
Break it: put 5061 on the trunk ACL because an SRV example used 5061. Recovery: 5062 or 8934 from the signaling row.
Reflection: which delay you would mention if both ICE and recording are on.

11 · Quiz

Twelve questions

Q1MCQ

DECT and media optimization:

Answer

DECT is excluded. ATA is excluded. [cite:1]

Q2MCQ

Local Gateway ICE requires CUBE:

Answer

17.3 or 16.12.5 in nt6eyxb. [cite:1]

Q3MCQ

The reinvite does what?

Answer

Starts media on the optimized path. [cite:1]

Q4Scenario

Two orgs, both on Webex Calling. Where is the media?

Answer

Through the PSTN. Optimization is inside one organization. [cite:1]

Q5MCQ

Recording and ICE together:

Answer

Media is not optimized, and the initial delay is longer than either feature alone. [cite:1]

Q6MCQ

Optimized device ports:

Answer

19560–19661. [cite:3]

Q7MCQ

Local Gateway media source toward the cloud:

Answer

UDP 8000–48199. [cite:3]

Q8MCQ

SIP ALG:

Answer

b2exve recommends off. The history line is January 21, 2025. re-check. [cite:3]

Q9Scenario

Phones fail only at busy hour. Which August 2026 sentence applies?

Answer

NAT pool size and port exhaustion. [cite:3]

Q10Draw

Write the two G.711 preference lines.

Answer

codec preference 1 g711ulaw and codec preference 2 g711alaw. [cite:2]

Q11MCQ

Commercial SRTP sample in the colocation article:

Answer

AES_CM_128_HMAC_SHA1_80. [cite:2]

Q12Scenario

A design equates this to Teams media bypass. What is the mark?

Answer

TODO-verify. nt6eyxb does not say that.

12 · Audio

Slots for Studio

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

13 · Interview

Oral answers

30 seconds. ICE can keep media direct inside one organization for the app, supported desk phones, and a reachable Local Gateway. Recording, DECT, ATA, and a second organization do not take that path. [cite:1]

2 minutes. The phases are discovery, exchange, checks, and a reinvite. CUBE ICE-lite in that article needs 17.3 or 16.12.5. [cite:1] I quote b2exve for 8500–8699, 19560–19661, 5062, and 8934. I mark SIP ALG re-check because of the January 21, 2025 history line, and I keep the August 13, 2026 NAT-pool sentence separate. [cite:3]

30 seconds, codecs. The Local Gateway guide’s class is G.711 µ-law then A-law. That is not the third-party phone preference list. [cite:2]

2 minutes, delays. ICE and recording each add a small delay at the start. Together it is more noticeable. I will not call a recorded call a direct-media proof. [cite:1]

What you will not say. You will not build the ACL from memory, and you will not call 5061 the trunk destination.

14 · Citations

Ledger

Retrieved 2026-10-14. Mirrors cites/T7-R03.md.

Webex Calling media optimization with ICE — help.webex — article nt6eyxb — help.webex.com article nt6eyxb — retrieved 2026-10-14. Supported devices. Default on. Four phases. CUBE 17.3 or 16.12.5. Public IP or same-network reachability. Same-organization only. Recording not optimized. Combined delay.
Configure Local Gateway on Cisco IOS XE for Webex Calling — help.webex — article jr1i3r — help.webex.com article jr1i3r — retrieved 2026-10-14. Codec preference g711ulaw then g711alaw. voice class stun-usage 100. Colocation article w0qmeu prints the same G.711 order and AES_CM_128_HMAC_SHA1_80. help.webex.com article w0qmeu.
Port Reference Information for Webex Calling — help.webex — article b2exve — help.webex.com article b2exve — retrieved 2026-10-14. Revision September 07, 2026 for phone source 5060–5280. Media ranges as quoted. SIP ALG section added January 21, 2025. NAT pool procedure updated August 13, 2026.
Cisco managed third-party device support on Webex Calling — help.webex — article njwkamr — help.webex.com article njwkamr — retrieved 2026-10-14. Device codec preference orders exist. They are not voice class codec 100.

15 · Re-engineer later

Open

Open questions: the CUBE ICE-lite restriction page was named and not copied.
Facts still TODO-verify: 1. Peer media-bypass equivalence.
re-check: SIP ALG paragraph, history January 21, 2025.
Assets missing: a path diagram with ports, audio.
Next review: nt6eyxb, b2exve, jr1i3r.

Sources and go deeper

Checked links were opened this month. A confirm row has no address because that page was not opened.

Wikipedia Webex (Wikipedia) last checked 2026-10
Vendor doc Webex Help Center last checked 2026-10
DevDocs Webex developer documentation last checked 2026-10
DevDocs Webex developer getting started last checked 2026-10
Community Webex community last checked 2026-10
SRND Cisco Collaboration design zone last checked 2026-10
RFC RFC 3261 SIP: Session Initiation Protocol last checked 2026-10
Port table IANA service name and port number registry last checked 2026-10
Port table Port reference for Webex Calling last checked 2026-10
RFC RFC 3263 Locating SIP Servers last checked 2026-10
RFC RFC 3264 An Offer/Answer Model with SDP last checked 2026-10
Wikipedia Session Initiation Protocol (Wikipedia) last checked 2026-10
RFC RFC 3550 RTP last checked 2026-10
RFC RFC 3711 SRTP last checked 2026-10
RFC RFC 4566 SDP last checked 2026-10
RFC RFC 4733 RTP payload for DTMF last checked 2026-10
Wikipedia Real-time Transport Protocol (Wikipedia) last checked 2026-10
Release notes What's new in Webex Calling last checked 2026-10
RFC RFC 8446 TLS 1.3 last checked 2026-10
Vendor doc help.webex.com article nt6eyxb last checked 2026-10
Vendor doc help.webex.com article jr1i3r last checked 2026-10
Vendor doc help.webex.com article w0qmeu last checked 2026-10
Vendor doc help.webex.com article njwkamr last checked 2026-10

sources.json for this page.