# Unified CM SIP trunk to CUBE configuration

Systems: Cisco Unified Communications Manager

For Voice engineers configuring a SIP trunk between Cisco Unified Communications Manager and Cisco Unified Border Element.

Canonical: https://warmtransfer.net/guides/cucm-config-sip-trunk-to-cube

Last verified: 2026-09-24

A SIP trunk connects Cisco Unified Communications Manager (Unified CM) to a Cisco Unified Border Element (CUBE) to pass call signalling and media between call control and the border[^53]. Following Cisco's task flow, administrators configure CUBE border routing, dial peers, security profiles, and Unified CM trunk parameters to establish bidirectional call routing[^50].

## Before you start

Before configuring the SIP trunk, verify that a Unified CM device pool is already configured[^35].

## What changes by situation

- How will signalling between Unified CM and CUBE be protected? Non-secure SIP over TCP; SIP over TLS with SRTP media.
- How will CUBE find the Unified CM call-processing nodes? Voice class server group; DNS SRV resolution.
- How many CUBEs does this trunk reach? Single CUBE; Two CUBEs.

## Step 1: Enable CUBE for SIP-to-SIP calls

### Do
Under `voice service voip`, enter `mode border-element` and `allow-connections sip to sip`[^7]. From Cisco IOS XE Amsterdam 17.2.1r onwards, omit the `capacity` keyword because it is deprecated, and session counts are monitored through Cisco Smart Software Manager[^19].

### Verify
Run `show cube status` to confirm that the CUBE version, software version, platform, and high-availability configuration are displayed[^18].

### Rollback
Suggested rollback: remove the configuration by entering `no allow-connections sip to sip` and `no mode border-element` under `voice service voip`.

## Step 2: Let CUBE trust every Unified CM node that will send it calls

### Do
CUBE populates its IP trusted list from dial-peer session targets, voice class server-group entries, and manual `ip address trusted list` entries[^26]. Under `voice service voip`, enter `ip address trusted list` and add the IPv4 or IPv6 addresses for all Unified CM subscriber nodes that will send traffic[^25]. The trusted list supports up to 100 addresses[^25].

### Verify
Verify that every subscriber IP address appears under `ip address trusted list` in the running configuration, keeping in mind that untrusted sources fail silently with discarded calls and no SIP error response[^27].

### Rollback
Suggested rollback: enter the `ip address trusted list` configuration mode under `voice service voip` and remove the added subscriber IP entries.

## Step 3: Define the Unified CM targets on CUBE

**Voice class server group**

### Do
Create a server group using `voice class server-group <id>`[^15]. Add up to 5 IPv4 or IPv6 target server addresses within the group[^17]. By default, the server group picks the available address with the highest preference, or you can configure `hunt-scheme round-robin` to distribute calls across nodes[^16].

### Verify
Run `show voice class server-group <id>` to verify that all subscriber targets and preference settings are configured[^15].

### Rollback
Suggested rollback: remove the server group by entering `no voice class server-group <id>` after detaching it from any dial peers.

**DNS SRV resolution**

### Do
Define local DNS SRV records mapping to the Unified CM subscriber nodes by creating `ip host` name entries and `ip host _sip._<proto>.<name> srv <priority> <weight> <port> <target-host>` entries[^3].

### Verify
Suggested check: view the running configuration to confirm that the `ip host` mappings and SRV records are present.

### Rollback
Suggested rollback: delete the configured `ip host` entries from the router configuration.

## Step 4: Build the dial peers to and from Unified CM

**Voice class server group**

### Do
Configure an outbound dial peer toward Unified CM with `session protocol sipv2` and attach the server group using `session server-group <id>`[^15]. Set `dtmf-relay rtp-nte` to specify RFC 2833 RTP-NTE DTMF relay[^5]. Add `voice-class sip bind control` and `voice-class sip bind media` to the interface facing Unified CM, which is mandatory for all CUBE Enterprise deployments[^1]. Match calls arriving from Unified CM on an inbound dial peer using `incoming uri via` mapped to a `voice class uri` pattern, which CUBE evaluates as its primary matching criterion[^9][^8]. Route inbound calls to outbound dial peers using `destination dpg <id>` referencing a `voice class dpg`[^4]. Route only specific number ranges and avoid catch-all destination patterns such as `destination-pattern.T`[^14].

### Verify
Run `show dial-peer voice summary` to confirm that the dial peers are registered as operational, and check `show voice class server-group` to verify dial-peer binding[^10][^15].

### Rollback
Suggested rollback: remove the inbound and outbound dial peers using `no dial-peer voice <tag> voip`, followed by removing the associated `voice class uri` and `voice class dpg` definitions.

**DNS SRV resolution**

### Do
Configure an outbound dial peer toward Unified CM with `session protocol sipv2` and specify `session target dns:<srv-name>`[^3]. Set `dtmf-relay rtp-nte` to declare RFC 2833 RTP-NTE DTMF relay[^5]. Add `voice-class sip bind control` and `voice-class sip bind media` to the interface facing Unified CM, which is mandatory in CUBE Enterprise deployments[^1]. Match incoming calls from Unified CM using `incoming uri via` pointing to a configured `voice class uri`, which CUBE checks before other inbound URI criteria[^9][^8]. Link the inbound dial peer to outbound peers using `destination dpg <id>` referencing a configured `voice class dpg`[^4]. Route known number ranges and avoid catch-all patterns like `destination-pattern.T`[^14].

### Verify
Run `show dial-peer voice summary` to confirm that the dial peers are operational and active[^10].

### Rollback
Suggested rollback: delete the configured dial peers using `no dial-peer voice <tag> voip` and remove the associated `voice class uri` and `voice class dpg` entries.

## Step 5: Monitor Unified CM from CUBE with OPTIONS keepalive

### Do
Configure an OPTIONS keepalive profile with `voice class sip-options-keepalive <id>`, which defaults to an up-interval of 60 seconds, a down-interval of 30 seconds, and 5 retries[^13]. Apply the profile to the outbound dial peer toward Unified CM using `voice-class sip options-keepalive profile <id>`[^10]. Do not apply the same keepalive profile to multiple dial peers that use different bind interfaces, which is unsupported[^11].

### Verify
Run `show dial-peer voice summary` to check the keepalive state of the target; when a target stops responding to OPTIONS pings, CUBE busies out the dial peer[^10][^12].

### Rollback
Suggested rollback: remove `voice-class sip options-keepalive profile <id>` from the dial peer, then delete the profile with `no voice class sip-options-keepalive <id>`.

## Step 6: Secure the CUBE side of the trunk

**Non-secure SIP over TCP**

### Do
Cisco's CUBE hardening guide recommends deploying SIP-TLS and SRTP across all call legs[^22].

### Verify
Suggested check: review deployment documentation to ensure that running unencrypted signalling and media on this leg is recorded as an accepted security exception.

### Rollback
Suggested rollback: no changes are required to revert this branch.

**SIP over TLS with SRTP media**

### Do
Starting in Cisco IOS XE Cupertino 17.8.1a, configure `cn-san validate` if you want CUBE to verify the peer certificate's CN or SAN against configured names[^2]. TLS 1.3 is supported on CUBE starting from Cisco IOS XE 17.14.1a[^24].

### Verify
Run `show sip-ua connections tcp tls brief` or `show sip-ua connections tcp tls detail` to inspect established TLS signalling connections to each subscriber[^23].

### Rollback
Suggested rollback: remove configured TLS dial-peer parameters and security profiles.

## Step 7: Create the Unified CM SIP profile

### Do
Unified CM requires configuring the SIP profile before configuring the security profile and SIP trunk[^50]. In Cisco Unified CM Administration, navigate to **Device** > **Device Settings** > **SIP Profile** and add or copy a profile[^47]. Check **Enable OPTIONS Ping to monitor destination status for Trunks with Service Type None (Default)**[^41]. By default, Unified CM exchanges OPTIONS messages every 60 seconds[^40]. If CUBE receives Delayed Offer calls, configuring `early-offer forced` under `voice service voip` on CUBE generates an outbound Early Offer[^6].

### Verify
Verify that the saved SIP profile displays the OPTIONS Ping checkbox as checked[^41].

### Rollback
Suggested rollback: open the SIP profile page in the administration interface and delete the created profile, or revert the assigned profile on the trunk.

## Step 8: Create the SIP trunk security profile

**Non-secure SIP over TCP**

### Do
In Cisco Unified CM Administration, navigate to **System** > **Security** > **SIP Trunk Security Profile** and add a profile[^46]. Set the transport to TCP in the SIP trunk security profile[^46]. If no profile is assigned, Unified CM assigns a nonsecure profile by default[^34]. The incoming port configured on this profile is where Unified CM listens for signalling and is the port advertised in its Via header toward CUBE[^36]. Do not aim multiple non-secure trunks with differing incoming ports at the same CUBE destination, as mid-call INVITEs can use the incorrect port and drop calls[^39].

### Verify
Verify under **System** > **Security** > **SIP Trunk Security Profile** that the profile shows the intended incoming port[^46].

### Rollback
Suggested rollback: delete the profile from the administration interface after unlinking it from any configured SIP trunks.

**SIP over TLS with SRTP media**

### Do
In Cisco Unified CM Administration, navigate to **System** > **Security** > **SIP Trunk Security Profile** and add a new profile[^46]. Set **Device Security Mode** to Encrypted, select TLS for incoming and outgoing transport, set the incoming port (defaulting to 5061 for TLS), and enter the X.509 Subject Name matching CUBE's certificate[^52][^56]. Do not configure a secure SIP trunk while Unified CM is running within its initial 90-day evaluation period, as secure trunks cannot be deployed in evaluation mode[^37].

### Verify
Verify under **System** > **Security** > **SIP Trunk Security Profile** that Device Security Mode displays Encrypted and both transports show TLS[^52].

### Rollback
Suggested rollback: delete the security profile from the administration interface and remove any uploaded certificate.

## Step 9: Create the SIP trunk to CUBE

**Single CUBE + Non-secure SIP over TCP**

### Do
Navigate to **Device** > **Trunk**, click **Add New**, and select **SIP Trunk**[^53]. Select the pre-existing device pool[^35]. Check **Run on All Active Unified CM Nodes** to activate the trunk on every cluster node[^45]. Enter the CUBE IP address or hostname in the Destination Address field, utilizing Unified CM's support for up to 16 destination addresses[^33]. Assign the non-secure SIP trunk security profile and the SIP profile created in previous steps[^50]. Save the trunk, then reset or restart it for the settings to take effect[^54].

### Verify
Open **Device** > **Trunk** and confirm the trunk status displays In Service[^49]. If status displays No Service, status reason code `local=1` indicates no OPTIONS response over UDP, `local=2` indicates a failure to open a socket to CUBE, and `local=3` indicates a DNS lookup failure[^38].

### Rollback
Suggested rollback: unassign the trunk from any route groups and delete the trunk under Device > Trunk.

**Two CUBEs + Non-secure SIP over TCP**

### Do
Navigate to **Device** > **Trunk**, click **Add New**, and choose **SIP Trunk**[^53]. Assign the device pool[^35]. Check **Run on All Active Unified CM Nodes**[^45]. Under Destination, enter the address of the first CUBE, click the add icon (+), and enter the second CUBE address, utilizing Unified CM's support for up to 16 destination addresses[^33]. Assign the non-secure SIP trunk security profile and your SIP profile, then save and reset the trunk[^50][^54].

### Verify
Confirm on the **Device** > **Trunk** page that the trunk shows In Service[^49]. If status displays No Service, code `local=1` indicates missing OPTIONS responses, `local=2` indicates a socket error, and `local=3` indicates DNS failure[^38]. Suggested check: verify that the preceding router configuration is also executed on the other router.

### Rollback
Suggested rollback: delete the second destination address or remove the trunk from all route groups and delete it under Device > Trunk.

**Single CUBE + SIP over TLS with SRTP media**

### Do
Navigate to **Device** > **Trunk**, click **Add New**, and select **SIP Trunk**[^53]. Assign the configured device pool[^35]. Check **Run on All Active Unified CM Nodes**[^45]. Enter CUBE's destination address, change the destination port from 5060 to 5061, and check **SRTP Allowed**, utilizing Unified CM's support for up to 16 destination addresses[^33][^51][^48]. Assign the encrypted SIP trunk security profile and your SIP profile[^50]. Save and reset the trunk so the changes take effect[^54].

### Verify
Check **Device** > **Trunk** to confirm that the trunk status reports In Service[^49]. A No Service status with reason `local=2` indicates that Unified CM failed to establish the TLS socket connection to CUBE[^38].

### Rollback
Suggested rollback: remove the SIP trunk from call routing devices and delete it from Device > Trunk.

**Two CUBEs + SIP over TLS with SRTP media**

### Do
Navigate to **Device** > **Trunk**, click **Add New**, and select **SIP Trunk**[^53]. Assign the device pool[^35]. Check **Run on All Active Unified CM Nodes**[^45]. Enter both CUBE addresses as destinations using (+), change the destination port from 5060 to 5061, and check **SRTP Allowed**, utilizing Unified CM's support for up to 16 destination addresses[^33][^51][^48]. Assign the encrypted security profile and SIP profile, then save and reset the trunk[^50][^54].

### Verify
Confirm under **Device** > **Trunk** that trunk status shows In Service[^49]. A No Service status showing `local=2` indicates Unified CM could not open a TLS socket to the destination[^38]. Suggested check: verify that the preceding router configuration is also executed on the other router.

### Rollback
Suggested rollback: remove the SIP trunk from all route groups and delete the trunk under Device > Trunk.

## Step 10: Route calls to the trunk

### Do
In Cisco Unified CM Administration, navigate to **Call Routing** > **Route/Hunt** > **Route Group** and create a route group containing the SIP trunk, selecting either Top Down or Circular distribution[^42]. Under **Call Routing** > **Route/Hunt** > **Route List**, create a route list, add the route group in order of priority, save, and select **Apply Config**[^43]. Under **Call Routing** > **Route/Hunt** > **Route Pattern**, create the dial pattern, assign it to the proper partition, and select your route list in the **Gateway/Route List** drop-down menu[^44].

### Verify
Verify under Route List configuration that the route group is assigned, and verify under Route Pattern that the pattern points to the route list[^43][^44].

### Rollback
Suggested rollback: delete the route pattern, delete the route list, and then delete the route group under Call Routing > Route/Hunt.

## Step 11: Verify both directions end to end

**Non-secure SIP over TCP**

### Do
In Cisco Unified CM Administration, place a call using the route pattern configured in step 10, or send an inbound call to Unified CM[^44].

### Verify
Suggested check: place an outbound test call from a registered phone matching the route pattern, and place an inbound test call through the border element to an internal extension.
Verify on Unified CM's **Device** > **Trunk** page that the trunk status is In Service[^49]. On CUBE, run `show dial-peer voice summary` to confirm that the keepalive state for the dial peer facing Unified CM is up[^10]. If inbound calls from Unified CM fail to arrive and generate no SIP error messages, verify that every sending subscriber address exists in CUBE's IP trusted list[^27].

### Rollback
Suggested rollback: no rollback actions are required for test calls.

**SIP over TLS with SRTP media**

### Do
In Cisco Unified CM Administration, place a call using the route pattern configured in step 10, or send an inbound call to Unified CM[^44].

### Verify
Suggested check: place test calls in both directions across the trunk between an endpoint and the border element.
Verify under Unified CM **Device** > **Trunk** that trunk status reports In Service[^49]. Run `show sip-ua connections tcp tls detail` on CUBE to verify active TLS signalling sessions to each subscriber[^23]. Run `show dial-peer voice summary` to ensure dial peer keepalive status is up[^10]. If the trunk status reports No Service with `local=2`, verify TLS handshakes and trustpoint certificates between Unified CM and CUBE[^38].

### Rollback
Suggested rollback: no rollback actions are required for test calls.

## Applicability

Applies to: Cisco Unified Border Element and Cisco Unified Communications Manager. Deployments: on-premises and hybrid. Sources checked 2026-09-24. Peer certificate verification via `cn-san validate` is available from Cisco IOS XE Cupertino 17.8.1a onwards[^2]. TLS 1.3 is supported on CUBE from Cisco IOS XE 17.14.1a onwards[^24]. CUBE Enterprise deployments require bind statements at the dial-peer or voice class tenant level[^1].

## What remains uncertain

The exact DNS SRV protocol label (`_tcp` or `_tls`) to use when pointing CUBE dial peers to Unified CM over TCP or TLS rather than UDP is not covered by the sources below. Dial plan normalization, PSTN carrier-facing configuration, media termination points (MTP), transcoder resources, SIP normalization scripts, and CUBE high availability pairing are not covered by the sources below.

## Sources

[^1]: All CUBE Enterprise deployments require signaling and media bind statements at the dial-peer or voice class tenant level. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-dp.html), Configure Dial Peers, note on bind statements. Checked 2026-09-24.
[^2]: From Cisco IOS XE Cupertino 17.8.1a CUBE can verify a peer's certificate CN or SAN against configured permitted names with cn-san validate. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), Peer identity verification. Checked 2026-09-24.
[^3]: Cisco's Local Gateway guide points a CUBE dial peer at several Unified CM nodes by defining local SRV records with ip host and using session target dns:<srv-name>. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified CM integration; ip host SRV entries and dial-peer 300/400. Checked 2026-09-24.
[^4]: In the Local Gateway guide, destination dpg <id> on an inbound dial peer names the dial-peer group, and so the outbound dial peer, used for calls arriving on it. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified CM integration; voice class dpg 100-400. Checked 2026-09-24.
[^5]: The Local Gateway guide's dial peers toward Unified CM set dtmf-relay rtp-nte, which declares RFC 2833 RTP-NTE as the expected DTMF method on that leg. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified CM integration; dial-peer 300/400. Checked 2026-09-24.
[^6]: The CUBE command early-offer forced under voice service voip makes CUBE send an Early Offer outbound when the inbound call arrived as a Delayed Offer. Source: [Configure CUCM to CUBE Integration - Configuration Example](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/117300-configure-cube-00.html), Configure, CUBE voice service voip block. Checked 2026-09-24.
[^7]: CUBE SIP-to-SIP operation is enabled under voice service voip with mode border-element and allow-connections sip to sip. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Basic SIP-to-SIP configuration example. Checked 2026-09-24.
[^8]: CUBE matches inbound SIP dial peers in this order: incoming uri via, incoming uri request, incoming uri to, incoming uri from, incoming called-number, then answer-address. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_cube-dp.html), Inbound dial-peer matching order list. Checked 2026-09-24.
[^9]: Cisco's Local Gateway guide matches calls arriving from Unified CM to a dial peer with a voice class uri pattern and incoming uri via. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified CM integration; voice class uri 300/400 and dial-peer 300/400. Checked 2026-09-24.
[^10]: A keepalive profile is applied with voice-class sip options-keepalive profile <id> on the dial peer, and show dial-peer voice summary reports keepalive state. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Applying to dial peers; verification. Checked 2026-09-24.
[^11]: Using the same OPTIONS keepalive profile on several dial peers with different bind interfaces is not supported. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Restrictions. Checked 2026-09-24.
[^12]: CUBE can monitor a SIP trunk with out-of-dialog OPTIONS pings and busies out the dial peer when the target stops responding. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), SIP Trunk Monitoring overview. Checked 2026-09-24.
[^13]: A CUBE voice class sip-options-keepalive profile defaults to an up-interval of 60 seconds, a down-interval of 30 seconds and 5 retries. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), voice class sip-options-keepalive parameters. Checked 2026-09-24.
[^14]: Cisco's CUBE hardening guide warns against catch-all destination patterns such as destination-pattern .T and advises routing only known number ranges. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Dial-peer configuration hardening section. Checked 2026-09-24.
[^15]: A server group is defined with voice class server-group <id> and address entries, attached to a dial peer with session server-group <id>, and inspected with show voice class server-group. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Server Groups](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/multiple-server-groups.html), Configure server groups; verification. Checked 2026-09-24.
[^16]: Without a hunt scheme, a CUBE server group selects the available address with the highest preference; hunt-scheme round-robin is the alternative. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Server Groups](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/multiple-server-groups.html), Server Groups, hunt scheme. Checked 2026-09-24.
[^17]: A CUBE voice class server-group holds up to five IPv4 or IPv6 target server addresses and is available for SIP dial peers only. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Server Groups](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/multiple-server-groups.html), Server Groups overview. Checked 2026-09-24.
[^18]: The show cube status command displays the CUBE version, software version, platform and HA configuration. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Licensing / show cube status example. Checked 2026-09-24.
[^19]: From Cisco IOS XE Amsterdam 17.2.1r the capacity keyword of mode border-element is deprecated and CUBE sessions are counted through Cisco Smart Software Manager. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Licensing. Checked 2026-09-24.
[^20]: On CUBE, the dial peer toward Unified CM for SIP TLS uses session transport tcp tls and srtp, with a PKI trustpoint referenced by crypto signaling. Source: [Configure SIP TLS Between CUCM-CUBE/CUBE-SBC With CA Signed Certificates](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/215412-configure-sip-tls-between-cucm-cube-cube.html), Configure, CUBE section. Checked 2026-09-24.
[^21]: The IOS XE 17.6+ CUBE guide configures SIP TLS with a PKI trustpoint, a voice class tls-profile referencing it, and a voice class tenant using session transport tcp tls. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), SIP TLS Support configuration examples. Checked 2026-09-24.
[^22]: Cisco's CUBE hardening guide recommends enabling SIP-TLS and SRTP on all call legs through CUBE. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), SIP TLS and SRTP section. Checked 2026-09-24.
[^23]: CUBE SIP TLS connections are inspected with show sip-ua connections tcp tls brief and show sip-ua connections tcp tls detail. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), Verification. Checked 2026-09-24.
[^24]: CUBE supports TLS 1.3 from Cisco IOS XE 17.14.1a. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_sip_tls_support_cube.html), Feature history / TLS version support. Checked 2026-09-24.
[^25]: CUBE toll-fraud prevention lets an administrator add trusted IPv4 and IPv6 addresses under voice service voip with ip address trusted list, up to 100 addresses. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/voi-cube-overview.html), Toll-Fraud Prevention. Checked 2026-09-24.
[^26]: The CUBE IP trusted list is populated from dial-peer session targets, voice class server-group entries and manually configured ip address trusted list entries. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), IP Address Trusted List section. Checked 2026-09-24.
[^27]: By default CUBE silently discards an inbound call that fails the IP trusted list check. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), IP Address Trusted List section. Checked 2026-09-24.
[^28]: When the trunk runs on all active nodes, CUBE should trust and target every call-processing subscriber, because any of them may originate calls and trusted-list failures are silently dropped (inferred). Source: [Cisco Collaboration System 12.x Solution Reference Network Designs (SRND) - Cisco Unified CM Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab12/collab12/trunks.html), Run on all Active Unified CM Nodes section, combined with cisco-technote-220380-harden-cube IP Address Trusted List section. Checked 2026-09-24.
[^29]: With Run on all Active Unified CM Nodes checked, Unified CM runs a SIP trunk instance on every call-processing subscriber, so trunk calls can be made or received on any of them. Source: [Cisco Collaboration System 12.x Solution Reference Network Designs (SRND) - Cisco Unified CM Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab12/collab12/trunks.html), Cisco Unified CM Trunks, Run on all Active Unified CM Nodes section. Checked 2026-09-24.
[^30]: Cisco's 12.x SRND recommends Early Offer support for voice and video calls set to Best Effort (no MTP inserted) for all Unified CM and Session Management Edition SIP trunks. Source: [Cisco Collaboration System 12.x Solution Reference Network Designs (SRND) - Cisco Unified CM Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab12/collab12/trunks.html), Cisco Unified CM Trunks, SIP Delayed Offer and Early Offer section. Checked 2026-09-24.
[^31]: With Early Offer set to Mandatory (insert MTP if needed), Unified CM inserts an MTP when it cannot determine the calling device's media characteristics; Best Effort sends Delayed Offer in that case. Source: [Cisco Collaboration System 12.x Solution Reference Network Designs (SRND) - Cisco Unified CM Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab12/collab12/trunks.html), Cisco Unified CM Trunks, SIP Delayed Offer and Early Offer section. Checked 2026-09-24.
[^32]: Cisco's 12.x SRND recommends enabling SIP OPTIONS ping on all SIP trunks so Unified CM tracks trunk state dynamically instead of per call on timeout. Source: [Cisco Collaboration System 12.x Solution Reference Network Designs (SRND) - Cisco Unified CM Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab12/collab12/trunks.html), Cisco Unified CM Trunks, SIP OPTIONS Ping section. Checked 2026-09-24.
[^33]: A Unified CM SIP trunk can have up to 16 destination addresses (IPv4, IPv6 or FQDN) or a single DNS SRV record. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), SIP Trunk Overview. Checked 2026-09-24.
[^34]: If no SIP trunk security profile is assigned to a Unified CM SIP trunk, a nonsecure profile is assigned. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunks, security profile assignment step. Checked 2026-09-24.
[^35]: A device pool must already be configured before a Unified CM SIP trunk is configured. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), SIP Trunk Prerequisites. Checked 2026-09-24.
[^36]: The incoming port set in a Unified CM SIP trunk security profile is where Unified CM accepts messages and is the port it places in the Via header toward CUBE, which is how the Local Gateway design separates two trunks to one CUBE (5065 and 5060). Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified CM integration; note on SIP Trunk Security Profile incoming port 5065. Checked 2026-09-24.
[^37]: A secure SIP trunk cannot be deployed while Unified CM is running in the 90-day evaluation period. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), SIP Trunk Interactions and Restrictions. Checked 2026-09-24.
[^38]: A No Service trunk status reason of local=1 means no OPTIONS responses after all retries over UDP, local=2 means Unified CM could not open a socket to the peer, and local=3 means DNS could not resolve the hostname or SRV. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Status reasons local=1, local=2, local=3. Checked 2026-09-24.
[^39]: When multiple non-secure SIP trunks with different listening ports point to the same destination, they may use the wrong port in a mid-call INVITE and the call drops. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), SIP Trunk Interactions and Restrictions. Checked 2026-09-24.
[^40]: By default Unified CM and CUBE exchange OPTIONS messages every 60 seconds. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Introduction / Configure. Checked 2026-09-24.
[^41]: Unified CM OPTIONS ping is turned on in the SIP profile with the checkbox Enable OPTIONS Ping to monitor destination status for Trunks with Service Type None (Default), and the profile is then assigned to the trunk. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Configure, Unified CM section. Checked 2026-09-24.
[^42]: Route groups are configured under Call Routing > Route/Hunt > Route Group, with a Distribution Algorithm of Circular or Top Down, and trunks are added to them as devices. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Call Routing](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010010.html), Configure Route Groups. Checked 2026-09-24.
[^43]: A route list, configured under Call Routing > Route/Hunt > Route List, holds route groups in priority order and is saved and then applied with Apply Config. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Call Routing](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010010.html), Configure Route Lists. Checked 2026-09-24.
[^44]: A route pattern, configured under Call Routing > Route/Hunt > Route Pattern, selects a gateway or route list in its Gateway/Route List field and is assigned a partition. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Call Routing](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010010.html), Configure Route Patterns. Checked 2026-09-24.
[^45]: The SIP trunk's Run on All Active Unified CM Nodes checkbox enables the trunk on all cluster nodes. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunks, step 7. Checked 2026-09-24.
[^46]: In Cisco Unified CM Administration, SIP trunk security profiles are configured under System > Security > SIP Trunk Security Profile. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunk Security Profile, step 1. Checked 2026-09-24.
[^47]: In Cisco Unified CM Administration, SIP profiles are configured under Device > Device Settings > SIP Profile. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Profiles, step 1. Checked 2026-09-24.
[^48]: The Unified CM SIP trunk configuration has an SRTP Allowed checkbox, checked in the documented procedure. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunks, step 6. Checked 2026-09-24.
[^49]: The SIP trunk status is shown on the Device > Trunk page in Cisco Unified CM Administration. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Problem / trunk status. Checked 2026-09-24.
[^50]: The Unified CM 15 SIP trunk configuration task flow is: configure SIP profiles, then configure a SIP trunk security profile, then configure SIP trunks. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), SIP Trunk Configuration Task Flow. Checked 2026-09-24.
[^51]: For SIP TLS to CUBE, the Unified CM trunk has SRTP enabled and its destination port changed from 5060 to 5061. Source: [Configure SIP TLS Between CUCM-CUBE/CUBE-SBC With CA Signed Certificates](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/215412-configure-sip-tls-between-cucm-cube-cube.html), Configure, Unified CM SIP trunk step. Checked 2026-09-24.
[^52]: For a TLS-encrypted trunk, the SIP trunk security profile uses Device Security Mode Encrypted, TLS for both incoming and outgoing transport type, and an incoming port whose TLS default is 5061. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunk Security Profile, step 3. Checked 2026-09-24.
[^53]: A SIP trunk is created in Cisco Unified CM Administration under Device > Trunk by clicking Add New and choosing SIP Trunk as the Trunk Type. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunks, steps 1-4. Checked 2026-09-24.
[^54]: After a Unified CM SIP trunk is modified, the trunk must be reset or restarted for the change to take effect. Source: [Configure CUCM to CUBE Integration - Configuration Example](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/117300-configure-cube-00.html), Configure, Unified CM trunk notes. Checked 2026-09-24.
[^55]: For SIP TLS to CUBE, the CUBE CA certificate or chain is uploaded in Unified CM OS Administration under Security > Certificate Management with the CallManager trust purpose. Source: [Configure SIP TLS Between CUCM-CUBE/CUBE-SBC With CA Signed Certificates](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/215412-configure-sip-tls-between-cucm-cube-cube.html), Configure, Unified CM step 1. Checked 2026-09-24.
[^56]: The TLS SIP trunk security profile procedure includes entering an X.509 Subject Name used to authenticate the peer's certificate. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure SIP Trunk Security Profile, step 3. Checked 2026-09-24.