00 · Header
T7 · SIP, routing, and queues
Codecs, media, and NAT
Media optimization, the G.711 class, and the port reference. SIP ALG is a recommendation on b2exve whose revision line is January 21, 2025, so that sentence stays re-check. Retrieved 2026-10-14.
01 · Executive summary
ICE is a path, G.711 is the guide’s codec list
- Media optimization uses ICE. Desk phones except DECT and ATA, the Webex App, and Local Gateway are the supported set. It is on by default for desk phones and the Webex App. [cite:1]
- Local Gateway uses ICE-lite. Minimum CUBE software in that article is 17.3 or 16.12.5. The gateway needs a public address or same-network reachability. Interorganization calls send media through the PSTN. [cite:1]
- If call recording is enabled, recorded-call media goes to the cloud and is not optimized. ICE and recording each add a small initial audio delay. Together the delay is longer. [cite:1]
- jr1i3r’s codec class is g711ulaw then g711alaw. b2exve, retrieved 2026-10-14, puts successful ICE media for the Webex App on 8500–8699 and for devices on 19560–19661. [cite:2] [cite:3]
- b2exve recommends turning SIP ALG off. The revision history dates that addition at January 21, 2025. re-check [cite:3]
02 · Architecture map
Direct media is conditional
Mermaid source (not rendered)
flowchart LR STUN --> SIP SIP --> Media
03 · Core concepts
Four ICE phases, then the port table
nt6eyxb: candidate discovery, candidate exchange over SIP, connectivity checks, then media path optimization with a reinvite. The server-reflexive address comes from a STUN server in the Webex Calling cloud. [cite:1]
The same article says recorded media is routed to the cloud and is not optimized. [cite:1]
To route calls, signaling goes to the Webex Calling cloud. An active internet connection is always required. Media is most of the traffic. [cite:1]
August 13, 2026 on b2exve: validate NAT pool size so PAT does not exhaust ports. The SIP ALG recommendation is the January 21, 2025 addition. Keep those dates apart. [cite:3]
Ports this room will quote
| Flow | Source ports | Destination | Protocol | Cite |
|---|---|---|---|---|
| Call media to Webex Calling | Local Gateway external NIC 8000–48199 | 5004, 9000, 8500–8699, 19560–65535 | UDP | [cite:3] |
| Optimized Webex App | Audio 8500–8599, video 8600–8699 | The other app, when ICE succeeds | UDP | [cite:3] |
| Optimized devices | 19560–19661 | The other device, when ICE succeeds | UDP | [cite:3] |
| Media from Webex Calling to a certificate Local Gateway | 19560–65535 | The customer’s chosen media ports | UDP | [cite:3] |
| Signaling to Webex Calling | Local Gateway source 8000–65535, protocol TCP on that row. Devices source 5060–5280. The devices protocol cell is blank, so this room does not label that range TCP. | Parent destinations 5062 and 8934. The devices row destination is 8934. | Parent TCP. Devices cell blank. | [cite:3] |
04 · Ecosystem & sister technologies
Glossary, map, sisters, edges
Glossary
- ICE
- Interactive Connectivity Establishment. The method nt6eyxb uses to find a direct media path. [cite:1]
- ICE-lite
- What CUBE supports. The article points at further restrictions on CUBE and does not paste them into the Webex page. [cite:1]
- STUN
- Session Traversal Utilities for NAT. Used to learn a server-reflexive address. [cite:1]
- Candidate
- A local address or a server-reflexive address where the endpoint can receive media. [cite:1]
- Reinvite
- The SIP request that starts media on the optimized path after checks succeed. [cite:1]
- Default on
- Desk phones and Webex App. DECT and ATA are excluded. [cite:1]
- Local Gateway command
- The article’s words are “STUN usage lite,” reviewed in the Local Gateway registration article. jr1i3r prints voice class stun-usage 100. [cite:1] [cite:2]
- CUBE minimum for this feature
- 17.3 or 16.12.5, in nt6eyxb. That is not the trunk-registration minimum in t9xctu. [cite:1]
- Same organization
- Calls optimize only inside one organization. Interorganization media goes through the PSTN for regulatory reasons. [cite:1]
- Recording path
- Cloud path. Not optimized. [cite:1]
- G.711 class
- jr1i3r preference 1 g711ulaw, preference 2 g711alaw. [cite:2]
- SIP ALG
- b2exve recommends turning it off because some ALG implementations break firewall traversal even though signaling is encrypted. Revision line January 21, 2025. re-check [cite:3]
- NAT pool
- August 13, 2026 update: size the pool so users and devices are not stuck when ports run out. [cite:3]
- DSCP
- b2exve: Webex App audio Expedited Forwarding (46) on 8500–8599. Video Assured Forwarding 41 (34) on 8600–8699. Device signaling Class Selector 3 (24). [cite:3]
- Certificate media return
- Call media from Webex Calling toward a certificate-based Local Gateway uses 19560–65535 UDP. [cite:3]
- Phone source signaling
- Devices row 5060–5280 toward 8934. The September 07, 2026 history line expanded 5060–5080 to 5060–5280. [cite:3]
Mind map
Mermaid source (not rendered)
mindmap
root((T7-R03))
Core
Sisters
Sister-technology matrix
| Sister | What it is | Why it matters here | Config touchpoint | Typical failure | Cite |
|---|---|---|---|---|---|
| Webex App | A supported ICE endpoint. On by default. | Audio and video port ranges differ. | No extra toggle in the article’s default case. | Expecting DECT to optimize. | [cite:1] |
| Desk phone | Supported, except DECT and ATA. | Device media ports are 19560–19661 when optimized. | MPP and room devices in the port table. | Using the app range on a phone. | [cite:3] |
| Local Gateway | ICE-lite, with reachability rules. | Public IP or same network. | stun-usage, codec class. | A private address the phone cannot reach. | [cite:1] |
| Recording | Forces cloud media. | Delay note when combined with ICE. | Turn recording off for a path test. | Calling a recorded call “direct media.” | [cite:1] |
| Firewall | b2exve is the port reference. | ALG off is a separate recommendation. | Manufacturer steps to disable ALG. | An ACL from a 2024 slide. | [cite:3] |
| NAT | PAT pools can exhaust. | August 13, 2026 procedure. | Count public addresses against users and devices. | One public IP for a large site with no pool check. | [cite:3] |
| PSTN | Interorganization media uses it. | Regulatory sentence in nt6eyxb. | Do not expect ICE across two orgs. | Opening device ports to another company’s phones. | [cite:1] |
| SRTP | jr1i3r and the colocation article offer AES_CM_128_HMAC_SHA1_80 for commercial Webex Calling. | That suite is not a UDP port. | voice class srtp-crypto. | Quoting a port as a cipher. | [cite:2] |
Integration map
| From | To | Mechanism | What moves | Cite |
|---|---|---|---|---|
| Endpoint | STUN server | STUN | Server-reflexive candidate. | [cite:1] |
| Endpoint | Endpoint | SIP | Candidate exchange. | [cite:1] |
| Endpoint | Endpoint | Connectivity checks | The chosen path. | [cite:1] |
| Endpoint | Endpoint | Reinvite | Media on the optimized path. | [cite:1] |
| Recorded call | Cloud | Media | Not optimized. | [cite:1] |
| Local Gateway | Webex | UDP SRTP | 8000–48199 toward the cloud media ports. | [cite:3] |
| Webex | Certificate Local Gateway | UDP | 19560–65535 toward customer media ports. | [cite:3] |
| Router | SIP | ALG | b2exve says turn that function off. re-check | [cite:3] |
Cross-platform bridges
| Webex behavior | Legacy habit | Peer orientation | Cite |
|---|---|---|---|
| ICE inside one Webex Calling org | CUCM MTP and TRP are not this feature. | Teams media bypass is not cited here. TODO-verify as a peer. | [cite:1] |
| G.711 on the gateway | A phone codec list can contain G.722 and Opus. njwkamr lists preference orders for third-party devices. That is not voice class codec 100. | Do not paste device codec order onto CUBE. | [cite:4] |
| SIP ALG off | Some carriers want ALG. b2exve’s recommendation is for Webex Calling traversal. | Follow the firewall vendor’s disable steps. The article does not name every vendor. | [cite:3] |
Future-integration hooks
- Canon plan: T7-R04 is the trunk and certificate design. Ports quoted here stay tied to b2exve’s September 07, 2026 history line for the phone source range.
- Government GCM is jr1i3r’s other crypto block. This room’s SHA1_80 line is the commercial sample in the colocation article. [cite:2]
- ICE-lite restrictions that live only on the CUBE ICE-lite page were not copied. Read that page before you teach a CUBE limitation nt6eyxb does not print.
Ecosystem troubleshooting
| Symptom | Likely sister-system cause | Check | Fix | Cite |
|---|---|---|---|---|
| Two companies’ users do not go direct | Interorganization media is through the PSTN. | nt6eyxb regulatory sentence. | Stop expecting ICE. | [cite:1] |
| DECT media stays on the relay | DECT is excluded. | Supported-device sentence. | Use a supported desk phone or the app for the test. | [cite:1] |
| Users drop when the office is busy | NAT pool exhaustion. August 13, 2026. | Public IP and port count. | Enlarge the pool. Do not only disable ALG. | [cite:3] |
| One-way audio after a new firewall | SIP ALG still rewrites signaling. | b2exve ALG section. re-check | Turn ALG off using the vendor’s steps. | [cite:3] |
05 · Flow
One optimized call
| Step | From | To | Mechanism | Notes | Cite |
|---|---|---|---|---|---|
| 1 | Endpoint | Cloud STUN | Binding | Learn the server-reflexive address. | [cite:1] |
| 2 | Caller | Callee | SIP | Exchange candidates. | [cite:1] |
| 3 | Both | Candidates | Checks | Pick a path. | [cite:1] |
| 4 | Both | Media | Reinvite | Send on the optimized path. | [cite:1] |
| 5 | If recording | Cloud | Media | Skip optimization. | [cite:1] |
| 6 | Local Gateway | Webex | UDP | Source 8000–48199 toward the listed destinations. | [cite:3] |
| 7 | Firewall | SIP ALG | Disable | January 21, 2025 line. re-check. | [cite:3] |
| 8 | NAT | Pool | Size | August 13, 2026. Prevent exhaustion. | [cite:3] |
06 · Config
What you enable, and what you turn off
- On desk phones and Webex App, leave media optimization at the default unless you are in a case the article excludes. [cite:1]
- On the Local Gateway, configure voice class stun-usage and the G.711 codec class from jr1i3r. Confirm CUBE is at least 17.3 or 16.12.5 before you promise optimization. [cite:1] [cite:2]
- Give the gateway a public address or put the phones on a network that can reach it. [cite:1]
- Open b2exve before any ACL. Quote 5062, 8934, and the media ranges from the current table. [cite:3]
- Turn SIP ALG off. Mark that recommendation re-check because the history line is January 21, 2025. [cite:3]
- Validate NAT pool size. That procedure was updated August 13, 2026. [cite:3]
07 · Limits
Numbers these articles state
| Item | Value | Source | Verified? |
|---|---|---|---|
| ICE on Local Gateway | CUBE 17.3 or 16.12.5 minimum, in nt6eyxb | [cite:1] | Quoted |
| Optimized app ports | 8500–8699, audio 8500–8599 and video 8600–8699 | [cite:3] | Quoted |
| Optimized device ports | 19560–19661 | [cite:3] | Quoted |
| LGW media source to cloud | UDP 8000–48199 | [cite:3] | Quoted |
| Certificate return media | UDP 19560–65535 | [cite:3] | Quoted |
| Phone signaling source | 5060–5280, expanded September 07, 2026 | [cite:3] | Quoted |
| SIP ALG addition | January 21, 2025 | [cite:3] | re-check |
| Peer media-bypass parity | TODO-verify | Not in nt6eyxb | Open |
08 · Troubleshooting
Failures
| Symptom | Likely cause | Evidence | Fix | Cite |
|---|---|---|---|---|
| Internal calls hairpin | ICE failed, or the gateway is unreachable. | Troubleshooting path field. nt6eyxb reachability. | Public IP or same network. | [cite:1] |
| Cross-org calls hairpin | They are required to use the PSTN. | Organization boundary. | Do not file that as an ICE bug. | [cite:1] |
| Recorded calls hairpin | Recording disables optimization. | Recording flag. | Expect cloud media. | [cite:1] |
| DECT will not optimize | Excluded. | Device type. | Stop the test. | [cite:1] |
| Audio delay at answer | ICE, recording, or both. | The delay sentence. | Tell the user which features are on. | [cite:1] |
| ALG “helps SIP” | b2exve recommends off. | Firewall SIP awareness. | Disable it. re-check the 2025 line. | [cite:3] |
| Random failures at peak | Port exhaustion. | NAT pool. | Add public addresses. | [cite:3] |
| ACL allows 5061 only | Trunk destinations in this table are 5062 and 8934. 5061 is not that row. | b2exve signaling row. | Fix the destination. | [cite:3] |
| App video blocked | Video is 8600–8699, not the audio range. | DSCP and port rows. | Allow both. | [cite:3] |
| Cipher taught as a port | AES_CM_128_HMAC_SHA1_80 is the commercial sample suite. | w0qmeu / jr1i3r. | Keep it out of the ACL. | [cite:2] |
09 · Self-question ladder
Twelve rungs
L1Which devices does nt6eyxb include?
Desk phones except DECT and ATA, Webex App, and Local Gateway. [cite:1]
L1Is optimization on by default for the app?
Yes. The article says it usually needs no extra configuration. [cite:1]
L2Name the four phases.
Candidate discovery, candidate exchange, connectivity checks, media path optimization. [cite:1]
L2What minimum does that article give for CUBE?
17.3 or 16.12.5. [cite:1]
L2Where does interorganization media go?
Through the PSTN. [cite:1]
L3What happens to a recorded call?
Media goes to the cloud and is not optimized. [cite:1]
L3Webex App optimized audio ports?
8500–8599. Video is 8600–8699. [cite:3]
L3Device-to-device optimized ports?
19560–19661. [cite:3]
L4What did September 07, 2026 change?
Phone source signaling from 5060–5080 to 5060–5280. [cite:3]
L4Why is SIP ALG marked re-check?
The revision line that added it is January 21, 2025, more than 12 months before 2026-10-14. The sentence is still on the page. [cite:3]
L5What is the August 13, 2026 NAT sentence?
Validate NAT pool size so port exhaustion does not stop users and devices. [cite:3]
L5What will you not teach?
A Teams media-bypass equivalent. TODO-verify.
10 · Lab
Paper lab
11 · Quiz
Twelve questions
DECT and media optimization:
Answer
DECT is excluded. ATA is excluded. [cite:1]
Local Gateway ICE requires CUBE:
Answer
17.3 or 16.12.5 in nt6eyxb. [cite:1]
The reinvite does what?
Answer
Starts media on the optimized path. [cite:1]
Two orgs, both on Webex Calling. Where is the media?
Answer
Through the PSTN. Optimization is inside one organization. [cite:1]
Recording and ICE together:
Answer
Media is not optimized, and the initial delay is longer than either feature alone. [cite:1]
Optimized device ports:
Answer
19560–19661. [cite:3]
Local Gateway media source toward the cloud:
Answer
UDP 8000–48199. [cite:3]
SIP ALG:
Answer
b2exve recommends off. The history line is January 21, 2025. re-check. [cite:3]
Phones fail only at busy hour. Which August 2026 sentence applies?
Answer
NAT pool size and port exhaustion. [cite:3]
Write the two G.711 preference lines.
Answer
codec preference 1 g711ulaw and codec preference 2 g711alaw. [cite:2]
Commercial SRTP sample in the colocation article:
Answer
AES_CM_128_HMAC_SHA1_80. [cite:2]
A design equates this to Teams media bypass. What is the mark?
Answer
TODO-verify. nt6eyxb does not say that.
12 · Audio
Slots for Studio
Transcript slot
Studio fills this. The prompt is the spoken outline, not a second article.
Transcript slot
Studio fills this. The prompt is the spoken outline, not a second article.
Transcript slot
Studio fills this. The prompt is the spoken outline, not a second article.
13 · Interview
Oral answers
30 seconds. ICE can keep media direct inside one organization for the app, supported desk phones, and a reachable Local Gateway. Recording, DECT, ATA, and a second organization do not take that path. [cite:1]
2 minutes. The phases are discovery, exchange, checks, and a reinvite. CUBE ICE-lite in that article needs 17.3 or 16.12.5. [cite:1] I quote b2exve for 8500–8699, 19560–19661, 5062, and 8934. I mark SIP ALG re-check because of the January 21, 2025 history line, and I keep the August 13, 2026 NAT-pool sentence separate. [cite:3]
30 seconds, codecs. The Local Gateway guide’s class is G.711 µ-law then A-law. That is not the third-party phone preference list. [cite:2]
2 minutes, delays. ICE and recording each add a small delay at the start. Together it is more noticeable. I will not call a recorded call a direct-media proof. [cite:1]
What you will not say. You will not build the ACL from memory, and you will not call 5061 the trunk destination.
14 · Citations
Ledger
Retrieved 2026-10-14. Mirrors cites/T7-R03.md.
- Webex Calling media optimization with ICE — help.webex — article nt6eyxb — help.webex.com article nt6eyxb — retrieved 2026-10-14. Supported devices. Default on. Four phases. CUBE 17.3 or 16.12.5. Public IP or same-network reachability. Same-organization only. Recording not optimized. Combined delay.
- Configure Local Gateway on Cisco IOS XE for Webex Calling — help.webex — article jr1i3r — help.webex.com article jr1i3r — retrieved 2026-10-14. Codec preference g711ulaw then g711alaw. voice class stun-usage 100. Colocation article w0qmeu prints the same G.711 order and AES_CM_128_HMAC_SHA1_80. help.webex.com article w0qmeu.
- Port Reference Information for Webex Calling — help.webex — article b2exve — help.webex.com article b2exve — retrieved 2026-10-14. Revision September 07, 2026 for phone source 5060–5280. Media ranges as quoted. SIP ALG section added January 21, 2025. NAT pool procedure updated August 13, 2026.
- Cisco managed third-party device support on Webex Calling — help.webex — article njwkamr — help.webex.com article njwkamr — retrieved 2026-10-14. Device codec preference orders exist. They are not voice class codec 100.
15 · Re-engineer later
Open
- Open questions: the CUBE ICE-lite restriction page was named and not copied.
- Facts still TODO-verify: 1. Peer media-bypass equivalence.
- re-check: SIP ALG paragraph, history January 21, 2025.
- Assets missing: a path diagram with ports, audio.
- Next review: nt6eyxb, b2exve, jr1i3r.
Sources and go deeper
Checked links were opened this month. A confirm row has no address because that page was not opened.
- Wikipedia Webex (Wikipedia) last checked 2026-10
- Vendor doc Webex Help Center last checked 2026-10
- DevDocs Webex developer documentation last checked 2026-10
- DevDocs Webex developer getting started last checked 2026-10
- Community Webex community last checked 2026-10
- SRND Cisco Collaboration design zone last checked 2026-10
- RFC RFC 3261 SIP: Session Initiation Protocol last checked 2026-10
- Port table IANA service name and port number registry last checked 2026-10
- Port table Port reference for Webex Calling last checked 2026-10
- RFC RFC 3263 Locating SIP Servers last checked 2026-10
- RFC RFC 3264 An Offer/Answer Model with SDP last checked 2026-10
- Wikipedia Session Initiation Protocol (Wikipedia) last checked 2026-10
- RFC RFC 3550 RTP last checked 2026-10
- RFC RFC 3711 SRTP last checked 2026-10
- RFC RFC 4566 SDP last checked 2026-10
- RFC RFC 4733 RTP payload for DTMF last checked 2026-10
- Wikipedia Real-time Transport Protocol (Wikipedia) last checked 2026-10
- Release notes What's new in Webex Calling last checked 2026-10
- RFC RFC 8446 TLS 1.3 last checked 2026-10
- Vendor doc help.webex.com article nt6eyxb last checked 2026-10
- Vendor doc help.webex.com article jr1i3r last checked 2026-10
- Vendor doc help.webex.com article w0qmeu last checked 2026-10
- Vendor doc help.webex.com article njwkamr last checked 2026-10
sources.json for this page.