WarmTransfer
Configuration · guide

Setting up CUBE for a carrier SIP trunk

Cisco Unified Border Element

Verified 2026-09-25 · 59 sources · tier 1–2

For Voice engineers configuring a carrier SIP trunk on Cisco Unified Border Element..

This guide steps through configuring a SIP trunk between Cisco Unified Border Element (CUBE) on Cisco IOS XE and an ITSP carrier, establishing bi-directional call routing with Cisco Unified Communications Manager (Unified CM) and trunk health monitoring using SIP OPTIONS 17 57 21. Telnyx, for example, offers both IP authentication and credential authentication models for a CUBE trunk connection 5.

Before you start

  • Verify that you have network reachability between the CUBE interfaces, the carrier signalling endpoints, and the Unified CM nodes 57 58.
  • Collect the carrier's signalling IP addresses or registrar FQDN, SIP credentials if required, supported audio codecs, and expected SRTP crypto suites 5 7 40.
  • Ensure that the CUBE enterprise router runs a supported Cisco IOS XE release, noting that dynamic session counting replaces the legacy capacity licensing model starting in Cisco IOS XE Amsterdam 17.2.1r 15.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

How does your carrier authenticate your trunk?
How is the carrier leg signalled and how is its media carried?

Two questions. One permanent page you can send to your manager.

Step 1 Enable CUBE under voice service voip

Do

Configure mode border-element and allow-connections sip to sip under voice service voip to permit SIP-to-SIP call routing through the router 17 1. Do not configure the deprecated capacity keyword on Cisco IOS XE Amsterdam 17.2.1r or later releases, as trunk licensing is enforced using dynamic session counting 15. In baseline Cisco Local Gateway designs, settings such as media statistics, no supplementary-service sip refer, and early-offer forced under sip are also applied 14.

Verify

Suggested check: inspect the running configuration to confirm that both commands are present under the voice service block.

Rollback

Suggested rollback: remove the added configuration lines under the voice service block.

Step 2 Restrict incoming traffic with the IP trusted list

Do

Configure ip address trusted list under voice service voip and add ipv4 address [mask] entries for each Unified CM node and carrier signalling address 53. CUBE automatically trusts addresses defined as dial-peer session targets and server-group targets, but entries pointing to a registrar, outbound proxy, or sip-server require explicit entries in the trusted list 52 44. Cisco warns that inbound calls failing the IP trusted list check are silently discarded rather than rejected with a SIP error 56.

Verify

Run show ip address trusted list to confirm that all required Unified CM and carrier addresses appear in the table 29.

Rollback

Suggested rollback: delete the configured ipv4 entries from the trusted list configuration block.

Step 3 Define the voice class codec preference list

Do

Create a codec preference list using voice class codec <tag> and add preference entries with codec preference <value> <codec-type> for the audio codecs negotiated with the carrier 7. CUBE filters codec negotiation against the list assigned to the dial-peer unless the offer-all keyword is appended to offer every configured codec 8 9.

Verify

Suggested check: view the configured voice class codec using the command-line interface to ensure the preference order matches carrier requirements.

Rollback

Suggested rollback: remove the voice class codec identifier from any dial-peers and delete the voice class codec.

Step 4 Prepare TLS on the platform

SIP over UDP with cleartext RTP

Do

Retain cleartext transport support rather than applying hardening commands that disable UDP 12.

Verify

Suggested check: verify the router configuration retains UDP transport capability for SIP processing.

Rollback

Suggested rollback: no changes to revert for this transport mode.

SIP over TLS with SRTP

Do

Configure a crypto pki trustpoint containing the CUBE certificate and import the root certificate authority bundle using crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b to allow validation of public CA certificates 48 54. Define an optional voice class tls-cipher list and create a voice class tls-profile referencing the trustpoint, enabling cn-san validate server and sni send as needed 48. Enable global SIP TLS with transport tcp tls v1.2 under sip-ua, verify router security licenses on ISR 4300 and 4400 platforms, and ensure all systems synchronize to a common NTP source 49 47. TLS 1.3 is supported starting in Cisco IOS XE 17.14.1a, while TLS 1.0 and 1.1 are restricted to insecure system mode 51.

Verify

Suggested check: verify that NTP is synchronized and check that the trustpoint and imported trustpool certificates display correctly in the crypto PKI configuration.

Rollback

Suggested rollback: remove the tls-profile and disable the transport command under sip-ua.

Step 5 Define the carrier trunk tenant and authentication

Registration-based: registrar, credentials, and outbound proxy

Do

Create a voice class tenant <tag> to override global parameters for the carrier trunk 46 42. Configure registrar with the carrier server and expiration time, and define credentials number <number> username <username> password [0|7] <password> realm <realm> to issue REGISTER requests and process challenges 10 44. Add authentication username <username> password [0|7] <password> [realm <realm>] to respond to 401 or 407 digest challenges on outbound INVITE requests 2 30. Configure bind control and bind media to the carrier-facing interface, which is mandatory for enterprise deployments 3 44. Note that trunk registration is distinct from endpoint registration pass-through configurations 24.

Verify

Suggested check: review the tenant configuration to confirm that the registrar, credentials, digest authentication, and binding statements are configured.

Rollback

Detach the tenant configuration from associated dial-peers using no voice-class sip tenant <tag> and delete the tenant 45.

IP-authenticated: accepted by source and destination IP addresses

Do

Create a voice class tenant <tag> and configure mandatory bind control and bind media statements targeting the external WAN interface 3 42. Do not define registrar or SIP credential statements within the tenant 42.

Verify

Suggested check: inspect the voice class tenant to verify that interface binds are applied without registration parameters.

Rollback

Detach the tenant configuration from associated dial-peers using no voice-class sip tenant <tag> and delete the tenant 45.

Step 6 Configure carrier transport and media encryption

SIP over UDP with cleartext RTP

Do

Configure the carrier leg for cleartext RTP media and standard UDP signalling without SRTP commands 12.

Verify

Suggested check: verify that the dial-peer uses UDP transport and does not reference crypto profiles.

Rollback

Suggested rollback: no encryption settings to remove.

SIP over TLS with SRTP

Do

In the carrier tenant, configure tls-profile <tag>, session transport tcp tls, listen-port secure 5061, and url sips 49. Create a voice class srtp-crypto <tag> configuring supported suites such as AEAD_AES_256_GCM, AEAD_AES_128_GCM, AES_CM_128_HMAC_SHA1_80, and AES_CM_128_HMAC_SHA1_32 40. SDES SRTP requires signalling encryption such as TLS to protect master keys carried in SDP 27. Apply srtp and voice-class sip srtp-crypto <tag> to the carrier dial-peer, noting that asymmetric SRTP fallback is unsupported and dynamic shifts from RTP to SRTP on the same leg require supplementary-service media-renegotiate 37 39 38.

Verify

Run show sip-ua calls during call testing to inspect negotiated SRTP suites and active crypto keys on the carrier call leg 41.

Rollback

Suggested rollback: remove the srtp and srtp-crypto lines from the dial-peer and remove TLS attributes from the tenant.

Step 7 Apply SIP profiles for carrier header adjustments

Do

Create a voice class sip-profiles <id> structure using rules of the format rule <n> request <METHOD> sip-header <Header> modify "<match>" "<replace>" to adapt headers for carrier compatibility 34 35. Apply the profile outbound with voice-class sip profiles <id> on the carrier dial-peer or tenant 32 42. If incoming messages require header modification, configure sip-profiles inbound under voice service voip / sip before assigning an inbound profile 32. Note that SIP profiles cannot add or delete mandatory headers including To, From, Via, CSeq, Call-ID, or Max-Forwards, and are limited to 300 characters per header value and 2048 characters for SDP 33.

Verify

Run show dial-peer voice <id> | include profile to confirm attachment, and use debug ccsip all during call flows to verify that SIP header manipulations are applied 36.

Rollback

Remove the SIP profiles entry from the dial-peer or tenant using no voice-class sip profiles <id> 32 42.

Step 8 Configure SIP OPTIONS keepalive monitoring

Do

Create an out-of-dialog keepalive profile with voice class sip-options-keepalive <id> to query carrier endpoint capabilities without establishing calls 31 21. Set the transport parameter to match the signalling transport (udp or tcp tls) and adjust up-interval (default 60 seconds), down-interval (default 30 seconds), or retry (default 5) as required 21. Do not attach the same OPTIONS profile across multiple dial-peers that bind to different network interfaces 18. Note that for SRV or server-group destinations, CUBE treats any response, including a 503 Service Unavailable, as indicating an active destination, and busies out the dial-peer only when all retries timeout without a response 19. When a monitored dial-peer busies out and no alternate route exists, CUBE returns a 503 by default; configuring error-code-override options-keepalive failure alters this code on incoming calls but has no effect on outbound dial-peers 20.

Verify

Run show voice class sip-options-keepalive <id> and show dial-peer voip keepalive status to verify profile attributes and keepalive operational status 22.

Rollback

Suggested rollback: detach the options-keepalive profile from the dial-peer and delete the voice class sip-options-keepalive profile.

Step 9 Build the carrier-facing dial-peers

Registration-based: registrar, credentials, and outbound proxy

Do

Create the carrier dial-peer with session protocol sipv2, session target sip-server, and voice-class sip tenant <tag> 44. Apply voice-class codec <tag> and voice-class sip options-keepalive profile <id> to the peer 7 21 58. Define outbound destinations using specific number ranges or destination e164-pattern-map rather than broad catch-all patterns like destination-pattern .T, which Cisco warns increase toll-fraud exposure 23 6. For inbound dial-peer matching, attach incoming uri via referencing a voice class uri matching the carrier, taking advantage of URI match priority over called-number matching 13 58. Dial-peer settings take precedence over tenant configurations, which override global settings 43.

Verify

Run show dial-peer voice summary to confirm that the carrier dial-peer operational status is UP 4 59.

Rollback

Suggested rollback: remove the configured dial-peer from the router configuration.

IP-authenticated: accepted by source and destination IP addresses

Do

Define a voice class uri <id> sip with host ipv4:<carrier-address> to identify inbound carrier signalling 58. Create the outbound and inbound dial-peer configuration with session protocol sipv2, session target ipv4:<carrier-address>, incoming uri via <id>, voice-class codec <tag>, and the OPTIONS keepalive profile 58 7 21. Ensure mandatory media and signalling interface binds are specified either on the dial-peer or via an assigned tenant 3 42. Restrict destination patterns to explicit ranges instead of catch-all entries such as .T 6. If the carrier provides multiple signalling IP addresses, build corresponding dial-peers with distinct preference values, where lower preference values are tried first 16. Outbound selection selects the most specific match first, falling back to preference order for matches of equal length 16.

Verify

Run show dial-peer voice summary to verify that all carrier dial-peers are listed in an UP state 4 59.

Rollback

Suggested rollback: delete the configured carrier dial-peers and voice class uri statements.

Step 10 Build the Unified CM-facing dial-peers

Do

Configure a voice class uri identifying Unified CM signalling by host address or port pattern, and attach it to an inbound dial-peer using incoming uri via 57 13. Configure an outbound dial-peer targeting Unified CM for delivered carrier DIDs, specifying LAN interface bind statements, dtmf-relay rtp-nte, and the codec voice class 57 3 7. If an inbound call fails to match a configured dial-peer, the system falls back to default dial-peer 0, which has no DTMF relay mechanism, advertises all codecs, and enables VAD 11.

Verify

Suggested check: view active call setups with the debugging tools during testing to verify that both inbound and outbound legs bind to explicit dial-peers rather than default dial-peers.

Rollback

Suggested rollback: delete the Unified CM dial-peers and the corresponding voice class uri.

Step 11 Confirm the carrier trunk status

Registration-based: registrar, credentials, and outbound proxy

Do

Run the registration and trunk keepalive verification commands from the executive CLI 4.

Verify

Run show sip-ua register status to confirm that the trunk registration status is registered 28. Run show dial-peer voip keepalive status to confirm the OPTIONS monitoring state 22. If registration fails, review debug ccsip messages to verify whether challenges receive appropriate credentials in the retry 4 30. When TLS is active, run show sip-ua connections tcp tls detail to inspect the negotiated TLS version and cipher suite 50.

Rollback

Suggested rollback: this verification step modifies no configuration.

IP-authenticated: accepted by source and destination IP addresses

Do

Run the keepalive verification commands from the executive CLI 4.

Verify

Run show dial-peer voice summary and show dial-peer voip keepalive status to confirm that the carrier dial-peer is active and not busied out 4 22 19. When TLS is enabled, run show sip-ua connections tcp tls detail to review the active TLS connection parameters 50.

Rollback

Suggested rollback: this verification step modifies no configuration.

Step 12 Place test calls in both directions

SIP over UDP with cleartext RTP

Do

Place test calls in both directions between Unified CM and the carrier, and verify DTMF transmission on each call 57 58.

Verify

Run show call active voice brief to check the active call legs and negotiated codec 4. If calls fail, use debug ccsip messages and debug voip ccapi inout to troubleshoot signalling and dial-peer selection 4. If inbound calls do not appear in debug logs, verify that the carrier source IP is present in the ip address trusted list 56.

Rollback

Suggested rollback: this step executes test calls and requires no rollback.

SIP over TLS with SRTP

Do

Place test calls in both directions between Unified CM and the carrier, and verify DTMF digit relay on both legs 57 58.

Verify

Run show call active voice brief to confirm active call legs and negotiated codecs 4. Run show sip-ua calls to confirm that SRTP suites and encryption keys are present on the carrier leg 41. If audio issues emerge after mid-call RTP-to-SRTP changes, ensure supplementary-service media-renegotiate is present 38.

Rollback

Suggested rollback: this step executes test calls and requires no rollback.

Applicability

Applies to: Cisco Unified Border Element, Cisco IOS SIP gateway, Cisco IOS, Telnyx SIP trunking, Cisco IOS XE Local Gateway (CUBE), SDP security descriptions, SIP, and Cisco IOS XE voice gateways. Deployments: on-premises, hybrid, multi-tenant, and any. Sources checked 2026-09-25. Cisco IOS XE Amsterdam 17.2.1r deprecated the capacity keyword on mode border-element, transitioning trunk licensing to dynamic session counting 15. A trunk-specific listen-port was added in Cupertino 17.8.1a, while TLS 1.3 is supported from Cisco IOS XE 17.14.1a 42 51. SRTP-to-SRTP call flows with transcoding are supported starting in Cisco IOS XE Bengaluru 17.6.1a 39.

What remains uncertain

The exact removal command syntax for every parameter across individual Cisco IOS XE sub-releases is not covered by the sources below. Platform DSP hardware requirements for interworking SRTP on the carrier leg with plain RTP on the Unified CM leg are not covered by the sources below. Carrier-side account portal configurations, public NAT address translation traversal rules, and DNS SRV record processing details are not covered by the sources below. In addition, Unified CM dial plan and SIP trunk configurations are not covered by the sources below.

See also

Configures

  • Cisco unified border elementstub — Configuration guide for connecting CUBE to a carrier SIP trunk with registration or IP authentication and UDP/RTP or TLS/SRTP.

Sources

  1. 1
    allow-connections sip to sip under voice service voip is part of basic CUBE enablement and permits SIP-to-SIP calls through the platform.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Overview of Cisco Unified Border Element; basic CUBE configuration steps · Checked 2026-09-25
  2. 2
    The authentication command (authentication username username password [0|7] password [realm realm]) configures SIP digest credentials used to answer challenges to both REGISTER and INVITE or other requests.
    SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks · Configuring Multiple Registrars on SIP Trunks; authentication command · Checked 2026-09-25
  3. 3
    All CUBE Enterprise deployments must have signalling and media bind statements specified at the dial-peer or voice class tenant level.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Configure Dial Peers; note on bind statements · Checked 2026-09-25
  4. 4
    show dial-peer voice summary, show call active voice brief, debug voip ccapi inout and debug ccsip messages are the commands Cisco gives for checking dial-peer status, active calls and dial-peer matching.
    Understand IOS and IOS XE Call Routing · Verify and troubleshoot sections · Checked 2026-09-25
  5. 5
    Telnyx offers either IP authentication or credential authentication for a CUBE trunk; for credentials it shows sip-ua credentials, authentication and registrar pointing at its SIP domain.
    Configuring a Cisco CUBE/CUCM SIP Trunk · Authentication options section · Checked 2026-09-25
  6. 6
    Cisco warns that generic catch-all destination patterns such as destination-pattern .T increase the likelihood of routing a fraudulent call through CUBE, and recommends restricting patterns to known ranges.
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Toll fraud section; dial-peer destination-pattern guidance · Checked 2026-09-25
  7. 7
    A codec preference list is built with voice class codec tag and codec preference value codec-type entries, then applied to a dial-peer with voice-class codec tag.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs · Introduction to Codecs; voice class codec and dial-peer application · Checked 2026-09-25
  8. 8
    With codecs configured on dial-peers CUBE filters codec negotiation to the configured codecs; with voice-class codec transparent only the offer passes unfiltered and filtering happens on the SDP in the answer.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs · Introduction to Codecs; codec negotiation and transparent codec · Checked 2026-09-25
  9. 9
    The offer-all keyword on voice-class codec makes CUBE offer every codec in the codec voice class.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs · Introduction to Codecs; voice-class codec tag offer-all · Checked 2026-09-25
  10. 10
    The credentials command (credentials number number username username password [0|7] password realm realm) makes the gateway send REGISTER requests and answer registration challenges for that number.
    SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks · Configuring Multiple Registrars on SIP Trunks; credentials command · Checked 2026-09-25
  11. 11
    When no inbound dial-peer matches, the gateway uses default dial-peer 0, which has no DTMF relay, advertises all voice codecs, enables VAD and does not support VRF.
    Understand IOS and IOS XE Call Routing · Inbound dial-peer matching; default dial-peer 0 characteristics · Checked 2026-09-25
  12. 12
    Cisco's CUBE hardening guide recommends disabling cleartext SIP transports (no transport udp, no transport tcp), enforcing TLS 1.2 as a minimum, and using SRTP.
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · TLS and SRTP section · Checked 2026-09-25
  13. 13
    For inbound SIP calls CUBE matches dial-peers in this order: voice class uri on incoming uri via, then request, then to, then from; then incoming called-number; then answer-address.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Configure Dial Peers; inbound dial-peer matching · Checked 2026-09-25
  14. 14
    Cisco's Local Gateway baseline under voice service voip includes ip address trusted list, mode border-element, media statistics, allow-connections sip to sip, no supplementary-service sip refer, and sip early-offer forced.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Voice service voip configuration block · Checked 2026-09-25
  15. 15
    From Cisco IOS XE Amsterdam 17.2.1r the capacity keyword of mode border-element is deprecated and CUBE SIP trunk licensing is based on dynamic session counting.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Overview of Cisco Unified Border Element; mode border-element license command description · Checked 2026-09-25
  16. 16
    For outbound selection the gateway picks the longest (most specific) destination match, and between equal-length matches uses the dial-peer preference, where a lower value is tried first.
    Understand IOS and IOS XE Call Routing · Outbound dial-peer matching section · Checked 2026-09-25
  17. 17
    Basic CUBE enablement is done under voice service voip with mode border-element, which enables CUBE configuration.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Overview of Cisco Unified Border Element; basic CUBE configuration steps · Checked 2026-09-25
  18. 18
    Using the same OPTIONS keepalive profile on two or more dial-peers with different bind interfaces is not supported.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring · SIP Trunk Monitoring; restrictions · Checked 2026-09-25
  19. 19
    CUBE counts any response to an OPTIONS ping (503, 200 OK and so on) as reachable and busies out the dial-peer only after the retry count is exhausted with no response.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring · SIP Trunk Monitoring; response handling and busyout · Checked 2026-09-25
  20. 20
    When an OPTIONS-monitored dial-peer is busied out and no alternate dial-peer exists, CUBE rejects the call with 503 by default; error-code-override options-keepalive failure changes this to any code from 400 to 699, and it has no effect on an outbound dial-peer.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure an Error Response Code upon an Out-of-Dialog OPTIONS Ping Failure · Configure an Error Response Code upon an Out-of-Dialog OPTIONS Ping Failure; configuration and restriction · Checked 2026-09-25
  21. 21
    An OPTIONS keepalive profile is created with voice class sip-options-keepalive id (transport, sip-profiles, down-interval default 30 s, up-interval default 60 s, retry default 5) and attached with voice-class sip options-keepalive profile id on the dial-peer.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring · SIP Trunk Monitoring; voice class sip-options-keepalive configuration · Checked 2026-09-25
  22. 22
    OPTIONS keepalive state is checked with show voice class sip-options-keepalive id, show dial-peer voice summary and show dial-peer voip keepalive status.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring · SIP Trunk Monitoring; verification · Checked 2026-09-25
  23. 23
    For outbound SIP dial-peer selection CUBE checks, in order, destination route-string, destination URI with carrier-id, destination-pattern with carrier-id, destination URI, destination-pattern, then target carrier-id; destination e164-pattern-map can also be used for pattern-based routing.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Configure Dial Peers; outbound dial-peer matching · Checked 2026-09-25
  24. 24
    The IOS XE 17.6+ Configure SIP Registration chapter covers registration pass-through (end-to-end and peer-to-peer modes) and a local registrar for endpoints behind CUBE, not CUBE registering its own trunk to a carrier.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure SIP Registration · Configure SIP Registration; registration methods · Checked 2026-09-25
  25. 25
    The sip-ua registrar command takes a registrar index from 1 to 6, a server address and an expires value; at most 6 registrars can be configured.
    SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks · Configuring Multiple Registrars on SIP Trunks; registrar command and restrictions · Checked 2026-09-25
  26. 26
    When the carrier leg is reached through a registrar, outbound proxy or sip-server rather than a dial-peer session target IP, the carrier's signalling addresses may not be trusted automatically, so they should be added explicitly to the trusted list.inferred
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Toll fraud section; list of automatically trusted sources (session target, server-group) read against the Local Gateway guide's instruction to add PSTN and data-centre ranges · Checked 2026-09-25
  27. 27
    RFC 4568 requires the SIP/SDP payload to be encrypted (for example with TLS) whenever it carries an inline SRTP master key, because an unencrypted key makes the SRTP protection useless.
    RFC 4568: Session Description Protocol (SDP) Security Descriptions for Media Streams · Section 8.3 (Signaling Authentication and Signaling Encryption) · Checked 2026-09-25
  28. 28
    show sip-ua register status is the command Cisco gives for verifying that a trunk has registered.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Verification commands for the registration-based trunk · Checked 2026-09-25
  29. 29
    show ip address trusted list displays the configured trusted addresses on CUBE.
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Monitoring commands section · Checked 2026-09-25
  30. 30
    In SIP a registrar or user agent challenges with 401 Unauthorized and a proxy with 407 Proxy Authentication Required, and the client retries with credentials.
    RFC 3261 — SIP: Session Initiation Protocol · Sections 22.2 (User-to-User Authentication) and 22.3 (Proxy-to-User Authentication) · Checked 2026-09-25
  31. 31
    The SIP OPTIONS method queries a server about its capabilities without setting up a call, which is what an out-of-dialog OPTIONS keepalive uses.
    RFC 3261 — SIP: Session Initiation Protocol · Section 11 (Querying for Capabilities) · Checked 2026-09-25
  32. 32
    Outbound SIP profiles apply with voice-class sip profiles id on a dial-peer or sip-profiles id globally; inbound profiles first need sip-profiles inbound under voice service voip sip, then voice-class sip profiles id inbound.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles · SIP Profiles; applying outbound and inbound profiles · Checked 2026-09-25
  33. 33
    SIP profiles cannot add or remove mandatory headers (To, From, Via, CSeq, Call-ID, Max-Forwards); header values are limited to 300 characters and SDP to 2048 characters.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles · SIP Profiles; restrictions · Checked 2026-09-25
  34. 34
    CUBE SIP profiles add, remove, copy or modify SIP, SDP and peer headers in incoming or outgoing messages to make incompatible devices interoperate.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles · SIP Profiles; overview · Checked 2026-09-25
  35. 35
    A SIP profile rule has the form rule n request METHOD sip-header|sdp-header HEADER add|remove|modify "match" "replace", with an equivalent response form keyed by status code.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles · SIP Profiles; rule syntax · Checked 2026-09-25
  36. 36
    show dial-peer voice id | include profile confirms which profile a dial-peer uses, and debug ccsip all shows applied profiles and their modifications.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles · SIP Profiles; verification · Checked 2026-09-25
  37. 37
    SRTP is enabled on a dial-peer with srtp (optionally srtp fallback), and cipher-suite preference is set with voice class srtp-crypto tag containing crypto 1-4 entries, applied with voice-class sip srtp-crypto tag.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking · SRTP-SRTP Interworking; dial-peer configuration and cipher suite preference · Checked 2026-09-25
  38. 38
    Any call flow that switches from RTP to SRTP on the same SIP call leg requires the supplementary-service media-renegotiate command to ensure two-way audio.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking · SRTP-SRTP Interworking; SRTP-RTP interworking note · Checked 2026-09-25
  39. 39
    CUBE does not support asymmetric SRTP fallback configuration or SRTCP-RTCP interworking, and supports SRTP-SRTP calls with transcoding only from IOS XE Bengaluru 17.6.1a.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking · SRTP-SRTP Interworking; restrictions · Checked 2026-09-25
  40. 40
    CUBE supports the SRTP cipher suites AEAD_AES_256_GCM, AEAD_AES_128_GCM, AES_CM_128_HMAC_SHA1_80 and AES_CM_128_HMAC_SHA1_32, in that default preference order.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking · SRTP-SRTP Interworking; supported crypto suites · Checked 2026-09-25
  41. 41
    show sip-ua calls displays the local and remote crypto keys, crypto suites and media stream details for SRTP calls.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking · SRTP-SRTP Interworking; verification · Checked 2026-09-25
  42. 42
    Tenant-level attributes include registrar, credentials, sip-server, bind, outbound-proxy and sip-profiles; a trunk-specific listen-port was added in Cupertino 17.8.1a.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Configure Multiple Trunks Using Tenants; supported tenant attributes and example · Checked 2026-09-25
  43. 43
    When a tenant is attached to a dial-peer, dial-peer configuration takes precedence over tenant configuration, which takes precedence over global configuration.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Configure Multiple Trunks Using Tenants; configuration precedence · Checked 2026-09-25
  44. 44
    Cisco's current registration-based trunk example puts registrar (with expires and refresh-ratio), credentials, authentication, bind control and media, sip-profiles and outbound-proxy inside one voice class tenant, and the trunk dial-peer uses session target sip-server with voice-class sip tenant.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Registration-based trunk configuration; voice class tenant 100 and dial-peer voice 100 · Checked 2026-09-25
  45. 45
    A tenant is detached from a dial-peer with no voice-class sip tenant tag.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Configure Multiple Trunks Using Tenants; dial-peer association · Checked 2026-09-25
  46. 46
    A voice class tenant acts as a configuration template for dial-peers, letting each SIP trunk override global settings, and is attached with voice-class sip tenant tag in dial-peer configuration.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · Configure Multiple Trunks Using Tenants; overview and dial-peer association · Checked 2026-09-25
  47. 47
    The CUBE TLS chapter notes that security licences are required on ISR 4300 and 4400 routers and recommends synchronising all devices in the solution to a common NTP source.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · SIP TLS Support on CUBE; restrictions · Checked 2026-09-25
  48. 48
    CUBE SIP TLS uses a crypto pki trustpoint holding the CUBE certificate, an optional voice class tls-cipher list, and a voice class tls-profile that references the cipher list and trustpoint and can enable cn-san validate server and sni send.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · SIP TLS Support on CUBE; configuration steps 1 to 3 · Checked 2026-09-25
  49. 49
    TLS is enabled globally with sip-ua transport tcp tls v1.2 and per trunk in the tenant with tls-profile, session transport tcp tls, listen-port secure 5061 and url sips.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · SIP TLS Support on CUBE; configuration steps 4 and 5 · Checked 2026-09-25
  50. 50
    show sip-ua connections tcp tls brief lists active TLS connections, and show sip-ua connections tcp tls detail shows the negotiated TLS version, cipher suite and key type.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · SIP TLS Support on CUBE; verification · Checked 2026-09-25
  51. 51
    From Cisco IOS XE 17.14.1a CUBE supports TLS 1.3 alongside 1.0, 1.1 and 1.2; TLS 1.0 and 1.1 are available only in system mode insecure.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · SIP TLS Support on CUBE; supported TLS versions · Checked 2026-09-25
  52. 52
    By default CUBE trusts inbound connections from IPv4 and IPv6 addresses configured as dial-peer session targets and in voice class server-group configurations.
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Toll fraud section; IP address trusted list · Checked 2026-09-25
  53. 53
    The toll-fraud trusted list is configured under voice service voip with ip address trusted list followed by ipv4 address [mask] or ipv6 address entries; up to 100 IPv4 entries are supported.
    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Overview of Cisco Unified Border Element; Configure a Trusted IP Address List for Toll-Fraud Prevention · Checked 2026-09-25
  54. 54
    Cisco's Local Gateway guide installs the root CA bundle with crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b so CUBE can validate public-CA server certificates.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · TLS and sip-ua configuration; trustpool import · Checked 2026-09-25
  55. 55
    On a carrier trunk signalled over UDP, SDES-keyed SRTP would expose its keys, so SRTP toward the carrier is only meaningful together with TLS; the UDP option should be treated as cleartext RTP.inferred
    RFC 4568: Session Description Protocol (SDP) Security Descriptions for Media Streams · Section 8.3, applied to a UDP-signalled SIP trunk · Checked 2026-09-25
  56. 56
    By default an inbound call that fails the IP trusted list check is silently discarded rather than answered with an error.
    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Toll fraud section; handling of untrusted connections · Checked 2026-09-25
  57. 57
    Cisco's Unified CM example classifies calls from Unified CM with a voice class uri (a pattern such as :5065, or a host match) referenced by incoming uri via on the Unified CM-facing dial-peer, which carries its own bind statements and dtmf-relay rtp-nte.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment; voice class uri 300 and dial-peer voice 300 · Checked 2026-09-25
  58. 58
    Cisco's IP PSTN example classifies inbound carrier calls with voice class uri id sip / host ipv4:carrier-address and matches them with incoming uri via id on a dial-peer whose session target is ipv4:carrier-address, with bind control and media statements.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · IP PSTN section; voice class uri 200 and dial-peer voice 200 · Checked 2026-09-25
  59. 59
    A dial peer must be in the UP operational state to be eligible for call routing; an outbound VoIP dial peer needs a valid outbound matching mechanism and a valid session target to be UP.
    Understand IOS and IOS XE Call Routing · Dial-Peer States · Checked 2026-09-24

Documents

tier 1 standards and regulators

RFC 3261 — SIP: Session Initiation Protocol

IETF / RFC Editor · 2002-06 · accessed 2026-09-04

tier 1 standards and regulators

RFC 4568: Session Description Protocol (SDP) Security Descriptions for Media Streams

IETF / RFC Editor · 2006-07-01 · accessed 2026-09-23

tier 2 current vendor documentation

Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices

Cisco Systems · 2023-04-10 · accessed 2026-09-23

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure an Error Response Code upon an Out-of-Dialog OPTIONS Ping Failure

Cisco Systems · 2026-04-25 · accessed 2026-09-25

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers

Cisco · 2026-04-25 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants

Cisco · accessed 2026-09-25

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure SIP Registration

Cisco Systems · 2026-04-25 · accessed 2026-09-25

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs

Cisco Systems · 2026-04-25 · accessed 2026-09-25

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element

Cisco · accessed 2026-09-21

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles

Cisco Systems · 2026-04-25 · accessed 2026-09-25

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support

Cisco · 2026-04-25 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring

Cisco · 2026-04-25 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking

Cisco Systems · 2026-04-25 · accessed 2026-09-23

tier 2 current vendor documentation

Configure Local Gateway on Cisco IOS XE for Webex Calling

Cisco Systems, Inc. (Webex Help Center) · 2026-07-09 · accessed 2026-09-04

tier 2 current vendor documentation

Configuring a Cisco CUBE/CUCM SIP Trunk

Telnyx · 2026-09-25 · accessed 2026-09-25

tier 2 current vendor documentation

SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks

Cisco Systems · 2014-11-25 · accessed 2026-09-25

tier 2 current vendor documentation

Understand IOS and IOS XE Call Routing

Cisco Systems · 2026-04-28 · accessed 2026-09-24

Cite this page

APA

WarmTransfer. (2026, September 25). Setting up CUBE for a carrier SIP trunk. WarmTransfer. https://warmtransfer.net/guides/cube-carrier-trunk-setup

BibTeX

@misc{warmtransfer-cube-carrier-trunk-setup,
  title  = {Setting up CUBE for a carrier SIP trunk},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/cube-carrier-trunk-setup},
  note   = {Verified 2026-09-25}
}