Source record · tier 2 current vendor documentation

Get started with Local Gateway

Publisher: Cisco Systems, Inc. (Webex Help Center)
URL: https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway
Published: 2026-09-10
Updated: unknown
Accessed: 2026-09-15
HTTP status: 200
License: Cisco proprietary documentation, all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

Avaya SBCE does not appear among the named validated Webex Calling Local Gateway vendors, so a Webex coexistence design likely needs Cisco CUBE or a listed third-party SBC between Session Manager and Webex Calling. inferred in context
A Webex Calling deployment using a third-party SBC requires support from both Cisco and the SBC vendor partner. in context
Cisco's Local Gateway article names Oracle, AudioCodes, Ribbon, anynode and Italtel SBCs as validated third-party Local Gateways for certificate-based trunks. in context
Webex Calling registration-based Local Gateway trunks support up to 250 concurrent calls per trunk and run only on Cisco CUBE; certificate-based trunks are needed above that and are the model for third-party SBCs. in context
A certificate-based Local Gateway trunk supports more than 250 concurrent calls, works with CUBE and listed third-party SBCs, needs a domain claim and a public DNS A or SRV record for the FQDN, and requires CUBE on IOS XE 17.9.1a or later. in context
Webex Calling does not support running both CME and the Local Gateway on a single vCUBE instance. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls, works only with CUBE, uses digest authentication with a shared username and password, needs no public DNS configuration, and requires CUBE on IOS XE 17.6.1a or later. in context
A single SBC that serves Teams hosting, Zoom BYOC-P and a certificate-based Webex Calling Local Gateway cannot use only a wildcard certificate: Webex LGW rejects wildcards, so the Webex trunk needs its own non-wildcard identity even if Teams and Zoom share a wildcard. inferred in context
A certificate-based Webex Calling Local Gateway trunk supports more than 250 concurrent calls per trunk and several SBC device types, using certificate authentication with Local Gateway FQDN verification. in context
The Webex Calling Local Gateway third-party SBC table lists AudioCodes Mediant CE, VE and appliances as tested at 7.40A.250.440 for certificate-based trunks, with a noted ICE interoperability limitation. in context
Wildcard certificates are not supported for the Webex Calling Local Gateway; the gateway needs a certificate signed by one of the listed certificate authorities. in context
Webex Calling currently does not support running both CME and Local Gateway on a single instance of vCUBE. in context
A registration-based Webex Calling Local Gateway trunk supports up to 250 concurrent calls per trunk, works only with Cisco CUBE, and uses digest authentication. in context
The network connection between a Webex Calling Local Gateway and Webex Calling should have a maximum packet jitter of 10 ms. in context
The network connection between a Webex Calling Local Gateway and Webex Calling should have a maximum one-way latency of 100 ms. in context
The network connection between a Webex Calling Local Gateway and Webex Calling should have a maximum packet loss of 0.5%. in context
Certificate-based Local Gateway trunking needs a public IP or static NAT, while dynamic NAT is preferred for registration-based trunking because it needs fewer firewall changes. in context
An anynode release between 3.20 and 4.09 meets Microsoft's Direct Routing supported minimum but falls below the Webex Calling certificate-based minimum of 4.10. inferred in context
For Webex Calling certificate-based Local Gateway, the minimum version for anynode SBC is 4.10. in context
For Webex Calling certificate-based Local Gateway, the minimum version for AudioCodes Mediant CE and VE and for Mediant appliances is 7.40A.250.440. in context
Webex's per-Local-Gateway capacity guidelines pair about 2000-6500 concurrent calls (about 65000 users) with certificate-based Interconnect, and about 250-2000 concurrent calls (about 20000 users) with certificate-based OTT. in context
Cisco supports deployments that use a validated third-party SBC with Webex Calling, but it does not support the SBC itself and is not responsible for support cases between the customer and the SBC vendor. in context
The minimum IOS XE release for CUBE as a Webex Calling Local Gateway is Cupertino 17.9.1a for certificate-based trunks and Bengaluru 17.6.1a for registration-based trunks. in context
Webex Calling does not require a Client Authentication EKU during the Local Gateway TLS handshake and accepts Server-Authentication-only certificates. Some third-party SBCs enforce strict EKU validation and may reject such certificates. in context
CUBE is the only SBC that currently supports Webex for Government, and every third-party SBC in the certificate-based table is marked 'Not supported' for Webex for Government. in context
For Webex Calling certificate-based Local Gateway, the minimum version for the Italtel NetMatch-S SBC is NetMatch-S-CI 5.8.0-20240111. in context
For Webex Calling certificate-based Local Gateway, the minimum version for the Oracle AP series, Oracle VME and Oracle SBC on Public Cloud is 9.3.0. in context
A Webex Calling registration-based trunk supports up to 250 concurrent calls per trunk, and a certificate-based trunk supports more than 250. in context
A Webex Calling registration-based Local Gateway trunk supports only Cisco Unified Border Element (CUBE). in context
For Webex Calling certificate-based Local Gateway, the minimum version for the Ribbon SBC 1000 and SBC 2000 is 11.0.1. in context
For Webex Calling certificate-based Local Gateway, the minimum version for the Ribbon SBC 5000 Series, SBC 7000 and SBC SWe is 10.1. in context
For Webex Calling certificate-based Local Gateway, the minimum version for the Ribbon SBC SWe Edge is 11.0.2. in context
Webex Calling lists its supported third-party SBCs only in the certificate-based trunk table (Table 4), so third-party SBCs are usable only on certificate-based Local Gateway trunks. in context
Cisco ISR 1100 platforms do not support Local Gateway configuration validation in Control Hub. in context
To configure a Webex Calling Local Gateway (registration-based, Cisco CUBE) in controller mode as part of a Cisco SD-WAN solution, Cisco requires IOS XE Cupertino 17.7.1 or later. in context
A Local Gateway deployed in controller mode with Cisco SD-WAN cannot be enrolled to Control Hub. in context
A Local Gateway deployed in controller mode with Cisco SD-WAN does not support Control Hub validation of its gateway configuration. in context
Cisco Secure Routers (C8231, C8235, C8355, C8375 series) are listed as Local Gateway platforms for registration-based and certificate-based trunks from release 26.2.1. in context
The managed gateway connector is not supported on Cisco Secure Routers. in context
Across the sources, registration plus digest is the model that tolerates dynamic NAT and no public IP, while IP-allow-list and certificate (mTLS) trunks assume a stable public address or static NAT. inferred in context
Webex for Government supports only certificate-based Local Gateway trunks, not registration-based ones. in context
A certificate-based Webex Calling Local Gateway trunk authenticates by certificate with LGW FQDN verification, and every SIP transaction the gateway starts toward Webex Calling must carry the gateway FQDN in the Contact header. in context
Certificate-based Webex Calling Local Gateway trunks support several SBC vendors (Cisco CUBE, Oracle, Ribbon, AudioCodes, anynode and Italtel), not only CUBE. in context
A certificate-based Webex Calling Local Gateway needs a public internet-facing address (public IP or static NAT), public DNS A or SRV records, and a claimed domain. in context
Cisco positions registration-based Webex Calling Local Gateway trunks for up to 250 concurrent calls per trunk and certificate-based trunks for more than 250. in context
A registration-based Webex Calling Local Gateway works behind any NAT or a public IP, with dynamic NAT preferred, because the firewall pinholes are opened by the gateway's outbound registration. in context
Webex Calling registration-based Local Gateway trunks support only Cisco Unified Border Element (CUBE) as the gateway. in context
A registration-based Webex Calling Local Gateway trunk authenticates with SIP digest using a shared username and password for both registration and calls. in context
In Cisco's Local Gateway guideline, 2000 concurrent calls is the boundary at which the minimum link quality changes from OTT to Interconnect while the trunk type stays certificate-based; the guideline does not present 2000 as a per-trunk hard ceiling. inferred in context
Automated troubleshooting is listed as supported for registration-based Local Gateway trunks and not supported for certificate-based trunks. in context
A Webex Calling certificate-based Local Gateway trunk supports more than 250 concurrent calls per trunk. in context
Choosing a certificate-based Webex Calling trunk for capacity above 250 calls also requires domain claims, public DNS A/SRV records, and a CA-signed certificate with the Server Authentication EKU. in context
A Webex Calling certificate-based Local Gateway trunk supports SBCs from multiple vendors, listed as Cisco, Oracle, Ribbon, AudioCodes, anynode and Italtel. in context
During provisioning each Webex Calling Local Gateway is assigned to two Webex Media PoP locations for redundancy and high availability. in context
A Webex Calling registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk. in context
A Webex Calling registration-based Local Gateway trunk can only use Cisco CUBE as the device. in context
A Webex Calling registration-based trunk authenticates with digest credentials (username and password), while a certificate-based trunk authenticates with a certificate plus FQDN verification. in context
The user counts in Cisco's Local Gateway capacity table correspond to roughly ten users per concurrent call at every tier (2,500 for 250; 20,000 for 2000; 65,000 for 6500), but the page does not state this ratio or its traffic assumptions. inferred in context
Cisco's Local Gateway capacity guideline maps a requirement of about 2000 to 6500 concurrent calls (about 65,000 users) to a certificate-based trunk, with Interconnect as the minimum link quality. in context
Cisco's Local Gateway capacity guideline maps a requirement of about 250 to 2000 concurrent calls (about 20,000 users) to a certificate-based trunk, with over-the-top (OTT) as the minimum link quality. in context
Cisco's Local Gateway capacity guideline maps a requirement of up to 250 concurrent calls (about 2,500 users) to a registration-based trunk, with over-the-top (OTT) as the minimum link quality. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls and is supported only on Cisco CUBE and Cisco Secure Routers, while a certificate-based trunk supports more than 250 concurrent calls and is supported on CUBE and on several third-party SBC platforms. in context
Webex Calling Local Gateway runs on Cisco Unified Border Element on IOS XE, or on a supported third-party session border controller from Oracle, Ribbon, AudioCodes, anynode or Italtel. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls and requires CUBE on Cisco IOS XE Bengaluru 17.6.1a or later, while a certificate-based mTLS trunk supports more than 250 concurrent calls and requires Cisco IOS XE Cupertino 17.9.1a or later. in context
Registration-based Local Gateway trunks support up to 250 concurrent calls per trunk and work only with Cisco CUBE using digest authentication, while certificate-based trunks are the option for more than 250 concurrent calls per trunk. in context
Certificate-based Local Gateway trunking is supported on Cisco CUBE from a minimum of Cisco IOS XE Cupertino 17.9.1a, Cisco Secure Routers, Oracle, AudioCodes Mediant, Ribbon, anynode and Italtel NetMatch-S. in context
Control Hub shows a Local Gateway trunk as Online, Offline, Impaired or Unknown. Online means every Webex Calling edge proxy has a successful connection to the Local Gateway. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls, runs only on Cisco CUBE, and uses digest authentication. A certificate-based trunk supports more than 250 concurrent calls, runs on several vendors' SBCs, and verifies the gateway FQDN by certificate. in context
A certificate-based trunk on Cisco CUBE requires IOS XE Cupertino 17.9.1a or later. in context
A certificate-based Local Gateway trunk supports more than 250 concurrent calls per trunk. in context
A certificate-based trunk requires public DNS A or SRV records for the gateway; a registration-based trunk does not. in context
A certificate-based trunk requires the gateway to have a public IP address or static NAT, whereas a registration-based trunk works behind dynamic NAT. in context
Webex for Government supports certificate-based Local Gateway trunks and does not support registration-based trunks. in context
A registration-based trunk on Cisco CUBE requires IOS XE Bengaluru 17.6.1a or later. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk. in context
Registration-based Local Gateway trunks are supported only on Cisco CUBE, while certificate-based trunks are supported on SBCs from several vendors. in context
For certificate-based trunks, gateway certificates that contain only the Server Authentication EKU are supported. in context
Cisco's Local Gateway task flow is: configure the trunk in Control Hub, then configure the SBC for the Local Gateway role, then verify the trunk's status in Control Hub. in context
Registration-based trunks authenticate with digest credentials (username and password); certificate-based trunks authenticate with a certificate verified against the gateway FQDN. in context
The local gateway platform is Cisco Unified Border Element on IOS XE, with registration-based trunks requiring at least IOS XE 17.6.1a and certificate-based trunks at least 17.9.1a. in context
In a Webex for Government deployment a third-party SBC such as a Ribbon or AudioCodes unit cannot serve as the Webex-facing Local Gateway. inferred in context
Certificate-based Local Gateway trunks support more than 250 concurrent calls per trunk, whereas registration-based trunks support up to 250. in context
Certificate-based Local Gateway trunks use certificate-based authentication with Local Gateway FQDN verification instead of digest authentication. in context
Local Gateways in Webex for Government are to be configured with certificate-based trunking. in context
CUBE is the only session border controller that currently supports Webex for Government. in context
A registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk, whereas a certificate-based trunk supports more than 250. in context
Cisco's Local Gateway overview lists Cisco Secure Routers as supported for both registration-based and certificate-based trunks from Cisco IOS XE 26.2.1. in context
The Get started with Local Gateway article gives the Control Hub path to trunk status as Services > PSTN & Routing > Gateway configurations > Trunk, then Trunk Info. disputed in context
Wildcard certificates are not permitted for Local Gateway certificate-based trunking. in context
Besides Cisco CUBE, certificate-based trunking supports third-party SBCs from Oracle, Ribbon, AudioCodes, anynode and Italtel (NetMatch-S). in context
For Webex for Government only certificate-based trunking on CUBE is supported: registration-based trunking is unavailable and no third-party session border controllers are supported. in context
Registration-based trunks authenticate with SIP digest credentials consisting of a shared username and password, while certificate-based trunks authenticate with mutual certificates plus verification of the Local Gateway fully qualified domain name. in context
Certificate-based trunks require a domain claimed and verified in Control Hub together with a DNS A or SRV record, whereas registration-based trunks impose no domain claim or DNS requirement. in context
Registration-based trunks support only Cisco Unified Border Element, whereas certificate-based trunks additionally support several third-party session border controllers. in context
Video is not supported over Local Gateway call flows, and Cisco recommends an audio-only configuration on those trunks. in context
A certificate-based trunk requires a claimed domain and a DNS A or SRV record for the Local Gateway in public DNS, and authenticates by certificate with Local Gateway FQDN verification rather than digest. in context
Cisco sets maximums of 100 ms one-way latency, 10 ms jitter and 0.5 percent packet loss for consistent Local Gateway call quality. in context
During provisioning, each Webex Calling Local Gateway is assigned to two Webex Media PoP locations for redundancy and high availability. in context
Cisco publishes 3 Local Gateway capacity bands per gateway: up to 250 concurrent calls for about 2500 users on a registration-based over-the-top trunk, about 250 to 2000 concurrent calls for about 20000 users on a certificate-based over-the-top trunk, and about 2000 to 6500 concurrent calls for about 65000 users on a certificate-based interconnect trunk. in context
Cisco Secure Routers C8231-G2, C8231-E-G2, C8235-G2, C8235-E-G2, C8355-G2 and C8375-E-G2 are listed as Local Gateway platforms for both the registration-based and the certificate-based trunking model, at a minimum of Cisco IOS XE 26.2.1. in context
Webex Calling accepts a Local Gateway certificate carrying only the Server Authentication extended key usage and does not validate or enforce the presence of Client Authentication extended key usage during TLS handshake establishment. in context
Webex Calling does not support running Cisco Unified Communications Manager Express and a Local Gateway on a single instance of vCUBE. in context
The network connection between a Local Gateway and Webex Calling should have at most 100 ms one-way latency, 10 ms packet jitter and 0.5% packet loss. in context
A TLS handshake failure after a Local Gateway certificate renewal may be a third-party session border controller enforcing strict extended key usage validation and rejecting a certificate without Client Authentication extended key usage, and Cisco states that any such requirement is determined by the session border controller vendor rather than by Webex Calling. in context
5 of the third-party session border controller rows in the certificate-based Local Gateway table carry a documented ICE interoperability limitation: AudioCodes Mediant CE and VE, AudioCodes Mediant Appliances, Ribbon SBC 5000 Series and SBC 7000 and SBC SWe, Ribbon SBC SWe Edge, and Ribbon SBC 1000 and SBC 2000. in context
Webex for Government does not support registration-based trunking, and the only Local Gateway platform its certificate-based column marks supported is Cisco Unified Border Element; every third-party session border controller row reads not supported for Webex for Government. in context
Cisco ISR 1100 platforms do not support Local Gateway configuration validation. in context
The managed gateway connector is not supported on Cisco Secure Routers, for either trunking model. in context
On a registration-based Local Gateway trunk the firewall opens inbound pinholes from the gateway's outbound registration messages, and Cisco recommends opening them for all Webex Calling IP addresses and ports rather than only for the address and port the gateway registers to. in context
A Local Gateway deployed in controller mode as part of a Cisco SD-WAN solution cannot be enrolled to Control Hub and its gateway configuration cannot be validated, and the restriction is stated for every Cisco platform row in both trunking tables. in context
Configuring a Local Gateway in controller mode as part of a Cisco SD-WAN solution requires Cisco IOS XE Cupertino 17.7.1 or a later release. in context
The certificate-based Local Gateway table publishes a minimum version for each of its 11 third-party rows: Oracle AP series and VME and Oracle SBC on Public Cloud at 9.3.0; AudioCodes Mediant CE and VE and Mediant Appliances at 7.40A.250.440; Ribbon SBC 5000 Series and SBC 7000 and SBC SWe at 10.1; Ribbon SBC SWe Edge at 11.0.2; Ribbon SBC 1000 and SBC 2000 at 11.0.1; Ribbon 8000 with SBC SWe Edge at 25.0; anynode SBC at 4.10; and Italtel NetMatch-S SBC at NetMatch-S-CI 5.8.0-20240111. in context
For a Webex Calling deployment on a third-party session border controller, Cisco states that it supports Webex Calling up to the edge deployment and the Webex Calling registered Cisco IP phones, is not responsible for providing assistance for the session border controller itself, and is not responsible for support cases between the customer and the session border controller vendor. in context
Each Local Gateway is assigned during provisioning to 2 Webex media points of presence for redundancy, the assignment is managed through a DNS SRV record, and the 2 are normally the most appropriate geographically separated points of presence within the same region as the gateway. in context

Cite this source record

APA

WarmTransfer. (2026, September 10). Get started with Local Gateway. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-help-t9xctu-get-started-local-gateway

BibTeX

@misc{warmtransfer-cisco-help-t9xctu-get-started-local-gateway,
  title  = {Get started with Local Gateway},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-help-t9xctu-get-started-local-gateway},
  note   = {Cisco Systems, Inc. (Webex Help Center), accessed 2026-09-15}
}