# Setting up CUBE for a carrier SIP trunk

Systems: Cisco Unified Border Element

For Voice engineers configuring a carrier SIP trunk on Cisco Unified Border Element.

Canonical: https://warmtransfer.net/guides/cube-carrier-trunk-setup

Last verified: 2026-09-25

This guide steps through configuring a SIP trunk between Cisco Unified Border Element (CUBE) on Cisco IOS XE and an ITSP carrier, establishing bi-directional call routing with Cisco Unified Communications Manager (Unified CM) and trunk health monitoring using SIP OPTIONS[^17][^57][^21]. Telnyx, for example, offers both IP authentication and credential authentication models for a CUBE trunk connection[^5].

## Before you start

- Verify that you have network reachability between the CUBE interfaces, the carrier signalling endpoints, and the Unified CM nodes[^57][^58].
- Collect the carrier's signalling IP addresses or registrar FQDN, SIP credentials if required, supported audio codecs, and expected SRTP crypto suites[^5][^7][^40].
- Ensure that the CUBE enterprise router runs a supported Cisco IOS XE release, noting that dynamic session counting replaces the legacy capacity licensing model starting in Cisco IOS XE Amsterdam 17.2.1r[^15].

## What changes by situation

- How does your carrier authenticate your trunk? Registration-based: registrar, credentials, and outbound proxy; IP-authenticated: accepted by source and destination IP addresses.
- How is the carrier leg signalled and how is its media carried? SIP over UDP with cleartext RTP; SIP over TLS with SRTP.

## Step 1: Enable CUBE under voice service voip

### Do
Configure `mode border-element` and `allow-connections sip to sip` under `voice service voip` to permit SIP-to-SIP call routing through the router[^17][^1]. Do not configure the deprecated `capacity` keyword on Cisco IOS XE Amsterdam 17.2.1r or later releases, as trunk licensing is enforced using dynamic session counting[^15]. In baseline Cisco Local Gateway designs, settings such as `media statistics`, `no supplementary-service sip refer`, and `early-offer forced` under `sip` are also applied[^14].

### Verify
Suggested check: inspect the running configuration to confirm that both commands are present under the voice service block.

### Rollback
Suggested rollback: remove the added configuration lines under the voice service block.

## Step 2: Restrict incoming traffic with the IP trusted list

### Do
Configure `ip address trusted list` under `voice service voip` and add `ipv4 address [mask]` entries for each Unified CM node and carrier signalling address[^53]. CUBE automatically trusts addresses defined as dial-peer session targets and server-group targets, but entries pointing to a registrar, outbound proxy, or `sip-server` require explicit entries in the trusted list[^52][^44]. Cisco warns that inbound calls failing the IP trusted list check are silently discarded rather than rejected with a SIP error[^56].

### Verify
Run `show ip address trusted list` to confirm that all required Unified CM and carrier addresses appear in the table[^29].

### Rollback
Suggested rollback: delete the configured ipv4 entries from the trusted list configuration block.

## Step 3: Define the voice class codec preference list

### Do
Create a codec preference list using `voice class codec <tag>` and add preference entries with `codec preference <value> <codec-type>` for the audio codecs negotiated with the carrier[^7]. CUBE filters codec negotiation against the list assigned to the dial-peer unless the `offer-all` keyword is appended to offer every configured codec[^8][^9].

### Verify
Suggested check: view the configured voice class codec using the command-line interface to ensure the preference order matches carrier requirements.

### Rollback
Suggested rollback: remove the voice class codec identifier from any dial-peers and delete the voice class codec.

## Step 4: Prepare TLS on the platform

**SIP over UDP with cleartext RTP**

### Do
Retain cleartext transport support rather than applying hardening commands that disable UDP[^12].

### Verify
Suggested check: verify the router configuration retains UDP transport capability for SIP processing.

### Rollback
Suggested rollback: no changes to revert for this transport mode.

**SIP over TLS with SRTP**

### Do
Configure a `crypto pki trustpoint` containing the CUBE certificate and import the root certificate authority bundle using `crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b` to allow validation of public CA certificates[^48][^54]. Define an optional `voice class tls-cipher` list and create a `voice class tls-profile` referencing the trustpoint, enabling `cn-san validate server` and `sni send` as needed[^48]. Enable global SIP TLS with `transport tcp tls v1.2` under `sip-ua`, verify router security licenses on ISR 4300 and 4400 platforms, and ensure all systems synchronize to a common NTP source[^49][^47]. TLS 1.3 is supported starting in Cisco IOS XE 17.14.1a, while TLS 1.0 and 1.1 are restricted to insecure system mode[^51].

### Verify
Suggested check: verify that NTP is synchronized and check that the trustpoint and imported trustpool certificates display correctly in the crypto PKI configuration.

### Rollback
Suggested rollback: remove the tls-profile and disable the transport command under sip-ua.

## Step 5: Define the carrier trunk tenant and authentication

**Registration-based: registrar, credentials, and outbound proxy**

### Do
Create a `voice class tenant <tag>` to override global parameters for the carrier trunk[^46][^42]. Configure `registrar` with the carrier server and expiration time, and define `credentials number <number> username <username> password [0|7] <password> realm <realm>` to issue REGISTER requests and process challenges[^10][^44]. Add `authentication username <username> password [0|7] <password> [realm <realm>]` to respond to 401 or 407 digest challenges on outbound INVITE requests[^2][^30]. Configure `bind control` and `bind media` to the carrier-facing interface, which is mandatory for enterprise deployments[^3][^44]. Note that trunk registration is distinct from endpoint registration pass-through configurations[^24].

### Verify
Suggested check: review the tenant configuration to confirm that the registrar, credentials, digest authentication, and binding statements are configured.

### Rollback
Detach the tenant configuration from associated dial-peers using `no voice-class sip tenant <tag>` and delete the tenant[^45].

**IP-authenticated: accepted by source and destination IP addresses**

### Do
Create a `voice class tenant <tag>` and configure mandatory `bind control` and `bind media` statements targeting the external WAN interface[^3][^42]. Do not define registrar or SIP credential statements within the tenant[^42].

### Verify
Suggested check: inspect the voice class tenant to verify that interface binds are applied without registration parameters.

### Rollback
Detach the tenant configuration from associated dial-peers using `no voice-class sip tenant <tag>` and delete the tenant[^45].

## Step 6: Configure carrier transport and media encryption

**SIP over UDP with cleartext RTP**

### Do
Configure the carrier leg for cleartext RTP media and standard UDP signalling without SRTP commands[^12].

### Verify
Suggested check: verify that the dial-peer uses UDP transport and does not reference crypto profiles.

### Rollback
Suggested rollback: no encryption settings to remove.

**SIP over TLS with SRTP**

### Do
In the carrier tenant, configure `tls-profile <tag>`, `session transport tcp tls`, `listen-port secure 5061`, and `url sips`[^49]. Create a `voice class srtp-crypto <tag>` configuring supported suites such as `AEAD_AES_256_GCM`, `AEAD_AES_128_GCM`, `AES_CM_128_HMAC_SHA1_80`, and `AES_CM_128_HMAC_SHA1_32`[^40]. SDES SRTP requires signalling encryption such as TLS to protect master keys carried in SDP[^27]. Apply `srtp` and `voice-class sip srtp-crypto <tag>` to the carrier dial-peer, noting that asymmetric SRTP fallback is unsupported and dynamic shifts from RTP to SRTP on the same leg require `supplementary-service media-renegotiate`[^37][^39][^38].

### Verify
Run `show sip-ua calls` during call testing to inspect negotiated SRTP suites and active crypto keys on the carrier call leg[^41].

### Rollback
Suggested rollback: remove the srtp and srtp-crypto lines from the dial-peer and remove TLS attributes from the tenant.

## Step 7: Apply SIP profiles for carrier header adjustments

### Do
Create a `voice class sip-profiles <id>` structure using rules of the format `rule <n> request <METHOD> sip-header <Header> modify "<match>" "<replace>"` to adapt headers for carrier compatibility[^34][^35]. Apply the profile outbound with `voice-class sip profiles <id>` on the carrier dial-peer or tenant[^32][^42]. If incoming messages require header modification, configure `sip-profiles inbound` under `voice service voip` / `sip` before assigning an inbound profile[^32]. Note that SIP profiles cannot add or delete mandatory headers including To, From, Via, CSeq, Call-ID, or Max-Forwards, and are limited to 300 characters per header value and 2048 characters for SDP[^33].

### Verify
Run `show dial-peer voice <id> | include profile` to confirm attachment, and use `debug ccsip all` during call flows to verify that SIP header manipulations are applied[^36].

### Rollback
Remove the SIP profiles entry from the dial-peer or tenant using `no voice-class sip profiles <id>`[^32][^42].

## Step 8: Configure SIP OPTIONS keepalive monitoring

### Do
Create an out-of-dialog keepalive profile with `voice class sip-options-keepalive <id>` to query carrier endpoint capabilities without establishing calls[^31][^21]. Set the transport parameter to match the signalling transport (`udp` or `tcp tls`) and adjust `up-interval` (default 60 seconds), `down-interval` (default 30 seconds), or `retry` (default 5) as required[^21]. Do not attach the same OPTIONS profile across multiple dial-peers that bind to different network interfaces[^18]. Note that for SRV or server-group destinations, CUBE treats any response, including a 503 Service Unavailable, as indicating an active destination, and busies out the dial-peer only when all retries timeout without a response[^19]. When a monitored dial-peer busies out and no alternate route exists, CUBE returns a 503 by default; configuring `error-code-override options-keepalive failure` alters this code on incoming calls but has no effect on outbound dial-peers[^20].

### Verify
Run `show voice class sip-options-keepalive <id>` and `show dial-peer voip keepalive status` to verify profile attributes and keepalive operational status[^22].

### Rollback
Suggested rollback: detach the options-keepalive profile from the dial-peer and delete the voice class sip-options-keepalive profile.

## Step 9: Build the carrier-facing dial-peers

**Registration-based: registrar, credentials, and outbound proxy**

### Do
Create the carrier dial-peer with `session protocol sipv2`, `session target sip-server`, and `voice-class sip tenant <tag>`[^44]. Apply `voice-class codec <tag>` and `voice-class sip options-keepalive profile <id>` to the peer[^7][^21][^58]. Define outbound destinations using specific number ranges or `destination e164-pattern-map` rather than broad catch-all patterns like `destination-pattern.T`, which Cisco warns increase toll-fraud exposure[^23][^6]. For inbound dial-peer matching, attach `incoming uri via` referencing a `voice class uri` matching the carrier, taking advantage of URI match priority over called-number matching[^13][^58]. Dial-peer settings take precedence over tenant configurations, which override global settings[^43].

### Verify
Run `show dial-peer voice summary` to confirm that the carrier dial-peer operational status is UP[^4][^59].

### Rollback
Suggested rollback: remove the configured dial-peer from the router configuration.

**IP-authenticated: accepted by source and destination IP addresses**

### Do
Define a `voice class uri <id> sip` with `host ipv4:<carrier-address>` to identify inbound carrier signalling[^58]. Create the outbound and inbound dial-peer configuration with `session protocol sipv2`, `session target ipv4:<carrier-address>`, `incoming uri via <id>`, `voice-class codec <tag>`, and the OPTIONS keepalive profile[^58][^7][^21]. Ensure mandatory media and signalling interface binds are specified either on the dial-peer or via an assigned tenant[^3][^42]. Restrict destination patterns to explicit ranges instead of catch-all entries such as `.T`[^6]. If the carrier provides multiple signalling IP addresses, build corresponding dial-peers with distinct `preference` values, where lower preference values are tried first[^16]. Outbound selection selects the most specific match first, falling back to preference order for matches of equal length[^16].

### Verify
Run `show dial-peer voice summary` to verify that all carrier dial-peers are listed in an UP state[^4][^59].

### Rollback
Suggested rollback: delete the configured carrier dial-peers and voice class uri statements.

## Step 10: Build the Unified CM-facing dial-peers

### Do
Configure a `voice class uri` identifying Unified CM signalling by host address or port pattern, and attach it to an inbound dial-peer using `incoming uri via`[^57][^13]. Configure an outbound dial-peer targeting Unified CM for delivered carrier DIDs, specifying LAN interface bind statements, `dtmf-relay rtp-nte`, and the codec voice class[^57][^3][^7]. If an inbound call fails to match a configured dial-peer, the system falls back to default dial-peer 0, which has no DTMF relay mechanism, advertises all codecs, and enables VAD[^11].

### Verify
Suggested check: view active call setups with the debugging tools during testing to verify that both inbound and outbound legs bind to explicit dial-peers rather than default dial-peers.

### Rollback
Suggested rollback: delete the Unified CM dial-peers and the corresponding voice class uri.

## Step 11: Confirm the carrier trunk status

**Registration-based: registrar, credentials, and outbound proxy**

### Do
Run the registration and trunk keepalive verification commands from the executive CLI[^4].

### Verify
Run `show sip-ua register status` to confirm that the trunk registration status is registered[^28]. Run `show dial-peer voip keepalive status` to confirm the OPTIONS monitoring state[^22]. If registration fails, review `debug ccsip messages` to verify whether challenges receive appropriate credentials in the retry[^4][^30]. When TLS is active, run `show sip-ua connections tcp tls detail` to inspect the negotiated TLS version and cipher suite[^50].

### Rollback
Suggested rollback: this verification step modifies no configuration.

**IP-authenticated: accepted by source and destination IP addresses**

### Do
Run the keepalive verification commands from the executive CLI[^4].

### Verify
Run `show dial-peer voice summary` and `show dial-peer voip keepalive status` to confirm that the carrier dial-peer is active and not busied out[^4][^22][^19]. When TLS is enabled, run `show sip-ua connections tcp tls detail` to review the active TLS connection parameters[^50].

### Rollback
Suggested rollback: this verification step modifies no configuration.

## Step 12: Place test calls in both directions

**SIP over UDP with cleartext RTP**

### Do
Place test calls in both directions between Unified CM and the carrier, and verify DTMF transmission on each call[^57][^58].

### Verify
Run `show call active voice brief` to check the active call legs and negotiated codec[^4]. If calls fail, use `debug ccsip messages` and `debug voip ccapi inout` to troubleshoot signalling and dial-peer selection[^4]. If inbound calls do not appear in debug logs, verify that the carrier source IP is present in the `ip address trusted list`[^56].

### Rollback
Suggested rollback: this step executes test calls and requires no rollback.

**SIP over TLS with SRTP**

### Do
Place test calls in both directions between Unified CM and the carrier, and verify DTMF digit relay on both legs[^57][^58].

### Verify
Run `show call active voice brief` to confirm active call legs and negotiated codecs[^4]. Run `show sip-ua calls` to confirm that SRTP suites and encryption keys are present on the carrier leg[^41]. If audio issues emerge after mid-call RTP-to-SRTP changes, ensure `supplementary-service media-renegotiate` is present[^38].

### Rollback
Suggested rollback: this step executes test calls and requires no rollback.

## Applicability

Applies to: Cisco Unified Border Element, Cisco IOS SIP gateway, Cisco IOS, Telnyx SIP trunking, Cisco IOS XE Local Gateway (CUBE), SDP security descriptions, SIP, and Cisco IOS XE voice gateways. Deployments: on-premises, hybrid, multi-tenant, and any. Sources checked 2026-09-25. Cisco IOS XE Amsterdam 17.2.1r deprecated the `capacity` keyword on `mode border-element`, transitioning trunk licensing to dynamic session counting[^15]. A trunk-specific `listen-port` was added in Cupertino 17.8.1a, while TLS 1.3 is supported from Cisco IOS XE 17.14.1a[^42][^51]. SRTP-to-SRTP call flows with transcoding are supported starting in Cisco IOS XE Bengaluru 17.6.1a[^39].

## What remains uncertain

The exact removal command syntax for every parameter across individual Cisco IOS XE sub-releases is not covered by the sources below. Platform DSP hardware requirements for interworking SRTP on the carrier leg with plain RTP on the Unified CM leg are not covered by the sources below. Carrier-side account portal configurations, public NAT address translation traversal rules, and DNS SRV record processing details are not covered by the sources below. In addition, Unified CM dial plan and SIP trunk configurations are not covered by the sources below.

## Sources

[^1]: allow-connections sip to sip under voice service voip is part of basic CUBE enablement and permits SIP-to-SIP calls through the platform. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Overview of Cisco Unified Border Element; basic CUBE configuration steps. Checked 2026-09-25.
[^2]: The authentication command (authentication username username password [0|7] password [realm realm]) configures SIP digest credentials used to answer challenges to both REGISTER and INVITE or other requests. Source: [SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/sip/configuration/15-mt/sip-config-15-mt-book/voi-sip-multi-trunks.html), Configuring Multiple Registrars on SIP Trunks; authentication command. Checked 2026-09-25.
[^3]: All CUBE Enterprise deployments must have signalling and media bind statements specified at the dial-peer or voice class tenant level. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-dp.html), Configure Dial Peers; note on bind statements. Checked 2026-09-25.
[^4]: show dial-peer voice summary, show call active voice brief, debug voip ccapi inout and debug ccsip messages are the commands Cisco gives for checking dial-peer status, active calls and dial-peer matching. Source: [Understand IOS and IOS XE Call Routing](https://www.cisco.com/c/en/us/support/docs/voice/ip-telephony-voice-over-ip-voip/211306-In-Depth-Explanation-of-Cisco-IOS-and-IO.html), Verify and troubleshoot sections. Checked 2026-09-25.
[^5]: Telnyx offers either IP authentication or credential authentication for a CUBE trunk; for credentials it shows sip-ua credentials, authentication and registrar pointing at its SIP domain. Source: [Configuring a Cisco CUBE/CUCM SIP Trunk](https://support.telnyx.com/en/articles/1130673-configuring-a-cisco-cube-cucm-sip-trunk), Authentication options section. Checked 2026-09-25.
[^6]: Cisco warns that generic catch-all destination patterns such as destination-pattern .T increase the likelihood of routing a fraudulent call through CUBE, and recommends restricting patterns to known ranges. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Toll fraud section; dial-peer destination-pattern guidance. Checked 2026-09-25.
[^7]: A codec preference list is built with voice class codec tag and codec preference value codec-type entries, then applied to a dial-peer with voice-class codec tag. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-codec-basic.html), Introduction to Codecs; voice class codec and dial-peer application. Checked 2026-09-25.
[^8]: With codecs configured on dial-peers CUBE filters codec negotiation to the configured codecs; with voice-class codec transparent only the offer passes unfiltered and filtering happens on the SDP in the answer. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-codec-basic.html), Introduction to Codecs; codec negotiation and transparent codec. Checked 2026-09-25.
[^9]: The offer-all keyword on voice-class codec makes CUBE offer every codec in the codec voice class. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Introduction to Codecs](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-codec-basic.html), Introduction to Codecs; voice-class codec tag offer-all. Checked 2026-09-25.
[^10]: The credentials command (credentials number number username username password [0|7] password realm realm) makes the gateway send REGISTER requests and answer registration challenges for that number. Source: [SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/sip/configuration/15-mt/sip-config-15-mt-book/voi-sip-multi-trunks.html), Configuring Multiple Registrars on SIP Trunks; credentials command. Checked 2026-09-25.
[^11]: When no inbound dial-peer matches, the gateway uses default dial-peer 0, which has no DTMF relay, advertises all voice codecs, enables VAD and does not support VRF. Source: [Understand IOS and IOS XE Call Routing](https://www.cisco.com/c/en/us/support/docs/voice/ip-telephony-voice-over-ip-voip/211306-In-Depth-Explanation-of-Cisco-IOS-and-IO.html), Inbound dial-peer matching; default dial-peer 0 characteristics. Checked 2026-09-25.
[^12]: Cisco's CUBE hardening guide recommends disabling cleartext SIP transports (no transport udp, no transport tcp), enforcing TLS 1.2 as a minimum, and using SRTP. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), TLS and SRTP section. Checked 2026-09-25.
[^13]: For inbound SIP calls CUBE matches dial-peers in this order: voice class uri on incoming uri via, then request, then to, then from; then incoming called-number; then answer-address. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-dp.html), Configure Dial Peers; inbound dial-peer matching. Checked 2026-09-25.
[^14]: Cisco's Local Gateway baseline under voice service voip includes ip address trusted list, mode border-element, media statistics, allow-connections sip to sip, no supplementary-service sip refer, and sip early-offer forced. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip configuration block. Checked 2026-09-25.
[^15]: From Cisco IOS XE Amsterdam 17.2.1r the capacity keyword of mode border-element is deprecated and CUBE SIP trunk licensing is based on dynamic session counting. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Overview of Cisco Unified Border Element; mode border-element license command description. Checked 2026-09-25.
[^16]: For outbound selection the gateway picks the longest (most specific) destination match, and between equal-length matches uses the dial-peer preference, where a lower value is tried first. Source: [Understand IOS and IOS XE Call Routing](https://www.cisco.com/c/en/us/support/docs/voice/ip-telephony-voice-over-ip-voip/211306-In-Depth-Explanation-of-Cisco-IOS-and-IO.html), Outbound dial-peer matching section. Checked 2026-09-25.
[^17]: Basic CUBE enablement is done under voice service voip with mode border-element, which enables CUBE configuration. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Overview of Cisco Unified Border Element; basic CUBE configuration steps. Checked 2026-09-25.
[^18]: Using the same OPTIONS keepalive profile on two or more dial-peers with different bind interfaces is not supported. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), SIP Trunk Monitoring; restrictions. Checked 2026-09-25.
[^19]: CUBE counts any response to an OPTIONS ping (503, 200 OK and so on) as reachable and busies out the dial-peer only after the retry count is exhausted with no response. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), SIP Trunk Monitoring; response handling and busyout. Checked 2026-09-25.
[^20]: When an OPTIONS-monitored dial-peer is busied out and no alternate dial-peer exists, CUBE rejects the call with 503 by default; error-code-override options-keepalive failure changes this to any code from 400 to 699, and it has no effect on an outbound dial-peer. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure an Error Response Code upon an Out-of-Dialog OPTIONS Ping Failure](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-conf-err-resp.html), Configure an Error Response Code upon an Out-of-Dialog OPTIONS Ping Failure; configuration and restriction. Checked 2026-09-25.
[^21]: An OPTIONS keepalive profile is created with voice class sip-options-keepalive id (transport, sip-profiles, down-interval default 30 s, up-interval default 60 s, retry default 5) and attached with voice-class sip options-keepalive profile id on the dial-peer. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), SIP Trunk Monitoring; voice class sip-options-keepalive configuration. Checked 2026-09-25.
[^22]: OPTIONS keepalive state is checked with show voice class sip-options-keepalive id, show dial-peer voice summary and show dial-peer voip keepalive status. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), SIP Trunk Monitoring; verification. Checked 2026-09-25.
[^23]: For outbound SIP dial-peer selection CUBE checks, in order, destination route-string, destination URI with carrier-id, destination-pattern with carrier-id, destination URI, destination-pattern, then target carrier-id; destination e164-pattern-map can also be used for pattern-based routing. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-dp.html), Configure Dial Peers; outbound dial-peer matching. Checked 2026-09-25.
[^24]: The IOS XE 17.6+ Configure SIP Registration chapter covers registration pass-through (end-to-end and peer-to-peer modes) and a local registrar for endpoints behind CUBE, not CUBE registering its own trunk to a carrier. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure SIP Registration](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_sip-registration-in-cube.html), Configure SIP Registration; registration methods. Checked 2026-09-25.
[^25]: The sip-ua registrar command takes a registrar index from 1 to 6, a server address and an expires value; at most 6 registrars can be configured. Source: [SIP Configuration Guide, Cisco IOS Release 15M&T - Configuring Multiple Registrars on SIP Trunks](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/sip/configuration/15-mt/sip-config-15-mt-book/voi-sip-multi-trunks.html), Configuring Multiple Registrars on SIP Trunks; registrar command and restrictions. Checked 2026-09-25.
[^26]: When the carrier leg is reached through a registrar, outbound proxy or sip-server rather than a dial-peer session target IP, the carrier's signalling addresses may not be trusted automatically, so they should be added explicitly to the trusted list (inferred). Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Toll fraud section; list of automatically trusted sources (session target, server-group) read against the Local Gateway guide's instruction to add PSTN and data-centre ranges. Checked 2026-09-25.
[^27]: RFC 4568 requires the SIP/SDP payload to be encrypted (for example with TLS) whenever it carries an inline SRTP master key, because an unencrypted key makes the SRTP protection useless. Source: [RFC 4568: Session Description Protocol (SDP) Security Descriptions for Media Streams](https://www.rfc-editor.org/rfc/rfc4568.html), Section 8.3 (Signaling Authentication and Signaling Encryption). Checked 2026-09-25.
[^28]: show sip-ua register status is the command Cisco gives for verifying that a trunk has registered. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Verification commands for the registration-based trunk. Checked 2026-09-25.
[^29]: show ip address trusted list displays the configured trusted addresses on CUBE. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Monitoring commands section. Checked 2026-09-25.
[^30]: In SIP a registrar or user agent challenges with 401 Unauthorized and a proxy with 407 Proxy Authentication Required, and the client retries with credentials. Source: [RFC 3261 — SIP: Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html), Sections 22.2 (User-to-User Authentication) and 22.3 (Proxy-to-User Authentication). Checked 2026-09-25.
[^31]: The SIP OPTIONS method queries a server about its capabilities without setting up a call, which is what an out-of-dialog OPTIONS keepalive uses. Source: [RFC 3261 — SIP: Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html), Section 11 (Querying for Capabilities). Checked 2026-09-25.
[^32]: Outbound SIP profiles apply with voice-class sip profiles id on a dial-peer or sip-profiles id globally; inbound profiles first need sip-profiles inbound under voice service voip sip, then voice-class sip profiles id inbound. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-param-mod.html), SIP Profiles; applying outbound and inbound profiles. Checked 2026-09-25.
[^33]: SIP profiles cannot add or remove mandatory headers (To, From, Via, CSeq, Call-ID, Max-Forwards); header values are limited to 300 characters and SDP to 2048 characters. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-param-mod.html), SIP Profiles; restrictions. Checked 2026-09-25.
[^34]: CUBE SIP profiles add, remove, copy or modify SIP, SDP and peer headers in incoming or outgoing messages to make incompatible devices interoperate. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-param-mod.html), SIP Profiles; overview. Checked 2026-09-25.
[^35]: A SIP profile rule has the form rule n request METHOD sip-header|sdp-header HEADER add|remove|modify "match" "replace", with an equivalent response form keyed by status code. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-param-mod.html), SIP Profiles; rule syntax. Checked 2026-09-25.
[^36]: show dial-peer voice id | include profile confirms which profile a dial-peer uses, and debug ccsip all shows applied profiles and their modifications. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Profiles](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-param-mod.html), SIP Profiles; verification. Checked 2026-09-25.
[^37]: SRTP is enabled on a dial-peer with srtp (optionally srtp fallback), and cipher-suite preference is set with voice class srtp-crypto tag containing crypto 1-4 entries, applied with voice-class sip srtp-crypto tag. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_srtp-srtp-interworking.html), SRTP-SRTP Interworking; dial-peer configuration and cipher suite preference. Checked 2026-09-25.
[^38]: Any call flow that switches from RTP to SRTP on the same SIP call leg requires the supplementary-service media-renegotiate command to ensure two-way audio. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_srtp-srtp-interworking.html), SRTP-SRTP Interworking; SRTP-RTP interworking note. Checked 2026-09-25.
[^39]: CUBE does not support asymmetric SRTP fallback configuration or SRTCP-RTCP interworking, and supports SRTP-SRTP calls with transcoding only from IOS XE Bengaluru 17.6.1a. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_srtp-srtp-interworking.html), SRTP-SRTP Interworking; restrictions. Checked 2026-09-25.
[^40]: CUBE supports the SRTP cipher suites AEAD_AES_256_GCM, AEAD_AES_128_GCM, AES_CM_128_HMAC_SHA1_80 and AES_CM_128_HMAC_SHA1_32, in that default preference order. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_srtp-srtp-interworking.html), SRTP-SRTP Interworking; supported crypto suites. Checked 2026-09-25.
[^41]: show sip-ua calls displays the local and remote crypto keys, crypto suites and media stream details for SRTP calls. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-SRTP Interworking](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/cube_m_srtp-srtp-interworking.html), SRTP-SRTP Interworking; verification. Checked 2026-09-25.
[^42]: Tenant-level attributes include registrar, credentials, sip-server, bind, outbound-proxy and sip-profiles; a trunk-specific listen-port was added in Cupertino 17.8.1a. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-multi-tenants.html), Configure Multiple Trunks Using Tenants; supported tenant attributes and example. Checked 2026-09-25.
[^43]: When a tenant is attached to a dial-peer, dial-peer configuration takes precedence over tenant configuration, which takes precedence over global configuration. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-multi-tenants.html), Configure Multiple Trunks Using Tenants; configuration precedence. Checked 2026-09-25.
[^44]: Cisco's current registration-based trunk example puts registrar (with expires and refresh-ratio), credentials, authentication, bind control and media, sip-profiles and outbound-proxy inside one voice class tenant, and the trunk dial-peer uses session target sip-server with voice-class sip tenant. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk configuration; voice class tenant 100 and dial-peer voice 100. Checked 2026-09-25.
[^45]: A tenant is detached from a dial-peer with no voice-class sip tenant tag. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-multi-tenants.html), Configure Multiple Trunks Using Tenants; dial-peer association. Checked 2026-09-25.
[^46]: A voice class tenant acts as a configuration template for dial-peers, letting each SIP trunk override global settings, and is attached with voice-class sip tenant tag in dial-peer configuration. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-multi-tenants.html), Configure Multiple Trunks Using Tenants; overview and dial-peer association. Checked 2026-09-25.
[^47]: The CUBE TLS chapter notes that security licences are required on ISR 4300 and 4400 routers and recommends synchronising all devices in the solution to a common NTP source. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support on CUBE; restrictions. Checked 2026-09-25.
[^48]: CUBE SIP TLS uses a crypto pki trustpoint holding the CUBE certificate, an optional voice class tls-cipher list, and a voice class tls-profile that references the cipher list and trustpoint and can enable cn-san validate server and sni send. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support on CUBE; configuration steps 1 to 3. Checked 2026-09-25.
[^49]: TLS is enabled globally with sip-ua transport tcp tls v1.2 and per trunk in the tenant with tls-profile, session transport tcp tls, listen-port secure 5061 and url sips. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support on CUBE; configuration steps 4 and 5. Checked 2026-09-25.
[^50]: show sip-ua connections tcp tls brief lists active TLS connections, and show sip-ua connections tcp tls detail shows the negotiated TLS version, cipher suite and key type. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support on CUBE; verification. Checked 2026-09-25.
[^51]: From Cisco IOS XE 17.14.1a CUBE supports TLS 1.3 alongside 1.0, 1.1 and 1.2; TLS 1.0 and 1.1 are available only in system mode insecure. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support on CUBE; supported TLS versions. Checked 2026-09-25.
[^52]: By default CUBE trusts inbound connections from IPv4 and IPv6 addresses configured as dial-peer session targets and in voice class server-group configurations. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Toll fraud section; IP address trusted list. Checked 2026-09-25.
[^53]: The toll-fraud trusted list is configured under voice service voip with ip address trusted list followed by ipv4 address [mask] or ipv6 address entries; up to 100 IPv4 entries are supported. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Overview of Cisco Unified Border Element; Configure a Trusted IP Address List for Toll-Fraud Prevention. Checked 2026-09-25.
[^54]: Cisco's Local Gateway guide installs the root CA bundle with crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b so CUBE can validate public-CA server certificates. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), TLS and sip-ua configuration; trustpool import. Checked 2026-09-25.
[^55]: On a carrier trunk signalled over UDP, SDES-keyed SRTP would expose its keys, so SRTP toward the carrier is only meaningful together with TLS; the UDP option should be treated as cleartext RTP (inferred). Source: [RFC 4568: Session Description Protocol (SDP) Security Descriptions for Media Streams](https://www.rfc-editor.org/rfc/rfc4568.html), Section 8.3, applied to a UDP-signalled SIP trunk. Checked 2026-09-25.
[^56]: By default an inbound call that fails the IP trusted list check is silently discarded rather than answered with an error. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Toll fraud section; handling of untrusted connections. Checked 2026-09-25.
[^57]: Cisco's Unified CM example classifies calls from Unified CM with a voice class uri (a pattern such as :5065, or a host match) referenced by incoming uri via on the Unified CM-facing dial-peer, which carries its own bind statements and dtmf-relay rtp-nte. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with an existing Unified CM environment; voice class uri 300 and dial-peer voice 300. Checked 2026-09-25.
[^58]: Cisco's IP PSTN example classifies inbound carrier calls with voice class uri id sip / host ipv4:carrier-address and matches them with incoming uri via id on a dial-peer whose session target is ipv4:carrier-address, with bind control and media statements. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), IP PSTN section; voice class uri 200 and dial-peer voice 200. Checked 2026-09-25.
[^59]: A dial peer must be in the UP operational state to be eligible for call routing; an outbound VoIP dial peer needs a valid outbound matching mechanism and a valid session target to be UP. Source: [Understand IOS and IOS XE Call Routing](https://www.cisco.com/c/en/us/support/docs/voice/ip-telephony-voice-over-ip-voip/211306-In-Depth-Explanation-of-Cisco-IOS-and-IO.html), Dial-Peer States. Checked 2026-09-24.