# Troubleshooting Unified CM SIP trunks that show No Service

Canonical: https://warmtransfer.net/knowledge/cucm-sip-trunk-no-service-troubleshooting

Last verified: 2026-10-02

Cisco's SIP trunk failure technote describes a Unified CM SIP trunk in No Service as one that cannot establish successful communication with the peer end[^23]. When OPTIONS ping is enabled in the SIP Profile, Unified CM sends SIP OPTIONS messages to the trunk peer, and a successful response indicates the trunk is in service[^26].

## How trunk state is determined

OPTIONS ping is enabled in Cisco Unified CM Administration under Device > Device Settings > SIP Profile. The SIP Profile is then applied to the trunk under Device > Trunk[^27]. With OPTIONS ping enabled, each Unified CM node running the trunk's SIP daemon periodically sends an OPTIONS request to each of the trunk's destination IP addresses[^28]. The trunk setting Run on All Active Unified CM Nodes enables the trunk on all call processing nodes in the cluster[^38]. A Unified CM Release 15 SIP trunk can have up to 16 destination addresses (IPv4, IPv6 or FQDN) or a single DNS SRV record[^21].

Cisco's design guidance considers a trunk destination address out of service in any of these cases[^24]:

- It does not respond to an OPTIONS request.
- It answers 503 Service Unavailable or 408 Request Timeout.
- A TCP connection to it cannot be established.

The SIP trunk is considered in service when at least one node receives a response other than 408 or 503 from at least one destination address[^18]. When all destinations of a SIP trunk are unreachable, Unified CM considers the SIP trunk out of service[^2]. With OPTIONS ping enabled, Unified CM sends trunk calls only to destinations it has found reachable[^4].

Cisco recommends enabling SIP OPTIONS ping on all SIP trunks, so that Unified CM tracks trunk state dynamically rather than per call and by timeout[^29]. WarmTransfer's reading of the sources is that a far end answering OPTIONS with an error other than 408 or 503, such as 404 or 405, would still keep the destination in service under the documented in-service rule[^22].

See also [SIP OPTIONS pings and trunk keepalives](https://warmtransfer.net/knowledge/sip-options-keepalive).

## Status Reason codes

In the failure scenarios of Cisco's technote, the trunk Status shows down and the Status Reason shows local=1, local=2 or local=3[^42].

| Status Reason | Meaning | Cisco's recommended checks |
|---|---|---|
| Local=1 | No responses were received to the OPTIONS request after all retries, where the originating side's SIP Trunk Security Profile transport is UDP[^35] | If the peer is another Unified CM, confirm the Cisco CallManager service there is activated and started. Confirm the remote trunk's incoming port matches the originating destination port. Test with `utils network ping`[^14][^17][^15] |
| Local=2 | Unified CM is not able to create a socket connection with the remote peer[^36] | If the peer is another Unified CM, confirm the Cisco CallManager service there is activated and started. Confirm the remote trunk's incoming port matches the originating destination port. Test with `utils network ping`[^14][^17][^15] |
| Local=3 | The DNS server is not reachable, or DNS is not configured to resolve the hostname or SRV record configured on the local SIP trunk[^37] | Review DNS under Show > Network. Correct the DNS server with `set network dns primary`. Test with `utils network ping`[^16][^15] |

WarmTransfer's reading of the sources is that a TCP or TLS trunk whose peer is unreachable is more likely to show Local=2 than Local=1. The reason is that Cisco documents Local=1 only for UDP and lists TCP connect failure as a separate out-of-service trigger[^20].

When all remote peers of a SIP trunk are out of service, Unified CM raises the alarm UC_CALLMANAGER-3-SIPTrunkOOS, stating that all remote peers are out of service and unable to handle calls[^1].

See also [Unified CM RTMT alerts and monitoring](https://warmtransfer.net/knowledge/cucm-rtmt-alerts).

## Diagnosing it

1. Confirm that the trunk's SIP Profile has OPTIONS ping enabled and is applied to the trunk under Device > Trunk[^27].
2. Read the Status Reason and match it to the table above[^42].
3. Check network connectivity from the originating Unified CM with `utils network ping` followed by the remote peer address[^15].
4. For Local=1 and Local=2, confirm that the remote side has a SIP trunk whose SIP Trunk Security Profile incoming port matches the destination port configured on the originating trunk[^17].
5. For Local=3, review DNS settings in Cisco Unified OS Administration under Show > Network, and correct the DNS server with `set network dns primary`[^16].

A successful ICMP ping does not settle the question. WarmTransfer's reading of the sources is that a trunk can show No Service while `utils network ping` to the peer succeeds. OPTIONS ping also fails on 503 or 408 answers, on TCP connect failure, and on a wrong destination port, and ICMP tests none of these[^34].

### Ports and transport

The default Incoming Port in a SIP Trunk Security Profile is 5060 for TCP and UDP[^30]. For TLS, the default Incoming Port is 5061[^31]. All SIP trunks that use TLS can share one incoming port, and all SIP trunks that use TCP+UDP can share one incoming port[^33]. SIP TLS trunks and non-TLS SIP trunks cannot be mixed on the same incoming port[^32]. The same X.509 subject name and incoming port combination cannot be assigned to different SIP trunks[^44].

With Device Security Mode Non Secure, the incoming transport is TCP+UDP. With Authenticated or Encrypted, the transport is TLS[^50]. Cisco advises using UDP as the outgoing transport only when connecting to systems or applications that do not support TCP[^51].

See also [Unified CM SIP trunks and security profiles](https://warmtransfer.net/knowledge/cucm-sip-trunks).

## TLS trunks

The SIP Trunk Security Profile offers three Device Security Mode settings:

- Non Secure applies no security features except image authentication[^41].
- Authenticated opens a TLS connection that uses NULL/SHA[^39].
- Encrypted opens a TLS connection that uses AES128/SHA for signaling[^40].

The X.509 Subject Name field takes the Subject or Subject Alternate Name of the remote SIP trunk device's certificate, for device authentication[^53]. Multiple names can be entered in that field, separated by a space, comma, semicolon or colon[^52].

For a CA-signed SIP TLS trunk, Cisco's example uploads the root and subordinate CA certificates as CallManager-trust under Cisco Unified OS Administration > Security > Certificate Management > Upload Certificate/Certificate Chain[^45]. Cisco verifies a SIP TLS trunk with a packet capture showing this sequence: TCP SYN, Client Hello, server certificate exchange, and then encrypted Application Data, which shows the TLS session is established[^47]. Cisco advises comparing the certificate serial number and subject seen in the capture with the certificates shown in OS Administration Certificate Management, to confirm which certificate is in use[^48]. Unified CM traces for a SIP TLS trunk contain SIPCertificateInd messages that show the peer X509SubjectName and cipher details[^49].

WarmTransfer's reading of the sources is that an untrusted far-end certificate or an X.509 Subject Name mismatch stops the TLS session before OPTIONS can be exchanged. OPTIONS ping then cannot succeed, and the trunk stays out of service[^46].

See also [SIP TLS handshake failures on trunks](https://warmtransfer.net/knowledge/sip-tls-handshake-failures).

## CUBE as the far end

In Cisco's CUCM-to-CUBE example, CUBE is configured with `voice-class sip options-keepalive` on the dial-peer so that OPTIONS are exchanged in both directions[^8]. On CUBE (IOS XE 17.6 onwards), the options-keepalive defaults are:

- up-interval: 60 seconds[^11]
- down-interval: 30 seconds[^6]
- retry count: 5[^9]

For DNS SRV destinations, CUBE marks a destination busyout if it receives a 503 response or no response to the INVITE, and then tries the next active destination[^5]. From the sources, we infer that CUBE tracks options-keepalive state for its dial-peers separately from Unified CM's SIP trunk status, so one side can show the trunk up while the other shows it down[^7].

See also [Unified CM SIP trunk to CUBE configuration](https://warmtransfer.net/knowledge/cucm-config-sip-trunk-to-cube).

## Unity Connection as the far end

For a Unified CM SIP trunk to Unity Connection, Cisco recommends keeping the default destination port 5060[^12]. For a secure trunk to Unity Connection, the X.509 Subject Name in the SIP Trunk Security Profile must match the Unity Connection server FQDN[^13].

See also [Cisco Unity Connection voicemail and migration](https://warmtransfer.net/knowledge/cucm-unity-connection).

## Applicability

Applies to: Cisco Unified Communications Manager, Cisco Unified Border Element, and Cisco Unity Connection. Deployments: on-premises. Sources checked 2026-10-02. Cisco's SIP trunk failure technote, the source for the Local=1, Local=2 and Local=3 scenarios, was updated 2018-09-26 and does not state a release[^23][^42]. The SIP Profile steps for enabling OPTIONS ping come from a technote written against CUCM 12.0[^27]. The in-service and out-of-service rules for OPTIONS ping come from Release 8.5(1) and 8.6(1) design guidance, and later releases are not verified against them[^24][^18]. The 16-destination limit, the Run on All Active Unified CM Nodes setting, and the SIP Trunk Security Profile settings are documented for Release 15 and SUs[^21][^38][^30]. The CA-signed SIP TLS trunk procedure is documented for CUCM 9.1(2) and 10.5(2)[^45]. The CUBE options-keepalive defaults apply to IOS XE 17.6 onwards[^11]. The Unity Connection guidance is from the Release 15 integration guide[^12].

## What remains uncertain

Status Reason codes of the Remote=xxx form, such as remote=503 or remote=404, and the causes Cisco lists for them are not covered by the sources below. The SIP Profile OPTIONS ping field names and defaults in Release 15 are not covered by the sources below. These include the in-service interval, out-of-service interval, retry timer and retry count. Cisco's technote describes No Service as a trunk that cannot establish successful communication with the peer end[^23]. The definitions of the Full Service, Partial Service and Unknown status values are not covered by the sources below. Unified CM raises UC_CALLMANAGER-3-SIPTrunkOOS when all remote peers of a SIP trunk are out of service[^1]. The RTMT alert definitions for SIPTrunkOOS, SIPTrunkPartiallyISV and SIPTrunkISV are not covered by the sources below. Which Status Reason a TLS certificate or subject-name failure produces is not covered by the sources below. The current Collaboration SRND trunks chapter wording on SIP OPTIONS ping is not covered by the sources below. The behaviour of Expressway or VCS as a far end answering OPTIONS from Unified CM is not covered by the sources below. Route list and route group behaviour when a member trunk is out of service is not covered by the sources below.

## Sources

[^1]: When all remote peers of a SIP trunk are out of service Unified CM raises the alarm UC_CALLMANAGER-3-SIPTrunkOOS, stating that all remote peers are out of service and unable to handle calls. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Verify / Troubleshoot (alarm message example). Checked 2026-10-02.
[^2]: When all destinations of a SIP trunk are unreachable, Unified CM considers the SIP trunk out of service. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^3]: After changing a SIP Trunk Security Profile, Apply Config resets the associated trunk so the change takes effect. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Configure SIP Trunk Security Profile / Apply SIP Trunk Security Profile procedure. Checked 2026-10-02.
[^4]: With OPTIONS ping enabled, Unified CM sends trunk calls only to destinations it has found reachable. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^5]: For DNS SRV destinations, CUBE marks a destination busyout if it receives a 503 response or no response to the INVITE and tries the next active destination. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), OPTIONS Ping for DNS SRV Hosts. Checked 2026-10-02.
[^6]: On CUBE (IOS XE 17.6 onwards) the options-keepalive down-interval defaults to 30 seconds. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Configure SIP Out-of-Dialog OPTIONS Ping Group, step 7. Checked 2026-10-02.
[^7]: CUBE's options-keepalive state for its dial-peers is tracked separately from Unified CM's SIP trunk status, so one side can show the trunk up while the other shows it down (inferred). Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Overview (combined with technote 214218 Configure section). Checked 2026-10-02.
[^8]: In Cisco's CUCM-to-CUBE example, CUBE is configured with voice-class sip options-keepalive on the dial-peer so that OPTIONS are exchanged in both directions. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Configure > CUBE configuration. Checked 2026-10-02.
[^9]: On CUBE (IOS XE 17.6 onwards) the options-keepalive retry count defaults to 5. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Configure SIP Out-of-Dialog OPTIONS Ping Group, step 9. Checked 2026-10-02.
[^10]: On CUBE, show dial-peer voip keepalive status with a dial-peer tag shows keepalive state per session target and server group, and show dial-peer voice summary shows keepalive status at dial-peer level. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Verify / OPTIONS Ping for DNS SRV Hosts. Checked 2026-10-02.
[^11]: On CUBE (IOS XE 17.6 onwards) the options-keepalive up-interval defaults to 60 seconds. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - SIP Trunk Monitoring](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_oodo-ping-group.html), Configure SIP Out-of-Dialog OPTIONS Ping Group, step 8. Checked 2026-10-02.
[^12]: For a Unified CM SIP trunk to Unity Connection, Cisco recommends keeping the default destination port 5060. Source: [Cisco Unified Communications Manager SIP Integration Guide for Cisco Unity Connection Release 15 - Setting Up a Cisco Unified Communications Manager SIP Trunk Integration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/15/integration/cucm_sip/b_15cucintcucmsip/b_14cucintcucmsip_chapter_010.html), Setting Up a Cisco Unified CM SIP Trunk Integration > SIP trunk destination. Checked 2026-10-02.
[^13]: For a secure Unified CM SIP trunk to Unity Connection, the X.509 Subject Name in the SIP Trunk Security Profile must match the Unity Connection server FQDN. Source: [Cisco Unified Communications Manager SIP Integration Guide for Cisco Unity Connection Release 15 - Setting Up a Cisco Unified Communications Manager SIP Trunk Integration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/15/integration/cucm_sip/b_15cucintcucmsip/b_14cucintcucmsip_chapter_010.html), Setting Up a Cisco Unified CM SIP Trunk Integration > SIP trunk security profile. Checked 2026-10-02.
[^14]: For Local=1 and Local=2 where the remote peer is another Unified CM, Cisco says to check in the remote peer's Serviceability under Tools > Control Center (Feature Services) that the Cisco CallManager service is activated and started. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 1 and Scenario 2 recommended actions. Checked 2026-10-02.
[^15]: Cisco recommends checking network connectivity to the remote peer from the originating Unified CM with the CLI command utils network ping followed by the remote peer address. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenarios 1 to 3 recommended actions. Checked 2026-10-02.
[^16]: For Local=3, Cisco says to review DNS settings in Cisco Unified OS Administration under Show > Network and to correct the DNS server with the CLI command set network dns primary. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 3 recommended actions. Checked 2026-10-02.
[^17]: For Local=1 and Local=2, Cisco says to check that the remote side has a SIP trunk whose SIP Trunk Security Profile incoming port matches the destination port configured on the originating trunk. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 1 and Scenario 2 recommended actions. Checked 2026-10-02.
[^18]: The SIP trunk is considered in service when at least one node receives a response other than 408 or 503 from at least one destination address. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^19]: Unified CM SIP trunk daemons accept inbound calls only from end systems whose IP addresses are defined in the trunk's destination address fields. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide 8.6(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_6_1/trunks.html), SIP trunk section (inbound call acceptance). Checked 2026-10-02.
[^20]: Because Cisco documents Local=1 only for UDP and lists TCP connect failure as a separate out-of-service trigger, a TCP or TLS trunk whose peer is unreachable is more likely to show Local=2 than Local=1 (inferred). Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenarios 1 and 2. Checked 2026-10-02.
[^21]: A Unified CM Release 15 SIP trunk can have up to 16 destination addresses (IPv4, IPv6 or FQDN) or a single DNS SRV record. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > SIP Trunk Overview. Checked 2026-10-02.
[^22]: Under the documented in-service rule, a far end that answers OPTIONS with an error other than 408 or 503 (for example 404 or 405) would still keep the destination in service (inferred). Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^23]: Cisco's SIP trunk failure technote describes a Unified CM SIP trunk in No Service as one that cannot establish successful communication with the peer end. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Background Information. Checked 2026-10-02.
[^24]: With SIP OPTIONS ping, a trunk destination address is considered out of service if it does not respond to an OPTIONS request, answers 503 Service Unavailable or 408 Request Timeout, or a TCP connection cannot be established. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^25]: Cisco's CUCM-to-CUBE OPTIONS ping technote states that the OPTIONS messages are exchanged every 60 seconds by default. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Verify. Checked 2026-10-02.
[^26]: When OPTIONS ping is enabled in the SIP Profile, Unified CM sends SIP OPTIONS messages to the trunk peer and a successful response indicates the trunk is in service. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Background Information. Checked 2026-10-02.
[^27]: OPTIONS ping is enabled in Cisco Unified CM Administration under Device > Device Settings > SIP Profile, and the SIP Profile is then applied to the trunk under Device > Trunk. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Configure > SIP Profile configuration. Checked 2026-10-02.
[^28]: With OPTIONS ping enabled, each Unified CM node running the trunk's SIP daemon periodically sends an OPTIONS request to each of the trunk's destination IP addresses. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^29]: Cisco recommends enabling SIP OPTIONS ping on all SIP trunks so Unified CM tracks trunk state dynamically rather than per call and by timeout. Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping. Checked 2026-10-02.
[^30]: The default Incoming Port in a SIP Trunk Security Profile is 5060 for TCP and UDP. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Incoming Port. Checked 2026-10-02.
[^31]: The default Incoming Port for TLS in a SIP Trunk Security Profile is 5061. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Incoming Port. Checked 2026-10-02.
[^32]: SIP TLS trunks and non-TLS SIP trunks cannot be mixed on the same incoming port. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Incoming Port. Checked 2026-10-02.
[^33]: All SIP trunks that use TLS can share one incoming port, and all SIP trunks that use TCP+UDP can share one incoming port. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Incoming Port. Checked 2026-10-02.
[^34]: A trunk can show No Service while utils network ping to the peer succeeds, because OPTIONS ping also fails on 503 or 408 answers, on TCP connect failure and on a wrong destination port, none of which ICMP tests (inferred). Source: [Cisco Unified Communications Manager Trunks (Session Management Edition deployment guide, Release 8.5(1))](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/session_mgmt/deploy/8_5_1/trunks.html), SIP OPTIONS Ping (combined with technote 213718 Troubleshoot section). Checked 2026-10-02.
[^35]: Status Reason Local=1 means no responses were received to the OPTIONS request after all retries when the transport in the SIP Trunk Security Profile on the originating side is UDP. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 1 (Local=1). Checked 2026-10-02.
[^36]: Status Reason Local=2 means Unified CM is not able to create a socket connection with the remote peer. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 2 (Local=2). Checked 2026-10-02.
[^37]: Status Reason Local=3 means the DNS server is not reachable or DNS is not configured to resolve the hostname or SRV record configured on the local SIP trunk. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot > Scenario 3 (Local=3). Checked 2026-10-02.
[^38]: The SIP trunk setting Run on All Active Unified CM Nodes enables the trunk on all call processing nodes in the cluster. Source: [System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_01000.html), Configure Trunks > Configure SIP Trunk (Run on All Active Unified CM Nodes). Checked 2026-10-02.
[^39]: In a SIP Trunk Security Profile, Device Security Mode Authenticated opens a TLS connection that uses NULL/SHA. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Device Security Mode. Checked 2026-10-02.
[^40]: In a SIP Trunk Security Profile, Device Security Mode Encrypted opens a TLS connection that uses AES128/SHA for signaling. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Device Security Mode. Checked 2026-10-02.
[^41]: In a SIP Trunk Security Profile, Device Security Mode Non Secure applies no security features except image authentication. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Device Security Mode. Checked 2026-10-02.
[^42]: In the failure scenarios of Cisco's technote, the trunk Status shows down and the Status Reason shows local=1, local=2 or local=3. Source: [Calls through Session Initiation Protocol (SIP) Trunk Failure](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213718-calls-through-session-initiation-protoco.html), Troubleshoot (introductory paragraph). Checked 2026-10-02.
[^43]: The SIP trunk configuration page shows Status, Status Reason and Duration fields; Cisco's technote shows them as N/A before OPTIONS ping is enabled. Source: [Configure Options Ping Between CUCM and CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/214218-configure-options-ping-between-cucm-and.html), Verify (screenshots before and after configuration). Checked 2026-10-02.
[^44]: The same X.509 subject name and incoming port combination cannot be assigned to different SIP trunks. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > X.509 Subject Name. Checked 2026-10-02.
[^45]: For a CA-signed SIP TLS trunk, Cisco's example uploads the root and subordinate CA certificates as CallManager-trust under Cisco Unified OS Administration > Security > Certificate Management > Upload Certificate/Certificate Chain. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Configure > upload CA certificates as CallManager-trust. Checked 2026-10-02.
[^46]: On a TLS trunk, an untrusted far-end certificate or an X.509 Subject Name mismatch stops the TLS session before OPTIONS can be exchanged, so OPTIONS ping cannot succeed and the trunk stays out of service (inferred). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > X.509 Subject Name (combined with 213718 Local=2 description). Checked 2026-10-02.
[^47]: Cisco's verification for a SIP TLS trunk is a packet capture showing TCP SYN, Client Hello, server certificate exchange and then encrypted Application Data, which shows the TLS session is established. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Verify. Checked 2026-10-02.
[^48]: Cisco advises comparing the certificate serial number and subject seen in the packet capture with the certificates shown in OS Administration Certificate Management to confirm which certificate is in use. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Verify. Checked 2026-10-02.
[^49]: Unified CM traces for a SIP TLS trunk contain SIPCertificateInd messages that show the peer X509SubjectName and cipher details. Source: [Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200180-Configure-SIP-TLS-Trunk-on-the-Communica.html), Verify (CUCM traces). Checked 2026-10-02.
[^50]: With Device Security Mode Non Secure the incoming transport is TCP+UDP; with Authenticated or Encrypted the transport is TLS. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Incoming Transport Type. Checked 2026-10-02.
[^51]: Cisco advises using UDP as the outgoing transport only when connecting to systems or applications that do not support TCP. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > Outgoing Transport Type. Checked 2026-10-02.
[^52]: Multiple names can be entered in the X.509 Subject Name field, separated by a space, comma, semicolon or colon. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > X.509 Subject Name. Checked 2026-10-02.
[^53]: The X.509 Subject Name field of a SIP Trunk Security Profile takes the Subject or Subject Alternate Name of the remote SIP trunk device's certificate, for device authentication. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), SIP Trunk Security Profile Settings > X.509 Subject Name. Checked 2026-10-02.