Cisco Unified Border Element configuration and licensing

See also

Sources

1. 1
   From IOS XE 17.6.2 the CUBE SIP service is no longer affected by missing license report acknowledgements.

   Configure Smart Licensing on IOS XE Platforms for CUBE · Platform Licensing · Checked 2026-10-14
2. 2
   CUBE shuts down call processing when no CSSM report acknowledgment arrives by the policy deadline only on IOS XE 17.3.2, 17.3.3, 17.3.4a, 17.6.1a and any 17.4 or 17.5 release.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart License Operation > Missing Acknowledgment warning · Checked 2026-10-14
3. 3
   Cisco's CUBE hardening guide advises against catch-all dial-peer patterns such as destination-pattern .T because they raise toll-fraud risk.

   Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Call Routing and Toll Fraud > Avoid generic dial-peer routing · Checked 2026-10-14
4. 4
   Box-to-box CUBE high availability requires CUBE Trunk Redundant Session licenses, and only the active platform reports usage.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · High Availability Licensing > Box-to-box · Checked 2026-10-14
5. 5
   CUBE Enterprise deployments need signaling and media bind statements on the dial peer or on a voice class tenant applied to that dial peer.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Overview (Note) · Checked 2026-10-14
6. 6
   From IOS XE Amsterdam 17.2.1r the capacity option of mode border-element license is deprecated because CUBE SIP trunk licensing uses dynamic session counting.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Configure CUBE Features > Enable the CUBE Application on a Device · Checked 2026-10-14
7. 7
   CN-SAN client identity validation and trunk-specific TLS policy for CUBE were introduced in IOS XE Cupertino 17.8.1a.

   Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · Feature Information table · Checked 2026-10-14
8. 8
   Cisco states that for all Smart License versions the CUBE session license itself is not enforced, so calls continue while usage is out of compliance.

   Configure Smart Licensing on IOS XE Platforms for CUBE · Platform Licensing; How Does Smart Licensing Work? > Operation · Checked 2026-10-14
9. 9
   By default CUBE listens for inbound SIP over UDP and TCP, sends outbound SIP over UDP, and negotiates RTP unencrypted; inbound TLS fails until TLS is configured.

   Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Transport Layer Security (TLS) and Public Key Infrastructure (PKI) > Use TCP TLS and SRTP · Checked 2026-10-14
10. 10
    Plaintext SIP listeners on CUBE are disabled with no transport udp and no transport tcp under sip-ua, not under voice service voip.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Transport Layer Security (TLS) and Public Key Infrastructure (PKI) > Disable Non-Secure SIP Ports · Checked 2026-10-14
11. 11
    Dynamic call (session) counting for CUBE licensing was introduced in IOS XE Amsterdam 17.2.1r.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table · Checked 2026-10-14
12. 12
    When both incoming and outgoing CUBE dial peers use calling e164-pattern-map, a provision policy must be applied to the incoming dial peer to avoid call failures.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Configure Inbound and Outbound Dial-Peer Matching, Table 1 (Note) · Checked 2026-10-14
13. 13
    CUBE is enabled under voice service voip with mode border-element and allow-connections sip to sip, and verified with show cube status.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Configure CUBE Features > Enable the CUBE Application on a Device; Verify CUBE on the Device · Checked 2026-10-14
14. 14
    CUBE trunk session usage is reported against entitlement tags CUBE_T_STD (standard) and CUBE_T_RED (redundant).

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Verify Smart License Operation sample output; High Availability Licensing · Checked 2026-10-14
15. 15
    In IOS XE 16.11.1a through 17.3.1a, SIP processing on CUBE is disabled when the platform is unregistered and in the Eval-Expired state.

    Configure Smart Licensing on IOS XE Platforms for CUBE · Smart Licensing Requirements by Release table, rows 16.11.1a to 17.1.x and 17.2.1r to 17.3.1a · Checked 2026-10-14
16. 16
    Flex subscription entitlement tag reporting for CUBE, including the CUBE_TS_STD tag, was added in IOS XE 17.18.1a.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table; license entitlement sample output · Checked 2026-10-14
17. 17
    H.323 is no longer supported on CUBE from IOS XE Bengaluru 17.6.1a onwards.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Overview (Note) · Checked 2026-10-14
18. 18
    For inbound SIP calls CUBE matches dial peers in this order: incoming uri via, request, to, from (voice class uri), then incoming called-number, then answer-address.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Preferences > inbound SIP matching order list · Checked 2026-10-14
19. 19
    Inbox CUBE high availability on ASR 1000 (SSO) uses CUBE Trunk Standard Session licenses, and only the active route processor reports usage.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · High Availability Licensing > Inbox · Checked 2026-10-14
20. 20
    From Cisco IOS XE 26.1.1, TLS 1.0 and 1.1 and their ciphers are not supported in CUBE default configurations and require system mode insecure.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · TLS Versions · Checked 2026-10-14
21. 21
    Webex Calling Local Gateway on CUBE requires at least IOS XE Bengaluru 17.6.1a for registration-based trunks and Cupertino 17.9.1a for certificate-based trunks.

    Get started with Local Gateway · Supported session border controllers, Tables 3 and 4 · Checked 2026-10-14
22. 22
    Webex Calling registration-based Local Gateway trunks support only Cisco Unified Border Element as the gateway.

    Get started with Local Gateway · Local Gateway trunking models, Table 2 · Checked 2026-10-14
23. 23
    Smart License Reservation for CUBE was introduced in IOS XE Gibraltar 16.12.1a.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table · Checked 2026-10-14
24. 24
    Configuring no ip address trusted authenticate makes CUBE accept inbound SIP connections from any address, and Cisco's hardening guide says to avoid it.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Call Routing and Toll Fraud > Allow Connections from Trusted IPs · Checked 2026-10-14
25. 25
    For outbound SIP calls CUBE prefers destination route-string, then URI class with carrier-id, destination-pattern with carrier-id, URI class, destination-pattern, then carrier-id alone.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Dial Peers · Preferences > outbound SIP matching order list · Checked 2026-10-14
26. 26
    If the license periodicity keyword is omitted from mode border-element, CUBE measures license usage every 7 days.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart Software Licensing Task Flow > Configure CUBE features · Checked 2026-10-14
27. 27
    The minimum CUBE license usage measurement periodicity is 8 hours.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart License Operation; Smart Software Licensing Task Flow > Configure CUBE features · Checked 2026-10-14
28. 28
    CUBE license periodicity is set under voice service voip with mode border-element license periodicity, taking hours 8-23 or days 1-30.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart Software Licensing Task Flow > Configure CUBE features · Checked 2026-10-14
29. 29
    Under Smart Licensing Using Policy CUBE must report license usage to CSSM at least every 90 days.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart License Operation · Checked 2026-10-14
30. 30
    Cisco CUBE Classic (RTU) licensing offers reached end-of-sale on 2019-06-15 and last ship on 2019-09-15, announced 2019-03-15.

    End-of-Sale and End-of-Life Announcement for the Cisco Unified Border Element (CUBE) Classic Licensing Offers (RTU) · End-of-Life Announcement milestones table · Checked 2026-10-14
31. 31
    Cisco directs CUBE Classic RTU customers to order per-session CUBE-T-STD or CUBE-T-RED smart licenses, which require a Cisco Smart Licensing account.

    End-of-Sale and End-of-Life Announcement for the Cisco Unified Border Element (CUBE) Classic Licensing Offers (RTU) · Product Migration Options · Checked 2026-10-14
32. 32
    In IOS XE 16.6.1 through 16.10.x CUBE used RTU licensing only, even though platform Smart Licensing was optional in 16.6.1 to 16.9.x and mandatory in 16.10.x.

    Configure Smart Licensing on IOS XE Platforms for CUBE · Smart Licensing Requirements by Release table, rows 16.6.1 to 16.9.x and 16.10.x · Checked 2026-10-14
33. 33
    Evaluation mode and Smart License Reservation are deprecated for CUBE from the Smart Licensing Using Policy releases (17.3.2 and 17.4.1a).

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table; Smart License Operation · Checked 2026-10-14
34. 34
    Smart Licensing Using Policy for CUBE was introduced in IOS XE Amsterdam 17.3.2 and Bengaluru 17.4.1a.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table · Checked 2026-10-14
35. 35
    Smart Licensing for CUBE features was introduced in Cisco IOS XE Gibraltar 16.11.1a.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Feature Information for Smart Licensing table · Checked 2026-10-14
36. 36
    The srtp-auth command on CUBE is deprecated from IOS XE Everest 16.5.1b, makes no configuration change, and voice class srtp-crypto should be used instead.

    Support for SRTP Termination - Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards · Example: Configuring Crypto Authentication (Note); Configure Crypto Authentication (Note) · Checked 2026-10-14
37. 37
    A CUBE voice class srtp-crypto can be applied globally under voice service voip sip, under a voice class tenant, or on a dial peer with voice-class srtp-crypto.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Transport Layer Security (TLS) and Public Key Infrastructure (PKI) > Trim unsecure SRTP Ciphers · Checked 2026-10-14
38. 38
    From IOS XE Everest 16.5.1b the default CUBE SRTP offer is AEAD_AES_256_GCM, AEAD_AES_128_GCM, AES_CM_128_HMAC_SHA1_80 and AES_CM_128_HMAC_SHA1_32.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-RTP Internetworking · Configure SRTP-RTP Interworking (Note) · Checked 2026-10-14
39. 39
    CUBE falls back from SRTP to RTP only if srtp fallback is configured on the respective dial peer (or globally); otherwise the call fails.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-RTP Internetworking · Enable SRTP Fallback · Checked 2026-10-14
40. 40
    SRTP-RTP interworking on CUBE platforms running IOS XE does not require DSP resources.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SRTP-RTP Internetworking · Prerequisites · Checked 2026-10-14
41. 41
    A CUBE voice class tls-cipher can list up to 13 ciphers and is referenced from a voice class tls-profile.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · voice class tls-cipher configuration step · Checked 2026-10-14
42. 42
    The CUBE SIP TLS chapter's TLS Versions section states that the default form of transport tcp tls supports TLS 1.1, 1.2 and 1.3.disputed

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · TLS Versions · Checked 2026-10-14
43. 43
    The CUBE SIP TLS chapter's sip-ua section states that TLS 1.2 and 1.3 are negotiated by default.disputed

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · Configure sip-ua (transport tcp tls) step · Checked 2026-10-14
44. 44
    CUBE TLS profiles for controlling offered ciphers are available from IOS XE 17.3.1; earlier releases used strict-cipher or ecdsa-cipher keywords on crypto signaling.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Transport Layer Security (TLS) and Public Key Infrastructure (PKI) > Enforce TLS Ciphers · Checked 2026-10-14
45. 45
    Cisco's April 2023 CUBE hardening guide stated TLS 1.2 was the highest TLS version CUBE supported.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Transport Layer Security (TLS) and Public Key Infrastructure (PKI) > Enforce TLS 1.2 · Checked 2026-10-14
46. 46
    CUBE added SIP TLS 1.3 support in Cisco IOS XE 17.14.1a.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · Feature Information table (Secured SIP with TLS version 1.3 support); TLS Versions · Checked 2026-10-14
47. 47
    From IOS XE 17.3.2 a CUBE platform is associated with CSSM using license smart trust idtoken, which replaces the older register and deregister commands.

    Configure Smart Licensing on IOS XE Platforms for CUBE · Versions 17.3.2 and Later · Checked 2026-10-14
48. 48
    The CUBE ip address trusted list for toll-fraud prevention accepts up to 100 IPv4 addresses.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Overview of Cisco Unified Border Element · Configure a Trusted IP Address List for Toll-Fraud Prevention · Checked 2026-10-14
49. 49
    By default CUBE silently discards inbound calls that fail the IP trusted list check rather than sending an error response.

    Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices · Call Routing and Toll Fraud > Allow Connections from Trusted IPs · Checked 2026-10-14
50. 50
    A change in CUBE peak license usage of more than 25% from the last reported value triggers an immediate usage report.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart License Operation · Checked 2026-10-14
51. 51
    From IOS XE 17.6.1a, WebSocket-forked calls on CUBE consume an Enhanced session license.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Smart Licensing · Smart License Operation · Checked 2026-10-14
52. 52
    WebSocket-based media forking on CUBE is not supported with TLS 1.3.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP TLS Support · Restrictions · Checked 2026-10-14
53. 53
    In Cisco's documented coexistence configuration the Local Gateway separates traffic by port: calls arriving from Unified CM on port 5060 are routed to the PSTN and calls arriving on port 5065 are routed to Webex Calling, which requires setting the Unified CM SIP trunk security profile incoming port to 5065.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Unified CM interconnect dial-peer configuration · Checked 2026-09-04
54. 54
    A certificate-based Local Gateway trunk on CUBE requires Cisco IOS XE Cupertino 17.9.1a or later, with 17.12.2 or later recommended.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Platform requirements · Checked 2026-09-04
55. 55
    A registration-based Local Gateway trunk on CUBE requires Cisco IOS XE Bengaluru 17.6.1a or later, with 17.12.2 or later recommended.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Platform requirements · Checked 2026-09-04
56. 56
    Supported Local Gateway hardware includes Cisco IOS XE ISR 1100 and 4000 series routers, Catalyst 8200 and 8300 series, Catalyst 8000V Edge Software, and certified third-party session border controllers; the Local Gateway may be deployed on premises or hosted by a partner.

    Transitioning from Unified CM to Webex Calling — Deployment Guide · Table 3, Local Gateway · Checked 2026-09-04
57. 57
    Media optimization on a Local Gateway is enabled with the command STUN usage lite, the Local Gateway running Cisco Unified Border Element supports ICE-lite with several restrictions, and the feature requires a minimum CUBE software version of 17.3 or 16.12.5.

    Webex Calling media optimization with Interactive Connectivity Establishment (ICE) · Prerequisites and limitations, Local Gateway paragraphs · Checked 2026-09-16
58. 58
    Webex Calling does not support running Cisco Unified Communications Manager Express and a Local Gateway on a single instance of vCUBE.

    Get started with Local Gateway · Configure Local Gateway, note after step 3 · Checked 2026-09-15
59. 59
    Configuring a Local Gateway in controller mode as part of a Cisco SD-WAN solution requires Cisco IOS XE Cupertino 17.7.1 or a later release.

    Get started with Local Gateway · Table 3 Registration-based SBC, CUBE row, Minimum version cell · Checked 2026-09-15

Documents

Cite this page

WarmTransfer. (2026, October 14). Cisco Unified Border Element configuration and licensing. WarmTransfer. https://warmtransfer.net/knowledge/cube-configuration

@misc{warmtransfer-cube-configuration,
  title  = {Cisco Unified Border Element configuration and licensing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cube-configuration},
  note   = {Verified 2026-10-14}
}