Unified CM SIP trunk to CUBE configuration

Do

Under voice service voip, enter mode border-element and allow-connections sip to sip 7. From Cisco IOS XE Amsterdam 17.2.1r onwards, omit the capacity keyword because it is deprecated, and session counts are monitored through Cisco Smart Software Manager 19.

Verify

Run show cube status to confirm that the CUBE version, software version, platform, and high-availability configuration are displayed 18.

Rollback

Suggested rollback: remove the configuration by entering no allow-connections sip to sip and no mode border-element under voice service voip.

Do

CUBE populates its IP trusted list from dial-peer session targets, voice class server-group entries, and manual ip address trusted list entries 26. Under voice service voip, enter ip address trusted list and add the IPv4 or IPv6 addresses for all Unified CM subscriber nodes that will send traffic 25. The trusted list supports up to 100 addresses 25.

Verify

Verify that every subscriber IP address appears under ip address trusted list in the running configuration, keeping in mind that untrusted sources fail silently with discarded calls and no SIP error response 27.

Rollback

Suggested rollback: enter the ip address trusted list configuration mode under voice service voip and remove the added subscriber IP entries.

Voice class server group

Do

Create a server group using voice class server-group <id> 15. Add up to 5 IPv4 or IPv6 target server addresses within the group 17. By default, the server group picks the available address with the highest preference, or you can configure hunt-scheme round-robin to distribute calls across nodes 16.

Verify

Run show voice class server-group <id> to verify that all subscriber targets and preference settings are configured 15.

Rollback

Suggested rollback: remove the server group by entering no voice class server-group <id> after detaching it from any dial peers.

DNS SRV resolution

Do

Define local DNS SRV records mapping to the Unified CM subscriber nodes by creating ip host name entries and ip host _sip._<proto>.<name> srv <priority> <weight> <port> <target-host> entries 3.

Verify

Suggested check: view the running configuration to confirm that the ip host mappings and SRV records are present.

Rollback

Suggested rollback: delete the configured ip host entries from the router configuration.

Voice class server group

Do

Configure an outbound dial peer toward Unified CM with session protocol sipv2 and attach the server group using session server-group <id> 15. Set dtmf-relay rtp-nte to specify RFC 2833 RTP-NTE DTMF relay 5. Add voice-class sip bind control and voice-class sip bind media to the interface facing Unified CM, which is mandatory for all CUBE Enterprise deployments 1. Match calls arriving from Unified CM on an inbound dial peer using incoming uri via mapped to a voice class uri pattern, which CUBE evaluates as its primary matching criterion 9 8. Route inbound calls to outbound dial peers using destination dpg <id> referencing a voice class dpg 4. Route only specific number ranges and avoid catch-all destination patterns such as destination-pattern .T 14.

Verify

Run show dial-peer voice summary to confirm that the dial peers are registered as operational, and check show voice class server-group to verify dial-peer binding 10 15.

Rollback

Suggested rollback: remove the inbound and outbound dial peers using no dial-peer voice <tag> voip, followed by removing the associated voice class uri and voice class dpg definitions.

DNS SRV resolution

Do

Configure an outbound dial peer toward Unified CM with session protocol sipv2 and specify session target dns:<srv-name> 3. Set dtmf-relay rtp-nte to declare RFC 2833 RTP-NTE DTMF relay 5. Add voice-class sip bind control and voice-class sip bind media to the interface facing Unified CM, which is mandatory in CUBE Enterprise deployments 1. Match incoming calls from Unified CM using incoming uri via pointing to a configured voice class uri, which CUBE checks before other inbound URI criteria 9 8. Link the inbound dial peer to outbound peers using destination dpg <id> referencing a configured voice class dpg 4. Route known number ranges and avoid catch-all patterns like destination-pattern .T 14.

Verify

Run show dial-peer voice summary to confirm that the dial peers are operational and active 10.

Rollback

Suggested rollback: delete the configured dial peers using no dial-peer voice <tag> voip and remove the associated voice class uri and voice class dpg entries.

Do

Configure an OPTIONS keepalive profile with voice class sip-options-keepalive <id>, which defaults to an up-interval of 60 seconds, a down-interval of 30 seconds, and 5 retries 13. Apply the profile to the outbound dial peer toward Unified CM using voice-class sip options-keepalive profile <id> 10. Do not apply the same keepalive profile to multiple dial peers that use different bind interfaces, which is unsupported 11.

Verify

Run show dial-peer voice summary to check the keepalive state of the target; when a target stops responding to OPTIONS pings, CUBE busies out the dial peer 10 12.

Rollback

Suggested rollback: remove voice-class sip options-keepalive profile <id> from the dial peer, then delete the profile with no voice class sip-options-keepalive <id>.

Non-secure SIP over TCP

Do

Cisco's CUBE hardening guide recommends deploying SIP-TLS and SRTP across all call legs 22.

Verify

Suggested check: review deployment documentation to ensure that running unencrypted signalling and media on this leg is recorded as an accepted security exception.

Rollback

Suggested rollback: no changes are required to revert this branch.

SIP over TLS with SRTP media

Do

Starting in Cisco IOS XE Cupertino 17.8.1a, configure cn-san validate if you want CUBE to verify the peer certificate's CN or SAN against configured names 2. TLS 1.3 is supported on CUBE starting from Cisco IOS XE 17.14.1a 24.

Verify

Run show sip-ua connections tcp tls brief or show sip-ua connections tcp tls detail to inspect established TLS signalling connections to each subscriber 23.

Rollback

Suggested rollback: remove configured TLS dial-peer parameters and security profiles.

Do

Unified CM requires configuring the SIP profile before configuring the security profile and SIP trunk 50. In Cisco Unified CM Administration, navigate to Device > Device Settings > SIP Profile and add or copy a profile 47. Check Enable OPTIONS Ping to monitor destination status for Trunks with Service Type None (Default) 41. By default, Unified CM exchanges OPTIONS messages every 60 seconds 40. If CUBE receives Delayed Offer calls, configuring early-offer forced under voice service voip on CUBE generates an outbound Early Offer 6.

Verify

Verify that the saved SIP profile displays the OPTIONS Ping checkbox as checked 41.

Rollback

Suggested rollback: open the SIP profile page in the administration interface and delete the created profile, or revert the assigned profile on the trunk.

Non-secure SIP over TCP

Do

In Cisco Unified CM Administration, navigate to System > Security > SIP Trunk Security Profile and add a profile 46. Set the transport to TCP in the SIP trunk security profile 46. If no profile is assigned, Unified CM assigns a nonsecure profile by default 34. The incoming port configured on this profile is where Unified CM listens for signalling and is the port advertised in its Via header toward CUBE 36. Do not aim multiple non-secure trunks with differing incoming ports at the same CUBE destination, as mid-call INVITEs can use the incorrect port and drop calls 39.

Verify

Verify under System > Security > SIP Trunk Security Profile that the profile shows the intended incoming port 46.

Rollback

Suggested rollback: delete the profile from the administration interface after unlinking it from any configured SIP trunks.

SIP over TLS with SRTP media

Do

In Cisco Unified CM Administration, navigate to System > Security > SIP Trunk Security Profile and add a new profile 46. Set Device Security Mode to Encrypted, select TLS for incoming and outgoing transport, set the incoming port (defaulting to 5061 for TLS), and enter the X.509 Subject Name matching CUBE's certificate 52 56. Do not configure a secure SIP trunk while Unified CM is running within its initial 90-day evaluation period, as secure trunks cannot be deployed in evaluation mode 37.

Verify

Verify under System > Security > SIP Trunk Security Profile that Device Security Mode displays Encrypted and both transports show TLS 52.

Rollback

Suggested rollback: delete the security profile from the administration interface and remove any uploaded certificate.

Single CUBE + Non-secure SIP over TCP

Do

Navigate to Device > Trunk, click Add New, and select SIP Trunk 53. Select the pre-existing device pool 35. Check Run on All Active Unified CM Nodes to activate the trunk on every cluster node 45. Enter the CUBE IP address or hostname in the Destination Address field, utilizing Unified CM's support for up to 16 destination addresses 33. Assign the non-secure SIP trunk security profile and the SIP profile created in previous steps 50. Save the trunk, then reset or restart it for the settings to take effect 54.

Verify

Open Device > Trunk and confirm the trunk status displays In Service 49. If status displays No Service, status reason code local=1 indicates no OPTIONS response over UDP, local=2 indicates a failure to open a socket to CUBE, and local=3 indicates a DNS lookup failure 38.

Rollback

Suggested rollback: unassign the trunk from any route groups and delete the trunk under Device > Trunk.

Two CUBEs + Non-secure SIP over TCP

Do

Navigate to Device > Trunk, click Add New, and choose SIP Trunk 53. Assign the device pool 35. Check Run on All Active Unified CM Nodes 45. Under Destination, enter the address of the first CUBE, click the add icon (+), and enter the second CUBE address, utilizing Unified CM's support for up to 16 destination addresses 33. Assign the non-secure SIP trunk security profile and your SIP profile, then save and reset the trunk 50 54.

Verify

Confirm on the Device > Trunk page that the trunk shows In Service 49. If status displays No Service, code local=1 indicates missing OPTIONS responses, local=2 indicates a socket error, and local=3 indicates DNS failure 38. Suggested check: verify that the preceding router configuration is also executed on the other router.

Rollback

Suggested rollback: delete the second destination address or remove the trunk from all route groups and delete it under Device > Trunk.

Single CUBE + SIP over TLS with SRTP media

Do

Navigate to Device > Trunk, click Add New, and select SIP Trunk 53. Assign the configured device pool 35. Check Run on All Active Unified CM Nodes 45. Enter CUBE's destination address, change the destination port from 5060 to 5061, and check SRTP Allowed, utilizing Unified CM's support for up to 16 destination addresses 33 51 48. Assign the encrypted SIP trunk security profile and your SIP profile 50. Save and reset the trunk so the changes take effect 54.

Verify

Check Device > Trunk to confirm that the trunk status reports In Service 49. A No Service status with reason local=2 indicates that Unified CM failed to establish the TLS socket connection to CUBE 38.

Rollback

Suggested rollback: remove the SIP trunk from call routing devices and delete it from Device > Trunk.

Two CUBEs + SIP over TLS with SRTP media

Do

Navigate to Device > Trunk, click Add New, and select SIP Trunk 53. Assign the device pool 35. Check Run on All Active Unified CM Nodes 45. Enter both CUBE addresses as destinations using (+), change the destination port from 5060 to 5061, and check SRTP Allowed, utilizing Unified CM's support for up to 16 destination addresses 33 51 48. Assign the encrypted security profile and SIP profile, then save and reset the trunk 50 54.

Verify

Confirm under Device > Trunk that trunk status shows In Service 49. A No Service status showing local=2 indicates Unified CM could not open a TLS socket to the destination 38. Suggested check: verify that the preceding router configuration is also executed on the other router.

Rollback

Suggested rollback: remove the SIP trunk from all route groups and delete the trunk under Device > Trunk.

Do

In Cisco Unified CM Administration, navigate to Call Routing > Route/Hunt > Route Group and create a route group containing the SIP trunk, selecting either Top Down or Circular distribution 42. Under Call Routing > Route/Hunt > Route List, create a route list, add the route group in order of priority, save, and select Apply Config 43. Under Call Routing > Route/Hunt > Route Pattern, create the dial pattern, assign it to the proper partition, and select your route list in the Gateway/Route List drop-down menu 44.

Verify

Verify under Route List configuration that the route group is assigned, and verify under Route Pattern that the pattern points to the route list 43 44.

Rollback

Suggested rollback: delete the route pattern, delete the route list, and then delete the route group under Call Routing > Route/Hunt.

Non-secure SIP over TCP

Do

In Cisco Unified CM Administration, place a call using the route pattern configured in step 10, or send an inbound call to Unified CM 44.

Verify

Suggested check: place an outbound test call from a registered phone matching the route pattern, and place an inbound test call through the border element to an internal extension. Verify on Unified CM's Device > Trunk page that the trunk status is In Service 49. On CUBE, run show dial-peer voice summary to confirm that the keepalive state for the dial peer facing Unified CM is up 10. If inbound calls from Unified CM fail to arrive and generate no SIP error messages, verify that every sending subscriber address exists in CUBE's IP trusted list 27.

Rollback

Suggested rollback: no rollback actions are required for test calls.

SIP over TLS with SRTP media

Do

In Cisco Unified CM Administration, place a call using the route pattern configured in step 10, or send an inbound call to Unified CM 44.

Verify

Suggested check: place test calls in both directions across the trunk between an endpoint and the border element. Verify under Unified CM Device > Trunk that trunk status reports In Service 49. Run show sip-ua connections tcp tls detail on CUBE to verify active TLS signalling sessions to each subscriber 23. Run show dial-peer voice summary to ensure dial peer keepalive status is up 10. If the trunk status reports No Service with local=2, verify TLS handshakes and trustpoint certificates between Unified CM and CUBE 38.

Rollback

Suggested rollback: no rollback actions are required for test calls.