Configure Local Gateway on Cisco IOS XE for Webex Calling

Publisher

Cisco Systems, Inc. (Webex Help Center)

URL

https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling

Published

2026-07-09

Updated

unknown

Accessed

2026-09-04

HTTP status

200

License

Cisco proprietary documentation, all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• Cisco's Local Gateway baseline under voice service voip includes ip address trusted list, mode border-element, media statistics, allow-connections sip to sip, no supplementary-service sip refer, and sip early-offer forced. in context
• show sip-ua register status is the command Cisco gives for verifying that a trunk has registered. in context
• Cisco's current registration-based trunk example puts registrar (with expires and refresh-ratio), credentials, authentication, bind control and media, sip-profiles and outbound-proxy inside one voice class tenant, and the trunk dial-peer uses session target sip-server with voice-class sip tenant. in context
• Cisco's Local Gateway guide installs the root CA bundle with crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b so CUBE can validate public-CA server certificates. in context
• Cisco's Unified CM example classifies calls from Unified CM with a voice class uri (a pattern such as :5065, or a host match) referenced by incoming uri via on the Unified CM-facing dial-peer, which carries its own bind statements and dtmf-relay rtp-nte. in context
• Cisco's IP PSTN example classifies inbound carrier calls with voice class uri id sip / host ipv4:carrier-address and matches them with incoming uri via id on a dial-peer whose session target is ipv4:carrier-address, with bind control and media statements. in context
• Cisco's Local Gateway guide matches calls from Webex Calling with incoming uri request referencing a voice class uri whose pattern is dtg= followed by the trunk OTG/DTG value from Control Hub. in context
• Cisco's Local Gateway guide configures destination-pattern BAD.BAD on outbound dial peers and states a dummy destination pattern is required when routing via an inbound dial-peer group. in context
• Cisco's Local Gateway guide matches calls from the SIP PSTN provider with incoming uri via referencing a voice class uri that lists the provider's IPv4 host address. in context
• The Webex Calling Local Gateway guide matches inbound calls from Webex with a voice class uri containing pattern dtg= followed by the trunk OTG/DTG value from Control Hub, applied with incoming uri request. in context
• The same Local Gateway guide identifies calls from an IP PSTN provider with a voice class uri host ipv4 entry and calls from Unified CM with a voice class uri pattern on the SIP port (for example :5065). in context
• crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b clears the current CA trustpool and installs the Cisco root CA bundle. in context
• show crypto pki trustpool confirms that the CA bundle was imported. in context
• Webex Calling supports only AES_CM_128_HMAC_SHA1_80 for SRTP, so a CUBE leg to Webex Calling offers that suite alone. in context
• Cisco's Local Gateway guide points a CUBE dial peer at several Unified CM nodes by defining local SRV records with ip host and using session target dns:<srv-name>. in context
• In the Local Gateway guide, destination dpg <id> on an inbound dial peer names the dial-peer group, and so the outbound dial peer, used for calls arriving on it. in context
• The Local Gateway guide's dial peers toward Unified CM set dtmf-relay rtp-nte, which declares RFC 2833 RTP-NTE as the expected DTMF method on that leg. in context
• Cisco's Local Gateway guide matches calls arriving from Unified CM to a dial peer with a voice class uri pattern and incoming uri via. in context
• The incoming port set in a Unified CM SIP trunk security profile is where Unified CM accepts messages and is the port it places in the Via header toward CUBE, which is how the Local Gateway design separates two trunks to one CUBE (5065 and 5060). in context
• Inference: both Unified CM trunks target the same LGW listening port (5060), so the LGW tells them apart by the port in the topmost Via header. That port is the Incoming Port of each trunk's security profile, not the trunk's destination port. inferred in context
• The LGW's inbound dial-peers for Unified CM traffic select a trunk with 'incoming uri via': dial-peer 300 uses uri 300 (Webex) and dial-peer 400 uses uri 400 (PSTN). in context
• In Cisco's Local Gateway design with an existing Unified CM, the LGW routes calls arriving from Unified CM on port 5060 to the PSTN and calls from port 5065 to Webex Calling. in context
• Cisco's LGW guide says to set the SIP trunk security profile incoming port to 5065 for the Webex Calling trunk in Unified CM. Unified CM then accepts messages on 5065 and puts 5065 in the Via header of messages it sends to the LGW. in context
• In the LGW guide, the SRV record wxtocucm.io points LGW-to-Unified CM Webex traffic at Unified CM port 5065, and the SRV record pstntocucm.io points PSTN traffic at Unified CM port 5060. in context
• When the Local Gateway and the PSTN gateway are on the same device, Unified CM needs two trunks to it with different SIP listening ports, so it can tell Webex traffic from PSTN traffic and apply a different class of service to each. in context
• In the LGW guide, voice class uri 300 identifies the Unified CM Webex trunk with the SIP pattern ':5065'. in context
• In the LGW guide, voice class uri 400 identifies the Unified CM PSTN trunk by the Unified CM node address range and port 5060. The example pattern is 192\.168\.80\.6[0-5]:5060. in context
• Cisco recommends Cisco IOS XE 17.12.2 or later for both registration-based and certificate-based Local Gateway trunks. in context
• Cisco's Local Gateway configuration guide assumes a dedicated platform with no existing voice configuration; if an existing PSTN gateway or CUBE Enterprise is reused, the changes must not interrupt existing call flows. in context
• The trunk between the Local Gateway and the Webex cloud uses SIP over TLS, and media between them uses SRTP. in context
• In Cisco's Local Gateway with Unified CM configuration, calls from Unified CM arriving on port 5060 go to the PSTN and calls arriving on port 5065 go to Webex Calling. in context
• Webex for Government does not support a registration-based Local Gateway, so its trunks are certificate-based and depend on a public A or SRV record. in context
• Cisco lists IOS XE 17.9.1a or later as a requirement for a certificate-based Webex Calling Local Gateway. in context
• For a certificate-based Webex Calling Local Gateway trunk, the certificate CN or SAN must match the FQDN or SRV address configured in Control Hub; for an SRV address the certificate carries the SRV domain name, not a target host. in context
• Whether a Webex Calling certificate-based trunk uses an FQDN or SRV address, the Contact address on new SIP dialogs from the Local Gateway must use the name configured in Control Hub. in context
• Cisco's Local Gateway guide shows ip host SRV entries (for example _sip._udp.wxtocucm.io srv 0 1 5065 ucmpub.mydomain.com) with session target dns:wxtocucm.io, so the gateway can pick Unified CM hosts and ports without external DNS. in context
• Control Hub converts trunk FQDN entries to lowercase, so Cisco instructs that the Local Gateway certificate use only lowercase letters. in context
• For a registration-based Webex Calling Local Gateway, only SRV-based Webex Calling addresses are supported on the tenant side toward Webex Calling, for example sip-server dns: and registrar dns: pointing at the Control Hub registrar domain. in context
• Cisco's Webex Calling Local Gateway configuration uses dtmf-relay rtp-nte on the PSTN-facing dial-peer and on the Unified CM-facing dial-peers. in context
• In the Webex Calling Local Gateway configuration for the registration-based trunk, T.38 fax transport is enabled by default. in context
• Local Gateway for Webex for Government does not support Fax (T.38). in context
• In the Cisco Local Gateway TDM example the loop-back dial-peers use G.711 a-law or mu-law chosen to match the companding method of the ISDN service. in context
• For TDM-IP call flows on a Webex Calling Local Gateway, Cisco uses a two-leg call routing process with internal loop-back dial-peers so that ICE media optimization can be applied on the IP leg. in context
• Webex Calling Local Gateway requires Cisco IOS XE 17.6.1a or later for registration-based trunks and 17.9.1a or later for certificate-based trunks. in context
• The Cisco Local Gateway TDM section sends readers to the Configuring ISDN PRI documentation for ISDN setup and shows an E1 PRI example that uses pri-group timeslots 1-31. in context
• The Cisco Local Gateway TDM example marks loop-around calls with over-decadic prefixes such as A1A and A2A. Voice translation rules add these tags on ingress and strip them before the call leaves on the destination trunk. in context
• Cisco documents that TDM ISDN circuits are supported with Webex Calling through a Cisco IOS XE Local Gateway with a TDM PSTN trunk. in context
• A registration-based Webex Calling Local Gateway on Cisco IOS XE requires 17.6.1a or later; a certificate-based one requires 17.9.1a or later and a device certificate signed by a public CA. in context
• For a registration-based Webex Calling Local Gateway, only SRV-based addresses are supported on the tenant side that connects to Webex Calling. in context
• In Cisco's Local Gateway configuration for Webex Calling, voice class tenants hold trunk-specific configuration: tenant 100 carries the Webex Calling registrar, credentials, sip-server and outbound proxy, and the Webex dial-peer inherits them. in context
• In Cisco's Local Gateway design with an existing Unified CM, all calls are routed through Unified CM: calls from Unified CM on port 5060 go to the PSTN and calls on port 5065 go to Webex Calling, using separate dial-peer groups for each path. in context
• Webex for Government does not currently support any third-party SBC as a Local Gateway, and does not support registration-based Local Gateway trunks. in context
• All certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later. in context
• The trunk between a Local Gateway and the Webex cloud uses SIP over TLS for signalling and SRTP for media. in context
• Local Gateway setup requires importing the Cisco root CA bundle into the IOS XE trustpool, using crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b. in context
• The Local Gateway configuration uses voice class tenant to create trunk-specific configuration for the Webex Calling trunk. in context
• All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later. in context
• Cisco's Local Gateway configuration article for Webex Calling describes a diagnostic signature for registration-based Local Gateways that polls SNMP every 10 minutes to detect abnormal call disconnects with SIP errors 403, 488 and 503. in context
• Cisco's Webex Calling Local Gateway IOS XE configuration includes early-offer forced under the global voice service voip configuration in the registration-based trunk procedure. in context
• The Local Gateway guide explains early-offer forced as forcing the gateway to send SDP in the initial INVITE rather than waiting for the neighbouring peer. in context
• For a Webex Calling registration-based local gateway, Cisco counts registration as successful when a 200 OK is received from the access SBC. in context
• The same example configures authentication for two realms, BroadWorks and the registrar domain, and uses the username, password and realm from the credentials configuration when the registration is challenged. in context
• Cisco's registration-based local gateway example sets the tenant registrar with scheme sips, expires 240 and refresh-ratio 50 over TCP TLS. in context
• The Webex Calling Local Gateway article describes a diagnostic signature, reported by the fetch as DS 65221, that detects abnormal call disconnects with SIP errors 403, 488 and 503. in context
• Cisco's Webex Calling Local Gateway configuration article includes the command 'no session refresh', described as disabling SIP session refresh for calls between CUBE and Webex. in context
• By default a Webex Calling Local Gateway blocks incoming VoIP messages from untrusted sources, so the administrator must add allowed subnets explicitly. in context
• Webex for Government supports only certificate-based Local Gateway trunks, not registration-based trunks. in context
• Cisco notes that where a firewall with restricted cone NAT protects the Local Gateway, the trusted list may be disabled on the Webex-facing interface because the firewall provides the external protection. in context
• Webex Calling Local Gateway trunks are either registration-based (digest credentials, IOS XE 17.6.1a or later) or certificate-based (mutual TLS with a publicly signed certificate, IOS XE 17.9.1a or later). in context
• The Local Gateway trusted list should include the regional Webex Calling data center ranges, Unified CM server addresses, and PSTN trunk gateway addresses. in context
• For a Webex Calling Local Gateway, Cisco describes the IP address trusted list as the list of hosts and networks from which the gateway expects legitimate VoIP calls, and uses it to protect against toll fraud. in context
• For a Webex Calling certificate-based trunk, the Local Gateway certificate must be signed by a public CA, and its subject CN or one SAN must equal the FQDN (or the SRV name, when SRV is used) configured in Control Hub. in context
• On a registration-based Local Gateway, 'crypto signaling default trustpoint EmptyTP cn-san-validate server' under sip-ua makes the gateway permit the connection only if the host name configured in tenant 200 appears in the peer certificate's CN or SAN. in context
• Cisco says the Local Gateway certificate should use only lowercase letters, because a case mismatch with the Control Hub FQDN will prevent trunk registration. in context
• The Local Gateway sip-ua block sets 'transport tcp tls v1.2' and 'timers connection establish tls 5' (a minimum of 5 seconds, to be tuned to network conditions) for the TLS connection to Webex Calling. in context
• Cisco's Local Gateway guide installs the Cisco root CA bundle with 'crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b'; the bundle includes the IdenTrust Commercial Root CA 1 certificate used by Webex Calling. in context
• For a certificate-based Local Gateway, a public CA from Cisco's supported list must sign the device certificate, and its CN or one SAN must equal the FQDN configured in Control Hub. in context
• When a registration-based Local Gateway trunk is created in Control Hub, Webex Calling issues the registrar domain, line/port, authentication username and password, outbound proxy SRV address and trunk OTG/DTG value. in context
• Cisco's example registration-based Local Gateway configuration registers over TLS with the sips scheme, a 240-second expiry and refresh ratio 50, so the gateway re-registers about every 120 seconds. in context
• Cisco's Local Gateway guide lists a diagnostic signature (DS 65095) that detects the IOS XE CCAPI 'Call spike threshold' internal-error syslog; the guide gives no spike threshold value. in context
• A Webex Calling certificate-based Local Gateway on Cisco IOS XE requires release 17.9.1a or later. in context
• For high-capacity Local Gateway deployments on Cisco IOS XE, a High Security (HSEC) license and additional throughput entitlement may be required; the article gives no numeric threshold. in context
• In Cisco's IOS XE Local Gateway configuration, max-conn on the Webex Calling dial-peer (dial-peer voice 100) restricts concurrent inbound and outbound calls between the LGW and Webex Calling, and for registration trunks it should be set no higher than 250. in context
• A Webex Calling registration-based Local Gateway on Cisco IOS XE requires release 17.6.1a or later. in context
• Cisco's Local Gateway guide for Webex Calling configures voice class srtp-crypto with crypto 1 AES_CM_128_HMAC_SHA1_80 as the only cipher suite CUBE offers or answers toward Webex Calling, and enables srtp on the Webex Calling dial-peer. in context
• For the registration-based trunk to Webex Calling, the Local Gateway guide configures SIP transport as TLS v1.2 (transport tcp tls v1.2). in context
• Media between a Local Gateway and Webex Calling uses SRTP, and the Webex Calling trunk dial peer is configured with the srtp command. in context
• Cisco's Local Gateway configuration for Webex Calling defines voice class srtp-crypto with only AES_CM_128_HMAC_SHA1_80, stating that Webex Calling supports only SHA1_80. in context
• A Local Gateway trunk must be created in Control Hub before configuring the gateway; it supplies values such as registrar domain, trunk group OTG/DTG, line/port, credentials and outbound proxy. in context
• In Cisco's Local Gateway IOS XE example, dial-peer voice 200 is the IP PSTN trunk dial-peer and is described as 'Inbound/Outbound IP PSTN trunk'. in context
• In the Local Gateway example, the destination dial-peer group on the inbound dial-peer sets which dial-peer handles the outbound leg for calls arriving on that dial-peer. in context
• Cisco's Local Gateway example assumes Webex Calling presents called numbers in +E.164 format. That statement covers calls from Webex Calling toward the gateway, not inbound PSTN calls. in context
• The Local Gateway SIP profile adds the Control Hub trunk group OTG/DTG identifier to the From header so Webex Calling can identify which Local Gateway site within an enterprise sent the call. in context
• In the Local Gateway example, calls are matched to an inbound dial-peer by a voice class URI compared against the INVITE's VIA header. in context
• If the VIA host of an inbound INVITE from the PSTN provider does not match the voice class URI on the PSTN dial-peer, the Local Gateway will probably pick a different inbound dial-peer and never apply the dial-peer group toward Webex Calling, so the call fails or misroutes. inferred in context
• On Catalyst 8000 Edge platforms the Local Gateway requires at least a DNA Essentials licence, and DNA Advantage where voice cards or DSPs are used. in context
• The gateway certificate's CN or SAN must contain the gateway FQDN exactly as configured on the Control Hub trunk. in context
• For a certificate-based trunk, the device certificate must be signed by a public CA from Cisco's supported root CA list. in context
• The certificate-based tenant example points 'sip-server' at a Webex sipconnect DNS name (example: us25.sipconnect.bcld.webex.com) rather than using registrar and credentials. in context
• With 'crypto signaling default trustpoint <tp> cn-san-validate server', the gateway permits the TLS connection only if the host name configured in the tenant appears in the CN or SAN of the certificate received from the Webex outbound proxy. in context
• Cisco's Local Gateway configuration article assumes a dedicated gateway platform with no existing voice configuration. in context
• The Local Gateway selects the inbound Webex Calling dial-peer with 'voice class uri 100 sip' matching 'pattern dtg=<trunk group value from Control Hub>'. in context
• A dummy destination pattern (the Cisco example uses BAD.BAD) is required on dial-peers when outbound calls are routed using an inbound dial-peer group. in context
• The Local Gateway 'voice service voip' sip configuration uses 'early-offer forced' so SDP is sent in the initial INVITE. in context
• Webex for Government does not support third-party SBCs as Local Gateway; CUBE must be used. in context
• Local Gateway for Webex for Government requires FIPS-compliant GCM ciphers to be configured. in context
• All Webex for Government Local Gateways must run IOS XE Dublin 17.12.1a or later. in context
• 'stun usage ice lite' is applied to all Webex Calling-facing dial-peers to allow media optimisation whenever possible. in context
• On ISR 4000 series routers the Local Gateway requires Unified Communications and Security licences. in context
• For registration trunks, the max-conn value on the Webex Calling dial-peer should be at most 250. in context
• In the SIP PSTN design, the Webex Calling dial-peer uses 'destination dpg' to send calls to the PSTN dial-peer group and the PSTN dial-peer sends calls to the Webex Calling dial-peer group. in context
• Cisco recommends IOS XE 17.12.2 for Local Gateway with either trunk type. in context
• After the Local Gateway configuration, save the configuration and reload the platform if this is the first time CUBE features have been configured on it. in context
• The Local Gateway sip-ua configuration includes 'transport tcp tls v1.2' so SIP over TLS uses TLS 1.2. in context
• In the Local Gateway configuration, voice class srtp-crypto 100 makes AES_CM_128_HMAC_SHA1_80 the only SRTP cipher suite CUBE offers in SDP offers and answers. in context
• For a TDM PSTN, Cisco's Local Gateway design uses loop-back call routing so media optimisation remains possible on the Webex call leg. in context
• In the registration-based tenant, the registrar takes the Register Domain value, the credentials take the Line/Port host and Authentication Username and Password, and the outbound-proxy takes the Outbound Proxy Address, all copied from Control Hub. in context
• The gateway's 'ip address trusted list' should contain the regional Webex Calling data-centre subnets plus the addresses of Unified CM servers (if used) and PSTN trunk gateways. in context
• By default the Local Gateway blocks all incoming VoIP messages from IP addresses that are not in its trusted list. in context
• The Local Gateway imports the Cisco root CA bundle with 'crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b'. in context
• In the Unified CM design, calls from Webex Calling are sent to a Unified CM dial-peer group rather than straight to the PSTN, and the Unified CM (port 5065) dial-peer sends calls to the Webex Calling group. in context
• In Cisco's Unified CM design, calls arriving at the gateway from Unified CM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling. in context
• When the Webex Calling trunk is created in Unified CM, its SIP Trunk Security Profile incoming port must be set to 5065. in context
• The Unified CM design defines local DNS SRV entries on the gateway ('ip host _sip._udp...') so a dial-peer session target reaches multiple Unified CM nodes. in context
• Cisco's Local Gateway configuration example assumes Webex Calling presents called numbers to the Local Gateway in +E.164 format and uses a voice translation rule to remove the leading plus before the PSTN. in context
• Webex Calling includes a P-Asserted-Identity header in outbound call INVITEs sent to the Local Gateway. in context
• FIPS-compliant GCM ciphers are mandatory on a Webex for Government Local Gateway and call setup fails without them. in context
• All Webex for Government Local Gateways must run Cisco IOS XE Dublin 17.12.1a or later. in context
• A certificate-based Local Gateway for Webex for Government should present a certificate that chains to a root CA on the Webex for Government root CA list. inferred in context
• Local Gateway for Webex for Government does not support STUN/ICE-Lite for media path optimization. in context
• Local Gateway for Webex for Government does not support T.38 fax. in context
• Webex for Government does not currently support any third-party session border controllers. in context
• Webex for Government does not support registration-based Local Gateway. in context
• The Local Gateway configuration article directs Webex for Government administrators to a separate list of root certificate authorities that Webex for Government supports. in context
• The IOS XE Local Gateway configuration uses voice class tenants for trunk-specific settings, voice class URI to select inbound dial-peers and dial-peer groups to pick outbound dial-peers. in context
• Webex for Government does not currently support any third-party SBCs as Local Gateway. in context
• Pointing a Local Gateway at Genesys BYOC Cloud means building a third-party SIP leg by analogy to the documented PSTN leg, with its own tenant, URI match and dial-peer group, which Cisco does not validate. inferred in context
• The trunk between a Cisco IOS XE Local Gateway and Webex Calling uses SIP over TLS and SRTP media. in context
• Cisco's IOS XE Local Gateway guide documents two topologies, Local Gateway with PSTN and Local Gateway with on-premises Unified CM, and does not document a Genesys Cloud leg. in context
• Cisco lists show sip-ua register status and show voice class tenant among the commands for verifying a Local Gateway. in context
• allow-connections sip to sip enables CUBE's basic SIP back-to-back user agent function on the Local Gateway. in context
• asymmetric payload full under voice service voip sip configures SIP asymmetric payload support for both DTMF and dynamic codec payloads. in context
• The tenant authentication username lines answer per-call authentication challenges, one with realm BroadWorks and one with the Control Hub Registrar Domain as realm. in context
• destination-pattern BAD.BAD on the Local Gateway dial-peers is a dummy pattern, required because outbound calls are routed via an inbound dial-peer's destination dial-peer group rather than by number matching. in context
• A certificate-based Local Gateway trunk needs a public-CA-signed device certificate whose CN or a SAN matches, in lowercase, the FQDN or SRV configured in Control Hub, and a Server Authentication EKU alone is accepted. in context
• The cn-san-validate server keyword on crypto signaling default trustpoint permits the TLS connection only if the configured server hostname appears in the presented certificate's CN or SAN. in context
• Cisco's example voice class codec 100 allows only G.711 for SIP trunk calls, preferring g711ulaw first and g711alaw second. in context
• connection-reuse in tenant 100 makes the Local Gateway use the same persistent TLS connection for registration and call processing. in context
• The tenant credentials command answers the trunk registration challenge using the Control Hub Line/Port host, Authentication Username and Authentication Password values with realm BroadWorks. in context
• In the SIP PSTN design, dial-peer 100 points at destination dpg 200 and dial-peer 200 at destination dpg 100, so any call arriving from Webex leaves to the PSTN and vice versa. in context
• Diagnostic signature DS 64117 checks the Webex SIP trunk registration every 60 seconds and alerts when the trunk unregisters; diagnostic signatures need IOS XE 17.6.1 or later. in context
• For emergency location delivery, Cisco's article passes the Geolocation and Geolocation-Routing headers via voice class sip-hdr-passthrulist and the PIDF-LO body via pass-thru content unsupp. in context
• early-offer forced makes the Local Gateway send SDP in the initial INVITE rather than waiting to offer media later in the dialog. in context
• In the registration-based configuration, crypto pki trustpoint EmptyTP with revocation-check none creates a placeholder trustpoint that the sip-ua TLS configuration references. in context
• Local Gateway for Webex for Government must be configured with FIPS-compliant GCM SRTP ciphers in its voice class srtp-crypto. in context
• Local Gateway for Webex for Government supports only certificate-based trunks and does not support registration-based trunks, STUN or ICE-Lite, or T.38 fax. in context
• voice class stun-usage 100 with stun usage ice lite enables ICE-Lite on all Webex Calling-facing dial-peers so media optimization is negotiated wherever possible. in context
• The network toward Webex Calling must use IPv4, and Local Gateway FQDN or SRV addresses configured in Control Hub must resolve to a public IPv4 address. in context
• The max-conn 250 command on Webex-facing dial-peer 100 restricts concurrent inbound and outbound calls, and for registration trunks the configured maximum should be 250. in context
• Because a Local Gateway trunk itself needs IOS XE 17.6.1a or later, the older 16.12.5 or 17.3 media-optimization floor is not the binding version constraint for a new Local Gateway build. inferred in context
• Media optimization through the Local Gateway is skipped when cloud media services such as call recording are required, so recorded calls route media through the Webex cloud. in context
• A certificate-based Webex Calling Local Gateway trunk on CUBE requires Cisco IOS XE 17.9.1a or later, with 17.12.2 or later recommended. in context
• Local Gateway for Webex for Government requires Cisco IOS XE Dublin 17.12.1a or later. in context
• Cisco's Local Gateway configuration article requires Cisco IOS XE 17.6.1a or later for a registration-based Webex Calling trunk and recommends 17.12.2 or later. in context
• mode border-element under voice service voip enables Cisco Unified Border Element features on the Local Gateway platform. in context
• no remote-party-id in tenant 100 disables the SIP Remote-Party-ID header because Webex Calling supports P-Asserted-Identity instead. in context
• The tenant outbound-proxy command points at the Webex Calling access SBC and must use the Outbound Proxy Address shown in Control Hub. in context
• The key config-key password-encrypt and password encryption aes commands protect the Local Gateway's registration and STUN credentials with symmetric encryption. in context
• privacy-policy passthru in tenant 100 passes privacy header values received on one call leg through to the next leg. in context
• The tenant registrar command uses the Control Hub Register Domain with scheme sips and expires 240 refresh-ratio 50, so the Local Gateway refreshes its registration every two minutes. in context
• rel1xx disable in tenant 100 turns off reliable provisional responses (PRACK) on the Webex Calling trunk. in context
• session target sip-server on dial-peer 100 makes calls from that dial-peer go to the SIP server defined in tenant 100. in context
• Rule 80 of voice class sip-profiles 100 appends the Control Hub trunk group OTG/DTG identifier to the From header so Webex can uniquely identify the Local Gateway site within the enterprise. in context
• Rules 10 to 70 and 90 of voice class sip-profiles 100 rewrite sips: to sip: in the Request-URI, To, From, Contact and P-Asserted-Identity headers because Webex proxies require the SIP scheme. in context
• The tenant sip-server command should name the Edge proxy SRV address provided in Control Hub as the target SIP server for the Webex trunk. in context
• voice class srtp-crypto 100 with crypto 1 AES_CM_128_HMAC_SHA1_80 makes SHA1_80 the only SRTP cipher suite CUBE offers, because Webex Calling supports only SHA1_80. in context
• The global stun configuration lets the Local Gateway send locally generated STUN requests over the negotiated media path to help open firewall pinholes. in context
• T.38 fax transport is enabled by default on the Local Gateway configuration described by Cisco. in context
• The sip-ua tcp-retry 1000 value is counted in 5-millisecond increments, giving a 5-second retry window in Cisco's Local Gateway configuration. in context
• For a TDM PSTN trunk, Cisco's example routes calls through loop-back SIP dial-peers using translation rules that add and strip call routing tags A1A and A2A, so the Webex-facing leg stays SIP-to-SIP. in context
• voice class tenant 100 holds a set of SIP parameters used only for the Webex Calling trunk, leaving the global and PSTN-side configuration unaffected. in context
• Under sip-ua, transport tcp tls v1.2 makes TLS 1.2 the only TLS version the Local Gateway uses for SIP signalling. in context
• ip address trusted list under voice service voip defines the hosts and networks from which the Local Gateway expects legitimate VoIP calls, as protection against toll fraud. in context
• crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b clears the existing trustpool and installs Cisco's root CA bundle, after ip http client source-interface points the download at the Webex-facing interface. in context
• In Cisco's Unified CM integration example, voice class uri 300 pattern :5065 classifies Unified CM-to-Webex calls by the SIP Via port, separating them from Unified CM-to-PSTN calls on 5060. in context
• voice class uri 100 sip uses pattern dtg= followed by the Trunk OTG/DTG value from Control Hub to match incoming Webex INVITEs to the Webex trunk dial-peer. in context
• url sips in tenant 100 is needed because the SRV query must use SIPS as the Webex access SBC supports, while the sip-profile changes all other messages back to SIP. in context
• Video over Webex Calling Local Gateway call flows is not supported, and voice-class sip audio forced can be added to the Webex dial-peer to restrict calls to audio. in context
• Control Hub converts all trunk FQDN entries to lowercase, so the Local Gateway certificate should use only lowercase letters. in context
• The cn-san-validate server option on crypto signaling makes the Local Gateway accept the TLS connection only if the host name configured in the tenant appears in the peer certificate's CN or SAN. in context
• Cisco publishes a diagnostic signature that checks every 60 seconds whether a Local Gateway SIP trunk has unregistered from the Webex Calling cloud. in context
• Diagnostic signatures on the Local Gateway depend on SNMP (checked with show snmp) and are verified with show call-home diagnostic-signature and show call-home diagnostic-signature statistics. in context
• The Local Gateway for Webex for Government does not support STUN/ICE-Lite for media path optimization. in context
• Webex for Government does not support registration-based Local Gateway; only certificate-based trunks are supported there. in context
• On a registration-based trunk, inbound INVITEs from Webex Calling are matched to the Webex dial-peer with a voice class uri that matches the trunk's DTG value (pattern dtg=...) from Control Hub. The DTG uniquely identifies the Local Gateway site within the enterprise. in context
• Inbound calls from an IP PSTN provider are matched to the PSTN dial-peer with a voice class uri host entry that matches the provider's source IP address. in context
• Certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later, and 17.12.2 or later is recommended. in context
• All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later, and 17.12.2 or later is recommended. in context
• A registration or inbound-match failure on a registration-based trunk is plausibly caused by a mismatch between the tenant or URI configuration and the Control Hub trunk info values (registrar, credentials, DTG, outbound proxy), so those values are the first thing to compare. inferred in context
• The Local Gateway tenant configuration disables the SIP Remote-Party-ID header (no remote-party-id) because Webex Calling supports P-Asserted-Identity. in context
• Video over Webex Calling using Local Gateway call flows is not supported. in context
• On a registration-based trunk, max-conn on the Webex-facing dial-peer should be set to no more than 250. in context
• Webex Calling supports only the SHA1_80 SRTP cipher suite (AES_CM_128_HMAC_SHA1_80), so the Local Gateway is configured to offer only that suite on the Webex side. in context
• In the registration-based trunk configuration, T.38 fax transport is enabled by default. in context
• When configuring the tenant side of the Local Gateway toward Webex Calling, only SRV-based addresses are supported. in context
• The sip-ua timers connection establish command sets how long the Local Gateway waits to connect to a proxy before trying the next option. The default is 20 seconds and the minimum is 5 seconds. in context
• The registration-based Local Gateway configuration uses trunk details from Control Hub: Register Domain (registrar), Line/Port host, Authentication Username and Password (credentials), Trunk OTG/DTG value, and Outbound Proxy Address. in context
• The Local Gateway configuration imports Cisco's root CA bundle (ios_core.p7b) into the IOS XE trustpool. The bundle includes the IdenTrust Commercial Root CA1 certificate used by Webex Calling. in context
• Webex for Government requires Cisco IOS XE Dublin 17.12.1a or later on the Local Gateway. in context
• In Cisco's documented coexistence configuration the Local Gateway separates traffic by port: calls arriving from Unified CM on port 5060 are routed to the PSTN and calls arriving on port 5065 are routed to Webex Calling, which requires setting the Unified CM SIP trunk security profile incoming port to 5065. in context
• A certificate-based Local Gateway trunk on CUBE requires Cisco IOS XE Cupertino 17.9.1a or later, with 17.12.2 or later recommended. in context
• A registration-based Local Gateway trunk on CUBE requires Cisco IOS XE Bengaluru 17.6.1a or later, with 17.12.2 or later recommended. in context
• Webex for Government does not support registration-based Local Gateway; it requires certificate-based trunks on IOS XE 17.12.1a or later with FIPS-compliant GCM ciphers. in context
• A certificate-based Local Gateway on Cisco CUBE requires Cisco IOS XE 17.9.1a or later, with 17.12.2 or later recommended. in context
• Cisco's Local Gateway example codec class prefers G.711 mu-law then G.711 A-law, which Cisco says suits most deployments. in context
• Cisco's Local Gateway example routes between Webex Calling and a SIP PSTN trunk with dial-peer groups: the Webex dial-peer's destination is the PSTN dpg and the PSTN dial-peer's destination is the Webex dpg. in context
• Cisco's Local Gateway configuration enables STUN usage with ICE-lite so media optimization is negotiated where possible; Webex for Government does not support it. in context
• On a registration-based trunk the Webex-facing dial-peer's max-conn should be at most 250. in context
• An ISR4000 Local Gateway needs both Unified Communications and Security technology licenses; a Catalyst 8000 Edge needs DNA Advantage with voice cards or DSPs and at least DNA Essentials without them. in context
• In Cisco's example the srtp command is set only on the Webex-facing dial-peer, so the PSTN-facing leg appears to use unencrypted RTP unless the carrier requires otherwise. inferred in context
• A registration-based Local Gateway on Cisco CUBE requires Cisco IOS XE 17.6.1a or later. in context
• For a registration-based trunk, CUBE's voice class tenant carries the Control Hub registrar domain, line/port credentials, digest authentication, TLS transport, the SRTP crypto class and source interfaces. in context
• The Local Gateway's Webex-facing SRTP crypto class must offer AES_CM_128_HMAC_SHA1_80, the only suite Webex Calling supports. in context
• The Local Gateway signals to Webex Calling over SIP TLS 1.2 and needs the Cisco root CA bundle imported into the IOS XE trustpool. in context
• Cisco lists show sip-ua register status and show voice class tenant as Local Gateway verification commands. in context
• Cisco's Local Gateway baseline under voice service voip includes ip address trusted list, allow-connections sip to sip, media statistics and early-offer forced. in context
• Cisco's Local Gateway configuration for a Webex Calling registration-based trunk includes no session refresh in the tenant configuration, which disables SIP session refresh for calls between CUBE and Webex. in context
• In Cisco's example, dial-peer 300 reaches Unified CM through a DNS SRV session target that resolves to multiple Unified CM nodes. in context
• In that design, the incoming dial-peer from Webex (100) applies dial-peer group 300, whose dial-peer 300 sends the call to the Unified CM Webex trunk, and the reverse direction uses dial-peer group 100. in context
• Cisco's Local Gateway example configures voice class codec 100 to allow only G.711 codecs on all trunks. in context
• Registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later, and certificate-based deployments require 17.9.1a or later. in context
• In Cisco's Local Gateway with Unified CM design, calls from Unified CM to the gateway on port 5060 go to the PSTN and calls on port 5065 go to Webex Calling. in context
• Because Webex delivers agent-leg called numbers in +E.164, Unified CM must either hold the agent directory numbers in +E.164 form or manipulate the inbound called number so that it matches the agent directory number. inferred in context
• When creating the Webex Calling trunk in Unified CM, the incoming port in its SIP Trunk Security Profile is set to 5065 so Unified CM accepts messages on that port and puts it in the Via header toward the Local Gateway. in context
• The Local Gateway guide states that Webex presents numbers to the gateway in +E.164 format. in context
• Cisco's Local Gateway configuration also puts dtmf-relay rtp-nte on the SIP PSTN trunk dial-peer (dial-peer 200). in context
• In Cisco's Local Gateway TDM PSTN example, the loop-back dial-peers 10, 11 and 12 each carry dtmf-relay rtp-nte. in context
• Cisco's Local Gateway configuration for an existing Unified CM environment puts dtmf-relay rtp-nte on the UCM-facing dial-peers 300 and 400. in context
• Cisco's Local Gateway on IOS XE configuration puts dtmf-relay rtp-nte on the inbound/outbound dial-peer that faces Webex Calling (dial-peer 100). in context

Cite this source record

APA

WarmTransfer. (2026, July 9). Configure Local Gateway on Cisco IOS XE for Webex Calling. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-help-jr1i3r-configure-lgw-ios-xe

BibTeX

@misc{warmtransfer-cisco-help-jr1i3r-configure-lgw-ios-xe,
  title  = {Configure Local Gateway on Cisco IOS XE for Webex Calling},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-help-jr1i3r-configure-lgw-ios-xe},
  note   = {Cisco Systems, Inc. (Webex Help Center), accessed 2026-09-04}
}