Unified CM SIP trunks and security profiles
Verified 2026-09-24 · 49 sources · tier 2
Unified CM SIP trunks connect Unified CM to external devices such as SIP gateways, SIP proxy servers, UC applications, conference bridges, remote clusters, or a Session Management Edition 39. A SIP trunk takes on the settings of its assigned security profile, or Unified CM assigns a nonsecure profile by default if none is selected 1043.
How it works
A Unified CM SIP trunk supports up to 16 destination addresses, configured as IPv4 or IPv6 addresses, fully qualified domain names, or a single DNS SRV record 33. Administrators can enable the trunk across all cluster nodes by checking Run on All Active Unified CM Nodes 40. After a security profile is assigned to a trunk and saved, the trunk is reset using Apply Config 4. A SIP trunk security profile assigned to a device cannot be deleted 5.
In Unified CM Release 15, the documented trunk configuration task flow specifies configuring SIP profiles first, followed by the SIP trunk security profile, and then the SIP trunks 7. From Unified CM Release 15 onward, H.323 Gatekeeper Control options are no longer available 17.
Security profile parameters and transport
The incoming transport type follows the device security mode configured in the profile: TCP+UDP when the mode is Non Secure, and TLS when the mode is Authenticated or Encrypted 22. For outgoing transport, the administrator chooses TCP or UDP under Non Secure mode, whereas Authenticated or Encrypted mode sets the outgoing transport to TLS 37.
The Incoming Port field accepts values from 0 to 65535 21. In the SIP trunk security profile, the default incoming port is 5060 for TCP and UDP SIP messages and 5061 for TLS, and the Release 14 and SUs security guide gives the same defaults 1819. The incoming port configured in a profile applies to every trunk using that profile 20. Trunks using TLS can share an incoming port, and trunks using TCP+UDP can share an incoming port, but TLS and non-TLS trunks cannot share the same incoming port 3834.
| Setting | Default or Range | Transport / Condition |
|---|---|---|
| Incoming Port | 0 to 65535 21 | 5060 for TCP/UDP, 5061 for TLS 18 |
| Incoming Transport | TCP+UDP or TLS | Follows security mode 22 |
| Nonce Validity Time | 600 seconds (10 minutes) 35 | Default value 35 |
When Enable Digest Authentication is checked, Unified CM challenges all SIP requests received on the trunk 16. Checking Enable Application Level Authorization requires checking Enable Digest Authentication and configuring digest authentication for the trunk 3. The Secure Certificate Subject or Subject Alternate Name field accepts up to 4096 characters, separating multiple entries with a space, comma, semicolon, or colon 6. Out-of-dialog REFER requests are accepted only when Accept Out-of-Dialog REFER is checked 1. The Accept Replaces Header setting allows Unified CM to accept new SIP dialogs that replace existing dialogs on the trunk 2.
When several non-secure SIP trunks with different listening ports target the same destination or port, Unified CM documents a restriction where they may use the wrong port in a mid-call INVITE, causing the call to drop 36.
Local Gateway and Webex Calling coexistence
In Cisco's documented coexistence configuration, the Local Gateway (LGW) separates traffic by port: calls arriving from Unified CM on port 5060 route to the PSTN, and calls on port 5065 route to Webex Calling 4927. To support this, the dedicated security profile for the trunk to the Local Gateway has Incoming Port 5065 492846. Unified CM accepts messages on 5065 and populates 5065 in the Via header of outbound messages sent to the LGW 28.
On CUBE, incoming uri via matches the topmost Via header of an incoming SIP request, identifying the last forwarding hop 9. The LGW matches inbound dial-peers using incoming uri via: dial-peer 300 references voice class uri 300 (configured with the pattern ':5065' for Webex), while dial-peer 400 references voice class uri 400 (configured with the Unified CM node address range and port 5060, such as 192.168.80.6[0-5]:5060, for PSTN) 313226. For return traffic, the SRV record wxtocucm.io routes Webex traffic to Unified CM port 5065, and pstntocucm.io routes PSTN traffic to port 5060 29.
The Unified CM SIP trunk targeting Webex uses the LGW CUBE IP address with destination port 5060 44. WarmTransfer's reading of the sources is that because both trunks target LGW port 5060, the LGW relies on the port in the topmost Via header—derived from the trunk security profile's Incoming Port rather than the destination port—to distinguish them 25. Furthermore, we infer that because the incoming port is defined per security profile, the 5060 PSTN trunk and the 5065 Webex trunk targeting the same LGW require two distinct SIP trunk security profiles 24.
In the Unified CM Webex Calling configuration, the Webex SIP profile enables OPTIONS Ping to monitor destination status for trunks with service type None 45. The Webex trunk is configured with Run On All Active Unified CM Nodes checked and uses an AAR calling search space (PSTNReroute) restricted to PSTN route patterns 48. The configuration sequence begins with the SIP trunk security profile, followed by the SIP profile, a calling search space for incoming Webex calls, the SIP trunk, and subsequent routing components 47.
Dedicated Instance recommendations
For Dedicated Instance deployments, Cisco guidelines recommend:
- Checking Run on all active Unified CM nodes across all SIP trunks 14.
- Enabling SIP OPTIONS ping keep-alives to dynamically track trunk destination availability 13.
- Using TCP transport within Cisco Collaboration Systems networks to provide reliability and accommodate large fragmented messages 15.
- Configuring Best Effort (No MTP Inserted) Early Offer so that MTPs are avoided for voice, video, and encrypted calls 12.
See also
See also Unified CM release trains and lifecycle dates. See also Unified CM dial plan partitions and calling search spaces. See also Unified CM device pools and device configuration model. See also Expressway and Mobile and Remote Access. See also CUCM CallManager SDL trace files.
Applicability
Applies to: Cisco Webex Calling, Cisco Unified Communications Manager, Cisco Webex Calling Local Gateway (IOS XE) with Unified CM, Cisco Webex Calling Local Gateway (IOS XE), Cisco Unified Communications Manager with Webex Calling Local Gateway, Cisco Webex Calling Dedicated Instance, Cisco Unified Border Element (IOS XE), and Cisco Unified CM with Webex Calling Local Gateway. Deployments: on-premises, hybrid, and dedicated instance. Sources checked 2026-09-24.
What remains uncertain
A workaround, bug ID, and affected releases for the non-secure multi-port mid-call INVITE call-drop restriction are not covered by the sources below. A TLS variant of the LGW coexistence design, including secure trunk ports and port 5061 versus custom secure ports, is not covered by the sources below. The content of the Multiple Secure SIP Trunks to Same Destination restriction is not covered by the sources below. Cluster-wide SIP trunk capacity and scale limits for Unified CM 15 are not covered by the sources below. Specific SIP profile OPTIONS ping timer values and behavior when all trunk destinations are down are not covered by the sources below. SIP normalization scripts on trunks are not covered by the sources below. Alternative LGW designs separating traffic by a CUBE listening port instead of the Unified CM Via port are not covered by the sources below. SRTP allowance on SIP trunks during the security task flow is not covered by the sources below.
See also
Referenced by
- Troubleshooting Unified CM SIP trunks that show No Service — Symptom-driven troubleshooting of the trunk status that OPTIONS ping produces; general SIP trunk configuration lives in the broader topic.
Sources
- 1Unified CM accepts incoming out-of-dialog REFER requests on a SIP trunk only when Accept Out-of-Dialog REFER is checked in the trunk's security profile.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Accept Out-of-Dialog Refer · Checked 2026-09-24
- 2The Accept Replaces Header check box lets Unified CM accept new SIP dialogs that replace existing SIP dialogs on the trunk.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Accept Replaces Header · Checked 2026-09-24
- 3Checking Enable Application Level Authorization also requires checking Enable Digest Authentication and configuring digest authentication for the trunk.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Enable Application Level Authorization · Checked 2026-09-24
- 4After a security profile is assigned to a SIP trunk and saved, the trunk is reset with Apply Config.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > Apply SIP Trunk Security Profile · Checked 2026-09-24
- 5A SIP trunk security profile that is assigned to a device cannot be deleted.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > Delete SIP Trunk Security Profile · Checked 2026-09-24
- 6The Secure Certificate Subject or Subject Alternate Name field takes up to 4096 characters. Multiple names are separated by a space, comma, semicolon or colon.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Secure Certificate Subject or Subject Alternate Name · Checked 2026-09-24
- 7The Release 15 trunk task flow puts configuring SIP profiles first, then the SIP trunk security profile, then the SIP trunks themselves.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > SIP Trunk Configuration Task Flow · Checked 2026-09-24
- 8A CUBE voice class uri pattern must be shorter than 32 characters, is case-sensitive, and each voice class uri allows only one pattern or host command.Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Matching Inbound Dial Peers by URI of Incoming SIP Calls · Matching Inbound Dial Peers by URI of Incoming SIP Calls > restrictions · Checked 2026-09-24
- 9On CUBE, 'incoming uri via' matches the topmost Via header of an incoming SIP request, which identifies the last hop that forwarded it.Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Matching Inbound Dial Peers by URI of Incoming SIP Calls · Matching Inbound Dial Peers by URI of Incoming SIP Calls · Checked 2026-09-24
- 10If no SIP trunk security profile is assigned to a SIP trunk, Unified CM assigns a nonsecure profile by default.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > Configure SIP Trunk Security Profile · Checked 2026-09-24
- 11The SIP trunk security profile offers three device security modes: Non Secure (TCP or UDP, no encryption), Authenticated (TLS with NULL/SHA, integrity only) and Encrypted (TLS with AES128/SHA).Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > Table 1. SIP Trunk Security Profile Configuration Settings > Device Security Mode · Checked 2026-09-24
- 12The Dedicated Instance guidelines recommend Best Effort (No MTP Inserted) Early Offer on SIP trunks, so that MTPs are not inserted for voice, video or encrypted calls.Dedicated Instance deployment guidelines · SIP Trunk and Route List section · Checked 2026-09-24
- 13The Dedicated Instance guidelines recommend SIP OPTIONS ping keep-alives on SIP trunks to track the state of trunk destinations dynamically.Dedicated Instance deployment guidelines · SIP Trunk and Route List section · Checked 2026-09-24
- 14Cisco's Dedicated Instance guidelines recommend enabling Run on all active Unified CM nodes on all SIP trunks.Dedicated Instance deployment guidelines · SIP Trunk and Route List section · Checked 2026-09-24
- 15The Dedicated Instance guidelines recommend TCP as the SIP transport within Cisco Collaboration Systems networks, because it is reliable and handles large fragmented SIP messages.Dedicated Instance deployment guidelines · SIP Trunk and Route List section · Checked 2026-09-24
- 16When Enable Digest Authentication is checked in the SIP trunk security profile, Unified CM challenges all SIP requests from the trunk.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Enable Digest Authentication · Checked 2026-09-24
- 17From Unified CM Release 15 onward, H.323 Gatekeeper Control options are no longer available.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > H.323 trunk note · Checked 2026-09-24
- 18In the SIP trunk security profile, the default incoming port is 5060 for TCP and UDP SIP messages and 5061 for TLS.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port · Checked 2026-09-24
- 19The Release 14 and SUs security guide gives the same incoming-port defaults: 5060 for TCP and UDP, and 5061 for TLS.Security Guide for Cisco Unified Communications Manager Release 14 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > SIP Trunk Security Profile Settings > Incoming Port · Checked 2026-09-24
- 20The Incoming Port set in a SIP trunk security profile applies to every SIP trunk that uses that profile.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port · Checked 2026-09-24
- 21The Incoming Port field of a SIP trunk security profile takes a port number from 0 to 65535.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port · Checked 2026-09-24
- 22The incoming transport type follows the device security mode: TCP+UDP when the mode is Non Secure, and TLS when it is Authenticated or Encrypted.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Transport Type · Checked 2026-09-24
- 23Inference: the documented LGW coexistence design (two non-secure trunks with different listening ports to one LGW at 5060) matches the conditions of the Release 15 restriction on mid-call INVITE port use. Whether that design is exposed to the call-drop behaviour is not established by any source retrieved.inferredSystem Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > SIP Trunk Restrictions > Multiple Non-secure SIP Trunks to Same Destination, read with cisco-help-jr1i3r-configure-lgw-ios-xe · Checked 2026-09-24
- 24Inference: the incoming port belongs to the security profile and applies to every trunk that uses it, so the 5060 PSTN trunk and the 5065 Webex trunk to the same LGW need two different SIP trunk security profiles.inferredSecurity Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port, read with cisco-help-nqqzbk7-configure-ucm-for-wxc step 1 · Checked 2026-09-24
- 25Inference: both Unified CM trunks target the same LGW listening port (5060), so the LGW tells them apart by the port in the topmost Via header. That port is the Incoming Port of each trunk's security profile, not the trunk's destination port.inferredConfigure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment (voice class URIs and dial-peers), read with cisco-cube-xe-inbound-dp-match-uri and cisco-help-nqqzbk7-configure-ucm-for-wxc · Checked 2026-09-24
- 26The LGW's inbound dial-peers for Unified CM traffic select a trunk with 'incoming uri via': dial-peer 300 uses uri 300 (Webex) and dial-peer 400 uses uri 400 (PSTN).Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment > Configure the following dial-peers · Checked 2026-09-24
- 27In Cisco's Local Gateway design with an existing Unified CM, the LGW routes calls arriving from Unified CM on port 5060 to the PSTN and calls from port 5065 to Webex Calling.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment · Checked 2026-09-24
- 28Cisco's LGW guide says to set the SIP trunk security profile incoming port to 5065 for the Webex Calling trunk in Unified CM. Unified CM then accepts messages on 5065 and puts 5065 in the Via header of messages it sends to the LGW.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment · Checked 2026-09-24
- 29In the LGW guide, the SRV record wxtocucm.io points LGW-to-Unified CM Webex traffic at Unified CM port 5065, and the SRV record pstntocucm.io points PSTN traffic at Unified CM port 5060.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment > Configure the following DNS records · Checked 2026-09-24
- 30When the Local Gateway and the PSTN gateway are on the same device, Unified CM needs two trunks to it with different SIP listening ports, so it can tell Webex traffic from PSTN traffic and apply a different class of service to each.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment (introductory paragraph) · Checked 2026-09-24
- 31In the LGW guide, voice class uri 300 identifies the Unified CM Webex trunk with the SIP pattern ':5065'.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment > Configure the following voice class URIs · Checked 2026-09-24
- 32In the LGW guide, voice class uri 400 identifies the Unified CM PSTN trunk by the Unified CM node address range and port 5060. The example pattern is 192\.168\.80\.6[0-5]:5060.Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment > Configure the following voice class URIs · Checked 2026-09-24
- 33A Unified CM SIP trunk can have up to 16 destination addresses, given as IPv4 or IPv6 addresses, fully qualified domain names or a single DNS SRV record.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > SIP Trunk Overview · Checked 2026-09-24
- 34TLS SIP trunks and non-TLS SIP trunks cannot share the same incoming port.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port (note) · Checked 2026-09-24
- 35The default Nonce Validity Time in the SIP trunk security profile is 600 seconds (10 minutes).Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Nonce Validity Time · Checked 2026-09-24
- 36Unified CM documents a restriction: when several non-secure SIP trunks with different listening ports point to the same destination or port, they may use the wrong port in a mid-call INVITE and the call drops.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > SIP Trunk Restrictions > Multiple Non-secure SIP Trunks to Same Destination · Checked 2026-09-24
- 37With a Non Secure device security mode the administrator chooses TCP or UDP as the outgoing transport. With Authenticated or Encrypted mode the outgoing transport is TLS.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Outgoing Transport Type · Checked 2026-09-24
- 38SIP trunks that use TLS can share one incoming port, and SIP trunks that use TCP+UDP can share one incoming port.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Table 1. SIP Trunk Security Profile Configuration Settings > Incoming Port (note) · Checked 2026-09-24
- 39Unified CM SIP trunks connect Unified CM to external devices such as SIP gateways, SIP proxy servers, UC applications, conference bridges, remote clusters or a Session Management Edition.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > SIP Trunk Overview · Checked 2026-09-24
- 40The SIP trunk's Run on All Active Unified CM Nodes check box enables the trunk on all cluster nodes.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > Configure SIP Trunks · Checked 2026-09-24
- 41The trunk security task flow in the Release 15 guide runs: set up secure gateways and trunks, set up the SIP trunk security profile, apply it, synchronize it with the SIP trunks, then allow SRTP.Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > task flow list · Checked 2026-09-24
- 42The SIP Trunk Service Type options are None (Default), Call Control Discovery, Extension Mobility Cross Cluster, Cisco Intercompany Media Engine and IP Multimedia System Service Control.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > Configure SIP Trunks (Trunk Service Type) · Checked 2026-09-24
- 43A SIP trunk that has a security profile assigned takes on that profile's settings.System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks · Configure Trunks > Configure SIP Trunk Security Profile · Checked 2026-09-24
- 44In the same Webex article, the Unified CM SIP trunk to and from Webex uses the Local Gateway CUBE's IP address as its destination, with destination port 5060.Configure Unified CM for Webex Calling · Configure a SIP Trunk To and From Webex · Checked 2026-09-24
- 45The Webex SIP Profile in Cisco's Unified CM for Webex Calling configuration has 'Enable OPTIONS Ping to monitor destination status for Trunks with Service Type None (Default)' checked.Configure Unified CM for Webex Calling · Configure SIP Profile for the Local Gateway Trunk · Checked 2026-09-24
- 46In Cisco's Unified CM configuration for Webex Calling, the dedicated security profile for the trunk to the Local Gateway has Incoming Port 5065, to match the port the LGW uses for Webex traffic.Configure Unified CM for Webex Calling · Configure SIP Trunk Security Profile for Trunk to Local Gateway · Checked 2026-09-24
- 47The article's Unified CM for Webex Calling sequence begins with the SIP trunk security profile, then the SIP profile, then a calling search space for calls from Webex, and only then the SIP trunk. Route group, route list, partition, route patterns and abbreviated intersite dialing normalization follow.Configure Unified CM for Webex Calling · Article step headings 1-9 · Checked 2026-09-24
- 48In the same article, the Webex SIP trunk uses the Webex security profile and SIP profile, has Run On All Active Unified CM Nodes checked, and uses an AAR calling search space (PSTNReroute) that can reach only PSTN route patterns.Configure Unified CM for Webex Calling · Configure a SIP Trunk To and From Webex · Checked 2026-09-24
- 49In Cisco's documented coexistence configuration the Local Gateway separates traffic by port: calls arriving from Unified CM on port 5060 are routed to the PSTN and calls arriving on port 5065 are routed to Webex Calling, which requires setting the Unified CM SIP trunk security profile incoming port to 5065.Configure Local Gateway on Cisco IOS XE for Webex Calling · Unified CM interconnect dial-peer configuration · Checked 2026-09-04
Documents
Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Matching Inbound Dial Peers by URI of Incoming SIP Calls
Configure Local Gateway on Cisco IOS XE for Webex Calling
Configure Unified CM for Webex Calling
Dedicated Instance deployment guidelines
Security Guide for Cisco Unified Communications Manager Release 14 and SUs - Trunk and Gateway SIP Security
Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security
System Configuration Guide for Cisco Unified Communications Manager Release 15 and SUs - Configure Trunks
Cite this page
APA
WarmTransfer. (2026, September 24). Unified CM SIP trunks and security profiles. WarmTransfer. https://warmtransfer.net/knowledge/cucm-sip-trunks
BibTeX
@misc{warmtransfer-cucm-sip-trunks,
title = {Unified CM SIP trunks and security profiles},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/cucm-sip-trunks},
note = {Verified 2026-09-24}
}