WarmTransfer
network foundations · published

SD-WAN considerations for voice

Verified 2026-09-24 · 60 sources · tier 1–2

Software-defined wide area networking (SD-WAN) introduces specific configuration requirements and traffic-handling rules for real-time voice deployments 24​2. Cloud telephony architectures across Cisco Webex Calling and Microsoft 365 rely on defined routing mechanisms, quality of service (QoS) mappings, and gateway capabilities when traversing SD-WAN overlays and breakout paths 20​44​49.

Cisco CUBE and Local Gateway in Controller Mode

CUBE functionality on Cisco IOS XE Catalyst SD-WAN devices is supported from IOS XE Catalyst SD-WAN 17.7.1a with vManage 20.7.1, configured via device CLI templates or CLI add-on feature templates 24. Supported CUBE use cases in the SD-WAN CUBE documentation include acting as a local gateway for the Bring Your Own PSTN (BYoPSTN) option of Cisco Webex Calling, alongside Webex Meetings Edge Audio 20. However, high-availability configuration is not supported for CUBE on Cisco IOS XE Catalyst SD-WAN devices 21.

Configuring a Webex Calling Local Gateway (registration-based, Cisco CUBE) in controller mode as part of a Cisco SD-WAN solution requires Cisco IOS XE Cupertino 17.7.1 or later 34. Standard on-premises deployments require Cisco IOS XE 17.6.1a or later for registration-based Local Gateways and Cisco IOS XE 17.9.1a or later for certificate-based Local Gateways 51​9. When deployed in controller mode, a Local Gateway cannot be enrolled to Control Hub and does not support Control Hub validation of its configuration 35​36. Cisco ISR 1100 platforms also do not support Local Gateway configuration validation in Control Hub, and the managed gateway connector is not supported on Cisco Secure Routers 32​55. In general, Control Hub Config Validation is supported only for registration-based Local Gateways, requiring the managed gateway to be enrolled with Control Hub and assigned Local Gateway as a service 59​58.

The trunk between a Local Gateway and the Webex cloud uses SIP over TLS for signalling and SRTP for media, establishing trunk-specific settings via voice class tenant 39​41. Webex Calling uses SIP TLS port 8934 for registration-based Local Gateway trunks and port 5062 for certificate-based trunks 38. Setting up a Local Gateway requires importing the Cisco root CA bundle into the IOS XE trustpool using crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b 40.

Template Provisioning and UC Voice Profiles

CLI add-on feature templates require Cisco IOS XE Catalyst SD-WAN 17.2.1r or later 14. Only 1 CLI add-on feature template can be attached to a device template, and commands within it take priority over identical commands in standard feature templates during configuration merges 15​16. Only qualified commands may be used in CLI add-on templates, as unsupported commands lead to errors and configuration failures; Cisco advises testing each command on the target device before addition 17. WarmTransfer's reading of the sources is that in controller mode, the Webex Calling Local Gateway configuration (trustpool import, voice class tenant, SIP TLS, and SRTP settings) must be delivered via device CLI or CLI add-on templates from SD-WAN Manager rather than entered manually on the router, requiring every command to be on the qualified list 33.

The SD-WAN configuration-group UC Voice Profile includes an SRST feature for SIP and a Server Group feature defining up to 5 destination SIP servers for an outbound dial peer 13​12. SIP IP phones in a branch can register to the local gateway and maintain PSTN breakout if the WAN degrades or goes down 13.

Overlay Traffic Steering and Path Resilience

Application-aware routing (AAR) measures loss, latency, and jitter across SD-WAN tunnels using BFD hello packets 2. WarmTransfer's reading of the sources is that with default timers, application-aware routing judges tunnel quality over a window of up to about an hour (10-minute poll times multiplier 6), so short voice-affecting brownouts may not trigger a path change unless timers are tuned or enhanced AAR is used 7. Enhanced application-aware routing measures loss, latency, and jitter using inline data and requires IOS XE Catalyst SD-WAN 17.12.1a and SD-WAN Manager 20.12.1 or later 29.

To protect voice streams over impaired paths, SD-WAN provides loss-mitigation mechanisms:

  • Packet Duplication: Transmits copies of selected traffic over alternative tunnels, allowing the destination device to forward 1 copy and discard duplicates 46.
  • Forward Error Correction (FEC): Generates 1 parity packet for every group of 4 data packets, allowing recovery of at most 1 lost packet per group 31. Under FEC Adaptive, recovery information is transmitted only when packet loss exceeds a set threshold, whereas FEC Always applies parity to all transmissions 30.

For SaaS connectivity, Cloud OnRamp for SaaS added Webex support in IOS XE Catalyst SD-WAN 17.7.1a and vManage 20.7.1 19. While Webex servers can send performance metrics such as audio and video data to Cisco SD-WAN Analytics starting in vManage 20.10.1 and IOS XE Catalyst SD-WAN 17.10.1a, Cloud OnRamp for SaaS does not use those metrics to make path-selection decisions for Webex traffic 18.

QoS, Firewalls, and Internet Egress

Each Cisco SD-WAN interface has 8 queues numbered 0 to 7 49. Queue 0 carries control traffic and low-latency queuing (LLQ) traffic, and any forwarding class mapped to queue 0 must be configured for LLQ 49. SD-WAN BFD packets are marked DSCP 48 (CS6) and placed in the low-latency priority queue (LLQ) before transmission 8.

Standard traffic marking and RFC guidelines include:

  • RFC 4594 specifies that Telephony traffic should use the Expedited Forwarding (EF) PHB with priority queuing and no active queue management 53.
  • RFC 4594 recommends the CS5 class selector with rate queuing for the Signaling service class 52.
  • Webex Calling marks Webex App audio EF (46) and video AF41 (34) with signalling CS0 60.
  • Webex devices (MPP and Room) mark signalling CS3 (24) 60.

Firewalls and NAT devices handling voice streams require specific perimeter handling:

  • Cisco recommends disabling SIP ALG along the Webex Calling path because certain implementations disrupt firewall traversal 27.
  • Stateful packet inspection and NAT devices in the Webex Calling path require a connection timeout of at least 30 minutes 45.
  • NAT or PAT must translate overlapping source ports across multiple devices into unique translated ports 45.

For Microsoft 365, Microsoft identifies migrating from traditional WAN to SD-WAN as an incremental connectivity optimisation to improve WAN performance, simplify management, and lower device load 44. Microsoft advises deploying local DNS and direct local internet egress while avoiding hairpins through cloud gateways or intermediate security stacks 42. Furthermore, Microsoft states that TLS termination, deep packet inspection on Microsoft 365 domains, and forcing protocol downgrades like UDP to TCP represent untested scenarios known to cause connectivity issues 43.

See also

Applicability

Applies to: Cisco Catalyst SD-WAN CUBE, Cisco Catalyst SD-WAN, Microsoft 365 including Teams, Cisco Webex Calling Local Gateway, Cisco Catalyst SD-WAN Manager, Cisco Webex Calling Local Gateway on Catalyst SD-WAN, Cisco Catalyst SD-WAN Manager configuration groups, Cisco Catalyst SD-WAN Cloud OnRamp for SaaS, IETF DiffServ, and Cisco Webex Calling. Deployments: on-premises, multi-tenant, any, and sd-wan-controller-mode. Sources checked 2026-09-24. Cisco requires IOS XE Cupertino 17.7.1 or later to configure a registration-based Webex Calling Local Gateway on Cisco CUBE in SD-WAN controller mode 34. All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later, while all certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later 51​9. CUBE on Cisco IOS XE Catalyst SD-WAN devices requires IOS XE Catalyst SD-WAN 17.7.1a and vManage 20.7.1 or later 24. CLI add-on feature templates require Cisco IOS XE Catalyst SD-WAN 17.2.1r or later 14. Enhanced application-aware routing requires IOS XE Catalyst SD-WAN 17.12.1a and SD-WAN Manager 20.12.1 or later 29. Cloud OnRamp for SaaS Webex integration applies from IOS XE Catalyst SD-WAN 17.7.1a and vManage 20.7.1, with server-side metrics supported from 17.10.1a and 20.10.1 19​18.

What remains uncertain

Operating a Webex Calling Survivability Gateway on a controller-mode SD-WAN router is not covered by the sources below. Whether Catalyst SD-WAN copies inner DSCP markings to the outer IPsec tunnel header is not covered by the sources below. Whether voice class tenant and sip-ua registration commands are on the SD-WAN qualified CLI list is not covered by the sources below. Whether the configuration-group Voice Tenant can build a Webex Calling Local Gateway trunk without a CLI add-on template is not covered by the sources below. The relationship between CUBE high-availability Local Gateway configurations and the SD-WAN no-HA restriction is not covered by the sources below. Cisco Secure Router 26.x releases acting as an SD-WAN controller-mode Local Gateway are not covered by the sources below. Local Gateway operation behind SD-WAN DIA NAT along with SIP ALG and Unified Threat Defense (UTD) interaction is not covered by the sources below. Deploying Teams Direct Routing SBCs and media bypass behind SD-WAN is not covered by the sources below.

See also

Related to

Referenced by

Sources

  1. 1
    The default application-aware routing timers are a 1-second BFD hello interval, a 10-minute (600,000 ms) poll interval and a multiplier of 6, which gives a sliding window of six poll intervals.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · Configure BFD for application-aware routing (bfd color interval, bfd app-route poll-interval, bfd app-route multiplier) · Checked 2026-09-24
  2. 2
    Application-aware routing measures loss, latency and jitter on each SD-WAN tunnel using BFD hello packets.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · How application-aware routing works / BFD measurement · Checked 2026-09-24
  3. 3
    From IOS XE Catalyst SD-WAN 17.15.1a, the default Voice-And-Video SLA class threshold is 2% loss, 300 ms latency and 60 ms jitter.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · Default SLA classes table (Release 17.15.1a) · Checked 2026-09-24
  4. 4
    If no tunnel meets the SLA, application-aware routing can fall back to the best path or send traffic to a backup preferred color. With neither action configured, traffic is forwarded on any available tunnel regardless of SLA.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · SLA not met / fallback-to-best-path and backup-preferred-color · Checked 2026-09-24
  5. 5
    Most devices allow 6 user-configurable SLA classes plus 1 non-configurable default class. Some larger platforms allow more: 7 on ISR 4400 and 15 on 16 GB ASR 1001/1002 and Catalyst 8500.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · SLA class limits table · Checked 2026-09-24
  6. 6
    An SLA class sets loss from 0 to 100 percent, latency from 1 to 1,000 ms and jitter from 1 to 1,000 ms.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · SLA class parameters · Checked 2026-09-24
  7. 7
    With default timers, application-aware routing judges tunnel quality over a window of up to about an hour (10-minute poll times multiplier 6), so short voice-affecting brownouts may not trigger a path change unless timers are tuned or enhanced AAR is used.inferred
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing · BFD defaults; combined with enhanced AAR overview · Checked 2026-09-24
  8. 8
    SD-WAN BFD packets are marked DSCP 48 (CS6) and placed in the low-latency priority queue (LLQ) before transmission.
    Cisco Catalyst SD-WAN Design Guide · BFD / QoS section · Checked 2026-09-24
  9. 9
    All certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Certificate-based trunk requirements · Checked 2026-09-24
  10. 10
    The UC Voice Profile in SD-WAN configuration groups offers features for analog and digital interfaces, call routing (dial peers), DSP farm, media profile (codecs and DTMF relay), SRST, server group, supervisory disconnect, translation profiles and rules, trunk group, voice global and voice tenant.
    Cisco Catalyst SD-WAN Configuration Groups, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Communications Voice Profile · Feature list for the Cisco Unified Communications Voice Profile; feature history · Checked 2026-09-24
  11. 11
    UC Voice Profile support in configuration groups began with DSP Farm in IOS XE Catalyst SD-WAN 17.13.1a / Manager 20.13.1 and expanded in 17.14.1a / 20.14.1.
    Cisco Catalyst SD-WAN Configuration Groups, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Communications Voice Profile · Feature history table · Checked 2026-09-24
  12. 12
    The UC Voice Profile Server Group feature defines a group of up to five destination SIP servers for an outbound dial peer.
    Cisco Catalyst SD-WAN Configuration Groups, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Communications Voice Profile · Server Group feature description · Checked 2026-09-24
  13. 13
    The SD-WAN configuration-group UC Voice Profile includes an SRST feature for SIP, so that if the WAN goes down or is degraded, SIP IP phones in a branch can register to the local gateway and keep PSTN breakout.
    Cisco Catalyst SD-WAN Configuration Groups, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Communications Voice Profile · SRST feature description · Checked 2026-09-24
  14. 14
    CLI add-on feature templates require Cisco IOS XE Catalyst SD-WAN 17.2.1r or later.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates · Feature history for CLI add-on feature templates · Checked 2026-09-24
  15. 15
    Only one CLI add-on feature template can be attached to a device template.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates · Restrictions for CLI add-on feature templates · Checked 2026-09-24
  16. 16
    When configurations are merged, commands in a CLI add-on feature template take priority over the same commands in feature templates.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates · CLI add-on feature templates (overview) · Checked 2026-09-24
  17. 17
    Only qualified commands may be used in CLI add-on templates. Unsupported commands cause errors and configuration failures, so Cisco advises running each command on the intended device before adding it.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates · Restrictions for CLI add-on feature templates; Qualified CLI commands · Checked 2026-09-24
  18. 18
    From vManage 20.10.1 and IOS XE Catalyst SD-WAN 17.10.1a, Webex servers can send performance metrics (audio, video and so on) to Cisco SD-WAN Analytics, but Cloud OnRamp for SaaS does not use that data to choose the best path for Webex traffic.
    Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cloud OnRamp for SaaS, Cisco Catalyst SD-WAN Release 20.3.1 to Cisco Catalyst SD-WAN Release 20.14.x · Webex server-side metrics · Checked 2026-09-24
  19. 19
    Cloud OnRamp for SaaS added Webex as a supported cloud application from IOS XE Catalyst SD-WAN 17.7.1a and vManage 20.7.1.
    Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cloud OnRamp for SaaS, Cisco Catalyst SD-WAN Release 20.3.1 to Cisco Catalyst SD-WAN Release 20.14.x · Feature history, Webex row · Checked 2026-09-24
  20. 20
    The SD-WAN CUBE chapter lists acting as a local gateway for the Bring Your Own PSTN (BYoPSTN) option of Cisco Webex Calling as a supported CUBE use case, alongside Webex Meetings Edge Audio.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Information about CUBE / use cases list · Checked 2026-09-24
  21. 21
    High-availability configuration is not supported for CUBE on Cisco IOS XE Catalyst SD-WAN devices.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Restrictions for CUBE · Checked 2026-09-24
  22. 22
    The SD-WAN CUBE chapter lists supported devices including Cisco 1000 and 4000 Series ISRs, Catalyst 8200 and 8300 Series Edge Platforms, Catalyst 8000V, and ASR 1001-X, 1002-X, 1004, 1006 and 1006-X routers.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Supported devices for CUBE · Checked 2026-09-24
  23. 23
    The supported CUBE command list for SD-WAN includes TLS commands (voice class tls-profile, transport tcp tls, secure-ciphersuite), SRTP commands (srtp, voice class srtp-crypto) and media-address voice-vrf.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Supported commands list for CUBE · Checked 2026-09-24
  24. 24
    CUBE functionality on Cisco IOS XE Catalyst SD-WAN devices is supported from IOS XE Catalyst SD-WAN 17.7.1a with vManage 20.7.1, and is configured through device CLI templates or CLI add-on feature templates.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Feature history table, row CUBE; Configure CUBE section · Checked 2026-09-24
  25. 25
    Secure SRST support in the SD-WAN CUBE and voice chapter arrived in IOS XE Catalyst SD-WAN 17.10.1a with vManage 20.10.1.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Feature history table, row Secure SRST · Checked 2026-09-24
  26. 26
    IOS XE Catalyst SD-WAN 17.14.1a with Manager 20.14.1 added voice and SIP-UA command support for more ciphers and transports, and SRST command support for secure HTTP and TLS transport.
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Feature history table, rows Voice/SIP-UA commands and SRST commands · Checked 2026-09-24
  27. 27
    Cisco advises disabling SIP ALG on firewalls and NAT devices in the Webex Calling path, because some SIP ALG implementations break firewall traversal.
    Port Reference Information for Webex Calling · Firewall / NAT guidance · Checked 2026-09-24
  28. 28
    Enhanced application-aware routing cuts SLA-violation detection from the tens-of-minutes range of standard AAR to as little as about 10 seconds in its aggressive setting.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Enhanced application-aware routing · Benefits / detection time comparison · Checked 2026-09-24
  29. 29
    Enhanced application-aware routing, which measures loss, latency and jitter with inline data, needs IOS XE Catalyst SD-WAN 17.12.1a and SD-WAN Manager 20.12.1 or later.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Enhanced application-aware routing · Feature history / overview · Checked 2026-09-24
  30. 30
    FEC Adaptive sends FEC information only when detected loss exceeds the packet-loss threshold, while FEC Always sends it with every transmission.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forward Error Correction · FEC Adaptive / FEC Always options · Checked 2026-09-24
  31. 31
    SD-WAN FEC sends one parity packet for every group of four data packets and can recover at most one lost packet in a group.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forward Error Correction · Information about forward error correction · Checked 2026-09-24
  32. 32
    Cisco ISR 1100 platforms do not support Local Gateway configuration validation in Control Hub.
    Get started with Local Gateway · Key limitations / configuration validation note · Checked 2026-09-24
  33. 33
    In controller mode, the Webex Calling LGW configuration (trustpool import, voice class tenant, SIP TLS and SRTP settings) has to be delivered as device CLI or CLI add-on templates from SD-WAN Manager rather than typed on the router, and every command must be on the qualified list.inferred
    Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element · Configure CUBE section; combined with CLI add-on restrictions · Checked 2026-09-24
  34. 34
    To configure a Webex Calling Local Gateway (registration-based, Cisco CUBE) in controller mode as part of a Cisco SD-WAN solution, Cisco requires IOS XE Cupertino 17.7.1 or later.
    Get started with Local Gateway · Registration-based trunking > Cisco CUBE requirements · Checked 2026-09-24
  35. 35
    A Local Gateway deployed in controller mode with Cisco SD-WAN cannot be enrolled to Control Hub.
    Get started with Local Gateway · Registration-based trunking > Cisco CUBE; also under Cisco Secure Routers and the certificate-based trunking section · Checked 2026-09-24
  36. 36
    A Local Gateway deployed in controller mode with Cisco SD-WAN does not support Control Hub validation of its gateway configuration.
    Get started with Local Gateway · Registration-based trunking > Cisco CUBE; controller-mode limitations list · Checked 2026-09-24
  37. 37
    The Local Gateway media port range is configurable with rtp-port range, and Webex Calling media from the LGW uses SRTP over UDP.
    Port Reference Information for Webex Calling · IP subnets for Webex Calling services > Local Gateway media row and footnote · Checked 2026-09-24
  38. 38
    Webex Calling uses SIP TLS port 8934 for registration-based Local Gateway trunks and port 5062 for certificate-based trunks.
    Port Reference Information for Webex Calling · IP subnets for Webex Calling services > Local Gateway call signalling row and footnote · Checked 2026-09-24
  39. 39
    The trunk between a Local Gateway and the Webex cloud uses SIP over TLS for signalling and SRTP for media.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Overview of Local Gateway trunk security · Checked 2026-09-24
  40. 40
    Local Gateway setup requires importing the Cisco root CA bundle into the IOS XE trustpool, using crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway > upload the Cisco root CA bundle step · Checked 2026-09-24
  41. 41
    The Local Gateway configuration uses voice class tenant to create trunk-specific configuration for the Webex Calling trunk.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Configuration steps > voice class tenant · Checked 2026-09-24
  42. 42
    Microsoft recommends local DNS and local internet egress for Microsoft 365, avoiding network hairpins through intermediate security stacks or cloud gateways, and prioritising direct internet access over WAN backhaul.
    Microsoft 365 network connectivity principles · Egress network connections locally; Avoid network hairpins; Optimizing connectivity to Microsoft 365 services · Checked 2026-09-24
  43. 43
    Microsoft says TLS termination or deep packet inspection of Microsoft 365 domains, and forcing protocol downgrade such as UDP to TCP, are untested scenarios known to cause connectivity issues.
    Microsoft 365 network connectivity principles · Additional network considerations · Checked 2026-09-24
  44. 44
    Microsoft lists migrating from traditional WAN to SD-WAN as one of its incremental Microsoft 365 connectivity optimisations, to improve WAN performance and manageability and reduce load on network devices.
    Microsoft 365 network connectivity principles · Incremental optimization table, row Migrate from traditional WAN to SD-WAN · Checked 2026-09-24
  45. 45
    Where NAT or stateful packet inspection sits in the Webex Calling path, Cisco recommends a connection timeout of at least 30 minutes, and NAT or PAT must map overlapping source ports from multiple devices to unique translated ports.
    Port Reference Information for Webex Calling · NAT / SPI guidance · Checked 2026-09-24
  46. 46
    SD-WAN packet duplication sends copies of selected traffic over alternate tunnels to mitigate loss. The receiving device forwards one copy and discards the duplicates.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Packet Duplication · Information about packet duplication · Checked 2026-09-24
  47. 47
    Packet duplication arrived in IOS XE SD-WAN 16.12.1b. In 17.15.1a it gained large packets (via underlay fragmentation) and IPv6 traffic types.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Packet Duplication · Feature history for packet duplication · Checked 2026-09-24
  48. 48
    Packet duplication is not supported on every IOS XE Catalyst SD-WAN edge device, cannot be combined with local or remote TLOC in policies, and does not interoperate between IOS XE 16.x and 17.x when combined with FEC or TCP optimisation.
    Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Packet Duplication · Restrictions for packet duplication · Checked 2026-09-24
  49. 49
    Each SD-WAN interface has eight queues, numbered 0 to 7. Queue 0 carries control traffic and LLQ traffic, and any forwarding class mapped to queue 0 must be configured for LLQ.
    Cisco Catalyst SD-WAN Forwarding and QoS Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forwarding and QoS · QoS overview / queues and scheduling · Checked 2026-09-24
  50. 50
    SD-WAN QoS rewrite rules use forwarding class and packet loss priority to set the DSCP code point on traffic as it leaves the device.
    Cisco Catalyst SD-WAN Forwarding and QoS Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forwarding and QoS · Rewrite rules · Checked 2026-09-24
  51. 51
    All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later.
    Configure Local Gateway on Cisco IOS XE for Webex Calling · Registration-based trunk requirements · Checked 2026-09-24
  52. 52
    RFC 4594 recommends that the Signaling service class use the CS5 class selector with rate queuing.
    RFC 4594: Configuration Guidelines for DiffServ Service Classes · Section 4.2; Figure 4 Signaling row · Checked 2026-09-24
  53. 53
    RFC 4594 recommends that the Telephony service class use the Expedited Forwarding (EF) PHB with priority queuing and no active queue management.
    RFC 4594: Configuration Guidelines for DiffServ Service Classes · Section 4.1; Figure 4 Telephony row · Checked 2026-09-24
  54. 54
    Cisco Secure Routers (C8231, C8235, C8355, C8375 series) are listed as Local Gateway platforms for registration-based and certificate-based trunks from release 26.2.1.
    Get started with Local Gateway · Registration-based trunking > Cisco Secure Routers; Certificate-based trunking > Cisco Secure Routers · Checked 2026-09-24
  55. 55
    The managed gateway connector is not supported on Cisco Secure Routers.
    Get started with Local Gateway · Key limitations / Cisco Secure Routers · Checked 2026-09-24
  56. 56
    Since Survivability Gateway is provisioned through Control Hub managed-gateway enrollment and controller-mode gateways cannot enrol, a gateway in SD-WAN controller mode probably cannot act as a Webex Calling Survivability Gateway. No source states this directly.inferred
    Site survivability for Webex Calling · Enrollment prerequisite; combined with t9xctu controller-mode limitation · Checked 2026-09-24
  57. 57
    Webex Calling Survivability Gateway is available from Cisco IOS XE Dublin 17.12.3, and gateways are provisioned for it by enrolling them as Cisco IOS managed gateways in Control Hub and assigning the service.
    Site survivability for Webex Calling · Requirements / platform and version section; references to Enroll Cisco IOS managed gateways to Webex Cloud · Checked 2026-09-24
  58. 58
    To run Control Hub Config Validation you must enrol the managed gateway with Control Hub and assign Local Gateway to it as a service.
    Validate Cisco Local Gateway configuration through Control Hub · Prerequisites · Checked 2026-09-24
  59. 59
    Control Hub Config Validation is supported only for registration-based Local Gateways.
    Validate Cisco Local Gateway configuration through Control Hub · Overview / prerequisites · Checked 2026-09-24
  60. 60
    Webex Calling marks Webex App audio EF (46) and video AF41 (34) with signalling CS0. Webex devices (MPP and Room) mark signalling CS3 (24).
    Port Reference Information for Webex Calling · QoS markings table · Checked 2026-09-24

Documents

tier 1 standards and regulators

RFC 4594: Configuration Guidelines for DiffServ Service Classes

IETF / RFC Editor · 2006-08-01 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cloud OnRamp for SaaS, Cisco Catalyst SD-WAN Release 20.3.1 to Cisco Catalyst SD-WAN Release 20.14.x

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Configuration Groups, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Communications Voice Profile

Cisco Systems · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Design Guide

Cisco Systems · 2024-08-21 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Forwarding and QoS Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forwarding and QoS

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Application-Aware Routing

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Enhanced application-aware routing

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Forward Error Correction

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Packet Duplication

Cisco Systems · 2025-12-19 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - Cisco Unified Border Element

Cisco Systems · 2026-07-09 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates

Cisco Systems · 2026-07-09 · accessed 2026-09-24

tier 2 current vendor documentation

Configure Local Gateway on Cisco IOS XE for Webex Calling

Cisco Systems, Inc. (Webex Help Center) · 2026-07-09 · accessed 2026-09-04

tier 2 current vendor documentation

Get started with Local Gateway

Cisco Systems, Inc. (Webex Help Center) · 2026-09-10 · accessed 2026-09-15

tier 2 current vendor documentation

Microsoft 365 network connectivity principles

Microsoft · 2026-08-26 · accessed 2026-09-24

tier 2 current vendor documentation

Port Reference Information for Webex Calling

Cisco Systems, Inc. (help.webex.com) · 2026-09-08 · accessed 2026-09-16

tier 2 current vendor documentation

Site survivability for Webex Calling

Cisco Systems, Inc. (help.webex.com) · 2026-07-06 · accessed 2026-09-16

tier 2 current vendor documentation

Validate Cisco Local Gateway configuration through Control Hub

Cisco Webex · 2025-09-23 · accessed 2026-09-24

Cite this page

APA

WarmTransfer. (2026, September 24). SD-WAN considerations for voice. WarmTransfer. https://warmtransfer.net/knowledge/sdwan-voice

BibTeX

@misc{warmtransfer-sdwan-voice,
  title  = {SD-WAN considerations for voice},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sdwan-voice},
  note   = {Verified 2026-09-24}
}