00 · Header

T7 · SIP, routing, and queues

SIP trunk design

Color-coded sequence: Phone → CUBE → Control Hub → PSTN. A packet moves along the arrows. Reduced motion keeps every step visible.

Certificate and registration trunks, route-group priority, and the FQDN that must sit in the certificate. Retrieved 2026-10-14.

Room T7-R04 Version v0.1 last-verified: TODO Difficulty L3 Est. time 100–130 min Prereq T7-R01 Reading 16 min

Key takeaways

A route group holds at least one trunk and at most ten. Same priority is random load balancing. A lower priority is used when the higher-priority trunks are unavailable. [cite:1]
Trunk status is online, offline, impaired, or unknown. The page updates every 3 minutes. Online means every Webex Calling edge proxy reached the Local Gateway. Impaired means at least one proxy did not. [cite:1]
Error 6 is an FQDN missing from the certificate CN or SAN. The jwkbt2 example strips :5061 off london.lgw.cisco.com. [cite:1] [cite:2]
t9xctu: wildcard certificates are not supported. Certificates with only Server Authentication EKU are supported. Webex does not require Client Authentication EKU. [cite:3]
Each Local Gateway is assigned to two Webex Media PoPs in the region, through DNS SRV, for redundancy. [cite:3]

01 · Executive summary

Ten trunks, two priorities, one FQDN

A route group holds at least one trunk and at most ten. Same priority is random load balancing. A lower priority is used when the higher-priority trunks are unavailable. [cite:1]
Trunk status is online, offline, impaired, or unknown. The page updates every 3 minutes. Online means every Webex Calling edge proxy reached the Local Gateway. Impaired means at least one proxy did not. [cite:1]
Error 6 is an FQDN missing from the certificate CN or SAN. The jwkbt2 example strips :5061 off london.lgw.cisco.com. [cite:1] [cite:2]
t9xctu: wildcard certificates are not supported. Certificates with only Server Authentication EKU are supported. Webex does not require Client Authentication EKU. [cite:3]
Each Local Gateway is assigned to two Webex Media PoPs in the region, through DNS SRV, for redundancy. [cite:3]

Why it matters. Impaired is not offline. A wildcard that a CA issued is still not a Webex Calling trunk certificate.

02 · Architecture map

How a route group fails over

Mermaid source (not rendered)

flowchart LR
  A --> B

03 · Core concepts

Status words and certificate names

Priority is not weight

n0xb944’s route-group example: trunks 1 and 2 at priority 1 share calls. Trunk 3 at priority 2 is used when 1 and 2 are unreachable. SRV weight and priority are a different sentence, on the DNS records for calls originating from Webex Calling. [cite:1]

Errors 2, 6, 11, and 12

Those four are shown only when all edge proxy nodes have the problem. A single-proxy failure is the impaired state, not that short list. [cite:1]

More than 1000 trunks

If search returns more than 1000 trunks, you cannot sort or search within the results. [cite:1]

Two PoPs

t9xctu says the assignment is geographic. An EU gateway uses two media PoPs in the EU. [cite:3]

Status

Status	Article’s meaning	Cite
Online	Successful connection between all edge proxies and the Local Gateway.	[cite:1]
Offline	Unsuccessful connection between Webex Calling and the Local Gateway.	[cite:1]
Impaired	At least one edge proxy failed.	[cite:1]
Unknown	Connection in progress for a recently added Local Gateway.	[cite:1]

04 · Ecosystem & sister technologies

Glossary, map, sisters, edges

Mini map of the neighbors named on this room’s sequence. Orientation sketch, not a new product claim.

Glossary

Trunk: The connection from Webex Calling to a local gateway or other supported device. [cite:1]
Registration trunk: The SBC registers. t9xctu: up to 250 concurrent calls, and the getting-started table limits that model to CUBE. [cite:3]
Certificate trunk: You enter an FQDN. Webex trusts the gateway from that FQDN plus the certificate. Concurrent calls above 250 in the getting-started wording. Table 5 is a separate band table and is not flattened here. [cite:1] [cite:3]
Route group: 1 to 10 trunks, possibly from multiple locations. [cite:1]
Priority: Same number means random distribution. Lower priority is the backup. [cite:1]
SRV weight: DNS records for the gateway FQDN. Differing weight and priority change distribution of calls from Webex Calling. Use the same listening port on those records. [cite:1]
FQDN in the certificate: CN or SAN must match the Control Hub FQDN, without the port. [cite:2]
Wildcard: Not supported, in t9xctu. [cite:3]
Server Authentication EKU: Supported alone. Client Authentication EKU is not required by Webex. Some third-party SBCs reject that certificate. [cite:2] [cite:3]
Two media PoPs: Assigned at provisioning, via DNS SRV, inside the region. [cite:3]
OPTIONS: Error 7: OPTIONS sent to the Local Gateway got no response. Error 11: the gateway is not sending OPTIONS toward Webex. [cite:1]
3 minutes: Trunk status updates on that interval. Refresh is still manual if you want the page now. [cite:1]
Impaired versus all-proxy errors: Impaired is one proxy. Errors 2, 6, 11, and 12 appear when every proxy is affected. [cite:1]
Calls to on-premises extensions: Per location. Unknown extensions of 2–10 digits can use a trunk or route group. [cite:1]
Premises PSTN boundary: Calls originating from premises users cannot access cloud PSTN. [cite:1]
DI interop trunk: Separate from a customer Local Gateway. ofrt6u activates the certificate trunk Cisco already created. [cite:4]

Mind map

Mermaid source (not rendered)

mindmap
  root((T7-R04))
    Core
    Sisters

Sister-technology matrix

Sister	What it is	Why it matters here	Config touchpoint	Typical failure	Cite
Local Gateway	Terminates the trunk.	Registration or certificate.	CUBE for registration. Certificate allows the device types in t9xctu.	Registering a third-party SBC.	[cite:3]
Route group	Redundancy across trunks.	Up to 10.	Services > PSTN & Routing > Gateway configurations.	One priority for every trunk when you wanted a backup.	[cite:1]
DNS	SRV and A records.	Weight, priority, one listening port.	Public DNS for the certificate FQDN.	Different ports on the SRV targets.	[cite:1]
Certificate authority	Must be one Webex trusts.	Error 3 and error 9 name an invalid CA.	The root article linked from n0xb944.	A private CA.	[cite:1]
Edge proxies	The far side of status.	All of them for online.	Status column.	Reading impaired as offline.	[cite:1]
Media PoPs	Two per gateway, in-region.	Not something you type as IP addresses on the trunk.	Provisioning.	Pinning one PoP in an ACL from memory.	[cite:3]
Dedicated Instance	Its own certificate trunks.	Do not reuse this route-group lesson to edit WXC-DI trunks. 2vpf1 says not to.	ofrt6u activation.	Deleting a default trunk.	[cite:4]
Cloud PSTN	For Webex Calling users.	Not for premises-originated calls.	Location PSTN.	Pointing a PBX user at Cisco Calling Plan.	[cite:1]

Integration map

From	To	Mechanism	What moves	Cite
Control Hub	Local Gateway	Registration or mTLS	The trunk.	[cite:1]
Route group	Trunks	Priority	Random within a priority. Fail down.	[cite:1]
Webex Calling	Gateway DNS	SRV	Weight and priority. Same port.	[cite:1]
Certificate	TLS	CN or SAN	FQDN without the port.	[cite:2]
Edge proxy	Status	Poll	Every 3 minutes.	[cite:1]
Gateway	Two media PoPs	SRV	Regional pair.	[cite:3]
Location	PBX	Calls to On-Premises Extensions	Unknown 2–10 digit extensions.	[cite:1]
Multi-tenant	Dedicated Instance	Certificate interop	Activated, not hand-edited.	[cite:4]

Cross-platform bridges

Webex behavior	Legacy habit	Peer orientation	Cite
Route-group priority	CUCM route-list priority is a different product. Do not copy the numbers across.	Peer SBC priority names are TODO-verify.	[cite:1]
FQDN without :5061	A CUCM SIP trunk security profile is not this check.	jwkbt2’s example is the one to quote.	[cite:2]
Two media PoPs	A single-homed data center is not this assignment.	The article says typically two, geographically separated, same region.	[cite:3]

Future-integration hooks

Canon plan: T7-R03 owns the UDP media ranges. This room owns signaling destinations 5062 and 8934 only as the status and certificate story.
Table 5 concurrent-call bands stay in t9xctu. Do not collapse them into “more than 250.” [cite:3]
IOS-XE minimums per platform stay on t9xctu’s matrix. This room does not restate 17.6.1a or 17.9.1a unless you have that table open.

Ecosystem troubleshooting

Symptom	Likely sister-system cause	Check	Fix	Cite
Status impaired	One edge proxy cannot reach the gateway.	n0xb944 status table.	Do not rebuild the trunk until you see whether every proxy failed.	[cite:1]
Error 6	FQDN not in CN or SAN.	Certificate.	Reissue with the Control Hub name and no port.	[cite:1]
Third-party SBC drops the Webex certificate	It requires Client Authentication EKU.	t9xctu and jwkbt2.	Accept Server Authentication EKU only, or disable strict EKU if the SBC allows it.	[cite:2]
Backup trunk never takes calls	It shares priority 1, so it is in the random set, not the backup.	Route group priorities.	Set a worse priority number.	[cite:1]

05 · Flow

From trunk to route group

Step	From	To	Mechanism	Notes	Cite
1	Admin	Trunk	Create	Registration or certificate.	[cite:1]
2	Certificate	CA and EKU	Check	No wildcard. Server Authentication EKU is enough for Webex.	[cite:3]
3	FQDN	CN or SAN	Match	Strip any port.	[cite:2]
4	Trunks	Route group	Priority	At most 10.	[cite:1]
5	Webex	Gateway	SRV	Two media PoPs.	[cite:3]
6	Status	Operator	3 minutes	Online, offline, impaired, unknown.	[cite:1]
7	OPTIONS	Both ways	Errors 7 and 11	Receive and send.	[cite:1]
8	Location	Premises	Unknown extensions	2–10 digits, if you enable the setting.	[cite:1]

06 · Config

Control Hub, then the certificate

Add the trunk before the route group. Path for the route group: Services > PSTN & Routing > Gateway configurations. Cisco Calling Plan customers can add a route group from Services > Calling > Call Routing. [cite:1]
Set priorities. Put backups on a lower priority than the pair that should share load. [cite:1]
For a certificate trunk, put the FQDN in Control Hub and in the certificate CN or SAN. Do not include the port in the certificate name. [cite:2]
Reject wildcard certificates. Confirm Server Authentication EKU. [cite:3]
Read status after 3 minutes. Use Refresh for the latest timestamp. [cite:1]
If Dedicated Instance interop is also in the design, activate ofrt6u’s certificate trunk. Do not edit the WXC-DI objects. [cite:4]

07 · Limits

Numbers these articles state

Item	Value	Source	Verified?
Trunks per route group	1 to 10	[cite:1]	Quoted
Status interval	3 minutes	[cite:1]	Quoted
Search sort limit	No sort or in-result search above 1000 trunks	[cite:1]	Quoted
Wildcard certificates	Not supported	[cite:3]	Quoted
Media PoPs per gateway	Two, in the region	[cite:3]	Quoted
Registration concurrent calls	Up to 250, CUBE only, getting-started wording	[cite:3]	Quoted
Certificate concurrent calls	Getting-started wording is above 250. Table 5 not flattened.	[cite:3]	Sentence quoted
Other-SBC priority syntax	TODO-verify	Not in n0xb944	Open

08 · Troubleshooting

Failures

Symptom	Likely cause	Evidence	Fix	Cite
Offline	Webex and the gateway are not connected.	Status definition.	DNS, port, certificate. Error 1 is DNS of the FQDN.	[cite:1]
Unknown for an hour	Unknown is for a recently added gateway.	If it persists, it is no longer that sentence.	Refresh. Then read the error table.	[cite:1]
Certificate expired	Errors 4 and 15.	Dates on the chain.	Renew. Root and intermediate must be unexpired too.	[cite:1]
Revoked	Errors 13 and 14.	The action column.	Replace the certificate.	[cite:1]
OPTIONS silence	Error 7 or 11.	Which direction.	Configure CUBE to answer, or to send.	[cite:1]
Maintenance	Error 12: Server error or Service Unavailable.	Gateway mode.	Leave maintenance. Enable call routing.	[cite:1]
SRV targets use two ports	n0xb944 recommends the same listening port.	DNS.	Align the port.	[cite:1]
Wildcard was accepted by the CA	t9xctu still says wildcards are not supported for this trunk.	Certificate.	Reissue a named certificate.	[cite:3]
EKU mismatch on a third-party SBC	Client Authentication EKU missing.	SBC policy.	Accept server EKU.	[cite:2]
You edited a WXC-DI trunk to add priority	Those trunks are not this customer route group.	2vpf1 via ofrt6u’s neighborhood.	Build a separate route group for premises trunks.	[cite:4]

09 · Self-question ladder

Twelve rungs

L1How many trunks can a route group hold?

At most 10, and at least one. [cite:1]

L1What does equal priority do?

Random load balancing. [cite:1]

L2Define impaired.

At least one edge proxy failed. Online means all of them succeeded. [cite:1]

L2How often does status update?

Every 3 minutes. [cite:1]

L2What is error 6?

The Control Hub FQDN is missing from CN or SAN. [cite:1]

L3What does the london.lgw.cisco.com:5061 example prove?

The certificate must contain london.lgw.cisco.com, not the port. [cite:2]

L3Are wildcard certificates allowed?

t9xctu says no. [cite:3]

L3Does Webex require Client Authentication EKU?

No. Some third-party SBCs still reject a server-only EKU. [cite:2]

L4How many media PoPs is a gateway assigned?

Two, in the same region, via SRV. [cite:3]

L4When do errors 2, 6, 11, and 12 show?

When all edge proxy nodes have the issue. [cite:1]

L5What breaks above 1000 trunks in search?

You cannot sort or search within those results. [cite:1]

L5What is still TODO-verify?

Peer SBC priority syntax.

10 · Lab

Paper lab

Goal: draw a three-trunk route group that load-balances two and fails over to the third.
Prereq: no production certificate change.
Step 1. Label trunks A and B priority 1, trunk C priority 2.
Step 2. Write the four status words and the 3-minute interval.
Step 3. Write a certificate CN for FQDN gw.example.com configured as gw.example.com:5061. Expected: the CN has no port.
Step 4. State the wildcard rule in one line.
Evidence: the drawing and the CN.
Break it: give all three trunks priority 1 and call C the backup. Recovery: set C to a lower priority.
Reflection: which errors appear only when every proxy fails.

11 · Quiz

Twelve questions

Q1MCQ

Route group size:

Answer

1 to 10 trunks. [cite:1]

Q2MCQ

Priority 1 on two trunks means:

Answer

Random load balancing between them. [cite:1]

Q3MCQ

Impaired means:

Answer

At least one edge proxy failed. [cite:1]

Q4MCQ

Status updates every:

Answer

3 minutes. [cite:1]

Q5Scenario

Control Hub FQDN is london.lgw.cisco.com:5061. What is in the certificate?

Answer

london.lgw.cisco.com. [cite:2]

Q6MCQ

Wildcard certificates:

Answer

Not supported. [cite:3]

Q7MCQ

Client Authentication EKU:

Answer

Webex does not require it. A third-party SBC might. [cite:2]

Q8MCQ

Media PoPs:

Answer

Two per gateway, in the region. [cite:3]

Q9Scenario

Error 6 is visible. What failed?

Answer

FQDN missing from CN or SAN, and the article shows that error when all proxies are affected. [cite:1]

Q10MCQ

Search above 1000 trunks:

Answer

You cannot sort or search within the results. [cite:1]

Q11Draw

Write the n0xb944 priority example.

Answer

Trunks 1 and 2 at priority 1. Trunk 3 at priority 2, used when 1 and 2 are unreachable. [cite:1]

Q12MCQ

Registration trunk concurrent calls in the getting-started wording:

Answer

Up to 250, CUBE only. Do not flatten Table 5 into that sentence. [cite:3]

12 · Audio

Slots for Studio

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

Transcript slot

Studio fills this. The prompt is the spoken outline, not a second article.

13 · Interview

Oral answers

30 seconds. A route group has up to ten trunks. Equal priority load-balances at random. A lower priority is the failure path. Status is online, offline, impaired, or unknown, every 3 minutes. [cite:1]

2 minutes. The certificate FQDN matches Control Hub without the port. Wildcards are out. Server Authentication EKU is enough for Webex, and some SBCs still want client EKU. [cite:2] [cite:3] Two media PoPs come from SRV inside the region. [cite:3] Errors 2, 6, 11, and 12 mean every proxy is in trouble. [cite:1]

30 seconds, OPTIONS. Error 7 is no response to OPTIONS. Error 11 is the gateway not sending them. [cite:1]

2 minutes, what I leave alone. I do not edit Dedicated Instance default trunks. I do not send premises-originated calls to cloud PSTN. I do not collapse Table 5. [cite:1] [cite:3]

What you will not say. You will not invent a peer-SBC priority command.

14 · Citations

Ledger

Retrieved 2026-10-14. Mirrors cites/T7-R04.md.

Configure trunks, route groups, and dial plans for Webex Calling — help.webex — article n0xb944 — help.webex.com article n0xb944 — retrieved 2026-10-14. Route group 1–10. Priority example. Status every 3 minutes. Error table including error 6. SRV weight and the same listening port. Calls to On-Premises Extensions. Premises-originated calls cannot use cloud PSTN. Search limit 1000.
Security requirements for Webex Calling — help.webex — article jwkbt2 — help.webex.com article jwkbt2 — retrieved 2026-10-14. FQDN in CN or SAN without the port. london.lgw.cisco.com:5061 example. Server Authentication EKU. Client Authentication EKU not required by Webex.
Get started with Local Gateway — help.webex — article t9xctu — help.webex.com article t9xctu — retrieved 2026-10-14. Registration up to 250 and CUBE only. Certificate wording above 250, Table 5 not flattened. No wildcard. Two media PoPs. EKU sentences.
Activate inter-op SIP trunk to Webex Calling multi-tenant — help.webex — article ofrt6u — help.webex.com article ofrt6u — retrieved 2026-10-14. Dedicated Instance interop is a certificate trunk you activate. Combined with 2vpf1’s do-not-edit rule as used in T6-R07.

15 · Re-engineer later

Open

Open questions: the live device-type list for certificate trunks changes. Read t9xctu’s table before you name a vendor.
Facts still TODO-verify: 1. Peer SBC priority syntax.
Assets missing: a redacted certificate with the key removed, audio.
Next review: n0xb944, jwkbt2, t9xctu.

Sources and go deeper

Checked links were opened this month. A confirm row has no address because that page was not opened.

Wikipedia Webex (Wikipedia) last checked 2026-10
Vendor doc Webex Help Center last checked 2026-10
DevDocs Webex developer documentation last checked 2026-10
DevDocs Webex developer getting started last checked 2026-10
Community Webex community last checked 2026-10
SRND Cisco Collaboration design zone last checked 2026-10
RFC RFC 3261 SIP: Session Initiation Protocol last checked 2026-10
Port table IANA service name and port number registry last checked 2026-10
Port table Port reference for Webex Calling last checked 2026-10
RFC RFC 3263 Locating SIP Servers last checked 2026-10
RFC RFC 3264 An Offer/Answer Model with SDP last checked 2026-10
Wikipedia Session Initiation Protocol (Wikipedia) last checked 2026-10
RFC RFC 3550 RTP last checked 2026-10
RFC RFC 3711 SRTP last checked 2026-10
RFC RFC 4566 SDP last checked 2026-10
RFC RFC 4733 RTP payload for DTMF last checked 2026-10
Wikipedia Real-time Transport Protocol (Wikipedia) last checked 2026-10
Release notes What's new in Webex Calling last checked 2026-10
Vendor doc help.webex.com article n0xb944 last checked 2026-10
Vendor doc help.webex.com article jwkbt2 last checked 2026-10
Vendor doc help.webex.com article t9xctu last checked 2026-10
Vendor doc help.webex.com article ofrt6u last checked 2026-10

sources.json for this page.