# Unified CM intercluster trunks

Canonical: https://warmtransfer.net/knowledge/cucm-intercluster-trunks

Last verified: 2026-09-25

The Intercluster Lookup Service (ILS) lets remote Unified CM clusters form a multi-cluster network that shares data, without an administrator configuring each connection between clusters by hand[^28]. Cisco's Collaboration 14 Preferred Architecture recommends connecting individual Unified CM clusters with a full mesh of SIP trunks, and states that ILS is required between all Unified CM clusters in a multi-cluster deployment because Global Dial Plan Replication (GDPR) uses it as transport[^41][^42].

## ILS Architecture and Limits

In an ILS network, hub clusters form the backbone and use automesh to build a full mesh among themselves[^21]. An ILS spoke cluster connects only to its local hub cluster and never contacts other hub or spoke clusters directly[^30]. Furthermore, an ILS spoke cluster can have only 1 hub cluster[^25]. An ILS network supports up to 10 hub clusters with 20 spoke clusters per hub, reaching a maximum of 200 clusters in total[^16]. Cisco cautions that hub clusters need enough CPU to handle the ILS load of their spokes[^22]. 

Every cluster in an ILS network needs a unique Cluster ID, and ILS does not work if remote clusters keep the default Cluster ID StandAloneCluster[^34]. The ILS service runs only on the Unified CM publisher node[^27]. In addition, third-party systems cannot connect directly to an ILS network[^24].

## Configuring and Troubleshooting ILS

Cisco's ILS task flow is: configure Cluster IDs, configure ILS starting with the hub cluster, verify that ILS is running, then configure the Remote Cluster view[^31]. The ILS Remote Cluster configuration covers services for remote clusters such as Extension Mobility Cross Cluster, TFTP and RSVP Agent[^29]. To check that ILS is running, look at the ILS Clusters and Global Dial Plan Imported Catalogs section under Advanced Features > ILS Configuration on a cluster's publisher[^35].

ILS supports TLS certificate authentication and password authentication, and the 2 can be used together[^15]. If you choose TLS authentication for ILS, the Release 15 guide says you must also exchange CA-signed certificates between the nodes[^32]. From Release 15SU5, if the Tomcat server and Tomcat client certificates differ, both certificates must be uploaded to the peer trust store for ILS TLS[^13].

Troubleshooting ILS joins involves specific logs and error patterns:
- When ILS password authentication fails, the tech note shows DecryptData failed errors and an ILSPwdAuthenticationFailed alarm; the fix is to configure the same password on hub and spoke[^18].
- An ILS join that fails with a self-signed certificate verification error is fixed by importing the remote cluster's Tomcat certificate into the tomcat-trust store, or by using TLS with CA-signed certificates[^19].
- A spoke that has not imported the hub's Tomcat certificate reports Certificate verification failed (Verification error:18) when it tries to join ILS[^17].
- A hub that lacks a spoke's Tomcat certificate logs that the certificate is not in the local store and the FQDN is not in the peer info vector[^20].
- For ILS troubleshooting, the tech note sets the Cisco Intercluster Lookup Service trace to detailed and collects from activelog /cm/trace/ils/sdl/[^33].

## Global Dial Plan Replication (GDPR)

Global Dial Plan Replication (GDPR) uses ILS as its transport and replicates global dial plan data to the remote clusters in the ILS network, so ILS must be configured first[^7]. The ILS Configuration window has an Exchange Global Dial Plan Replication Data with Remote Clusters checkbox, which turns on GDPR data exchange for that cluster[^4]. GDPR advertises directory URIs, enterprise and E.164 alternate numbers, advertised patterns, PSTN failover numbers and route strings, and can also carry dial plan data imported from non-ILS systems[^3]. A GDPR PSTN failover number gives an alternate route when a call to a global dial plan element fails over the VoIP path[^8].

Cisco's GDPR task flow is: enable ILS support, configure SIP profiles, configure SIP trunks, configure SIP route patterns, set database limits and assign partitions, then optionally set advertised patterns, block learned patterns and import dial plan data, and finally provision dial plan data[^11].

The ILS Max Number of Learned Objects in Database service parameter defaults to 100,000 and can be set as high as 1,000,000[^5]. Learned GDPR data goes into 4 predefined partitions: Global Learned Enterprise Numbers, Global Learned E.164 Numbers, Global Learned Enterprise Patterns and Global Learned E.164 Patterns; learned numbers cannot be assigned to a NULL partition[^6]. A caller can dial a directory URI only if the URI's partition is in the caller's calling search space[^2].

## URI Dialing and Route Strings

A directory number can carry up to 5 line-based directory URIs, in addition to the user-based URI[^56]. The user portion of a directory URI can be at most 47 characters[^59]. By default the user portion of a directory URI is case-sensitive; the URI Lookup Policy setting changes this[^54].

For ILS-based URI routing, the SIP profile's Use Fully Qualified Domain Name in SIP Requests option must be enabled[^58]. The SIP profile option Send ILS Learned Destination Route String can be enabled to route intercluster calls across a Cisco Unified Border Element[^57]. Route strings identify each dial plan element's home cluster, and each remote cluster needs SIP route patterns that route learned route strings back to their home clusters[^9]. The SIP route patterns that match GDPR route strings use the Domain Routing pattern usage[^10].

The SIP trunk Calling and Connected Party Info Format setting defaults to Deliver DN only in connected party; the alternatives are URI only if available, or URI and DN (blended) if available[^55]. WarmTransfer's reading of the sources is that ILS and GDPR only replicate dial plan data; intercluster calls still travel over SIP trunks selected by SIP route patterns, so a working ILS catalog does not by itself make intercluster calls succeed[^23].

## SIP Trunk Configuration and Security

Cisco's SIP trunk task flow is: configure SIP profiles, then the SIP trunk security profile, then the SIP trunk[^53]. A Unified CM SIP trunk can have up to 16 destination addresses, given as IPv4, IPv6, FQDN or a DNS SRV record[^52]. Several non-secure SIP trunks that point at the same destination with different listening ports can misroute mid-call INVITEs and drop calls[^44]. With more than 4 clusters, the Preferred Architecture suggests Session Management Edition to centralise the dial plan and trunking instead of a full mesh of SIP trunks[^43].

A SIP trunk security profile sets Device Security Mode to Non Secure, Authenticated (integrity and authentication) or Encrypted (integrity, authentication and signaling encryption)[^45]. The default incoming port for SIP over TLS on a Unified CM SIP trunk security profile is 5061[^46]. 2 SIP trunks cannot share the same X.509 subject name and incoming port combination[^49]. SIP trunk security profiles have separate checkboxes to accept out-of-dialog REFER, unsolicited NOTIFY, and new dialogs with a Replaces header[^47]. If SRTP Allowed is checked on a trunk with a non-encrypted security profile, SRTP keys are exposed in signaling and traces; Cisco recommends an encrypted TLS profile[^48].

For a SIP TLS trunk between 2 clusters, each cluster's SIP trunk security profile X.509 Subject Name must match the Common Name of the remote cluster's CallManager certificate[^51]. For an intercluster SIP TLS trunk with CA-signed certificates, the CA root goes into CallManager-trust and the signed CSR is uploaded as the CallManager certificate on each cluster[^50]. WarmTransfer's reading of the sources is that ILS peering and intercluster SIP TLS trunks depend on different certificate families (Tomcat for ILS, CallManager for the SIP trunk), so fixing 1 trust store does not fix the other[^1].

## Trunk Status Monitoring

SIP OPTIONS ping is turned on in the SIP profile applied to the trunk (Device > Device Settings > SIP Profile), and it is what lets Unified CM report trunk status[^39]. Without OPTIONS ping, a SIP trunk's Status, Status Reason and Duration show N/A[^40].

When active, specific local status reasons indicate failure modes:
- Trunk status reason Local=1 means no response came back to OPTIONS after all retries over UDP; check that the remote CallManager service is running, that the remote trunk's incoming port matches, and basic reachability[^36].
- Trunk status reason Local=2 means Unified CM could not open a socket connection to the remote peer[^37].
- Trunk status reason Local=3 means the DNS server is unreachable or DNS cannot resolve the trunk's hostname or SRV record[^38].

## See also

- See also [Unified CM SIP trunks and security profiles](https://warmtransfer.net/knowledge/cucm-sip-trunks).
- See also [Unified CM dial plan partitions and calling search spaces](https://warmtransfer.net/knowledge/cucm-dial-plan).
- See also [Unified CM route patterns and partitions configuration](https://warmtransfer.net/knowledge/cucm-config-route-patterns-and-partitions).

## Applicability

Applies to: Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. Deployments: on-premises. Sources checked 2026-09-25.

## What remains uncertain

- Observed ILS TLS failures after upgrade to 15SU5 when Tomcat client cert differs from server cert are not covered by the sources below.
- A complete list of SIP trunk status reason codes (Local= and Remote= values) is not covered by the sources below.
- What triggers GDPR PSTN failover (cause codes and timers) on intercluster calls is not covered by the sources below.
- A current SRND or design guide chapter on ILS route strings and multi-cluster dial plan is not covered by the sources below.
- The ILS synchronization interval default and range and replication latency are not covered by the sources below.
- The status of H.323 intercluster trunks (gatekeeper and non-gatekeeper) in Release 15 release notes is not covered by the sources below.
- ILS ports in the Release 15 TCP and UDP port usage guide are not covered by the sources below.
- Intercluster enhanced locations CAC and LBM hub replication over intercluster trunks are not covered by the sources below.

## Sources

[^1]: ILS peering and intercluster SIP TLS trunks depend on different certificate families (Tomcat for ILS, CallManager for the SIP trunk), so fixing one trust store does not fix the other (inferred). Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > TLS authentication (Tomcat), read with tech note 200180 certificate steps (CallManager). Checked 2026-09-25.
[^2]: A caller can dial a directory URI only if the URI's partition is in the caller's calling search space. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Interactions and Restrictions. Checked 2026-09-25.
[^3]: GDPR advertises directory URIs, enterprise and E.164 alternate numbers, advertised patterns, PSTN failover numbers and route strings, and can also carry dial plan data imported from non-ILS systems. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Global Dial Plan Replication Overview (dial plan elements). Checked 2026-09-25.
[^4]: The ILS Configuration window has an Exchange Global Dial Plan Replication Data with Remote Clusters checkbox, which turns on GDPR data exchange for that cluster. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure ILS (ILS Configuration window fields). Checked 2026-09-25.
[^5]: The ILS Max Number of Learned Objects in Database service parameter defaults to 100,000 and can be set as high as 1,000,000. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Set Database Limits. Checked 2026-09-25.
[^6]: Learned GDPR data goes into four predefined partitions: Global Learned Enterprise Numbers, Global Learned E.164 Numbers, Global Learned Enterprise Patterns and Global Learned E.164 Patterns; learned numbers cannot be assigned to a NULL partition. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Assign Partitions for Learned Numbers and Patterns. Checked 2026-09-25.
[^7]: Global Dial Plan Replication (GDPR) uses ILS as its transport and replicates global dial plan data to the remote clusters in the ILS network, so ILS must be configured first. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Overview; Prerequisites. Checked 2026-09-25.
[^8]: A GDPR PSTN failover number gives an alternate route when a call to a global dial plan element fails over the VoIP path. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > PSTN Failover. Checked 2026-09-25.
[^9]: Route strings identify each dial plan element's home cluster, and each remote cluster needs SIP route patterns that route learned route strings back to their home clusters. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Route Strings; Configure SIP Route Patterns. Checked 2026-09-25.
[^10]: The SIP route patterns that match GDPR route strings use the Domain Routing pattern usage. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Configure SIP Route Patterns. Checked 2026-09-25.
[^11]: Cisco's GDPR task flow is: enable ILS support, configure SIP profiles, configure SIP trunks, configure SIP route patterns, set database limits and assign partitions, then optionally set advertised patterns, block learned patterns and import dial plan data, and finally provision dial plan data. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Global Dial Plan Replication Configuration Task Flow. Checked 2026-09-25.
[^12]: From Release 15, H.323 gatekeeper-controlled trunk options are discontinued; Cisco recommends SIP trunks with Location Bandwidth Manager instead. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > H.323 trunk notes. Checked 2026-09-25.
[^13]: From Release 15SU5, if the Tomcat server and Tomcat client certificates differ, both certificates must be uploaded to the peer trust store for ILS TLS. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure ILS > Use TLS Certificates (note). Checked 2026-09-25.
[^14]: A TLS-authenticated ILS network that exchanged only the Tomcat server certificate may lose peering after an upgrade to 15SU5 or later if a separate Tomcat client certificate is in use (inferred). Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure ILS > Use TLS Certificates (note). Checked 2026-09-25.
[^15]: ILS supports TLS certificate authentication and password authentication, and the two can be used together. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure ILS > ILS Authentication (Use TLS Certificates / Use Password). Checked 2026-09-25.
[^16]: An ILS network supports up to 10 hub clusters with 20 spoke clusters per hub, to a maximum of 200 clusters in total. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Overview (network sizing). Checked 2026-09-25.
[^17]: A spoke that has not imported the hub's Tomcat certificate reports Certificate verification failed (Verification error:18) when it tries to join ILS. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > missing hub certificate on spoke. Checked 2026-09-25.
[^18]: When ILS password authentication fails, the tech note shows DecryptData failed errors and an ILSPwdAuthenticationFailed alarm; the fix is to configure the same password on hub and spoke. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > Password authentication. Checked 2026-09-25.
[^19]: An ILS join that fails with a self-signed certificate verification error is fixed by importing the remote cluster's Tomcat certificate into the tomcat-trust store, or by using TLS with CA-signed certificates. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > TLS authentication. Checked 2026-09-25.
[^20]: A hub that lacks a spoke's Tomcat certificate logs that the certificate is not in the local store and the FQDN is not in the peer info vector. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > missing spoke certificate on hub. Checked 2026-09-25.
[^21]: In an ILS network, hub clusters form the backbone and use automesh to build a full mesh among themselves. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Overview > hub clusters. Checked 2026-09-25.
[^22]: Cisco cautions that hub clusters need enough CPU to handle the ILS load of their spokes. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Overview (hub sizing note). Checked 2026-09-25.
[^23]: ILS and GDPR only replicate dial plan data; intercluster calls still travel over SIP trunks selected by SIP route patterns, so a working ILS catalog does not by itself make intercluster calls succeed (inferred). Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Task Flow (SIP trunk and SIP route pattern steps); Route Strings. Checked 2026-09-25.
[^24]: Third-party systems cannot connect directly to an ILS network. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS restrictions. Checked 2026-09-25.
[^25]: An ILS spoke cluster can have only one hub cluster. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS restrictions. Checked 2026-09-25.
[^26]: The ILS joining tech note gives TCP port 7501 for TLS-authenticated ILS and 7502 for password-authenticated ILS. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Configure and Troubleshoot Joining Clusters for ILS > ports noted in the configuration methods. Checked 2026-09-25.
[^27]: The ILS service runs only on the Unified CM publisher node. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS restrictions. Checked 2026-09-25.
[^28]: The Intercluster Lookup Service (ILS) lets remote Unified CM clusters form a multi-cluster network that shares data, without an administrator configuring each connection between clusters by hand. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Overview. Checked 2026-09-25.
[^29]: The ILS Remote Cluster configuration covers services for remote clusters such as Extension Mobility Cross Cluster, TFTP and RSVP Agent. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure Remote Cluster Services. Checked 2026-09-25.
[^30]: An ILS spoke cluster connects only to its local hub cluster and never contacts other hub or spoke clusters directly. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Overview > spoke clusters. Checked 2026-09-25.
[^31]: Cisco's ILS task flow is: configure Cluster IDs, configure ILS starting with the hub cluster, verify that ILS is running, then configure the Remote Cluster view. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > ILS Configuration Task Flow. Checked 2026-09-25.
[^32]: If you choose TLS authentication for ILS, the Release 15 guide says you must also exchange CA-signed certificates between the nodes. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure ILS > Use TLS Certificates. Checked 2026-09-25.
[^33]: For ILS troubleshooting, the tech note sets the Cisco Intercluster Lookup Service trace to detailed and collects from activelog /cm/trace/ils/sdl/. Source: [Configure and Troubleshoot Joining Clusters for ILS](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200694-Configure-and-Troubleshoot-Joining-Clust.html), Troubleshoot > traces. Checked 2026-09-25.
[^34]: Every cluster in an ILS network needs a unique Cluster ID, and ILS does not work if remote clusters keep the default Cluster ID StandAloneCluster. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Configure Cluster IDs. Checked 2026-09-25.
[^35]: To check that ILS is running, look at the ILS Clusters and Global Dial Plan Imported Catalogs section under Advanced Features > ILS Configuration on a cluster's publisher. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Intercluster Lookup Service](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010100.html), Configure Intercluster Lookup Service > Verify ILS Is Running. Checked 2026-09-25.
[^36]: Trunk status reason Local=1 means no response came back to OPTIONS after all retries over UDP; check that the remote CallManager service is running, that the remote trunk's incoming port matches, and basic reachability. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Scenario Local=1. Checked 2026-09-25.
[^37]: Trunk status reason Local=2 means Unified CM could not open a socket connection to the remote peer. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Scenario Local=2. Checked 2026-09-25.
[^38]: Trunk status reason Local=3 means the DNS server is unreachable or DNS cannot resolve the trunk's hostname or SRV record. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Scenario Local=3. Checked 2026-09-25.
[^39]: SIP OPTIONS ping is turned on in the SIP profile applied to the trunk (Device > Device Settings > SIP Profile), and it is what lets Unified CM report trunk status. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Configure > SIP Profile; Verify. Checked 2026-09-25.
[^40]: Without OPTIONS ping, a SIP trunk's Status, Status Reason and Duration show N/A. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Verify. Checked 2026-09-25.
[^41]: Cisco's Collaboration 14 Preferred Architecture recommends connecting individual Unified CM clusters with a full mesh of SIP trunks. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), Call Control > multi-cluster deployments. Checked 2026-09-25.
[^42]: The Preferred Architecture says ILS is required between all Unified CM clusters in a multi-cluster deployment because GDPR uses it as transport. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), Call Control > dial plan > GDPR. Checked 2026-09-25.
[^43]: With more than four clusters, the Preferred Architecture suggests Session Management Edition to centralise the dial plan and trunking instead of a full mesh of SIP trunks. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), Call Control > multi-cluster deployments (SME). Checked 2026-09-25.
[^44]: Several non-secure SIP trunks that point at the same destination with different listening ports can misroute mid-call INVITEs and drop calls. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > SIP trunk restrictions. Checked 2026-09-25.
[^45]: A SIP trunk security profile sets Device Security Mode to Non Secure, Authenticated (integrity and authentication) or Encrypted (integrity, authentication and signaling encryption). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SIP Trunk Security Profile Settings > Device Security Mode. Checked 2026-09-25.
[^46]: The default incoming port for SIP over TLS on a Unified CM SIP trunk security profile is 5061. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SIP Trunk Security Profile Settings > Incoming Port. Checked 2026-09-25.
[^47]: SIP trunk security profiles have separate checkboxes to accept out-of-dialog REFER, unsolicited NOTIFY, and new dialogs with a Replaces header. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SIP Trunk Security Profile Settings (authorization checkboxes). Checked 2026-09-25.
[^48]: If SRTP Allowed is checked on a trunk with a non-encrypted security profile, SRTP keys are exposed in signaling and traces; Cisco recommends an encrypted TLS profile. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SRTP Allowed caution. Checked 2026-09-25.
[^49]: Two SIP trunks cannot share the same X.509 subject name and incoming port combination. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SIP Trunk Security Profile Settings > X.509 Subject Name. Checked 2026-09-25.
[^50]: For an intercluster SIP TLS trunk with CA-signed certificates, the CA root goes into CallManager-trust and the signed CSR is uploaded as the CallManager certificate on each cluster. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Configure > certificate steps. Checked 2026-09-25.
[^51]: For a SIP TLS trunk between two clusters, each cluster's SIP trunk security profile X.509 Subject Name must match the Common Name of the remote cluster's CallManager certificate. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Configure > SIP Trunk Security Profile (X.509 Subject Name). Checked 2026-09-25.
[^52]: A Unified CM SIP trunk can have up to 16 destination addresses, given as IPv4, IPv6, FQDN or a DNS SRV record. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > SIP Trunk Overview (destination addresses). Checked 2026-09-25.
[^53]: Cisco's SIP trunk task flow is: configure SIP profiles, then the SIP trunk security profile, then the SIP trunk. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > SIP Trunk Configuration Task Flow. Checked 2026-09-25.
[^54]: By default the user portion of a directory URI is case-sensitive; the URI Lookup Policy setting changes this. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Interactions and Restrictions (URI Lookup Policy). Checked 2026-09-25.
[^55]: The SIP trunk Calling and Connected Party Info Format setting defaults to Deliver DN only in connected party; the alternatives are URI only if available, or URI and DN (blended) if available. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Configure SIP Trunks for URI dialing (Calling and Connected Party Info Format). Checked 2026-09-25.
[^56]: A directory number can carry up to five line-based directory URIs, in addition to the user-based URI. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Directory URIs. Checked 2026-09-25.
[^57]: The SIP profile option Send ILS Learned Destination Route String can be enabled to route intercluster calls across a Cisco Unified Border Element. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Configure SIP Profiles for ILS > Trunk-Specific Configuration. Checked 2026-09-25.
[^58]: For ILS-based URI routing, the SIP profile's Use Fully Qualified Domain Name in SIP Requests option must be enabled. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Configure SIP Profiles for ILS. Checked 2026-09-25.
[^59]: The user portion of a directory URI can be at most 47 characters. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Global Dial Plan Replication](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010101.html), Configure Global Dial Plan Replication > Directory URI format. Checked 2026-09-25.