Integrations · guide

Connecting Unified CM to Genesys Cloud CX

Cisco Unified Communications Manager to Genesys Cloud CX

Verified 2026-09-25 · 72 sources · tier 2–5

For Unified CM and CUBE administrators with Genesys Cloud telephony administrative access configuring or reviewing the trunk integration..

This guide steps through integrating Cisco Unified Communications Manager (Unified CM) to Genesys Cloud CX using Cisco Unified Border Element (CUBE) 2 3. It details trunk creation, signalling transport, dial-peer configuration, number routing, agent endpoints, transfers, and User-to-User Information handling across both platforms 53 14 58.

Before you start

BYOC Cloud establishes SIP trunks between the public Internet and the Genesys Cloud AWS-based Edge and Media Tier 2.
BYOC Premises relies on on-premises customer-managed Edge devices connecting on-premises telephony infrastructure to Genesys Cloud across third-party SIP trunks 3.
A BYOC Cloud trunk requires an outbound route that uses it, even when the trunk carries only inbound calls 32.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Where does Genesys terminate your trunk?

Is signalling between CUBE and Genesys encrypted?

What device do agents answer calls on?

Do you pass call data between Unified CM and Genesys Cloud?

Four questions. One permanent page you can send to your manager.

Step 1 Confirm platform network requirements

BYOC Cloud

Do

Review whether your Genesys Cloud organisation operates on Dynamic Cloud Voice or Legacy Cloud Voice 36 37. On Dynamic Cloud Voice, BYOC Cloud provisions 3 ingress IP addresses and 1 egress CIDR range per region behind regional load balancers formatted as lb0[1-3].byoc.[region].genesys.cloud 36. On Legacy Cloud Voice, BYOC Cloud provides 4 IP addresses per region behind load balancers formatted as lb0[1-4].voice.[region].pure.cloud 37.

Note that BYOC Cloud handles signalling and media on separate services using different IP addresses, with media addresses provided in the SDP 29. For Dynamic Cloud Voice, confirm CUBE supports RFC 3261 section 8.2.6.2 to return the Via header untouched in responses, supports the RFC 3261 section 19.1.1 FQDN routing method, and returns unknown Contact URI parameters in later requests per section 19.1.5 7 5. For Legacy Cloud Voice, verify full Record-Route support on CUBE as required by RFC 3261 6.

Verify

Confirm that the organisation platform type, regional SIP ingress IPs, and egress CIDR blocks are documented for firewall rules 36 37.

Rollback

Suggested rollback: Discard recorded IP details if the planned cloud deployment region or organisation is changed.

BYOC Premises

Do

Identify the Edge hardware model in your premises environment 34. Support for Genesys Hardware Solution Edges (Standard v1–v3, Micro, Mini v1–v2) ends on 1 December 2026 34. Genesys recommends migrating to the Customer Hardware Solution for premises deployments 34.

Verify

Confirm that on-premises Edges run on Customer Hardware Solution appliances or have a documented replacement schedule prior to 1 December 2026 34.

Rollback

Suggested rollback: No configuration changes are made in this step; maintain existing hardware asset tracking records.

Step 2 Configure the Genesys site

BYOC Cloud

Do

In Genesys Cloud CX, create a location and then create a site that has a valid location and uses AWS for Phone Edge assignment 9.

Verify

Confirm under site properties that the assigned location is active and Phone Edge assignment is set to AWS 9.

Rollback

Suggested rollback: Delete the created site before associating it with trunks, outbound routes, or agent phones.

BYOC Premises

Do

In Genesys Cloud CX, take the Edge device out of service and assign its site and Edge group 33.

Verify

Verify that the Edge configuration displays the target site and Edge group 33.

Rollback

Suggested rollback: Revert the site and Edge group assignments to their previous settings and restore the device service state.

Step 3 Open firewall and access control lists

BYOC Cloud

Do

Configure access control lists (ACLs) on both sides of the connection and allow SIP signalling and media through intervening firewalls 8. Allow traffic to and from the regional signalling IPs and egress CIDR range on CUBE's external interface 8 36 37.

Open outbound and inbound RTP media traffic across the firewall to accommodate media addresses delivered in SDP 29 8. Open port 5060 for TCP signalling or port 5061 for TLS signalling according to your selected transport 53.

Verify

Suggested check: Inspect firewall and border router counters to confirm packets pass without drops on the required signalling ports and media ranges.

Rollback

Suggested rollback: Remove the newly added access control lists and firewall rules from the perimeter network interfaces.

BYOC Premises

Do

Prepare CUBE's IP address to be added to the trunk SIP Access Control list with Use Source Address set to Yes 35. Addresses entered into SIP Servers or Proxies will be added to the trunk's SIP Access Control allow list automatically upon trunk creation 43.

Verify

Suggested check: Verify network reachability between the border router interface and the premises Edge network interface over the local network.

Rollback

Suggested rollback: Remove any pre-staged routing or static entries configured on network firewalls between the CUBE and Edge NIC.

Step 4 Configure CUBE transport parameters

TLS with SRTP

Do

Configure TLS on CUBE using a PKI trustpoint with a certificate issued by a public CA trusted by Genesys 15 46. The certificate common name (CN) or subject alternative name (SAN) must match the hostname entered in the Genesys trunk SIP Servers or Proxies list; IP addresses are not accepted for this match 46. BYOC Cloud supports one-way (server-side) TLS only and does not support mutual TLS 47.

Genesys Cloud server certificates are signed by Amazon Trust Services on Dynamic Cloud Voice and by DigiCert on Legacy Cloud Voice 49. WarmTransfer's reading of the sources is that for cn-san-validate server to accept Genesys Cloud endpoints, CUBE must trust the CA signing the Genesys certificates using a trustpoint authenticated with that root CA 26.

Create a voice class tls-profile referencing the trustpoint with cn-san-validate server, and associate it to a voice class tenant that specifies session transport tcp tls 15. Ensure TLS 1.2 is permitted, as BYOC Cloud supports only TLS 1.2 on port 5061 50. CUBE supports TLS 1.3 and a TLS 1.2 minimum setting with sip-ua transport tcp tls from IOS XE 17.14.1a 17. From IOS XE 26.1.1, TLS 1.0 and 1.1 are not allowed in default configurations 17.

Configure srtp on the dial-peer facing Genesys Cloud if SRTP media is used 12. If the Unified CM leg uses unencrypted RTP, configure srtp on one dial-peer and omit it from the other; CUBE interworks SRTP and RTP on IOS XE platforms without DSP resources 12.

In the field, community reports note timed-out INVITEs to BYOC Cloud on IOS XE 17.3.x and earlier 22. In the field, practitioners resolved connection failures by installing the full certificate chain and using DNS session targets rather than server groups 21.

Verify

Run show sip-ua connections tcp tls detail to verify the active connection and negotiated cipher, and run show sip-ua connections tcp tls brief to check active connections and listening sockets 16.

Rollback

Remove the voice class tls-profile binding and session transport tcp tls from the tenant configuration, and remove srtp from the dial-peer 15 12.

Unencrypted TCP

Do

Configure TCP transport under the CUBE voice class tenant or the dial-peer facing Genesys using session transport tcp 15 53.

Both ends of a Genesys Cloud trunk must use the same transport protocol, or the trunk may fail to function 52. Set TCP on port 5060 53. The trunk Protocol setting in Genesys controls only the protocol Genesys Cloud uses to send calls and is not enforced on calls the trunk receives 54.

Verify

Suggested check: Run packet captures or debugs on the border router to verify that initial SIP messages use TCP transport.

Rollback

Suggested rollback: Remove session transport tcp from the CUBE tenant or dial-peer configuration.

Step 5 Provision the external SIP trunk in Genesys Cloud

BYOC Cloud

Do

Navigate to Menu > Digital and Telephony > Telephony > Trunks > External Trunks and create an external trunk 57. BYOC Cloud external trunks can be type BYOC Carrier (subtypes Generic, Verizon, or WhatsApp Business Calling) or BYOC PBX (subtype Generic only) 57. WarmTransfer's reading of the sources is that BYOC PBX is the closer fit when connecting CUBE in front of Unified CM 24.

Configure the Inbound SIP Termination Identifier with a value that is unique across your organisation's region 45. Use the FQDN routing method (or TGRP) 41. In SIP Servers or Proxies, enter CUBE's external hostname and port; addresses in this list are added to the SIP Access Control allow list automatically 43.

Under Protocol, select TLS or TCP to match the transport selected across both ends 52 53. In the Media section, configure the Preferred Codec List (selecting from g722, g729, PCMA, PCMU, opus) and DTMF Method (RTP Events, In-band Audio, or None) 56.

Verify

Confirm that the trunk state is In-Service and that the Inbound SIP Termination Identifier reflects your chosen regional identifier 45.

Rollback

Suggested rollback: Set the external trunk state to Out of Service or delete the trunk before applying outbound routes.

BYOC Premises

Do

Create an external trunk with type Premises External SIP 35. In SIP Servers or Proxies, enter CUBE's IP address or hostname, and set SIP Access Control Use Source Address to Yes 35. Addresses in SIP Servers or Proxies are added to the SIP Access Control allow list automatically 43.

Set the Protocol field to match CUBE's transport 52 53. Configure the Preferred Codec List and DTMF Method under Media 56.

Assign the external trunk to the Edge: take the Edge out of service, set the site and Edge group, select the external trunk under "Use the following trunks", and return the Edge to service and save 33.

Verify

Verify that the Edge device returns to In-Service and the external trunk is listed under its assigned trunks 33.

Rollback

Suggested rollback: Remove the trunk from the Edge's assigned trunks list and delete the Premises External SIP trunk configuration.

Step 6 Configure CUBE dial-peers

BYOC Cloud

Do

Bind the Genesys-facing dial-peer to the tenant configured with session transport tcp or session transport tcp tls using voice-class sip tenant <tag> 14. CUBE evaluates settings in priority order: dial-peer settings override tenant settings, which override global settings 14.

WarmTransfer's reading of the sources is that setting the dial-peer session target to dns:<identifier>.byoc.<region>.genesys.cloud generates the FQDN-method host required in the Request-URI 25 23. With FQDN routing, the inbound Request-URI must carry the dialled number in the user part and the identifier-based FQDN in the host part (for example sip:+13172222222@myuniqueidentifier.byoc.use1.genesys.cloud) 23.

For inbound SIP call legs, CUBE prefers match criteria in the following order: incoming uri via, incoming uri request, incoming uri to, incoming uri from, incoming called-number, and answer-address 66.

Configure a dial-peer directed toward the Unified CM SIP trunk to complete bidirectional call routing 19.

Verify

Run show dial-peer voice summary to verify that the dial-peers are in an UP operational state 67 68. When initiating a test call, run debug ccsip messages and debug ccsip error to check the Request-URI format 69 23.

Rollback

Suggested rollback: Remove or administratively shut down the configured outbound and inbound dial-peers on CUBE.

BYOC Premises

Do

Bind the dial-peer facing the premises Edge to the tenant configured with session transport tcp or session transport tcp tls using voice-class sip tenant <tag> 14. WarmTransfer's reading of the sources is that for BYOC Premises, the dial-peer targets the IP address of the Edge NIC selected for calls rather than a public load balancer 28.

For inbound SIP call legs, CUBE prefers match criteria in the order of incoming uri via, incoming uri request, incoming uri to, incoming uri from, incoming called-number, and answer-address 66. WarmTransfer's reading of the sources is that inbound peers should carry explicit incoming uri or incoming called-number criteria because an outbound dial-peer with destination-pattern but no incoming criteria can be selected for an inbound leg whose calling number matches that pattern 70.

Configure the inbound and outbound dial-peers connecting CUBE to Unified CM 19.

Verify

Run show dial-peer voice summary to confirm operational status 67 68. Verify live calls using show call active voice brief to confirm matched dial-peer tags via pid:<peer_id> 71.

Rollback

Suggested rollback: Remove or shut down the Edge and Unified CM dial-peers on CUBE.

Step 7 Configure Unified CM trunk and routing to CUBE

TLS with SRTP

Do

In Unified CM Administration, complete SIP trunk setup in three tasks: configure SIP profiles, configure a SIP trunk security profile, then configure the SIP trunk 19.

Create a SIP trunk security profile with incoming and outgoing transport set to TLS, using incoming port 5061 20. On the SIP trunk configuration page, check SRTP Allowed if encrypting media on the Unified CM leg 20. Enter CUBE as the trunk destination (Unified CM supports up to 16 destination IP addresses or a single DNS SRV record per trunk) 19.

Add the SIP trunk to a route group, associate the route group with a route list, and configure route patterns pointing to the route list for Genesys destination numbers 18. Cisco recommends using route lists and route groups over pointing route patterns directly to a device 18.

Verify

Suggested check: Place a test call to a destination pattern and inspect border router call status to confirm call leg encryption.

Rollback

Suggested rollback: Delete the route patterns, route list, route group, SIP trunk, and SIP trunk security profile in reverse order.

Unencrypted TCP

Do

In Unified CM Administration, configure the SIP trunk following the standard task flow: configure SIP profiles, configure a non-secure SIP trunk security profile using TCP, then configure the SIP trunk pointing to CUBE's IP or DNS SRV destination 19.

Assign the SIP trunk to a route group and route list 18. Configure route patterns for Genesys destination numbers pointing to the route list 18.

Verify

Suggested check: Place a test call from an endpoint and verify that the call matches the inbound dial-peer on the border router.

Rollback

Suggested rollback: Remove the route patterns, route list, route group, SIP trunk, and SIP trunk security profile in reverse order.

Step 8 Configure Genesys site number plans and outbound routes

Do

On the Genesys site, add a number plan using the Regular Expression match type 30. Define the Match Expression covering Unified CM extensions or DIDs, configure the Normalized Number Expression, and assign a unique classification 30. Position this plan above broader match rules, because Genesys Cloud evaluates number plans sequentially from top to bottom 30.

Create an outbound route on the site mapping that classification to external trunks, configuring Sequential or Random distribution, and set the route State to enabled 31. An outbound route using the trunk is required for every BYOC Cloud trunk, even when the trunk carries only inbound calls 32.

Verify

Place an outbound call from Genesys Cloud to a Unified CM extension; verify that the call egresses the trunk and reaches CUBE 31.

Rollback

Suggested rollback: Set the outbound route State to disabled, then delete the number plan classification.

Step 9 Configure inbound call routing and test

Do

For BYOC Cloud, assign the inbound DID or toll-free numbers received from Unified CM to call routes linked to Architect inbound call flows 1.

For BYOC Cloud, test the trunk connection using the Genesys Cloud call simulator and place live calls through CUBE 4. If test calls fail and escalation is required, gather the organisation ID, trunk name, test call timestamps, calling and called numbers, and CUBE packet captures 4. Before debugging on CUBE, set logging buffered 10000000, disable console and monitor logging, enable millisecond timestamps, and stop debugs (undebug all) if CPU usage exceeds 80% 72.

Verify

For BYOC Cloud, confirm that an inbound call from Unified CM reaches the assigned Architect flow and routes to the target queue 4.

Rollback

Suggested rollback: Unassign the dialled numbers from the call routes in the administrative console.

Step 10 Provision agent phones

Genesys Cloud WebRTC phone

Do

Create WebRTC phone base settings with Phone Make and Model set to Genesys Cloud WebRTC Phone 65. Create a phone referencing those base settings, assign the site, and assign the user; when using BYOC, do not select the PureCloud Voice - AWS site 65.

If configuring a persistent connection (configurable with a timeout between 600 and 604,800 seconds), note that agents must log out and log back in before the persistent connection becomes active 64.

Verify

Have an agent select the WebRTC phone in the client, set their status to On Queue, and answer an incoming test call 65.

Rollback

Suggested rollback: Unassign the WebRTC phone from the agent user profile or delete the phone record.

Unified CM desk phone as a remote phone

Do

Create remote phone base settings in Genesys Cloud 39. Add a remote phone for each agent with the remote address configured as the agent's Unified CM extension in E.164 format or as a SIP address 39. Ensure this destination matches the site number plan configured with Regular Expression match rules 30.

Remote phones require an established persistent connection before they can answer Genesys Cloud calls and do not support auto answer 40.

Verify

Suggested check: Place the agent on queue, confirm that the system initiates a persistent call to the destination desk phone, answer the phone, and confirm subsequent queue calls deliver audio over the established connection.

Rollback

Suggested rollback: Delete the remote phone record and assign the user to another phone configuration.

Step 11 Configure transfers back to Unified CM

Do

In Architect, use the Transfer to Number action to transfer calls to external numbers 51. Configure destination numbers in E.164 format matching the configured number plan; Genesys recommends E.164 format and warns that other formats risk carrier errors 51 30.

Under external trunk settings, configure SIP transfer handling 38 44. Enable Release Link Transfer to turn on outbound SIP REFER 38. Enable Take Back and Transfer if Unified CM is expected to send inbound REFER requests to Genesys Cloud 44.

Verify

Test an Architect transfer to an external number to verify that audio bridges correctly 51. If Release Link Transfer is enabled, run debug ccsip messages on CUBE to observe the inbound REFER 69 38.

Rollback

Suggested rollback: Disable Release Link Transfer or Take Back and Transfer on the trunk, and publish a previous version of the Architect flow.

Step 12 Configure User-to-User Information

Yes, as User-to-User Information (UUI)

Do

On the Genesys external trunk, enable UUI Passthrough; Genesys Cloud does not recognise incoming or outgoing UUI data until UUI Passthrough is enabled 63. Select the header type (x-UserToUser, User-To-User, or User-To-User PD Attribute), specify the encoding format (hex or ascii), and configure the two-digit hexadecimal protocol discriminator if applicable 58. Set the encoding format explicitly, as hexadecimal is assumed by default 61. Note that the protocol discriminator field is not available when selecting the x-UserToUser header type 61.

In Architect call flows, use the Set UUI Data action to specify UUI sent on disconnect or transfer 60. If Set UUI Data is called multiple times, the last value supplied is used 60. Keep UUI strings to 128 characters or fewer; while Genesys Cloud does not limit UUI length, some systems discard values exceeding 128 characters 59. Genesys recommends using TCP transport when large amounts of UUI or custom data are transmitted to avoid maximum transmission unit packet limits 55.

On CUBE, configure unsupported SIP header pass-through using a voice class sip-hdr-passthrulist containing passthru-hdr entries for the chosen UUI header, and apply it to both dial-peers using voice-class sip pass-thru headers <list-tag> 10. Alternatively, voice-class sip pass-thru headers unsupp passes all unsupported headers 10. Do not use dial-peer rotary for these calls, as CUBE does not support unsupported-header pass-through on SIP-to-SIP dial-peer rotary calls 11.

Verify

Capture SIP signalling on CUBE using debug ccsip messages during a call transfer or disconnect to verify that the UUI header passes intact between both legs 69 10.

Rollback

Set the Architect Set UUI Data action value to NOT_SET to stop the flow from sending UUI (or pass an empty string to clear the value) 62. Disable UUI Passthrough on the trunk and remove the header pass-through list from the CUBE dial-peers 63 10.

No call data

Do

Leave UUI Passthrough disabled on the Genesys external trunk; Genesys Cloud ignores incoming and outgoing UUI data when this switch is disabled 63. Do not configure header pass-through lists on CUBE 10.

Verify

Suggested check: Run SIP trace on CUBE to confirm that SIP signalling does not carry User-to-User headers.

Rollback

Suggested rollback: No configuration steps to undo.

Step 13 Verify signalling and media encryption

TLS with SRTP

Do

show sip-ua connections tcp tls detail and show call active voice brief report active TLS connection state and SRTP media status per call leg on CUBE 16 13.

Verify

In the output of show sip-ua connections tcp tls detail, verify that the connection shows the negotiated version and cipher 16. In show call active voice brief, verify that SRTP reports on or off as configured for each call leg 13.

Rollback

Suggested rollback: No rollback required for verification read-only commands.

Unencrypted TCP

Do

show call active voice brief reports SRTP media status on or off for each call leg on CUBE 13.

Verify

Confirm that both call legs are present and operational, and verify that SRTP reports off on the unencrypted leg 13.

Rollback

Suggested rollback: No rollback required for verification read-only commands.

Applicability

Applies to: Genesys Cloud CX, Cisco Unified Border Element, Cisco Unified Communications Manager, Genesys Cloud CX Architect, and Cisco IOS XE voice gateways. Deployments: on-premises, hybrid, and multi-tenant. Sources checked 2026-09-25. A CUBE dial-peer is bound to a tenant with voice-class sip tenant <tag>, and settings apply in the order dial-peer, then tenant, then global 14. CUBE added TLS 1.3 and a TLS 1.2 minimum option in IOS XE 17.14.1a, configured with sip-ua transport tcp tls, and from IOS XE 26.1.1, TLS 1.0 and 1.1 are not allowed in the default configuration 17. A Unified CM SIP trunk can have up to 16 destination addresses or a single DNS SRV record 19. Support for the BYOC Premises Genesys Hardware Solution Edges (Standard v1-v3, Micro, Mini v1-v2) ends on 1 December 2026 34.

What remains uncertain

Whether Unified CM natively passes the User-to-User header across its SIP trunk or requires a custom SIP normalization script is not covered by the sources below. Whether CUBE classifies User-to-User as a standard supported header or strictly requires configuration under voice class sip-hdr-passthrulist is not covered by the sources below. The specific TLS certificate requirements and local port specifications for BYOC Premises Edge devices are not covered by the sources below.

Sources

1
The BYOC Cloud checklist includes assigning DID and toll-free numbers to users and to call routes.
BYOC Cloud configuration checklist · DID and caller ID checklist items · Checked 2026-09-25
2
BYOC Cloud defines SIP trunks between the Genesys Cloud AWS-based Edge and Media Tier and third-party carriers over the public Internet.
About BYOC Cloud · opening paragraph · Checked 2026-09-25
3
BYOC Premises is a customer-managed deployment where on-premises Edge devices connect the on-premises telephony infrastructure to Genesys Cloud through third-party SIP trunks.
About BYOC Premises · opening paragraph · Checked 2026-09-25
4
Genesys says to test a BYOC Cloud connection with the Genesys Cloud call simulator. For a support escalation it asks for the org, the trunk name, the test call time and numbers, and packet captures if available.
BYOC Cloud configuration checklist · testing and support escalation items · Checked 2026-09-25
5
On Dynamic Cloud Voice, a party connecting to BYOC Cloud must support the FQDN method of SIP routing recommended in RFC 3261 section 19.1.1. It must also return unknown Contact URI parameters in later requests, per section 19.1.5.
Carrier requirements for BYOC Cloud · RFC 3261 compliance (Dynamic Cloud Voice) · Checked 2026-09-25
6
On Legacy Cloud Voice, a party connecting to BYOC Cloud needs full Record-Route support as RFC 3261 requires.
Carrier requirements for BYOC Cloud · Legacy Cloud Voice platform section · Checked 2026-09-25
7
On Dynamic Cloud Voice, a party connecting to BYOC Cloud must fully support RFC 3261 section 8.2.6.2 and return the Via header in responses exactly as Genesys Cloud sent it.
Carrier requirements for BYOC Cloud · RFC 3261 compliance (Dynamic Cloud Voice) · Checked 2026-09-25
8
The BYOC Cloud checklist requires ACLs to be configured on both sides of the connection and SIP and media to be allowed through firewalls.
BYOC Cloud configuration checklist · network checklist items · Checked 2026-09-25
9
The BYOC Cloud checklist requires a site that uses AWS for Phone Edge assignment and has a valid location.
BYOC Cloud configuration checklist · site checklist items · Checked 2026-09-25
10
CUBE passes chosen SIP headers between call legs through a voice class sip-hdr-passthrulist (passthru-hdr entries) applied to a dial-peer with voice-class sip pass-thru headers <list-tag>. voice-class sip pass-thru headers unsupp passes all unsupported headers.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Pass Unsupported SIP Headers · configuration commands · Checked 2026-09-25
11
CUBE does not support unsupported-header pass-through on SIP-to-SIP dial-peer rotary calls.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Pass Unsupported SIP Headers · restrictions · Checked 2026-09-25
12
CUBE interworks SRTP and RTP when srtp is configured on one dial-peer and left off the other. IOS XE platforms need no DSP resources for this.
Configure SRTP-RTP Interworking on CUBE · configuration; DSP requirements · Checked 2026-09-25
13
show call active voice brief on CUBE reports SRTP on or off for each call leg.
Configure SRTP-RTP Interworking on CUBE · verification · Checked 2026-09-25
14
A CUBE dial-peer is bound to a tenant with voice-class sip tenant <tag>. Settings apply in the order dial-peer, then tenant, then global.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants · dial-peer association; configuration priority · Checked 2026-09-25
15
On CUBE, SIP TLS uses a PKI trustpoint and a voice class tls-profile (trustpoint, optional cn-san-validate server). The profile is referenced from a voice class tenant that sets session transport tcp tls, with url sips for SIPS URLs.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · configuration: TLS profile and tenant · Checked 2026-09-25
16
On CUBE, show sip-ua connections tcp tls detail shows each TLS connection's negotiated version and cipher, and show sip-ua connections tcp tls brief lists active connections and listen sockets.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · verification commands · Checked 2026-09-25
17
CUBE added TLS 1.3 and a TLS 1.2 minimum option in IOS XE 17.14.1a, configured with sip-ua transport tcp tls. From IOS XE 26.1.1, TLS 1.0 and 1.1 are not allowed in the default configuration.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · TLS versions supported; global sip-ua configuration · Checked 2026-09-25
18
Unified CM route patterns send matching calls to a gateway, trunk or route list. Cisco recommends route lists and route groups over pointing a route pattern directly at a device.
System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Call Routing · route patterns; direct assignment note · Checked 2026-09-25
19
Unified CM SIP trunk setup is three tasks in order: configure SIP profiles, configure a SIP trunk security profile, then configure SIP trunks. A trunk can have up to 16 destination addresses or a single DNS SRV record.
System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · SIP trunk task flow; destination addresses · Checked 2026-09-25
20
For an encrypted Unified CM SIP trunk, the security profile sets incoming and outgoing transport to TLS (default incoming port 5061), and the trunk's SRTP Allowed check box allows encrypted media.
System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · SIP trunk security profile; SRTP Allowed · Checked 2026-09-25
21
Practitioners in the Genesys community fixed CUBE TLS to BYOC Cloud by installing the full certificate chain, using DNS session targets rather than server groups, and checking the connection with show sip-ua connections tcp tls detail.field report
BYOC Cloud with Cisco CUBE SBC · final recommended fixes post · Checked 2026-09-25
22
Community posts report failed CUBE-to-BYOC-Cloud TLS on IOS XE 17.3.x and earlier. In those reports the TLS handshake succeeded but INVITEs timed out.field report
BYOC Cloud with Cisco CUBE SBC · posts dated June 2021 and January 2023 · Checked 2026-09-25
23
With the FQDN routing method, the inbound Request-URI puts the dialled number in the user part and the trunk's identifier-based FQDN in the host part, for example sip:+13172222222@myuniqueidentifier.byoc.use1.genesys.cloud.
Carrier requirements for BYOC Cloud · FQDN routing method · Checked 2026-09-25
24
A CUBE that fronts Unified CM is a PBX-side peer rather than a PSTN carrier, so the BYOC PBX trunk type is the closer fit for it.inferred
Create a trunk under BYOC Cloud · trunk type selection · Checked 2026-09-25
25
Setting the Genesys-facing CUBE dial-peer's session target to dns:<identifier>.byoc.<region>.genesys.cloud should put the FQDN-method host into the Request-URI that Genesys expects.inferred
Carrier requirements for BYOC Cloud · FQDN routing method · Checked 2026-09-25
26
For cn-san-validate server to accept Genesys, CUBE must trust the CA that signs the Genesys certificates (Amazon Trust Services on Dynamic Cloud Voice), usually via a trustpoint authenticated with that root.inferred
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · certificate setup: crypto pki authenticate · Checked 2026-09-25
27
If Release Link Transfer stays off, a transfer from Genesys Cloud back to a Unified CM extension is likely placed as a new outbound call that Genesys keeps bridged, so the call uses two trunk legs through CUBE.inferred
External trunk settings · Release Link Transfer · Checked 2026-09-25
28
With BYOC Premises, the CUBE dial-peer toward Genesys most likely targets the address of the Edge NIC selected for calls, not a public Genesys load balancer.inferred
Assign a site, Edge group, and external SIP trunk · step 4 (NIC for calls) · Checked 2026-09-25
29
BYOC Cloud handles call signalling and media with separate services at different IP addresses. The media addresses are provided in the SDP.
BYOC Cloud public SIP IP addresses · signalling and media note · Checked 2026-09-25
30
A site number plan with the Regular Expression match type takes a Match Expression, a Normalized Number Expression and a classification. Genesys Cloud evaluates number plans from top to bottom.
Add a number plan · match types: Regular Expression; classification and processing · Checked 2026-09-25
31
An outbound route on a site maps one or more classifications to one or more external trunks, with Sequential or Random distribution. The route carries calls only when its State is enabled.
Create an outbound route · classification; external trunks; distribution pattern; state · Checked 2026-09-25
32
A BYOC Cloud trunk needs an outbound route that uses it, even when the trunk carries only inbound calls.
BYOC Cloud configuration checklist · number plan and routing checklist items · Checked 2026-09-25
33
To assign an external trunk to an Edge, take the Edge out of service, set its site and Edge group, select the external trunk under Use the following trunks, then put the Edge back in service and save.
Assign a site, Edge group, and external SIP trunk · steps 1, 2, 5 and 6 · Checked 2026-09-25
34
Support for the BYOC Premises Genesys Hardware Solution Edges (Standard v1-v3, Micro, Mini v1-v2) ends on 1 December 2026. For a premises deployment, Genesys recommends moving to the Customer Hardware Solution.
Deprecation: BYOC-Premises – Genesys Hardware Solution · end of support date; affected equipment; recommended alternatives · Checked 2026-09-25
35
A BYOC Premises trunk to a SIP peer is created as type Premises External SIP, with the peer in SIP Servers or Proxies and SIP Access Control Use Source Address set to Yes.
Create a trunk under BYOC Premises · trunk type; SIP servers or proxies; SIP access control · Checked 2026-09-25
36
On the Dynamic Cloud Voice platform, BYOC Cloud has three ingress IP addresses and one egress CIDR range per region, behind load balancers named lb0[1-3].byoc.[region].genesys.cloud.
BYOC Cloud public SIP IP addresses · Dynamic Cloud Voice section and regional tables · Checked 2026-09-25
37
On the Legacy Cloud Voice platform, BYOC Cloud has four IP addresses per region, behind load balancers named lb0[1-4].voice.[region].pure.cloud.
BYOC Cloud public SIP IP addresses · Legacy Cloud Voice section and regional tables · Checked 2026-09-25
38
The external trunk setting Enable Release Link Transfer turns on the outbound REFER method.
External trunk settings · Release Link Transfer · Checked 2026-09-25
39
A Genesys Cloud remote phone uses remote phone base settings, a site, and a remote address given as an E.164 number or a SIP address.
Create a remote phone · phone settings; address format · Checked 2026-09-25
40
A remote phone must have an established persistent connection before it can answer Genesys Cloud calls, and remote phones do not support auto answer.
Create a remote phone · key requirements; critical limitations · Checked 2026-09-25
41
BYOC Cloud inbound INVITEs can use the FQDN or TGRP method by default. The DNIS Replacement Routing method is for cases where the sender cannot use either.
Configure SIP routing for a BYOC Cloud trunk · inbound routing methods · Checked 2026-09-25
42
For Genesys Cloud Voice and BYOC Cloud, outbound connections to RTP media ports 16384-65535 must be open. Without them, media can be intermittent or missing.
Why does the port range 16384-65535 (RTP media) need to be opened up for Genesys Cloud Voice/BYOC Cloud? · FAQ answer · Checked 2026-09-25
43
IP addresses entered in a trunk's SIP Servers or Proxies list are added to the trunk's SIP Access Control allow list automatically.
External trunk settings · SIP Servers or Proxies · Checked 2026-09-25
44
The external trunk setting Enable Take Back and Transfer turns on the inbound REFER method.
External trunk settings · Take Back and Transfer · Checked 2026-09-25
45
Genesys Cloud requires a unique Inbound SIP Termination Identifier in each inbound INVITE to associate the call with the organisation. The identifier must be unique within the organisation's region.
Configure SIP routing for a BYOC Cloud trunk · identifier uniqueness requirement · Checked 2026-09-25
46
For TLS, the customer endpoint needs a certificate from a public CA that Genesys trusts, with a common name or subject alternative name that matches a hostname in the trunk's SIP Servers or Proxies. IP addresses are not accepted for this match.
TLS trunk transport protocol specification for BYOC Cloud · validation requirements: subject name validation · Checked 2026-09-25
47
BYOC Cloud TLS trunks support one-way (server-side) TLS only. Mutual TLS is not supported.
TLS trunk transport protocol specification for BYOC Cloud · certificate requirements: authentication model · Checked 2026-09-25
48
A BYOC Cloud trunk that uses TLS signalling requires SRTP for call media.
TLS trunk transport protocol specification for BYOC Cloud · media encryption · Checked 2026-09-25
49
BYOC Cloud server certificates are signed by Amazon Trust Services on Dynamic Cloud Voice and by DigiCert on Legacy Cloud Voice.
TLS trunk transport protocol specification for BYOC Cloud · certificate requirements: BYOC Cloud endpoints · Checked 2026-09-25
50
A BYOC Cloud TLS trunk supports only TLS 1.2, on port 5061.
TLS trunk transport protocol specification for BYOC Cloud · TLS versions and ports · Checked 2026-09-25
51
The Architect Transfer to Number action transfers an interaction to an external number. Genesys recommends E.164 format and warns that other formats risk carrier errors.
Transfer to Number action · purpose; telephone number input · Checked 2026-09-25
52
Both ends of a Genesys Cloud trunk must use the same transport protocol, or the trunk may not function.
Choose a trunk transport protocol · warnings: protocol matching · Checked 2026-09-25
53
A Genesys Cloud trunk can use UDP, TCP or TLS as its transport protocol for sending calls. TLS uses port 5061; UDP and TCP use port 5060.
Choose a trunk transport protocol · supported protocols; firewall ports · Checked 2026-09-25
54
The trunk Protocol setting controls only the protocol Genesys Cloud uses to send calls. It is not enforced on calls the trunk receives.
Choose a trunk transport protocol · configuration note · Checked 2026-09-25
55
Genesys recommends TCP over UDP when headers carry large amounts of UUI or custom data, so that messages do not fail by exceeding the maximum transmission unit.
Choose a trunk transport protocol · TCP section · Checked 2026-09-25
56
The external trunk Media section sets a Preferred Codec List (g722, g729, PCMA, PCMU, opus) and an SRTP Cipher Suite List. DTMF Method can be RTP Events, In-band Audio or None.
External trunk settings · Media section; DTMF settings · Checked 2026-09-25
57
A BYOC Cloud external trunk is created as type BYOC Carrier (subtypes Generic, Verizon or WhatsApp Business Calling) or BYOC PBX (subtype Generic only), under Menu > Digital and Telephony > Telephony > Trunks > External Trunks.
Create a trunk under BYOC Cloud · menu navigation; trunk type selection · Checked 2026-09-25
58
The external trunk's User to User Information settings are a UUI Passthrough switch, a header type (x-UserToUser, User-To-User or User-To-User PD Attribute), an encoding format (hex or ascii) and a two-digit hexadecimal protocol discriminator.
External trunk settings · Protocol: User to User Information (UUI) · Checked 2026-09-25
59
Genesys Cloud does not limit UUI string length, but some systems discard UUI longer than 128 characters, so Genesys recommends keeping UUI at 128 characters or fewer.
Set UUI Data action · length guidance · Checked 2026-09-25
60
The Architect Set UUI Data action specifies whether the UUI is sent on disconnect or on transfer. If it is called more than once, the last value supplied is used.
Set UUI Data action · action description · Checked 2026-09-25
61
Genesys recommends setting an explicit UUI encoding format, because otherwise hexadecimal is assumed. The protocol discriminator field is not available with the X-User-To-User header type.
Enable the User to User Information settings · dynamic UUI setup · Checked 2026-09-25
62
Passing NOT_SET to Set UUI Data stops the flow from sending UUI on either disconnect or transfer. Passing an empty string clears the UUI.
Set UUI Data action · NOT_SET and empty string notes · Checked 2026-09-25
63
Genesys Cloud does not recognise incoming or outgoing UUI data until UUI Passthrough is enabled on the trunk.
Set UUI Data action · prerequisite note · Checked 2026-09-25
64
WebRTC phone persistent connection has a timeout configurable from 600 to 604,800 seconds. Agents do not get the feature after it is enabled until they log out and back in.
Configure the Genesys Cloud WebRTC phone · key configuration options: persistent connection · Checked 2026-09-25
65
To create a Genesys Cloud WebRTC phone, first create base settings with Phone Make and Model set to Genesys Cloud WebRTC Phone. Then add a phone with those base settings, a site and a person. With BYOC, do not choose the PureCloud Voice - AWS site.
Configure the Genesys Cloud WebRTC phone · create base settings; create the phone · Checked 2026-09-25
66
For inbound SIP call legs, CUBE prefers inbound dial-peer match criteria in this order: incoming uri via, incoming uri request, incoming uri to, incoming uri from, incoming called-number, answer-address.
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Configure Dial Peers > Preferences (inbound dial-peer matching list) · Checked 2026-09-24
67
Useful verification commands for this configuration include show dial-peer voice summary (operational status and keepalive), show voice class uri, show voice class dpg, show voice class server-group and show dialplan incall sip.
Understand IOS and IOS XE Call Routing · verification examples (show dial-peer voice summary; show voice class uri) · Checked 2026-09-24
68
A dial peer must be in the UP operational state to be eligible for call routing; an outbound VoIP dial peer needs a valid outbound matching mechanism and a valid session target to be UP.
Understand IOS and IOS XE Call Routing · Dial-Peer States · Checked 2026-09-24
69
Cisco's basic debug set for SIP calls on CUBE is debug ccsip messages and debug ccsip error, with debug ccsip non-call optional, and debug voip ccapi inout recommended alongside because it usually has minimal CPU impact.
Configure Debug Collection for CUBE and TDM Gateways · SIP Call Flow Debugs; CCAPI debugs · Checked 2026-09-24
70
An outbound dial peer that has destination-pattern but no incoming criteria can be selected as the inbound dial peer for a call whose calling number happens to match that pattern, so inbound peers should carry explicit incoming uri or incoming called-number criteria.inferred
Understand IOS and IOS XE Call Routing · Inbound Dial-Peer Matching > Table 1 (SIP), preference 7 · Checked 2026-09-24
71
show call active voice brief shows, per call leg, pid:<peer_id> (the dial-peer tag used for that leg) and the direction Answer or Originate, which is how the matched inbound and outbound dial peers are confirmed for a live call.
Cisco IOS Voice Command Reference - S commands - show aal2 profile through show call filter match-list · show call active voice > brief output format and field descriptions (Dial-Peer, CallOrigin) · Checked 2026-09-24
72
Before debugging, Cisco recommends logging to a 10 MB buffer (logging buffered 10000000), disabling console and monitor logging, and millisecond timestamps; debugs should be stopped (undebug all) if CPU exceeds 80%.
Configure Debug Collection for CUBE and TDM Gateways · Configure > baseline logging configuration; CPU caution · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 25). Connecting Unified CM to Genesys Cloud CX. WarmTransfer. https://warmtransfer.net/guides/cucm-with-genesys-cloud

BibTeX

@misc{warmtransfer-cucm-with-genesys-cloud,
  title  = {Connecting Unified CM to Genesys Cloud CX},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/cucm-with-genesys-cloud},
  note   = {Verified 2026-09-25}
}