sbc trunking · published

CUBE high availability

Verified 2026-09-25 · 58 sources · tier 2

Cisco Unified Border Element (CUBE) box-to-box redundancy uses the Redundancy Group (RG) infrastructure to maintain session state between paired routers 5. All signaling and media are bound to Virtual IP (VIP) addresses configured on externally facing interfaces, ensuring consistent addressing across switchovers 56.

Redundancy Group Architecture

In a CUBE HA pair, the RG infrastructure relies on two interconnecting paths: a control link carrying the redundancy state of each router and a data synchronization link carrying stateful call and media-flow information 40. The RG infrastructure component uses an HSRP-like protocol exchanging keepalive and hello messages to negotiate redundancy state, alongside a dedicated transport to checkpoint call signaling and media state 41.

Prerequisites and interface configuration rules include:

A Layer 2 connection between the active and standby routers, as well as NTP or identical clocks on both devices 36.
Cisco recommends using port channels for the RG control and data interfaces because a single cable or switch path constitutes a single point of failure that can leave both routers in an Active state 35.
Cisco recommends connecting the RG control and data interfaces of the pair to the same physical switch to avoid network latency 42.
One CUBE in the HA pair must have the lower IP address on all 3 interfaces compared with the peer router's corresponding interfaces 24.
Secondary IP addresses are not permitted on CUBE HA interfaces 29.
Both routers must be configured with the same redundancy group priority and failover threshold 45.
VRFs must be defined identically and in the same order on both active and standby routers for accurate data synchronization 57.
Up to 2 active/standby CUBE HA pairs (2 redundancy groups) may exist on the same Layer 2 segment, with a unique Redundancy Interface Identifier (RII) per redundant interface pair 54.

VIPs are configured on each redundant interface using the command syntax redundancy group <n> ip <address> exclusive 55. External devices such as Cisco Unified Communications Manager must target the CUBE HA VIP address rather than physical interface addresses 34. Interface tracking of the LAN and WAN interfaces (for example track 1 interface ... line-protocol) is assigned to the redundancy group so that traffic-interface failure triggers switchover. 51

Call State Checkpointing and Feature Restrictions

CUBE HA checkpoints only active calls that have completed a 200 OK/ACK transaction 8. Calls still in transit, including those in trying or ringing states, are not checkpointed 52. A media inactivity timer allows the HA pair to disconnect calls when no RTP is received within a configured period, such as via timer receive-rtp 1200 25.

Transport-layer sessions using TCP, TLS, and UDP are not checkpointed between the HA pair 53. Following a failover, SIP-layer signaling state is preserved, but remote user agents must re-establish TCP sessions before sending further messages 49. Out-of-band DTMF using SIP NOTIFY or KPML is not supported on a call after switchover 33.

The following features and co-located roles are not preserved or supported:

SCCP-based media resources, CPA, noise reduction, acoustic shock protection, and transrating calls are not preserved or supported across a switchover 32.
Media flow-around and the UC Services API are not supported with box-to-box HA 28.
Co-locating Unified SRST or TDM gateway functions on the HA routers is not supported 30.

Failover Behavior and Operational Lifecycle

Upon failover, the previously active router reloads by design 37. Any router that is reloaded while in a CUBE HA relationship boots up as Standby 39.

Configuration changes carry specific lifecycle considerations:

After completing CUBE HA configuration, the configuration must be saved and the router reloaded 38.
Adding or removing the redundancy-group command under voice service voip requires a reload to take effect 43.
Configuration replicated from the active router lands only in the standby router's running configuration and must be committed on the standby using write memory 48.

Platform Deployments and Licensing

CUBE box-to-box redundancy is supported on Cisco 4000 Series ISRs and Catalyst 8300, 8200, and 8200-L Edge Platforms 5. On ASR 1000 Series routers, box-to-box redundancy is supported on the ASR 1001-X, 1002-X, 1004, 1006, and 1006-X starting in Cisco IOS XE 3.11 3. The ASR 1006 supports both inbox and box-to-box redundancy, but cannot switch between the 2 modes dynamically 27. ASR 1000 box-to-box HA additionally requires the Firewall/NAT Stateful Inter-Chassis Redundancy license FLSASR1-FWNAT-R 4.

When deploying with Cisco Application Centric Infrastructure (ACI), Cisco advises placing an intermediate Layer 3 switch between the CUBE HA pair and the ACI fabric so that ACI does not directly learn the CUBE IP and MAC addresses 1. WAN links cannot be terminated directly on a CUBE HA router 31. Both CUBE HA routers must reside in the same data center; geographic stateful switchover and routers connected across MAN Ethernet are not supported 44.

For virtualized and cloud environments:

For C8000V HA, the virtual router connects to the virtual switch within the virtualized host, and the RG control and data interfaces may be connected back-to-back or through a switch 7.
CUBE HA is not supported on vCUBE deployed in AWS or Microsoft Azure 26.

For Smart Licensing:

Both platforms of a box-to-box HA pair must establish trust with the same Cisco Smart Software Manager (CSSM) Smart Virtual Account 46.
Only the active platform submits license usage reports to CSSM; a newly active platform starts a new measurement interval 2.
From Cisco IOS XE Amsterdam 17.2.1r, CUBE license usage in HA deployments is based on dynamic call counting 11.
Inbox high availability under Smart Licensing requires CUBE Trunk Standard Session licenses 18.

Webex Calling and Webex Contact Center Integrations

Deploying CUBE HA as a Webex Calling Local Gateway requires Cisco IOS XE 17.9.1 or later on a platform supporting both roles 22. Configuration across both CUBEs in the pair must be identical, including the physical setup 21. Cisco recommends retaining the default RG timers (delay 30 seconds and reload 60 seconds) with a holdtime at least 3 times the hellotime 20. Once HA is configured, Local Gateway configuration—whether registration-based or certificate-based—is applied on both routers 23.

For Webex Contact Center, component-redundancy guidance requires peer CUBEs to use the same hardware, software configuration, and IOS version, using VIPs for signaling and media 58.

Verification

Operational status is verified using EXEC mode show commands:

show redundancy application group all indicates healthy operation when one router reports My Role ACTIVE and Peer RF state STANDBY HOT 12.
show redundancy application if-mgr group <n> confirms the VIP interface state as no shut on the active router and shut on the standby router 14.

Applicability

Support for IPv6 flows in CUBE high availability requires Cisco IOS XE Dublin 17.12.1a or later 19. Cisco TAC tech note 221645 demonstrates CUBE HA on ASR 1001-X routers running Cisco IOS XE 16.09.04 50. Box-to-box redundancy on ASR 1000 Series platforms applies from Cisco IOS XE 3.11 onwards 3. Deployments as a Webex Calling Local Gateway require Cisco IOS XE 17.9.1 or later 22.

What remains uncertain

Trunk Redundant Session versus Enhanced Trunk license naming across product eras is not covered by the sources below. Measured failover and media interruption durations are not covered by the sources below. The software upgrade procedure for an HA pair, including router order and call impact, is not covered by the sources below. Webex Local Gateway SIP registration and TLS behavior during a switchover is not covered by the sources below. Deploying CUBE HA on Google Cloud Platform or other public clouds, as well as on-premises hypervisor specifics, is not covered by the sources below. Non-HA multi-CUBE redundancy across separate sites using OPTIONS keepalives and dial-peer groups is not covered by the sources below. The manual switchover command (redundancy application reload group n self) for failover testing is not covered by the sources below. DSP high availability support for transcoding across HA pairs is not covered by the sources below.