00 · Header
T2 · Webex Calling
Local Gateway & PSTN Options
Every location picks one PSTN path. Local Gateway is the premises session border controller that keeps your carrier. It is not the registrar for phones.
01 · Executive summary
Five lines, then why it matters
- Webex Calling documents three PSTN choices, selected per location: Cisco PSTN (Cisco Calling Plan), Cloud Connected PSTN, and premises-based PSTN (Local Gateway). You may mix them across locations. Each location has one. [cite:1]
- Local Gateway terminates a trunk on a supported session border controller. Two trunk models exist: registration-based and certificate-based. They differ in scale and device support. [cite:2] [cite:3]
- Registration-based trunks are up to 250 concurrent calls per trunk and support only CUBE. Certificate-based trunks are for more than 250 concurrent calls per trunk and a choice of device types. [cite:3]
- Signaling to Webex Calling uses SIP over TLS, and media uses SRTP. [cite:4] Phones do not register through the Local Gateway; Cisco Live states endpoints register to Webex Calling over the internet. [cite:5]
- Webex for Government uses the certificate-based trunk, and the getting-started article says CUBE is the only SBC that currently supports Webex for Government. [cite:3] [cite:4]
02 · Architecture map
Three ways a call reaches the PSTN
- 1Location holds the PSTN choice
- 2Trunk is the premises connection
- 3Route group / dial plan
- 4Registration model
- 5Certificate model
Mermaid source (offline SVG above is the picture)
flowchart LR EP[Endpoints] --> WX[Webex Calling] WX --> CCPN[Cisco Calling Plan] WX --> CCP[Cloud Connected PSTN] WX --> LGW[Local Gateway] LGW --> PSTN[Carrier or PBX]
Studio asset still required: assets/diagrams/T2-R02/arch.svg
03 · Concept deep-dive
Choose the path before you touch dial peers
The calling setup article is blunt: the PSTN choice is at location level, each location has only one PSTN option, and you can mix options across a deployment. After you provision an option you can change it from Manage on the location’s PSTN properties, but some options — Cisco PSTN is the example — may not be available once another option was assigned. Open a support case for guidance rather than clicking until it works. [cite:1]
assets/images/T2-R02/hero.png · Studio: a location card with three cables, only one plugged in, and a phone registering upward to the cloud instead of sideways into the gateway.The three PSTN options
| Option | What help says you are choosing | When the article says it fits | Cite |
|---|---|---|---|
| Cisco PSTN / Cisco Calling Plan | A cloud PSTN replacement from Cisco: emergency calling, inbound and outbound domestic and international calling, order new numbers or port existing numbers to Cisco. | Visible only if you purchased at least one committed Outbound Calling Plan, the location’s country is supported, the location is eligible, and you are hosted in a supported Webex Calling data center. | [cite:1] [cite:6] |
| Cloud Connected PSTN | Cloud PSTN from a CCP partner. Integrated CCP can order numbers inside Control Hub. Non-integrated CCP means you buy numbers from the partner outside Control Hub. | When you want a partner cloud PSTN, or Cisco Calling Plan is not available in the location. Only partners that support the location’s country are displayed. | [cite:1] |
| Premises-based PSTN (Local Gateway) | Keep the current PSTN provider, or connect non-cloud sites with cloud sites. The premises end is a trunk on a supported SBC. | Existing carrier, existing SBC, or a need to hairpin between cloud and non-cloud sites. | [cite:1] [cite:2] |
A Cisco at-a-glance PDF (cm-5770) describes the same three families and names third-party SBC vendors (AudioCodes, Oracle, Ribbon) alongside CUBE for Local Gateway. The help article on trunks is stricter: third-party SBC integration is supported with certificate-based trunk, and only SBCs shown in the Control Hub device-type list are validated. Treat the PDF as marketing scope and the Control Hub list as the deployable list. [cite:7] [cite:2] Open the device-type list on the trunk in Control Hub. It changes when Cisco validates a new SBC, and the at-a-glance PDF is not that list.
Two Local Gateway trunk models
| Registration-based | Certificate-based | |
|---|---|---|
| Concurrent calls | Up to 250 per trunk | More than 250 per trunk |
| Device | CUBE only | Device types in the certificate-trunk table; third-party only if listed in Control Hub |
| Authentication | Digest: shared username and password for registration and calls | Certificate plus FQDN verification. Contact header on SIP the LGW sends must carry the LGW FQDN. OPTIONS matter for Control Hub status. |
| Certificate | Upload the CA bundle that signed the Webex service certificate | That, plus an LGW certificate from a listed CA. Wildcard certificates are not supported. Server Authentication EKU alone is supported; Webex Calling does not require Client Authentication EKU. |
| Webex for Government | Not the option the IOS-XE guide tells you to use | Required. CUBE is the only SBC the getting-started article says currently supports Webex for Government. |
Rows above are compressed from Get started with Local Gateway and the trunk article. [cite:3] [cite:2] [cite:4]
Objects you configure, in dependency order
| Object | What it decides | If it is missing | Cite |
|---|---|---|---|
| Location | Which one PSTN option applies, plus address, language, and time zone | There is nowhere to hang numbers or a trunk | [cite:1] |
| Trunk | Registration or certificate connection to the premises SBC | The CUBE has nothing in Control Hub to register or peer with | [cite:2] |
| Route group / dial plan | Which trunk Webex Calling uses for which calls | A registered trunk still does not carry the location’s PSTN calls | [cite:2] |
| Numbers on the location | What can be called and what the location can present | The calling article shows a caution and says you cannot make or receive calls | [cite:1] |
| Endpoint registration | Separate from the trunk. Phones register to Webex Calling | Users have no phone service even if the trunk is online | [cite:5] |
What the gateway is not
BRKCOL-2312 (Cisco Live 2025) states that endpoint registration is not proxied through the Local Gateway. Endpoints register directly to Webex Calling over the internet. The gateway’s job is premises PSTN or IP-PBX connectivity, and it can be part of a paced migration. [cite:5] Survivability Gateway is a different service: BRKCOL-2312 describes it as a site gateway managed from Control Hub that routes internal, external, and emergency calls during a network outage. Co-locating LGW and SGW has its own constraints in that deck, including an IOS-XE release note. Survivability is T2-R07; do not collapse the two names in this room.
Write the location’s PSTN choice on the design in the same sentence as the trunk type. “LGW” alone does not tell you registration versus certificate, and that choice changes the certificate plan, the firewall, and the call budget. [cite:3]
For registration trunks the IOS-XE guide says max-conn on the Webex dial peer should be 250 or lower. Setting it higher does not raise the documented trunk limit. [cite:4] Certificate trunks that share an IP and port across customers can lose capacity; the partner-hosted gateway article says separate TCP connections per trunk support the maximum concurrent call capacity. [cite:8]
BRKCOL-2812 (2024) told viewers to permit TCP 8934 or 5062 and UDP 19560–65535, and to follow the updated Webex Calling port reference. That deck is more than 12 months old relative to 2026-10-14. re-check Current firewall objects are as of 2026-10-14, b2exve (revision history September 07, 2026): certificate signaling destination TCP 5062, registration destination TCP 8934, phone signaling source ports 5060–5280 (the devices protocol cell is blank; this room does not call that range TCP). Local-gateway media source UDP 8000–48199 toward 5004, 9000, 8500–8699, and 19560–65535. Build the ACL from that article, not from BRKCOL-2812 (2024). [cite:21]. against the live port reference before any ACL is written. [cite:9]
04 · Ecosystem
Ecosystem and sister technologies
A Local Gateway is a trunk, not the whole calling system. Emergency calling, the carrier choice, the SBC, and call recording sit beside it and fail independently. This section names those sisters. Peer PBX and contact-center products are orientation labels. The hub ecosystem map holds the cross-vendor picture.
Glossary
- Local Gateway
- The premises session border controller that terminates a Webex Calling trunk. Registration-based trunks are up to 250 concurrent calls and CUBE only. Certificate-based trunks are for more than 250 and a choice of device types. [cite:3]
- CUBE
- Cisco’s IOS XE session border controller. It is the only device for a registration trunk, and the getting-started article says it is the only SBC that currently supports Webex for Government. [cite:3] [cite:4]
- Premises PSTN
- One of the three PSTN families for a location, alongside Cisco Calling Plan and Cloud Connected PSTN. The trunk is how premises PSTN reaches Webex Calling. [cite:1] [cite:7]
- RedSky
- The emergency provider in the enhanced emergency calling article. You get a RedSky account, set alert email addresses, and allow the phones and the Webex client to reach RedSky. [cite:14]
- HELD / HELD+
- HTTP Enabled Location Delivery. The article lists HELD+ as used by Webex App, with dynamic location via network discovery using a wiremap. Supported clients named there include Cisco MPP phones and Webex App. [cite:14]
- Dispatchable location
- RAY BAUM’S Act Phase 2, begun January 2022, requires a correct dispatch address for non-fixed devices and nomadic users, including a Webex App user who leaves the premises. [cite:14]
- Kari’s Law
- Public Law 115-127. A call from the organization to emergency services must generate an email notification. Control Hub can enable that for all locations or for selected locations. [cite:15] [cite:14]
- 933
- A North American emergency test number for locations in the United States and Canada. It tests emergency-call email generation and does not alert public safety personnel. [cite:15]
- ECBN
- Emergency Callback Number. Extension-only users need an accurate ECBN: the location default, or another telephone number from that same location. [cite:17]
- Call recording provider
- The provider you select for the organization before anyone enables recording for users. Article nhvl4hw says both of these: “Webex is the default value,” and, later, “Dubber is chosen by default, as there is no additional cost to include Dubber Go.” This Canon cites both sentences. It does not claim a screenshot of which control paints first. [cite:16]
- Dubber Go
- Included with Webex Calling user entitlements at no additional cost. Unlimited recordings, each stored 30 days, and only the user manages them in the Dubber portal. [cite:16]
- Survivability Gateway
- A different service from Local Gateway. BRKCOL-2312 describes it as a site gateway, managed from Control Hub, that routes internal, external, and emergency calls during an outage. [cite:5]
Mind map
Mermaid mind map (no engine is loaded)
mindmap
root((Local Gateway))
Carriers
Cisco Calling Plan
Cloud Connected PSTN
Premises PSTN
SBC
CUBE registration
Certificate trunk
Third-party SBC
Emergency
RedSky
RAY BAUM
Kari email
ECBN
Recording
Webex provider
Dubber Go
Webhooks
Neighbor
Survivability Gateway
Studio asset still required: assets/diagrams/T2-R02/eco.svg
Sister-technology matrix
| Sister | What it is | Why it matters here | Config touchpoint | Typical failure | Cite |
|---|---|---|---|---|---|
| RedSky enhanced emergency | Emergency calling for hybrid and nomadic users. Phones and the Webex client use port 443 to https://api.wxc.e911cloud.com and https://wxc.e911cloud.com. | A trunk can be up and 911 can still fail if the client cannot reach RedSky or has no dispatch address. | Get a RedSky account. Allow those two hosts. Set alert email addresses. | Firewall allows SIP to Webex and blocks 443 to the RedSky hosts. | [cite:14] |
| RAY BAUM’S Act | Phase 2 began January 2022. Emergency calls must send a correct dispatch address for non-fixed devices and nomadic users. | A Webex App user who leaves the building is the example in the article. The site address is not automatically their dispatch address. | RedSky location and the HELD/HELD+ network discovery the article describes. | Off-premises soft client with no updated dispatch address. | [cite:14] |
| Kari’s Law notifications | Public Law 115-127. Emergency calls must generate an email notification. Notifications are disabled by default. | Legal notification is not the same feature as the carrier route. Both have to be true. | Services → PSTN & Routing → Settings → Emergency call notification. Turn it on at the organization before a location can have its own address. Location path: Management → Locations, then Emergency Calling. | Location toggle changed while the organization setting is still off. The article says the location setting requires the organization setting first. | [cite:15] |
| ECBN | Callback number for users with no direct telephone number. Location default, or another number from that location. | Extension-only users cannot complete emergency calling setup without it. The API description also restates the Kari email requirement. | Emergency callback configuration at the organization, then the user’s or location’s number. Read the emergency callback fields in Control Hub under the organization and the user’s location. The API description names the behavior, and the on-screen labels can change. | Extension-only user left on a callback number from a different location. | [cite:17] |
| CUBE / registration trunk | Registration-based Local Gateway. Up to 250 concurrent calls. CUBE only. max-conn on the Webex dial peer should be 250 or lower. | This is the premises PSTN choice for smaller call budgets. It is not how phones register. | Control Hub trunk, digest credentials, IOS XE guide for that trunk type. | Raising max-conn above 250 and expecting the documented trunk limit to rise. It does not. | [cite:3] [cite:4] |
| Certificate trunk and third-party SBC | More than 250 concurrent calls. Third-party SBC integration is supported on the certificate trunk, and only device types in the Control Hub list are validated. No wildcard certificates. | AudioCodes, Oracle, and Ribbon appear in the PSTN at-a-glance PDF. The help article is stricter than the PDF. | FQDN, public DNS, CN or SAN matches the FQDN, CA bundle. Partner-hosted certificate trunks can show a field range of 250–6500. | A vendor from the PDF that is absent from the live device-type list. Open the live device-type list on the trunk in Control Hub. A vendor in the at-a-glance PDF is deployable only when that list still shows it, and the list changes when Cisco validates an SBC. | [cite:2] [cite:7] [cite:8] [cite:10] |
| Carriers | Cisco Calling Plan, Cloud Connected PSTN, or premises PSTN via Local Gateway. One location takes one of these families. | Choosing Calling Plan means you do not build this gateway for that location. Market counts in cm-5770 need re-check. | Location PSTN connection in Control Hub. Calling Plan article is nousk9ab. | Designing a CUBE for a location that is already on Cisco Calling Plan. Country lists are re-check. | [cite:1] [cite:6] [cite:7] |
| Webex Call Recording | A provider every Webex Calling customer can use, at no additional cost for the base option. Retention one year. Storage 100 GB per organization. Compliance officers can access recordings for a selected storage location. | Recording is chosen per organization before users are enabled. It is not a dial-peer feature you infer from the trunk. | Control Hub provider dropdown. The article says Webex is the default value, and to select Webex if you only have the Calling service. | Users enabled before a provider is selected. The same article also says Dubber is chosen by default because Dubber Go is included. Both sentences are cited. The live pixel was not screenshotted. | [cite:16] |
| Dubber Go | The no-extra-cost Dubber entitlement. Unlimited recordings, 30-day storage, user access only through the Dubber portal. Paid Dubber teams and premier licenses need a Dubber contract. | Compliance retention of a year is the Webex recording sentence, not the Dubber Go sentence. | Same provider selection. User self-service is the Dubber portal, not Control Hub. | A compliance officer looking in Control Hub for Dubber Go files that only the user can open in Dubber. | [cite:16] |
| Survivability Gateway | Site survivability during a network outage, including emergency calls, managed from Control Hub. Not the PSTN trunk. | People collapse the names and then debug an outage on the registration trunk. | Its own Control Hub service. Co-location constraints, including an IOS-XE note, are in BRKCOL-2312. re-check that deck. | Expecting phones to register through the Local Gateway during an outage. Endpoints register to Webex Calling over the internet. SGW is the other box. | [cite:5] |
Integration map
| From | To | Mechanism | What moves | Cite |
|---|---|---|---|---|
| Premises carrier or IP-PBX | Local Gateway | The gateway’s PSTN or PBX side. Not the Webex registration of phones. | PSTN calls for that location. | [cite:5] [cite:3] |
| Local Gateway | Webex Calling | SIP over TLS, media SRTP. Registration trunk uses digest credentials. Certificate trunk uses FQDN and the LGW certificate. | Call signaling and media for premises PSTN. Up to 250 calls on registration; more than 250 on certificate. | [cite:4] [cite:2] [cite:3] |
| Endpoint | Webex Calling | The endpoint’s own registration over the internet. Not proxied by the Local Gateway. | Phone or app registration. Debug this on the endpoint, not on the CUBE’s trunk registration. | [cite:5] |
| MPP phone or Webex App | RedSky | HTTPS port 443 to https://api.wxc.e911cloud.com and https://wxc.e911cloud.com. HELD / HELD+ for dynamic location. | Network location and the dispatch address for nomadic users. | [cite:14] |
| Control Hub | RedSky account | Account plus alert email addresses, as the emergency article lists in its setup list. | Who is notified when someone dials 911, on the RedSky side of the design. | [cite:14] |
| Control Hub organization | Locations | Emergency call notification. Organization first: Services → PSTN & Routing → Settings. Then Management → Locations. | Email notification required by Kari’s Law. 933 tests the email and does not alert public safety. | [cite:15] |
| Administrator | Recording provider, then users | Select the provider in Control Hub before enabling users. Partner or user administrator can then enable or disable specific users. | Which store holds the recording: Webex (one year, 100 GB, compliance officer) or Dubber Go (30 days, user portal). | [cite:16] |
| Webex call recording | Webhook subscriber | The recording article says you can create webhook notifications on Webex call recordings. | A notification that a Webex recording exists. Cited names: recordingStarting, recordingStarted, recordingPaused, recordingResumed, recordingStopped on telephony_calls, scope spark-admin:calls_read. Resource convergedRecordings is “a Webex call was recorded for a user,” and serviceType is mandatory. [cite:18] Dubber Go access stays in the Dubber portal. | [cite:16] |
| Extension-only user | Emergency callback | Emergency services settings API description: location default ECBN or another number from that location. | The callback identity presented for that user. Read the scopes on this operation at developer.webex.com. A global scope catalog is not this endpoint’s requirement, and scopes change when the API is revised. | [cite:17] |
Cross-platform bridges
| Webex concept | Legacy | Peer label | Cite |
|---|---|---|---|
| Local Gateway trunk into Webex Calling | A CUCM SIP trunk to an SBC is the familiar shape. Dial peers and calling search spaces are different engines. CUCM closest-match stays in T6-R02. Webex enterprise patterns use the wildcard rules in T2-R03. No field-equivalence table is in these articles. Do not paste CUCM route patterns onto a Webex dial plan from memory. | Teams Phone PSTN and Amazon Connect telephony: orientation labels only. No parity matrix is published on help.webex.com. Cisco’s documented calling migrations are Unified CM and BroadWorks/BroadCloud. [cite:19] [cite:20] | [cite:3] [cite:5] |
| RedSky, HELD, Kari email, RAY BAUM dispatch address | On-prem CER or a PRI’s emergency treatment is a different product. Calling RedSky is av6oo3. nvfbjts, header September 08, 2024, says WebRTC agents use Control Hub and RedSky, place 933, then use Enhanced emergency calling. re-check [cite:22] mwjlgk, header September 03, 2025, confirms the agent MyE911 host and a verification email. It does not reprint those admin steps. [cite:23] A CER field map is not in those articles and stays marked on the peer cell. | Check Kari and RAY BAUM on the Calling emergency pages in Control Hub. A peer product’s emergency checkbox is a different test and does not cover those Calling requirements. | [cite:14] [cite:15] |
| Webex recording versus Dubber Go | CUCM recording profiles and a recording server are not these two cloud providers. Read retention in help.webex.com article nhvl4hw for Webex Calling and Dubber Go. Leave those numbers off a CUCM recording profile, because each product stores recordings on its own clock. | Contact-center recording in WxCC is a different article set. This room’s numbers are Webex Calling only. T3 ecosystem | [cite:16] |
| Certificate trunk toward Dedicated Instance contact-center interop | Registration-based trunks are no longer the supported interop on that path. | Not a Microsoft or Amazon statement. See the DI article. | [cite:13] |
Future-integration hooks
Emergency depth is the planned room T2-R06. Survivability is T2-R07. Devices are T2-R04. None of those rooms exist yet.
- Recording-provider copy is settled as a conflict inside nhvl4hw: “Webex is the default value” and “Dubber is chosen by default.” Cite both. Do not pick a live control this Canon has not screenshotted. [cite:16]
- Recording event names are cited on the call-control page. Do not copy sample organization IDs from developer pages.
- Port ACLs still come from the current port-reference article, not from BRKCOL-2812 (2024). re-check [cite:9]
- Webex for Government remains certificate-based and CUBE-only in the getting-started article. [cite:3]
- WxCC voice that lands on Webex Calling PSTN is cited from the contact-center architecture article. Read the PSTN choice on the location in Control Hub. The order SKU sits on the subscription, and this architecture article does not name it. [cite:12]
Ecosystem troubleshooting
Sister-system causes. The room’s own trouble matrix still owns trunk-down and certificate errors.
| Symptom | Likely sister-system cause | Check | Fix | Cite |
|---|---|---|---|---|
| 911 from a laptop off site has the wrong address | Nomadic dispatch address was never updated. RAY BAUM Phase 2 applies to non-fixed and nomadic users. | RedSky location for that Webex App user, not only the building’s civic address. | Use the HELD/HELD+ configuration the emergency article describes. | [cite:14] |
| Phones cannot determine location; trunk looks fine | 443 to the RedSky hosts is blocked. | Allow https://api.wxc.e911cloud.com and https://wxc.e911cloud.com. | Open 443 to those hosts. This is not a SIP ACL on the CUBE. | [cite:14] |
| Nobody gets email when 911 is dialed | Emergency call notification is disabled by default, or the location was edited before the organization toggle. | Services → PSTN & Routing → Settings, then the location’s Emergency Calling section. | Enable at the organization. Then set all-location email or a location-specific email. | [cite:15] |
| A 933 test “called the fire brigade” | 933 is the test number. The article says it does not alert public safety personnel. | Confirm the dialed number was 933 and the location is US or Canada. | Use 933 for the email test. Other test capabilities depend on the PSTN or emergency provider. Do not invent a second test number. | [cite:15] |
| Extension-only user cannot place an emergency call | No accurate ECBN from that location. | Location default ECBN or another number at the same location. | Assign one of those two. A number from a different location is not what the API description allows. | [cite:17] |
Registration trunk still caps near 250 after max-conn was raised | The documented registration limit is 250. The dial-peer knob does not raise it. | Trunk type in Control Hub. | Move that call budget to a certificate trunk. | [cite:3] [cite:4] |
| Recording enabled on users and nothing is stored | Provider was not selected first, or the viewer is in the wrong store. | Organization provider. Webex retention is one year and 100 GB, compliance officer. Dubber Go is 30 days in the Dubber portal. | Select the provider, then enable users. Open the store that matches the provider. | [cite:16] |
| Phone unregistered, and the engineer is on the CUBE | Endpoints do not register through the Local Gateway. | Endpoint registration to Webex Calling over the internet. | Leave the trunk debug for PSTN calls. Registration is the endpoint’s path. | [cite:5] |
05 · Flow
Inbound PSTN call through a Local Gateway
Outbound is the reverse until the carrier. Cisco Calling Plan and CCP do not traverse this gateway; forcing them through it is a design error, not a clever hairpin.
| Step | From | To | Protocol | Notes | Cite |
|---|---|---|---|---|---|
| 1 | Carrier | Local Gateway | SIP as you contracted, often UDP/TCP to the carrier | Carrier-facing dial peers are customer-specific. This Canon does not paste a carrier template. | [cite:4] |
| 2 | Local Gateway | Webex Calling | SIP over TLS, media SRTP | Registration model uses digest credentials from the trunk page. Certificate model uses FQDN and the LGW certificate. | [cite:4] [cite:2] |
| 3 | Webex Calling | Called user or hunt/queue | Webex Calling routing | The number must already exist on the location. A location with no number cannot make or receive calls. | [cite:1] |
| 4 | Webex Calling | Endpoint | The endpoint’s own registration, not the LGW | Do not debug “phone not registered” on the CUBE registration if the phone is a Webex endpoint. | [cite:5] |
| 5 | Certificate LGW | Webex Calling | SIP OPTIONS | Getting-started article: OPTIONS from the LGW are especially important for the trunk to show online in Control Hub. | [cite:3] |
| 6 | Control Hub | Admin | HTTPS | Trunk status and location PSTN properties are the cloud-side evidence. | [cite:2] |
| 7 | Admin | Route group | Control Hub config | A trunk without a route group and dial plan does not become the location’s PSTN path by existing. | [cite:2] |
| 8 | Firewall | Webex Calling | Outbound SIP, RTP, DNS, NTP | Exact current ports: as of 2026-10-14, b2exve (revision history September 07, 2026): certificate signaling destination TCP 5062, registration destination TCP 8934, phone signaling source ports 5060–5280 (the devices protocol cell is blank; this room does not call that range TCP). Local-gateway media source UDP 8000–48199 toward 5004, 9000, 8500–8699, and 19560–65535. Build the ACL from that article, not from BRKCOL-2812 (2024). [cite:21]. 2024 deck figures are re-check only. [cite:9] | [cite:9] |
06 · Config path
Control Hub first, gateway second
The IOS-XE guide assumes you already created the trunk and wrote down what Control Hub displayed. This room stops at the decision points. It does not reproduce sample usernames, passwords, or a full dial-peer stanza from the guide.
- Decide per locationWrite Cisco Calling Plan, CCP, or premises PSTN on the location row. Confirm country, data center, and whether a committed Outbound Calling Plan exists before you promise Cisco PSTN. [cite:1] [cite:6]
Screenshot placeholder · step 1 · location PSTN choices.
- Management → Location → add or Manage PSTNFor premises PSTN, choose Premises-based PSTN (Local Gateway). Acknowledge the risk prompt if you are changing an existing choice. [cite:1]
Screenshot placeholder · step 2 · premises PSTN selected.
- Calling → Call Routing → Add TrunkBRKCOL-2312’s lab path is Services → Calling → Call Routing → Add Trunk. Pick Registration-based or Certificate-based before you fill names. [cite:5] [cite:2]
Screenshot placeholder · step 3 · trunk type.
- Registration trunkCopy the trunk information Control Hub shows (registrar, username, password) into your password vault. The guide uses those values on a voice class tenant. Do not paste them into chat or into this Canon. [cite:4]
Screenshot placeholder · step 4 · trunk credentials blurred.
- Certificate trunkEnter the FQDN. DNS must resolve the LGW from the public internet by A or SRV. The certificate CN or SAN must contain that FQDN. No wildcards. [cite:2] [cite:10]
Screenshot placeholder · step 5 · FQDN field.
- On the CUBE / SBCFollow Configure Local Gateway on Cisco IOS XE for the trunk type you picked. Set
max-conn 250or lower on a registration trunk. Update the trustpool with the CA bundle Cisco documents. [cite:4]Screenshot placeholder · step 6 · redacted CLI header only. - Route group and location PSTN connectionSelect the trunk for the location’s premises PSTN. Add numbers. The calling article: for non-integrated CCP or premises PSTN, enter numbers and Validate. [cite:1]
Screenshot placeholder · step 7 · trunk selected on the location.
- Prove statusRegistration trunk: registration is up and a test call completes both ways. Certificate trunk: OPTIONS succeed and Control Hub shows the trunk online. [cite:3]
Screenshot placeholder · step 8 · trunk status online.
07 · Limits
Capacity you can cite
| Item | Value | Source | Verified? |
|---|---|---|---|
| PSTN options per location | Exactly one | Configure Webex Calling | Cited 2026-10-14 [cite:1] |
| Registration trunk concurrent calls | Up to 250 per trunk | Get started with Local Gateway | Cited [cite:3] |
| Certificate trunk concurrent calls | More than 250 per trunk. Partner-hosted article shows a field range of 250–6500 on certificate trunks. | t9xctu and noei0ug | Cited [cite:3] [cite:8]. Platform sizing as of 2026-10-14 is t9xctu Table 5: up to 250 concurrent calls, 2500 users, registration-based, OTT; about 250–2000 concurrent calls, 20000 users, certificate-based, OTT; about 2000–6500 concurrent calls, 65000 users, certificate-based, interconnect. [cite:3] the platform row you will buy. |
| Calling-capacity guideline table | Up to 250 calls / 2500 users → registration, OTT. ~250–2000 calls / 20000 users → certificate, OTT. ~2000–6500 calls / 65000 users → certificate, interconnect. | Table 5, Get started with Local Gateway | Cited [cite:3]. The help table’s header is slightly garbled in the HTML extract (“Concurrent call requirement)”). re-check the rendered table before you put these numbers on a customer slide. |
Registration max-conn | 250 maximum configured value | IOS-XE LGW guide | Cited [cite:4] |
| Wildcard certificates | Not supported | Get started with Local Gateway | Cited [cite:3] |
| Registration model on Webex for Government | Guide directs you to certificate-based only | IOS-XE LGW guide | Cited [cite:4] |
| Markets for Cisco Calling Plan | At-a-glance PDF says 19 markets (US, Canada, 15 European markets, Australia, New Zealand). Help says “country where the plan is supported” without repeating that list in the extract used here. | cm-5770 | re-check The PDF is undated in the extract. Read the country in the location wizard on the day you order. The live list changes, and this room leaves the undated PDF off that wizard. [cite:7] |
| CCP “65+ markets” and LGW “120+ countries” | Printed in cm-5770 | Same PDF | re-check Read current market coverage on the help article for the PSTN option you ordered. The undated PDF’s market counts are not that page, and the counts move when Cisco adds a country. |
| Firewall ports | as of 2026-10-14, b2exve (revision history September 07, 2026): certificate signaling destination TCP 5062, registration destination TCP 8934, phone signaling source ports 5060–5280 (the devices protocol cell is blank; this room does not call that range TCP). Local-gateway media source UDP 8000–48199 toward 5004, 9000, 8500–8699, and 19560–65535. Build the ACL from that article, not from BRKCOL-2812 (2024). [cite:21] | Do not use BRKCOL-2812 (2024) as the build ACL | Open [cite:9] |
| Supported IOS-XE release for your platform | as of 2026-10-14, t9xctu header September 10, 2026: registration CUBE minimum is Cisco IOS XE Bengaluru 17.6.1a (controller mode uses Cupertino 17.7.1 or later); certificate CUBE minimum is Cupertino 17.9.1a; the Cisco Secure Router rows in that table list IOS XE 26.2.1. Suggested releases stay on Cisco Software Research for the platform. [cite:3] in the Local Gateway ordering/configuration guide for the hardware in the design | Prepare your environment points at that guide | Open [cite:11] |
08 · Troubleshooting
Separate the trunk from the phone
| Symptom | Likely cause | Evidence / check | Fix | Cite |
|---|---|---|---|---|
| Trunk never registers | Digest credentials, DNS, or trust bundle | Compare vaulted trunk username to the tenant. Confirm the Webex CA bundle is in the trustpool. Outbound TCP/TLS allowed. | Re-copy credentials from Control Hub. Do not keep typing a password from a screenshot in a guide. | [cite:4] [cite:11] |
| Certificate trunk stays offline | FQDN mismatch or OPTIONS not sent | Certificate CN/SAN versus the FQDN typed in Control Hub. Packet capture for OPTIONS toward Webex. | Reissue the cert for that exact FQDN. No wildcard. Make OPTIONS part of the config, not an afterthought. | [cite:2] [cite:3] [cite:10] |
| TLS handshake fails on a third-party SBC | SBC demands Client Authentication EKU and Webex presents Server Authentication EKU only | Handshake alert mentioning EKU | The trunk article says some SBCs must be set to accept Server Authentication EKU only, or to relax strict EKU checks if the product allows it. | [cite:3] |
| Calls fail above a couple of hundred | Registration trunk, or max-conn left at 250, or shared IP/port on certificate trunks | Trunk type in Control Hub. show dial-peer max-conn. Whether two trunks share a socket. | Move to certificate-based if you need more than 250. Give each certificate trunk its own listen address/port. | [cite:3] [cite:4] [cite:8] |
| One-way or no audio | RTP ports or SRTP mismatch. Not a SIP 200 problem. | Signaling completes; RTP counters stay at zero in one direction. | Current port list: as of 2026-10-14, b2exve (revision history September 07, 2026): certificate signaling destination TCP 5062, registration destination TCP 8934, phone signaling source ports 5060–5280 (the devices protocol cell is blank; this room does not call that range TCP). Local-gateway media source UDP 8000–48199 toward 5004, 9000, 8500–8699, and 19560–65535. Build the ACL from that article, not from BRKCOL-2812 (2024). [cite:21]. Confirm SRTP on the Webex-facing dial peers as the guide requires. | [cite:4] [cite:9] |
| Phone unregistered, trunk looks fine | You are looking at the wrong registrar | Endpoint status in Control Hub, not show sip-ua register status on the CUBE | Debug the phone’s path to Webex Calling. LGW does not proxy endpoint registration. | [cite:5] |
| Inbound PSTN rings nowhere | Number not on the location, or route group not selected | Location numbers list. Location PSTN connection points at the trunk. | Validate and add the number. Select the trunk. A caution icon means no number. | [cite:1] |
| Cannot select Cisco Calling Plan | Missing OCP, unsupported country, location already had another PSTN option, or data center | The four visibility conditions in the calling article | Do not hide the option with a browser trick. Open a support case if you believe the location should be eligible. | [cite:1] |
| Changed PSTN type and emergency address looks stuck | Address fields lock after PSTN and emergency address are set | Location overview address is read-only | Update the emergency service address; Control Hub syncs the overview address from it. | [cite:1] |
| Government deployment using registration | Wrong trunk model | Org is Webex for Government and the trunk type is registration | Rebuild as certificate-based on CUBE. | [cite:4] [cite:3] |
09 · Recursive self-question
Ladder
L0What is a Local Gateway?
The premises SBC that terminates a Webex Calling trunk so a location can use premises-based PSTN or reach a non-cloud site. [cite:1] [cite:2]
L1Why does it exist?
Cisco PSTN and Cloud Connected PSTN replace the carrier in the cloud. Local Gateway exists when you keep your carrier, your analog, or a PBX next door. Without it, that location has no documented premises PSTN path. [cite:1]
L1aWhat breaks if I also expect phones to register to it?
You will troubleshoot the wrong box. Endpoints register to Webex Calling. The gateway is a trunk, not a proxy registrar. [cite:5]
L2How does a premises call work end to end?
Carrier ↔ LGW ↔ TLS/SRTP ↔ Webex Calling ↔ endpoint. The location’s numbers and route selection decide whether step three has anywhere to go. [cite:4] [cite:1]
L3How do I prove which failure I have?
Four evidence piles: Control Hub trunk status, location number list, CUBE registration or TLS/OPTIONS, and whether the endpoint is registered in Control Hub. Audio failures are a fifth pile (RTP), after signaling succeeds.
L4How does this differ across Calling, WxCC, WxCCE, and Dedicated Instance?
This room is multi-tenant Webex Calling. Contact-center voice can ride Webex Calling PSTN services even without a Calling subscription for the contact-center order itself — that claim belongs to the WxCC architecture article and is taught in T3-R01. [cite:12] Dedicated Instance has its own Local Gateway patterns and, for DI-to-multi-tenant contact-center support, help says certificate-based trunks are required because registration-based trunks are no longer supported on that interop. [cite:13] WxCCE PSTN is not this trunk model; do not answer an enterprise-routing question with CUBE max-conn 250.
L4aIs Survivability Gateway just a second name for LGW?
No. BRKCOL-2312 treats SGW as the outage path for endpoints when the cloud is unreachable, managed from Control Hub, and lists co-location constraints that include provisioning the gateway as Survivability Gateway rather than as Local Gateway. Detail is T2-R07. [cite:5]
L5If I redesigned PSTN attachment, what would I change?
I would want one trunk type so labs stop splitting digest and certificates. The constraint is scale and device support: registration is the simple CUBE model at 250 calls, and certificate exists because that model does not scale. The partner-hosted article says certificate trunking was created to solve registration’s scale limits. [cite:8] [cite:3]
10 · Lab
Checklist
11 · Quiz
Twelve checks
How many PSTN options can one location use at a time?
- Three, active-active
- One
- Two if one is a Local Gateway
- Unlimited
Reveal
One. Mix across locations, not inside one. [cite:1]
Registration-based Local Gateway concurrent calls, per trunk:
- Up to 250
- Up to 2000
- 6500
- Unlimited on CUBE
Reveal
Up to 250. [cite:3]
Registration-based trunks support which SBC?
- Any SBC in the cm-5770 PDF
- CUBE only
- CUBE and AudioCodes
- Whatever answers SIP OPTIONS
A designer sends phones to the Local Gateway’s registrar “so the branch survives.” What is wrong in the steady state?
Reveal
Endpoints register to Webex Calling, not through the LGW. Survivability is a different gateway service. [cite:5]
Wildcard certificates on a certificate-based LGW are:
- Preferred
- Not supported
- Supported if the SAN lists the domain
- Required for Webex for Government
Reveal
Not supported. [cite:3]
Control Hub shows a certificate trunk offline. Signaling config “looks right.” What transaction does the getting-started article single out?
Reveal
OPTIONS from the Local Gateway. [cite:3]
Webex-facing media and signaling in the IOS-XE guide are:
- UDP SIP and RTP
- SIP over TLS and SRTP
- H.323 and SRTP
- MGCP
Reveal
SIP/TLS and SRTP. [cite:4]
Draw three locations: Austin on Cisco Calling Plan, Berlin on CCP, Denver on LGW. Show phones registering to the cloud in all three.
Cisco PSTN does not appear for a location that already used a Local Gateway. Name two documented reasons besides “the UI is broken.”
Reveal
Pre-existing locations that already had another PSTN capability are not eligible in the article’s conditions, and Cisco PSTN may be unavailable after another option was assigned. Also check committed OCP, country, and data center. [cite:1]
For a registration trunk, max-conn should be:
- 250 or lower
- 6500
- Unset
- Equal to the user count
Reveal
250 or lower. [cite:4]
Why was certificate-based trunking created, according to the partner-hosted gateway article?
Reveal
To solve the scale limitations of the registration-based model. [cite:8]
Someone pastes TCP 5062 and UDP 19560–65535 into a firewall request and cites “Cisco Live.” What do you do?
12 · Audio slots
Studio fills these
Overview · 3–5 min
“Explain Local Gateway to a senior engineer walking a PSTN design: three location-level options, why phones do not register to the gateway, and the 250-call registration ceiling.”
assets/audio/T2-R02/overview.mp3
Transcript
Empty until Studio. Cite 1, 3, and 5 only.
Deep dive · 8–12 min
“Compare registration and certificate trunks: auth, devices, OPTIONS, wildcards, EKU surprises, max-conn, and what you still must verify in the port guide.”
assets/audio/T2-R02/deep-dive.mp3
Transcript
Empty until Studio.
Oral drill · 2 min
Rapid Q&A from the quiz. Correct any answer that sends endpoint registration through the CUBE.
assets/audio/T2-R02/oral-drill.mp3
Transcript
Empty until Studio.
13 · Interview
Oral-ready
1 · What are the PSTN options?
30 seconds. Cisco Calling Plan, Cloud Connected PSTN, and premises Local Gateway. One per location. Mix across sites. [cite:1]
2 minutes. Add when Cisco PSTN is even visible (OCP, country, new/eligible location, data center), the integrated versus non-integrated CCP split, and the warning that switching back to Cisco PSTN may require a support case. [cite:1]
2 · What is the Local Gateway actually doing?
30 seconds. It is the SBC trunk for premises PSTN. Phones register to the cloud, not to it. [cite:5]
2 minutes. Draw the map. Name TLS and SRTP on the Webex side. Separate Survivability Gateway in one sentence so you are not corrected. [cite:4] [cite:5]
3 · Registration or certificate?
30 seconds. Registration: CUBE, digest, 250 calls. Certificate: FQDN and cert, above 250, more device types. [cite:3]
2 minutes. Add wildcards unsupported, OPTIONS for status, EKU gotcha, max-conn, and Webex for Government = certificate on CUBE. [cite:3] [cite:4]
4 · How do you troubleshoot an offline trunk?
30 seconds. Registration: credentials, trust bundle, outbound TLS. Certificate: FQDN match and OPTIONS. [cite:4] [cite:3]
2 minutes. Walk the trouble rows for one-way audio versus failed registration versus a phone that was never the gateway’s job.
5 · What will you not quote?
30 seconds. Live port numbers and the PDF’s country counts, until re-checked.
2 minutes. Explain BRKCOL-2812 as a 2024 teaching deck that itself points at the port reference, and cm-5770 as an at-a-glance that can drift from the Control Hub device list. [cite:9] [cite:7]
14 · Citations
Ledger
Retrieved 2026-10-14. Mirrors cites/T2-R02.md.
- Configure Webex Calling for your organization — help.webex — article njvdjf2 — help.webex.com article njvdjf2 — retrieved 2026-10-14.
- Configure trunks, route groups, and dial plans for Webex Calling — help.webex — article n0xb944 — help.webex.com article n0xb944 — retrieved 2026-10-14.
- Get started with Local Gateway — help.webex — article t9xctu — help.webex.com article t9xctu — retrieved 2026-10-14.
- Configure Local Gateway on Cisco IOS XE for Webex Calling — help.webex — article jr1i3r — help.webex.com article jr1i3r — retrieved 2026-10-14.
- BRKCOL-2312 — Local Gateway and Survivability Gateway material (deck text: endpoint registration is not proxied; trunk types; SGW) — Cisco Live 2025 — ciscolive.com global-event 2025 PDF. re-check (event year 2025; confirm session title on the title slide).
- Get Started with the Cisco Calling Plans — help.webex — article nousk9ab — help.webex.com article nousk9ab — retrieved 2026-10-14.
- Webex Calling PSTN options at-a-glance — Cisco/Webex PDF cm-5770 — webex.com content dam … cm-5770.pdf — retrieved 2026-10-14. Market counts need re-check.
- Configuring a Partner Hosted Gateway — help.webex — article noei0ug — help.webex.com article noei0ug — retrieved 2026-10-14.
- BRKCOL-2812 — Webex Calling PSTN architecture, registration and certificate trunks, firewall note — Cisco Live 2024 — ciscolive.com global-event 2024 PDF. re-check Ports in the deck are not a build source.
- Security requirements for Webex Calling (certificate FQDN, CA bundle, EKU) — help.webex — article jwkbt2 — help.webex.com article jwkbt2 — retrieved 2026-10-14.
- Prepare your environment for Webex Calling — help.webex — article n4cprps — help.webex.com article n4cprps — retrieved 2026-10-14. Points at the ordering guide and CA bundle steps.
- Webex Contact Center Architecture — help.webex — article utqcm7 — used only for the cross-track sentence on contact-center PSTN. Full treatment is T3-R01. help.webex.com article utqcm7.
- Webex Dedicated Instance Contact Center integration — help.webex — article nmhk7ve — certificate trunks required for DI to multi-tenant contact-center support; registration-based trunks no longer supported on that interop. help.webex.com article nmhk7ve — retrieved 2026-10-14.
- Enhanced emergency calling for Webex Calling — help.webex — article av6oo3 — help.webex.com article av6oo3 — retrieved 2026-10-14. RedSky hosts, port 443, HELD/HELD+, RAY BAUM’S Act Phase 2 (January 2022), Kari’s Law email.
- Configure emergency call notifications in Control Hub — help.webex — article nj0abhbb — help.webex.com article nj0abhbb — retrieved 2026-10-14. Disabled by default. Organization path Services → PSTN & Routing → Settings. Location path Management → Locations. Test number 933 does not alert public safety.
- Manage call recording for Webex Calling — help.webex — article nhvl4hw — help.webex.com article nhvl4hw — retrieved 2026-10-14. Select the provider before enabling users. The provider procedure says “Webex is the default value” and also “Webex call recording is selected by default for organization and all locations.” A later note in the same procedure says “Dubber is chosen by default, as there is no additional cost to include Dubber Go.” Webex retention one year and 100 GB. Dubber Go 30 days, user portal.
- Emergency Services Settings — developer.webex — developer.webex.com calling emergency-services-settings — retrieved 2026-10-14. ECBN for extension-only users: location default or another number from that location. Kari’s Law email restated. Endpoint-specific OAuth scopes were not isolated from the site-wide scope catalog.
- Call Control — developer.webex — developer.webex.com calling call-control — retrieved 2026-10-14. telephony_calls events include the recording* names. Scope spark-admin:calls_read. List-events resource convergedRecordings; serviceType is mandatory when that resource is set. list events.
- Migrate Unified CM to Webex Calling, introduction — help.webex — article nbedetf — help.webex.com article nbedetf.
- Migration from BroadWorks and BroadCloud to Webex Calling — help.webex — article n1ku0vfb — help.webex.com article n1ku0vfb.
- Port Reference for Cisco Webex Calling — help.webex — article b2exve — help.webex.com article b2exve — retrieved 2026-10-14. Revision history line September 07, 2026 expanded phone signaling source ports from 5060–5080 to 5060–5280. Certificate-trunk signaling destination TCP 5062. Registration-trunk destination TCP 8934. Outbound media from the local gateway uses UDP source 8000–48199 toward 5004, 9000, 8500–8699, and 19560–65535. RedSky hosts api.wxc.e911cloud.com and wxc.e911cloud.com use port 443. b2exve does not name TCP on that row. Do not paste the IP subnet table from memory; the article points at IP Subnets for Webex Calling Services. Government ranges are a different article.
- Provision Emergency Calling in Webex Contact Center — help.webex — article nvfbjts — help.webex.com article nvfbjts — retrieved 2026-10-14. Header September 08, 2024. WebRTC desktops use Control Hub and RedSky. Bundled Cisco PSTN makes RedSky mandatory. Re-checked 2026-10-14 against mwjlgk: the 2025 agent article does not replace these admin steps.
- Provision Emergency Calling in Webex Contact Center for Agents — help.webex — article mwjlgk — help.webex.com article mwjlgk — retrieved 2026-10-14. Header September 03, 2025. Cirrus host https://wxc.e911cloud.com. Verification email. Does not restate password length, Device User Id, $0 add-on, or 933-then-activate.
15 · Re-engineer later
Stub
- Open questions: exact title slide wording for BRKCOL-2312 and BRKCOL-2812; live device-type dropdown versus cm-5770 vendor list; current port-reference article id.
- Firewall ports, IOS-XE minimums, and the t9xctu capacity bands are cited as of 2026-10-14. Still marked in the limits table: live Cisco Calling Plan country list, CCP and LGW country counts, and the cm-5770 Table 5 header as rendered.
- Assets missing:
assets/diagrams/T2-R02/arch.svg,assets/diagrams/T2-R02/eco.svg,assets/images/T2-R02/hero.png, screenshots 1–8,assets/audio/T2-R02/*.mp3. The ecosystem mind map is already an inline SVG. - Ecosystem gaps: the recording article states both defaults and this room now cites both; webhook scopes for emergency settings, ECBN menu labels, CUCM dial-plan crosswalk, and peer PSTN equivalence stay open.
- Ideas for v1.0: a redacted CLI diff that shows only the tenant and dial-peer names, generated from a lab after Architect review. Do not commit live credentials.
- Next review date: 2027-01-15, or sooner if the port reference or Calling Plan country list is updated.
Sources and go deeper
Checked links were opened this month. A confirm row has no address because that page was not opened.
- Wikipedia Webex (Wikipedia) last checked 2026-10
- Vendor doc Webex Help Center last checked 2026-10
- DevDocs Webex developer documentation last checked 2026-10
- DevDocs Webex developer getting started last checked 2026-10
- Community Webex community last checked 2026-10
- SRND Cisco Collaboration design zone last checked 2026-10
- RFC RFC 3261 SIP: Session Initiation Protocol last checked 2026-10
- Port table IANA service name and port number registry last checked 2026-10
- Port table Port reference for Webex Calling last checked 2026-10
- RFC RFC 3263 Locating SIP Servers last checked 2026-10
- RFC RFC 3264 An Offer/Answer Model with SDP last checked 2026-10
- Wikipedia Session Initiation Protocol (Wikipedia) last checked 2026-10
- RFC RFC 3550 RTP last checked 2026-10
- RFC RFC 3711 SRTP last checked 2026-10
- RFC RFC 4566 SDP last checked 2026-10
- RFC RFC 4733 RTP payload for DTMF last checked 2026-10
- Wikipedia Real-time Transport Protocol (Wikipedia) last checked 2026-10
- Release notes What's new in Webex Calling last checked 2026-10
- Vendor doc help.webex.com article njvdjf2 last checked 2026-10
- Vendor doc help.webex.com article n0xb944 last checked 2026-10
- Vendor doc help.webex.com article t9xctu last checked 2026-10
- Vendor doc help.webex.com article jr1i3r last checked 2026-10
- Vendor doc ciscolive.com global-event 2025 PDF last checked 2026-10
- Vendor doc help.webex.com article nousk9ab last checked 2026-10
- Vendor doc webex.com content dam … cm-5770.pdf last checked 2026-10
- Vendor doc help.webex.com article noei0ug last checked 2026-10
- Vendor doc ciscolive.com global-event 2024 PDF last checked 2026-10
- Vendor doc help.webex.com article jwkbt2 last checked 2026-10
- Vendor doc help.webex.com article n4cprps last checked 2026-10
- Vendor doc help.webex.com article utqcm7 last checked 2026-10
- Vendor doc help.webex.com article nmhk7ve last checked 2026-10
- Vendor doc help.webex.com article av6oo3 last checked 2026-10
- Vendor doc help.webex.com article nj0abhbb last checked 2026-10
- Vendor doc help.webex.com article nhvl4hw last checked 2026-10
- Vendor doc developer.webex.com calling emergency-services-settings last checked 2026-10
- Vendor doc developer.webex.com calling call-control last checked 2026-10
- Vendor doc list events last checked 2026-10
- Vendor doc help.webex.com article nbedetf last checked 2026-10
- Vendor doc help.webex.com article n1ku0vfb last checked 2026-10
- Vendor doc help.webex.com article nvfbjts last checked 2026-10
- Vendor doc help.webex.com article mwjlgk last checked 2026-10
sources.json for this page.