00 · Header

T2 · Webex Calling

Survivability Gateway

In Active mode, endpoints register to the Webex cloud. When that path fails they register to a Survivability Gateway on the local network and keep basic calling. They return to the cloud after the connection has been back for at least 30 seconds. The gateway listens on port 8933 after mode webex-sgw. IOS XE Dublin 17.12.3 is the feature baseline. Hunt group, call forward, and auto attendant on the gateway start at IOS 17.18.2.

Expand all sections

01 · Executive summary

Five lines, then why it matters

• Assign the service from Services > Calling > Managed Gateways. The hostname is the certificate FQDN. Devices register to the IPv4 address you enter. Download the template from Services > PSTN & Routing > Gateway configurations > Manage Gateways. [cite:1]
• SIP TLS from devices uses source ports 5060–5080 toward gateway port 8933. Media uses device UDP 19560–19660 toward gateway UDP 8000–14198. The article says these defaults can be customized. [cite:1]
• Certificates must be from a publicly known CA. Private or enterprise CAs are not accepted. Wildcard certificates are not supported. [cite:1]
• Do not configure SIP bind under voice service voip. That causes registration failure. Shared line appearances count toward max-dn. Five phones sharing five DNs count as 25. [cite:1]
• If you sign out of Webex App during survivability, you cannot sign in again until the network returns. When the outage ends, a call already up continues unchanged. [cite:2]

02 · Architecture map

Active mode, then the local gateway

• 1Active
• 2Survivability
• 3Restore
• 4Local PSTN

flowchart LR
  Phone[Endpoint] --> Cloud[Webex Calling]
  Cloud -->|outage| SGW[Survivability Gateway]
  SGW --> PSTN
  SGW -->|30 seconds restored| Cloud

Studio asset still required: assets/diagrams/T2-R07/arch.svg

03 · Concept deep-dive

Mode, scale, and what still works

Site survivability for Webex Calling is dated July 06, 2026. The Webex App article is dated April 11, 2026. The colocation article is dated November 20, 2024 and is older than 12 months. [cite:1] [cite:2] re-check [cite:3]

Platform maxima from the July 06, 2026 table

What the mode allows

Certificates, ports, and colocation

04 · Ecosystem

Ecosystem and sister technologies

Glossary

Active mode

Endpoints register to the Webex cloud for SIP. [cite:1]

Survivability mode

Endpoints register to the local Survivability Gateway and use basic backup calling. [cite:1]

Survivability Gateway

An IOS XE router on the local network that takes registrations when the cloud path is down. [cite:1]

mode webex-sgw

The configuration mode after which the gateway listens on port 8933. [cite:1]

max-dn

The directory-number limit on the router. Shared appearances count. Five phones sharing five DNs count as 25. [cite:1]

FQDN hostname

The certificate name entered in Control Hub. It can be a Subject Alternative Name. DNS population is not mandatory for the secure connection. [cite:1]

Colocation

Local gateway and survivability gateway services on one Cisco IOS device. re-check [cite:3]

B-ACD

Basic automatic call distribution on the gateway, with auto-attendant and one call-queue service. Colocation with a local gateway is not supported for this service. [cite:1]

Mind map

mindmap
  root((SGW))
    Active mode
    Survivability mode
    Certificates
    PSTN
    Webex App

Sister-technology matrix

Integration edges

Cross-platform bridges

Future-integration hooks

• Hunt group, call forward, and auto attendant on the gateway require IOS 17.18.2, which is later than the 17.12.3 feature baseline. [cite:1]
• Canon planning: record platform maximum, IOS version, and whether weighted hunt groups are required in an outage. If they are, survivability mode does not provide that pattern.
• The November 20, 2024 colocation article includes an encryption-scheme note tied to September 1, 2024. Re-read it before you treat that date as an open action. re-check [cite:3]

Ecosystem troubleshooting

05 · Flow

From assignment to a restored registration

06 · Config

Click paths and the router order

1. If the gateway is not in Control Hub, enroll it first. The survivability article points at the enroll-IOS-gateways article. [cite:1]
2. Open Services > Calling > Managed Gateways. Select the gateway. If the service is empty, click Assign Service and choose Survivability Gateway. [cite:1]
3. Select one or more locations. Enter the certificate FQDN as the host name and the IPv4 address phones will register to. Click Assign. [cite:1]
4. Download the template from Services > PSTN & Routing > Gateway configurations > Manage Gateways. [cite:1]
5. On an ISR 4000, the article’s license example is license boot level uck9 and license boot level securityk9. Catalyst 8200 and 8300 examples use DNA Network Advantage and a crypto throughput. Catalyst 8000V examples use a throughput level. Throughput above 250 Mbps needs an HSEC license. [cite:1]
6. Install a public CA certificate. Do not use a wildcard or a private CA. [cite:1]
7. Apply the mandatory lines from the template, including mode webex-sgw. The gateway then listens on 8933. [cite:1]
8. Leave SIP bind unset under voice service voip. Set max-dn to the platform maximum and count shared appearances. [cite:1]
9. For external calls, add a VIC or a SIP trunk. PSTN during the outage depends on that path. [cite:1]

Screenshot placeholder. The paths above are the articles. Router command blocks stay in the Cisco article rather than a shortened paste.

07 · Limits

Values the articles state

08 · Troubleshooting

Eight survivability failures

09 · Self-question ladder

Twelve rungs

10 · Lab

Paper failover, no production router

• Goal: for one site, name the mode, the listen port, the platform maximum, and two features that stop.
• Prereq: T2-R01 and this room. Do not load a production gateway.
• Step 1. Phones are registered to Webex. Expected: Active mode.
• Step 2. The WAN drops. Expected: local registration, Webex App banner, messaging unavailable.
• Step 3. The WAN returns for 10 seconds. Expected: the article’s restore wait is 30 seconds.
• Step 4. The platform is an ISR 4321. Expected: 50 endpoints, and 17.12.3 in that row.
• Step 5. The design needs weighted hunt groups during the outage. Expected: not supported in this mode.
• Evidence: the five answers with cites.
• Break it: plan IPv6 on the gateway. Recovery: IPv4 only.
• Reflection: which sites have a PSTN trunk that would still be up if the WAN to Webex failed.

11 · Quiz

Twelve questions

12 · Audio

Slots for Studio

13 · Interview

Oral answers

30 seconds. Phones register to Webex until the path fails, then to a local Survivability Gateway on port 8933. They return after the link has been up for 30 seconds. The gateway is IPv4, IOS XE 17.12.3 or later, and it does not take third-party phones.

2 minutes. I assign the service on Managed Gateways with the certificate FQDN and the IPv4 address. I download the template, license the platform, and use a public CA without a wildcard. mode webex-sgw opens 8933. I do not set SIP bind under voice service voip. Shared appearances count toward max-dn. In that mode I can have 100 hunt groups of 32 users and I cannot use weighted routing. Webex App shows a banner and keeps basic calls, including outgoing emergency if the local PSTN path is up. Messaging and meetings stop. A call that is up when failover starts is torn down. A call that is up when service returns stays up. If the user signs out, they wait for the network.

30 seconds, scale. An ISR 4321 is 50 endpoints. A Catalyst Edge 8200-1N-4T is 2,500. Those numbers are registrations in the survivability table, not the Control Hub hunt-group caps.

2 minutes, what I will not merge. I will not quote the November 2024 colocation article without a re-check. I will not put survivability on a third-party SBC. I will not promise meetings. I will not treat a 10-second WAN recovery as the restore timer.

What you will say about PSTN. Internal extensions can work on the gateway. External calls need the VIC or the SIP trunk that is still available at the site.

14 · Citations

1. Site survivability for Webex Calling — help.webex — article d68vi1 — help.webex.com article d68vi1 — header July 06, 2026 — retrieved 2026-10-14. Active and survivability modes, 30-second restore, platform table, ports, 8933, certificates, task flow, max-dn, IPv4, hunt groups 100 by 32, IOS versions, endpoint minimums.
2. Webex App | Site survivability — help.webex — article dgjdi9 — help.webex.com article dgjdi9 — header April 11, 2026 — retrieved 2026-10-14. Banner, supported call list, messaging and meetings unsupported, in-progress call terminated, sign-in lock, call continues when the outage ends.
3. Colocation of Local Gateway and Site Survivability on Cisco IOS Managed Gateways — help.webex — article w0qmeu — help.webex.com article w0qmeu — header November 20, 2024 — retrieved 2026-10-14. re-check. Same IOS gateway for both services. Provision as Survivability Gateway. Third-party local gateways deploy survivability separately. High availability is not supported for local gateways in that article.

15 · Re-engineer later

• Open questions: whether w0qmeu’s November 20, 2024 colocation limits are unchanged.
• Facts still TODO-verify: 0. Colocation sentences are re-check.
• Assets missing: Managed Gateways screenshot, audio, a full endpoint-model plate copied only after the table is re-read line by line.
• Ideas for v1.0: a mode card with port 8933 on one side and the 30-second restore on the other.
• Next review: when d68vi1 changes a platform maximum or the hunt-group limit in survivability mode.