# Setting up a Webex Calling Local Gateway Systems: Cisco IOS XE For voice engineers who administer both a Webex Calling organization in Control Hub and the IOS XE router that will act as CUBE. Canonical: https://warmtransfer.net/guides/webex-calling-local-gateway-setup Last verified: 2026-09-24 Cisco IOS XE CUBE operates as a Webex Calling Local Gateway to carry voice traffic between Webex Calling and premises-based connections[^50]. The deployment relies on SIP TLS signalling and SRTP media sessions established according to the chosen trunk architecture[^49]. ## Before you start - Cisco's Local Gateway configuration procedure assumes a dedicated gateway platform with no existing voice configuration[^25]. - The connection between on-premises and Webex Calling must be designed and sized for the expected number of concurrent calls and required redundancy[^61], with one-way latency between the gateway and the Webex Calling access SBC not exceeding 100 ms[^62]. - A Control Hub location can be assigned only 1 PSTN option: Cisco Calling Plans, Cloud Connect, or on-premises PSTN via Local Gateway[^63]. - The task flow involves configuring the trunk in Control Hub, configuring the SBC for the Local Gateway role, and verifying trunk status in Control Hub[^50]. ## What changes by situation - Which kind of Webex Calling trunk will the gateway use? Registration-based trunk; Certificate-based trunk. - Does Unified CM sit behind the gateway? No Unified CM behind gateway; Unified CM sits behind gateway. ## Step 1: Confirm the platform and release **Registration-based trunk** ### Do Confirm that the Cisco CUBE router runs Cisco IOS XE Bengaluru 17.6.1a or later[^42]. Note that registration-based trunks are supported only on Cisco CUBE[^44]. ### Verify Suggested check: verify that the reported software version meets or exceeds the minimum required release. ### Rollback Suggested rollback: if the platform does not meet software requirements, upgrade the image before continuing. **Certificate-based trunk** ### Do Confirm that the Cisco CUBE router runs Cisco IOS XE Cupertino 17.9.1a or later[^3]. If the deployment is in Webex for Government, CUBE must be used instead of a third-party SBC[^31], and it must run Cisco IOS XE Dublin 17.12.1a or later[^33]. ### Verify Suggested check: confirm that the reported software version meets or exceeds the required release. ### Rollback Suggested rollback: if the platform does not meet software requirements, upgrade the image before continuing. ## Step 2: Open network paths to Webex Calling **Registration-based trunk** ### Do Allow outbound TCP signalling from the gateway's external interface to the Webex Calling subnets on port 8934 for SIP TLS[^39]. Do not configure inbound signalling firewall pinholes, because a registration-based gateway reuses the connection it opens[^38]. The gateway can operate behind dynamic NAT[^8]. ### Verify Suggested check: review perimeter firewall policy to ensure outbound traffic to destination subnets is allowed from the outside interface. ### Rollback Suggested rollback: remove the outbound firewall access rule. **Certificate-based trunk** ### Do Configure the perimeter network so the gateway has a public IP address or static NAT[^8], and publish public DNS A or SRV records for the gateway's FQDN[^7]. Allow outbound TCP signalling from the gateway's external interface to Webex Calling subnets on port 5062 for SIP TLS[^39]. Allow inbound SIP TLS signalling from Webex Calling subnets to the customer-chosen gateway IP address and port[^38]. ### Verify Suggested check: query public DNS servers to verify that the gateway FQDN resolves to the configured public or static NAT IP address, and confirm that both inbound and outbound firewall rules are active. ### Rollback Suggested rollback: remove the inbound and outbound firewall access rules and remove the public DNS records. ## Step 3: Create the trunk in Control Hub **Registration-based trunk** ### Do In Control Hub, navigate to Services > Calling > Call Routing > Trunk and click Add Trunk[^19]. Select the location, enter a trunk name no longer than 24 characters[^18], and choose Registering as the trunk type[^21]. Set the Max Concurrent Calls value according to the Local Gateway's capacity[^14], with a limit of up to 250 concurrent calls per trunk[^43]. Once saved, copy the Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address, username, and password into a local file[^15][^10]. ### Verify Confirm that the trunk appears in Control Hub with a status of Unknown, indicating that connection is in progress for the new gateway[^20]. Suggested check: verify that all trunk credential parameters have been copied. ### Rollback Delete the trunk from Control Hub if needed, ensuring it is not currently in use[^11]. If credentials are lost, regenerate them from the trunk information screen using Retrieve Username and Reset Password[^16]. **Certificate-based trunk** ### Do Ensure the organization has a verified domain[^9]. In Control Hub, navigate to Services > Calling > Call Routing > Trunk and click Add Trunk[^19]. Select the location, enter a trunk name no longer than 24 characters[^18], and select Certificate-based as the trunk type[^21]. Enter the device type, SBC address as an FQDN or SRV that is unique across the organization, domain, and port[^21][^9]. Set the Max Concurrent Calls according to gateway capacity[^14], noting that certificate-based trunks support more than 250 concurrent calls[^6]. ### Verify Confirm that the trunk appears in Control Hub with a status of Unknown[^20]. ### Rollback Delete the trunk in Control Hub, which is permitted only while it is not in use[^11]. ## Step 4: Import trust store and configure TLS **Registration-based trunk** ### Do Import the Cisco root CA bundle using: ``` crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b ``` [^56]. Configure `sip-ua` to enforce TLS 1.2 by setting `transport tcp tls v1.2`[^48]. Apply `crypto signaling default trustpoint cn-san-validate server` under `sip-ua`, which causes the gateway to permit the TLS connection only if the tenant host name appears in the CN or SAN of the certificate received from the Webex outbound proxy[^24]. ### Verify Suggested check: run trustpool and running-config verification commands to confirm root certificates and user-agent parameters are present. ### Rollback Suggested rollback: remove the trustpoint and validation lines under `sip-ua`. **Certificate-based trunk** ### Do Import the Cisco root CA bundle using: ``` crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b ``` [^56]. Obtain and install a device certificate signed by a public CA from Cisco's supported root CA list[^4][^45]. Certificates containing only the Server Authentication EKU are supported[^47]. Configure `sip-ua` with `transport tcp tls v1.2`[^48] and configure `crypto signaling default trustpoint cn-san-validate server` referencing the device trustpoint[^24]. ### Verify Suggested check: confirm the installed certificate displays the expected CN or SAN matching the address configured in Control Hub. ### Rollback Suggested rollback: delete the device certificate trustpoint and remove the `crypto signaling default trustpoint` configuration under `sip-ua`. ## Step 5: Configure global voice service and trusted list **No Unified CM behind gateway** ### Do Under `voice service voip`, navigate to `sip` configuration and enter `early-offer forced` so SDP is sent in the initial INVITE[^28]. Under `voice service voip`, configure `ip address trusted list` with the regional Webex Calling data-centre subnets and the PSTN trunk gateway addresses[^54]. By default, the Local Gateway blocks all incoming VoIP messages from IP addresses not in the trusted list[^55]. ### Verify Suggested check: verify that early offer and the trusted IP address entries for both regional subnets and PSTN gateways are listed. ### Rollback Suggested rollback: remove the added entries from the `ip address trusted list` and remove `early-offer forced` from `voice service voip`. **Unified CM sits behind gateway** ### Do Under `voice service voip`, navigate to `sip` and configure `early-offer forced` so SDP is sent in the initial INVITE[^28]. Configure `ip address trusted list` to include the regional Webex Calling data-centre subnets, the PSTN trunk gateway addresses, and the IP addresses of all Unified CM servers that send calls to the gateway[^54]. Without these entries, the Local Gateway blocks incoming VoIP messages from them by default[^55]. ### Verify Suggested check: verify that the trusted IP list includes regional subnets, PSTN addresses, and node addresses. ### Rollback Suggested rollback: remove the IP entries from `ip address trusted list` and remove `early-offer forced`. ## Step 6: Define SRTP, ICE-lite, and inbound matching classes ### Do In voice class configuration, configure AES_CM_128_HMAC_SHA1_80 as the only SRTP cipher suite CUBE offers in SDP offers and answers[^49]. Note that Local Gateway for Webex for Government requires FIPS-compliant GCM ciphers instead[^32]. Create a `voice class stun-usage` configured with `stun usage ice lite` to allow media optimisation on Webex Calling-facing dial-peers[^35]. Create `voice class uri 100 sip` configured with `pattern dtg=` to select the inbound Webex Calling dial-peer[^26]. ### Verify Suggested check: confirm the SRTP crypto class, STUN usage class, and URI class definitions are present in the configuration. ### Rollback Suggested rollback: remove the SRTP crypto class, the STUN usage class, and the URI class. ## Step 7: Build the Webex Calling tenant and dial-peer **Registration-based trunk** ### Do In the registration-based tenant, configure the registrar with the Register Domain, configure credentials using the Line/Port host along with Authentication Username and Password, and configure outbound-proxy with the Outbound Proxy Address copied from Control Hub[^52]. Make AES_CM_128_HMAC_SHA1_80 the SRTP suite offered[^49]. Configure the Webex dial-peer: bind the tenant, match the inbound dial-peer using the DTG pattern[^26], configure `srtp`, attach `stun usage ice lite`[^35], configure a dummy destination pattern[^27], and set `max-conn` to at most 250[^37]. ### Verify Run the command to check registration: ``` show sip-ua register status ``` Confirm the numbers registered with the external SIP registrar show `registered` indicating success[^23]. ### Rollback Suggested rollback: remove the Webex dial-peer from configuration, then delete the tenant. **Certificate-based trunk** ### Do Create the tenant and make AES_CM_128_HMAC_SHA1_80 the SRTP suite offered[^49]. Do not configure registrar or digest credentials in the tenant, because certificate-based trunks authenticate via certificate verified against the gateway FQDN[^53]. Configure the Webex dial-peer: bind the tenant, configure `srtp`, attach `stun usage ice lite`[^35], and configure a dummy destination pattern[^27]. ### Verify Run the command to verify active SIP user-agent TLS transport connections: ``` show sip-ua connections tcp tls detail ``` Confirm that connection tables show active TLS connections toward Webex Calling, noting that a Tenant field is displayed from Cisco IOS XE 17.8.1a[^22]. ### Rollback Suggested rollback: remove the Webex dial-peer and delete the tenant. ## Step 8: Build on-premises dial-peers **No Unified CM behind gateway** ### Do Configure a PSTN dial-peer targeting the ITSP gateway IP address or host, and configure a dummy destination pattern on it[^27]. Configure an inbound PSTN matching rule using a `voice class uri` targeting the provider's host, and ensure that host is included in the trusted list[^54]. ### Verify Suggested check: verify that the dial-peer voice summary shows the PSTN dial-peer in an operational state of up. ### Rollback Suggested rollback: remove the PSTN dial-peer and its matching URI class. **Unified CM sits behind gateway** ### Do Define local DNS SRV entries (`ip host _sip._udp...`) on the gateway for the Unified CM nodes so session targets can reach multiple nodes[^60]. Configure one dial-peer pointing to the SRV target for Webex Calling traffic and another dial-peer pointing to the SRV target for PSTN traffic[^60]. Maintain the port split: route calls from Unified CM arriving on port 5060 to PSTN and calls arriving on port 5065 to Webex Calling[^58]. In Unified CM, configure the incoming port in the Webex Calling trunk's SIP Trunk Security Profile to 5065[^59]. Configure the PSTN dial-peer toward the provider with a dummy destination pattern[^27]. ### Verify Suggested check: verify that both node dial-peers and the provider dial-peer are listed and up, and verify the security profile configuration. ### Rollback Suggested rollback: remove the dial-peers and the host SRV entries, and revert the SIP Trunk Security Profile incoming port setting. ## Step 9: Wire dial-peer groups **No Unified CM behind gateway** ### Do A dummy destination pattern is required on dial-peers when outbound calls are routed using an inbound dial-peer group[^27]. ### Verify Suggested check: verify that the running configuration displays destination dial-peer group references. ### Rollback Suggested rollback: remove dial-peer group routing references. **Unified CM sits behind gateway** ### Do In Cisco's Unified CM design, calls arriving at the gateway from Unified CM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling[^58]. A dummy destination pattern is required on dial-peers when outbound calls are routed using an inbound dial-peer group[^27]. ### Verify Suggested check: verify dial-peer group memberships and destination bindings in the running configuration. ### Rollback Suggested rollback: remove destination dial-peer group bindings. ## Step 10: Save configuration and reload ### Do Save the running configuration to startup configuration, and reload the platform if this is the first time CUBE features have been configured on it[^46]. ### Verify Suggested check: after reload completes, verify that running configuration parameters are intact. ### Rollback Suggested rollback: restore the previously archived startup configuration if settings failed to initialize properly. ## Step 11: Configure call routing in Webex Calling **No Unified CM behind gateway** ### Do In Control Hub, navigate to Calling > Locations, select the location, and under Assign or Manage configure the PSTN connection to Premises-based PSTN (Local Gateway) using the configured trunk[^13]. If multiple trunks are used for redundancy, assign them to a route group supporting up to 10 trunks with priorities, where calls are spread randomly among same-priority trunks and fall back to lower priorities when higher ones fail[^17]. ### Verify Confirm in Control Hub that the location's PSTN connection displays the selected trunk or route group[^13]. ### Rollback Suggested rollback: reconfigure the location's PSTN connection in Control Hub to its prior selection. **Unified CM sits behind gateway** ### Do In Control Hub, set the location's PSTN connection to Premises-based PSTN (Local Gateway) pointing to the trunk or route group[^13][^17]. Navigate to Call Routing > Dial Plans and create a dial plan to route calls matching enterprise extension, E.164, or SIP URI domain patterns to on-premises Unified CM through the trunk or route group[^12]. See also [Unified CM and Webex Calling coexistence during a migration](https://warmtransfer.net/knowledge/cucm-webex-calling-coexistence). ### Verify Confirm that the location displays Premises-based PSTN and that the dial plan appears in Control Hub with the configured extension patterns assigned to the trunk or route group[^13][^12]. ### Rollback Suggested rollback: delete the dial plan entries routing to the trunk and revert the location's PSTN connection in Control Hub. ## Step 12: Verify end to end **Registration-based trunk** ### Do In Control Hub, verify the trunk status under Services > Calling > Call Routing > Trunk[^19]. On the gateway, check registration status with `show sip-ua register status`[^23] and check TLS connection details with `show sip-ua connections tcp tls detail`[^22]. ### Verify Verify that Control Hub reports the trunk status as Online, noting that Impaired indicates at least 1 Webex Calling edge proxy cannot connect to it[^20]. Confirm that `show sip-ua register status` shows `registered`[^23]. Suggested check: place test calls to verify two-way audio. ### Rollback Suggested rollback: if the trunk fails to register or remains impaired, review registration credentials and configuration. **Certificate-based trunk** ### Do In Control Hub, check that the trunk status displays Online under Call Routing > Trunk[^20]. On the gateway, execute `show sip-ua connections tcp tls detail` to verify established TLS connections to Webex Calling[^22]. Inbound call signalling from Webex Calling to the customer-chosen gateway address and port exercises the certificate-based inbound path[^38]. ### Verify Confirm that Control Hub displays trunk status as Online[^20]. If the trunk shows Impaired, at least 1 Webex Calling edge proxy cannot connect[^20]; verify the inbound firewall rule, public DNS resolution, and that the certificate's CN or SAN matches the SBC address configured in Control Hub[^38][^7][^9][^24]. Suggested check: place test calls to verify call delivery. ### Rollback Suggested rollback: if the trunk does not establish TLS connectivity, re-examine certificate chain validity, DNS host records, and inbound port accessibility. ## Applicability Applies to: Cisco IOS XE CUBE, Cisco Webex Calling, Cisco Webex Calling Control Hub, Cisco Webex Calling for Government, Cisco Webex audio, Cisco Unified CM, and Cisco Local Gateway. Deployments: on-premises and multi-tenant. Sources checked 2026-09-24. Certificate-based trunks require Cisco IOS XE Cupertino 17.9.1a or later[^3], whereas registration-based trunks require Cisco IOS XE Bengaluru 17.6.1a or later[^42]. Deployments on Webex for Government require Cisco IOS XE Dublin 17.12.1a or later, require CUBE hardware, require certificate-based trunks, and mandate FIPS-compliant GCM ciphers[^33][^31][^30][^32]. High availability as box-to-box CUBE redundancy using Redundancy Group infrastructure is documented for Cisco IOS XE 17.9.1 or later[^34]. For TDM PSTN connections, Cisco's design specifies loop-back call routing so media optimisation remains available on the Webex leg[^51]. ## What remains uncertain The specific syntax of loop-back call routing configuration for TDM PSTN interfaces is not covered by the sources below. The exact CUBE configuration commands for FIPS-compliant GCM ciphers on Webex for Government are not covered by the sources below. Specific Unified CM calling search spaces, partitions, and route patterns needed on the cluster are not covered by the sources below. ## Sources [^1]: On Catalyst 8000 Edge platforms the Local Gateway requires at least a DNA Essentials licence, and DNA Advantage where voice cards or DSPs are used. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations / prerequisites (licences). Checked 2026-09-24. [^2]: The gateway certificate's CN or SAN must contain the gateway FQDN exactly as configured on the Control Hub trunk. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Certificate-based trunk, Configure connectivity and security (certificate requirements). Checked 2026-09-24. [^3]: A certificate-based trunk on Cisco CUBE requires IOS XE Cupertino 17.9.1a or later. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Supported platforms, certificate-based trunk list. Checked 2026-09-24. [^4]: For a certificate-based trunk, the device certificate must be signed by a public CA from Cisco's supported root CA list. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Certificate-based trunk, Configure connectivity and security. Checked 2026-09-24. [^5]: The certificate-based tenant example points 'sip-server' at a Webex sipconnect DNS name (example: us25.sipconnect.bcld.webex.com) rather than using registrar and credentials. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Certificate-based trunk section, voice class tenant block. Checked 2026-09-24. [^6]: A certificate-based Local Gateway trunk supports more than 250 concurrent calls per trunk. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, concurrent calls row. Checked 2026-09-24. [^7]: A certificate-based trunk requires public DNS A or SRV records for the gateway; a registration-based trunk does not. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, DNS configuration row. Checked 2026-09-24. [^8]: A certificate-based trunk requires the gateway to have a public IP address or static NAT, whereas a registration-based trunk works behind dynamic NAT. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, NAT requirements row. Checked 2026-09-24. [^9]: A certificate-based trunk requires a verified domain, accepts the SBC address as an FQDN or SRV, and that address must be unique across the organization. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, certificate-based fields. Checked 2026-09-24. [^10]: Cisco recommends copying the registering trunk information from Control Hub into a local file for use when configuring the Local Gateway. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, note after trunk information. Checked 2026-09-24. [^11]: A trunk can be deleted in Control Hub only when it is not in use. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Delete a trunk. Checked 2026-09-24. [^12]: Webex Calling dial plans route calls matching enterprise extension, E.164 or SIP URI domain patterns to on-premises destinations through a trunk or route group. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Dial plans. Checked 2026-09-24. [^13]: A location uses the gateway for PSTN when its PSTN connection is set to Premises-based PSTN (Local Gateway) under Calling > Locations > Assign or Manage. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Premises-based PSTN configuration for a location. Checked 2026-09-24. [^14]: The Control Hub trunk's Max Concurrent Calls value must be set according to the Local Gateway's capacity. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, Max Concurrent Calls field. Checked 2026-09-24. [^15]: After a registering trunk is created, Control Hub shows the Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address, and a username and password. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, trunk information after save. Checked 2026-09-24. [^16]: Lost registering-trunk credentials can't be recovered; they must be regenerated from the trunk information screen with Retrieve Username and Reset Password. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, note on lost credentials. Checked 2026-09-24. [^17]: A route group holds up to 10 trunks with priorities; calls are spread randomly among same-priority trunks and fall back to lower priorities when higher ones fail. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Route groups. Checked 2026-09-24. [^18]: A Webex Calling trunk name can't be more than 24 characters long. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, trunk name field. Checked 2026-09-24. [^19]: A Local Gateway trunk is created in Control Hub under Services > Calling > Call Routing > Trunk with Add Trunk. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, steps. Checked 2026-09-24. [^20]: Control Hub reports a trunk as Online, Offline, Impaired or Unknown; Unknown means connection in progress for a newly added gateway and Impaired means at least one Webex Calling edge proxy can't connect to it. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Trunk status table. Checked 2026-09-24. [^21]: When adding a trunk, Control Hub asks for a location, a trunk name, and a trunk type of Registering or Certificate-based; certificate-based trunks also take a device type, SBC address, domain and port. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/en-us/article/n0xb944/Configure-trunks,-route-groups,-and-dial-plans-for-Webex-Calling), Configure a trunk, steps. Checked 2026-09-24. [^22]: 'show sip-ua connections {tcp [tls] | udp} {brief | detail}' displays the SIP user-agent transport connection tables, including a Tenant field from IOS XE 17.8.1a. Source: [Cisco IOS Voice Command Reference - S commands - show sip service through show trunk hdlc](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/vcr4/vcr4-cr-book/vcr-s8.html), show sip-ua connections, syntax and field table. Checked 2026-09-24. [^23]: 'show sip-ua register status' displays the numbers the gateway has registered with an external SIP registrar, with a 'registered' field showing whether each registration succeeded. Source: [Cisco IOS Voice Command Reference - S commands - show sip service through show trunk hdlc](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/vcr4/vcr4-cr-book/vcr-s8.html), show sip-ua register status, description and field table. Checked 2026-09-24. [^24]: With 'crypto signaling default trustpoint cn-san-validate server', the gateway permits the TLS connection only if the host name configured in the tenant appears in the CN or SAN of the certificate received from the Webex outbound proxy. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security, sip-ua command explanations. Checked 2026-09-24. [^25]: Cisco's Local Gateway configuration article assumes a dedicated gateway platform with no existing voice configuration. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations. Checked 2026-09-24. [^26]: The Local Gateway selects the inbound Webex Calling dial-peer with 'voice class uri 100 sip' matching 'pattern dtg='. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class uri 100 block. Checked 2026-09-24. [^27]: A dummy destination pattern (the Cisco example uses BAD.BAD) is required on dial-peers when outbound calls are routed using an inbound dial-peer group. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, dial-peer 100 explanation. Checked 2026-09-24. [^28]: The Local Gateway 'voice service voip' sip configuration uses 'early-offer forced' so SDP is sent in the initial INVITE. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice service voip block. Checked 2026-09-24. [^29]: One integrator guide advises replacing underscores with periods in the 'pattern dtg' value on the gateway (field report). Source: [Cisco WebEx Calling: Local Gateway configuration to Unified CM](https://www.lookingpoint.com/blog/cisco-webex-calling-local-gateway-configuration-to-unified-cm), voice class uri section. Checked 2026-09-24. [^30]: Webex for Government supports certificate-based Local Gateway trunks and does not support registration-based trunks. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, Webex for Government row. Checked 2026-09-24. [^31]: Webex for Government does not support third-party SBCs as Local Gateway; CUBE must be used. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations. Checked 2026-09-24. [^32]: Local Gateway for Webex for Government requires FIPS-compliant GCM ciphers to be configured. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Webex for Government note in connectivity and security section. Checked 2026-09-24. [^33]: All Webex for Government Local Gateways must run IOS XE Dublin 17.12.1a or later. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations. Checked 2026-09-24. [^34]: Cisco documents Local Gateway high availability as layer-2 box-to-box CUBE redundancy using the Redundancy Group infrastructure on IOS XE 17.9.1 or later, with the Local Gateway configuration then applied to both CUBEs. Source: [Implement CUBE high availability as Local Gateway](https://help.webex.com/en-us/article/ndiofhf/Implement-CUBE-High-Availability-as-Local-Gateway), Introduction and prerequisites. Checked 2026-09-24. [^35]: 'stun usage ice lite' is applied to all Webex Calling-facing dial-peers to allow media optimisation whenever possible. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class stun-usage explanation. Checked 2026-09-24. [^36]: On ISR 4000 series routers the Local Gateway requires Unified Communications and Security licences. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations / prerequisites (licences). Checked 2026-09-24. [^37]: For registration trunks, the max-conn value on the Webex Calling dial-peer should be at most 250. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, dial-peer 100 explanation. Checked 2026-09-24. [^38]: Inbound SIP TLS signalling from Webex Calling to a customer-chosen gateway address and port applies only to certificate-based gateways; a registration-based gateway reuses the connection it opened. Source: [Port Reference Information for Cisco Webex Calling](https://help.webex.com/en-us/article/b2exve/Port-Reference-Information-for-Cisco-Webex-Calling), Local Gateway row: Call signaling from Webex Calling (SIP TLS) to Local Gateway. Checked 2026-09-24. [^39]: Local Gateway SIP TLS signalling to Webex Calling goes from the gateway's external interface over TCP to the Webex Calling subnets on port 8934 for registration-based trunks and port 5062 for certificate-based trunks. Source: [Port Reference Information for Cisco Webex Calling](https://help.webex.com/en-us/article/b2exve/Port-Reference-Information-for-Cisco-Webex-Calling), Local Gateway row: Call signaling to Webex Calling (SIP TLS). Checked 2026-09-24. [^40]: In the SIP PSTN design, the Webex Calling dial-peer uses 'destination dpg' to send calls to the PSTN dial-peer group and the PSTN dial-peer sends calls to the Webex Calling dial-peer group. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with SIP PSTN trunk, voice class dpg blocks. Checked 2026-09-24. [^41]: Cisco recommends IOS XE 17.12.2 for Local Gateway with either trunk type. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Key considerations / prerequisites (IOS XE versions). Checked 2026-09-24. [^42]: A registration-based trunk on Cisco CUBE requires IOS XE Bengaluru 17.6.1a or later. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Supported platforms, registration-based trunk list. Checked 2026-09-24. [^43]: A registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, concurrent calls row. Checked 2026-09-24. [^44]: Registration-based Local Gateway trunks are supported only on Cisco CUBE, while certificate-based trunks are supported on SBCs from several vendors. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, supported devices row; supported platforms list. Checked 2026-09-24. [^45]: Cisco's supported root CAs for Webex audio and video platforms are those in all of the Microsoft, Apple and Mozilla root stores, plus the Cisco-specific roots in the Trusted Core bundle. Source: [What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms?](https://help.webex.com/en-us/article/WBX9000008850/What-Root-Certificate-Authorities-are-Supported-for-Calls-to-Cisco-Webex-Audio-and-Video-Platforms), Trusted External Root bundle description. Checked 2026-09-24. [^46]: After the Local Gateway configuration, save the configuration and reload the platform if this is the first time CUBE features have been configured on it. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with SIP PSTN trunk, closing paragraph. Checked 2026-09-24. [^47]: For certificate-based trunks, gateway certificates that contain only the Server Authentication EKU are supported. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Security / certificate note. Checked 2026-09-24. [^48]: The Local Gateway sip-ua configuration includes 'transport tcp tls v1.2' so SIP over TLS uses TLS 1.2. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security, sip-ua block. Checked 2026-09-24. [^49]: In the Local Gateway configuration, voice class srtp-crypto 100 makes AES_CM_128_HMAC_SHA1_80 the only SRTP cipher suite CUBE offers in SDP offers and answers. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, srtp-crypto explanation. Checked 2026-09-24. [^50]: Cisco's Local Gateway task flow is: configure the trunk in Control Hub, then configure the SBC for the Local Gateway role, then verify the trunk's status in Control Hub. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Deployment task flow. Checked 2026-09-24. [^51]: For a TDM PSTN, Cisco's Local Gateway design uses loop-back call routing so media optimisation remains possible on the Webex call leg. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with TDM PSTN trunk, first paragraph. Checked 2026-09-24. [^52]: In the registration-based tenant, the registrar takes the Register Domain value, the credentials take the Line/Port host and Authentication Username and Password, and the outbound-proxy takes the Outbound Proxy Address, all copied from Control Hub. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class tenant 100 explanations. Checked 2026-09-24. [^53]: Registration-based trunks authenticate with digest credentials (username and password); certificate-based trunks authenticate with a certificate verified against the gateway FQDN. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Trunk types comparison table, authentication row. Checked 2026-09-24. [^54]: The gateway's 'ip address trusted list' should contain the regional Webex Calling data-centre subnets plus the addresses of Unified CM servers (if used) and PSTN trunk gateways. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, ip address trusted list explanation. Checked 2026-09-24. [^55]: By default the Local Gateway blocks all incoming VoIP messages from IP addresses that are not in its trusted list. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice service voip explanation. Checked 2026-09-24. [^56]: The Local Gateway imports the Cisco root CA bundle with 'crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b'. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security. Checked 2026-09-24. [^57]: In the Unified CM design, calls from Webex Calling are sent to a Unified CM dial-peer group rather than straight to the PSTN, and the Unified CM (port 5065) dial-peer sends calls to the Webex Calling group. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with an existing Unified CM environment, voice class dpg blocks. Checked 2026-09-24. [^58]: In Cisco's Unified CM design, calls arriving at the gateway from Unified CM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with an existing Unified CM environment. Checked 2026-09-24. [^59]: When the Webex Calling trunk is created in Unified CM, its SIP Trunk Security Profile incoming port must be set to 5065. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with an existing Unified CM environment. Checked 2026-09-24. [^60]: The Unified CM design defines local DNS SRV entries on the gateway ('ip host _sip._udp...') so a dial-peer session target reaches multiple Unified CM nodes. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Local Gateway with an existing Unified CM environment, ip host explanation. Checked 2026-09-24. [^61]: Cisco says the connection between on-premises and Webex Calling must be designed and sized for the expected number of concurrent calls and the required redundancy. Source: [Design to migrate from Unified CM to Webex Calling](https://help.webex.com/en-us/article/nqojzwt/Design-to-migrate-from-Unified-CM-to-Webex-Calling), Design to migrate from Unified CM to Webex Calling > PSTN. Checked 2026-09-24. [^62]: Cisco says one-way latency between the Local Gateway and the Webex Calling access SBC should not exceed 100 ms. Source: [Prepare to migrate from Unified CM to Webex Calling](https://help.webex.com/en-us/article/4yz2zd/Prepare-to-migrate-from-Unified-CM-to-Webex-Calling), Prepare to migrate > PSTN connectivity. Checked 2026-09-24. [^63]: A Control Hub location can be assigned only one PSTN option: Cisco Calling Plans, Cloud Connect, or on-premises PSTN via Local Gateway. Source: [Prepare to migrate from Unified CM to Webex Calling](https://help.webex.com/en-us/article/4yz2zd/Prepare-to-migrate-from-Unified-CM-to-Webex-Calling), Prepare to migrate > PSTN connectivity. Checked 2026-09-24.