Remote site survivability patterns
Verified 2026-09-24 · 60 sources · tier 2
Remote site survivability patterns maintain branch calling when connectivity to centralized or cloud call control is interrupted 5214. Implementations span dedicated on-premises appliances, router-embedded survivability engines, and branch software components paired with local session border controllers 455232.
Webex Calling Site Survivability
Each branch deploying Webex Calling Site Survivability requires a Survivability Gateway inside the local network of that site 45. The gateway must be assigned an IPv4 address; IPv6 is not supported 39. In addition, the gateway accepts only certificates signed by publicly known CAs, disallowing private or enterprise CAs 47.
| Platform / Release | Feature / Capacity Detail |
|---|---|
| Cisco IOS XE Dublin 17.12.3 or later | Minimum baseline required for Webex Calling Survivability Gateway features 42. |
| Cisco IOS XE 17.18.2 or later | Hunt groups, call forwarding, and basic auto attendant support 33. |
| Cisco ISR 4321 | Supports a maximum of 50 endpoint registrations 40. |
The Webex Calling Survivability Gateway supports up to 100 hunt groups with at most 32 users in each group 38. In survivability mode, conferencing, 3-way calling, and softkeys for Park, Unpark, Barge, Pickup, Group Pickup, and Call Pull are not supported 4344. Desktop survivability requires Webex App version 43.2 or later on Windows and Mac 50.
In a multi-location setup where a single gateway serves multiple sites, Cisco recommends maintaining latency between the Survivability Gateway and endpoints at 50 ms or less 41. Enterprise Significant Numbers must also be unique across those locations 36. If a Survivability Gateway shares hardware with a Local Gateway, High Availability is not supported for the Local Gateway 4. Following an outage, phone registrations and call control fail back to the Webex cloud only after the connection to the Webex network has been restored for at least 30 seconds 37.
Cisco Unified SRST and Dedicated Instance
Cisco Unified SRST allows a branch router to process calls for Cisco IP phones that have lost contact with their primary, secondary, and tertiary Unified CM nodes 52. If an endpoint maintains an active standby connection to the SRST router, fallback completes in 10 to 20 seconds after losing connection to Unified CM 51. Enabling Unified SIP SRST requires an SRST feature license 55.
In Unified CM, SRST configuration is assigned per device pool, directing phones to an SRST gateway when no Unified CM nodes are reachable 8. The device pool SRST Reference field provides 3 choices: Disable, Use Default Gateway (using the phone's IP gateway), or a user-defined SRST reference 7. Unified CM includes a Connection Monitor Duration parameter that defines how long a phone observes its restored Unified CM link before unregistering from SRST 6. It defaults to 120 seconds, protects against WAN flapping, and can be applied cluster-wide or per device pool 6.
SRST Feature and Hardware Constraints
- Unified SRST 15.0 ships in Cisco IOS XE versions 17.18.1a, 17.18.2, and 26.1.1 59.
- Cisco IOS XE 17.18.2 introduces Unified SRST support on Cisco 8300 Series Secure Routers 57.
- Cisco IOS XE 26.1.1 updates default Unified SRST settings to remove support for TLS 1.0, TLS 1.1, and discontinued ciphers 60.
- During SCCP SRST mode, MeetMe, GPickUp, Park, and Confrn function keys are dimmed because they are unsupported 53.
- Cisco Unified CME in SRST fallback mode supports only SCCP endpoints; SIP endpoints are unsupported 2.
- Cisco Unified SRST Manager cannot be used to provision Enhanced SRST release 12.2 and later 19.
- Beginning with IOS XE 17.9.3 and Dublin 17.11.1a, a Unified SRST configuration and a Webex Calling Survivability Gateway can run concurrently on the same physical gateway 54.
Webex Calling Dedicated Instance Enhanced Survivability
For Webex Calling Dedicated Instance deployments, Enhanced Survivability utilizes an on-premises Enhanced Survivability Node (ESN) to maintain call control and routing when the cloud cannot be reached 14. In a single-site design, an ESN supports up to 7500 registered devices during an outage 11. The ESN routes calls locally within the site and directs all external calls out via the PSTN; therefore, every ESN location must maintain a local DNS server and its own Local Gateway 13. The ESN can also coexist with Cisco SRST 12.
Microsoft Teams Survivable Branch Appliance (SBA)
The Teams Survivable Branch Appliance is Microsoft-provided code distributed to SBC partners, who embed it directly in SBC firmware or offer it as a standalone image for virtual machines or bare-metal hardware 32. SBA requires Media Bypass on the connected SBC so that local Teams clients exchange media directly with the SBC interface 26.
Client Support and User Experience
SBA operation is supported on Teams desktop clients for Windows and macOS, as well as native Teams Phones 22. It does not run on web clients or desktop clients installed inside virtual machines 28.
When cloud connectivity drops, an in-client banner is the sole visual confirmation that an endpoint has transitioned to SBA (Appliance) mode; without this banner, SBA mode is inactive and calls fail 20. Once offline, supported operations include outbound and inbound PSTN calls through the SBC, call hold and resume, blind transfers, forwarding to single telephone numbers or Teams users, redirection of calls directed to auto attendants or call queues, VoIP fallback, and intra-site calls to users registered to the identical SBA 29.
When internet access is restored and all active outbound sessions terminate, the client exits appliance mode, and the SBA uploads its stored call data records to the cloud 25.
Configuration and Known Constraints
Configuration is managed solely using Teams PowerShell cmdlets because the Teams admin center lacks support 30. Administrators must follow a strict setup sequence: create the SBAs, create the Teams branch survivability policy, link the policy to target users, and complete the registration of the SBA application in Microsoft Entra ID 23.
- Authentication timing: Expired client authentication tokens remain valid on the SBA for up to 7 days 31. However, a client cannot connect if it needs to negotiate a fresh token (such as following a system restart) or if it has not established a connection with that specific SBA within the preceding 24 hours 31.
- Continuous Access Evaluation (CAE): Tenants utilizing CAE tokens will find SBA functionality terminates after approximately 30 minutes; Microsoft's documented mitigation is disabling CAE across the tenant 21.
- Emergency calling restrictions: Emergency calls remain dialable in SBA mode, but no location attributes are transmitted with the call 24. Furthermore, Emergency Call Routing Policies are unsupported 27. SBA emergency strings bypass normalization and do not include a leading +; hence, calls will fail unless an organization's regular voice routing policy contains a pattern matching the dial string 27.
See also
- See also Local Gateway design and configuration.
- See also Teams Phone Direct Routing and SBC certification.
- See also Unified CM device pools and device configuration model.
Applicability
Applies to: Cisco Webex Calling, Cisco Unified SRST, Cisco Unified Enhanced SRST, Cisco Unified Communications Manager, Cisco Unified CME, Cisco Webex Calling Dedicated Instance, and Microsoft Teams Phone Direct Routing. Deployments: on-premises, multi-tenant, and dedicated instance. Sources checked 2026-09-24. Webex Calling Site Survivability features require Cisco IOS XE Dublin 17.12.3 or later, with hunt groups, forwarding, and basic auto attendant functions requiring IOS XE 17.18.2 or later 4233. Webex App support requires version 43.2 or later on Windows and Mac 50. Unified SRST 15.0 applies to IOS XE releases 17.18.1a, 17.18.2, and 26.1.1, with Cisco 8300 Series Secure Routers supported as of 17.18.2 5957. Enhanced SRST provisioning restrictions apply from release 12.2 and later 19. The device pool SRST reference and Connection Monitor Duration behaviors are set in Unified CM 86.
What remains uncertain
Hardware registration limits for Webex Calling Survivability Gateways on platforms other than the ISR 4321 are not covered by the sources below. Specific throughput or concurrent call maximums for the Dedicated Instance Enhanced Survivability Node beyond its 7500 device registration limit are not covered by the sources below.
See also
Constrained by
- Teams Phone Direct Routing and SBC certification — Recorded as inbound in the registry: teams-direct-routing is constrained by this topic. SBA is a constrained Direct Routing branch-outage design: it needs Media Bypass; works only on physical desktop clients and Teams Phones; is configured in PowerShell only; sends no E911 location and ignores Emergency Call Routing Policies.
Referenced by
- Setting up site survivability for Webex Calling — This guide is the Webex Calling configuration walk-through; survivability-remote-site carries the general remote-site survivability concepts
- Teams Phone Direct Routing and SBC certification — SBA is a constrained Direct Routing branch-outage design
- Cellular failover for voice at branch sitesstub — Queued 2026-10-14; Remote site survivability patterns is the nearest existing coverage
- SD-WAN considerations for voice — Webex Calling Survivability Gateway needs Control Hub enrollment and gateways in SD-WAN controller mode cannot enrol; whether they can coexist is still an open question
- Setting up Zoom Phone local survivability with Zoom Node — General branch survivability concepts across platforms
- Unified CM device pools and device configuration model — The device pool carries the SRST Reference and Connection Monitor Duration
- Zoom Phone routing and PSTN connectivity — Zoom Phone Local Survivability reuses the BYOC-P SBC and needs a BYOC ELIN.
Sources
- 1Cisco advises customers who need more than 240 phones, secure voice fallback or simple one-time configuration to use Unified SRST instead of CME-based SRST fallback.Cisco Unified Communications Manager Express System Administrator Guide - SRST Fallback Mode · Information About SRST Fallback Mode · Checked 2026-09-24
- 2SRST fallback mode on Cisco Unified CME works only with SCCP phones; SIP phones are not supported.Cisco Unified Communications Manager Express System Administrator Guide - SRST Fallback Mode · Restrictions for SRST Fallback Mode · Checked 2026-09-24
- 3Running Local Gateway and Survivability Gateway services together on one Cisco IOS XE gateway is supported only on IOS XE Dublin 17.12.3 and later.Colocation of Local Gateway and Site Survivability on Cisco IOS Managed Gateways · Prerequisites / supported versions · Checked 2026-09-24
- 4When Local Gateway and Survivability Gateway share one device, High Availability is not supported for the Local Gateway.Colocation of Local Gateway and Site Survivability on Cisco IOS Managed Gateways · Restrictions · Checked 2026-09-24
- 5Local Gateway and Survivability Gateway colocation does not apply to third-party or partner-deployed Local Gateways.Colocation of Local Gateway and Site Survivability on Cisco IOS Managed Gateways · Restrictions · Checked 2026-09-24
- 6Unified CM's Connection Monitor Duration sets how long a phone watches its Unified CM connection before leaving the SRST gateway. It guards against WAN flapping, defaults to 120 seconds, and can be set cluster-wide or per device pool.System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST · Configure Connection Monitor Duration · Checked 2026-09-24
- 7The device pool SRST Reference field in Unified CM has three settings: Disable, Use Default Gateway (the phone's IP gateway acts as the SRST gateway), or a user-defined SRST reference.System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST · SRST Reference field / device pool settings · Checked 2026-09-24
- 8In Unified CM, SRST is set per device pool: when a device pool has an SRST reference, its phones try to connect to that SRST gateway if they cannot reach any Unified CM node.System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST · SRST Overview · Checked 2026-09-24
- 9When connectivity to Unified CM returns, phones on the SRST gateway re-register with Unified CM and full telephony service is restored.System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST · SRST Overview · Checked 2026-09-24
- 10The Unified CM SRST task flow runs in this order: configure an SRST reference, assign it to a device pool, optionally set Connection Monitor Duration, then enable SRST on the gateway.System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST · SRST Configuration Task Flow · Checked 2026-09-24
- 11In a single-site deployment, up to 7500 devices can register to one Enhanced Survivability Node during an outage.Get Started with Enhanced Survivability · Deployment models / single site · Checked 2026-09-24
- 12The Dedicated Instance Enhanced Survivability Node can coexist with Cisco SRST.Get Started with Enhanced Survivability · Overview / coexistence · Checked 2026-09-24
- 13The Enhanced Survivability Node routes calls only within its site; every other call goes to the PSTN, so each ESN site needs its own Local Gateway and a local DNS server.Get Started with Enhanced Survivability · Prerequisites / Deployment considerations · Checked 2026-09-24
- 14For Webex Calling Dedicated Instance, Enhanced Survivability deploys an on-premises Enhanced Survivability Node that handles call control and routing for a site that cannot reach the Dedicated Instance cloud.Get Started with Enhanced Survivability · Overview · Checked 2026-09-24
- 15While a Dedicated Instance site runs on the Enhanced Survivability Node, voicemail, auto attendant, MRA registration and RedSky emergency call routing are unavailable.Get Started with Enhanced Survivability · Features not supported during survivability · Checked 2026-09-24
- 16Enhanced SRST is supported on the Catalyst 8300 from IOS XE Amsterdam 17.3.2 and on the Catalyst 8200 from IOS XE Bengaluru 17.4.1a.Cisco Unified SRST Administration Guide (All Versions) - Enhanced SRST · Supported platforms / releases table · Checked 2026-09-24
- 17Enhanced SRST adds voice hunt groups, shared lines, Busy Lamp Field monitoring, video between local SIP phones and B-ACD, none of which classic Unified SRST provides.Cisco Unified SRST Administration Guide (All Versions) - Enhanced SRST · Enhanced SRST feature list · Checked 2026-09-24
- 18E-SRST Smart Licensing needs one endpoint entitlement per configured phone, counting ephones and voice register pools whether or not they are registered.Cisco Unified SRST Administration Guide (All Versions) - Enhanced SRST · Licensing · Checked 2026-09-24
- 19Enhanced SRST release 12.2 and later cannot be provisioned through Cisco Unified SRST Manager.Cisco Unified SRST Administration Guide (All Versions) - Enhanced SRST · Provisioning / Cisco Unified SRST Manager note · Checked 2026-09-24
- 21If the tenant uses Continuous Access Evaluation tokens, the SBA works for only about 30 minutes. Microsoft's alternative is to disable CAE for the tenant.Survivable Branch Appliance for Direct Routing · Known issues and considerations · Checked 2026-09-24
- 22SBA is supported on the Teams Windows desktop client, the Teams macOS desktop client and Teams Phones.Survivable Branch Appliance for Direct Routing · Supported Teams clients · Checked 2026-09-24
- 23SBA configuration runs in this order: create the SBAs, create the Teams branch survivability policy, assign the policy to users, then register an SBA application in Microsoft Entra ID.Survivable Branch Appliance for Direct Routing · Configuration · Checked 2026-09-24
- 24In SBA mode users can still place emergency calls, but no location information is shared with the call.Survivable Branch Appliance for Direct Routing · Known issues and considerations · Checked 2026-09-24
- 25The Teams client falls back to normal mode once it detects the internet is back and any outgoing calls have ended. The SBA then uploads its collected call data records to the cloud.Survivable Branch Appliance for Direct Routing · How it works · Checked 2026-09-24
- 26The SBA requires the SBC to use Media Bypass, so the branch Teams client exchanges media directly with the SBC.Survivable Branch Appliance for Direct Routing · Prerequisites · Checked 2026-09-24
- 27SBA does not support Emergency Call Routing Policies. Emergency dial strings skip normalization and are sent without a leading +, so emergency calls through the SBA fail unless the regular voice routing policy has a matching pattern.Survivable Branch Appliance for Direct Routing · Known issues and considerations · Checked 2026-09-24
- 28SBA mode activates only on desktop clients running on a physical machine; VMs and web clients are not supported.Survivable Branch Appliance for Direct Routing · How it works · Checked 2026-09-24
- 29In SBA mode a Teams client can make and receive PSTN calls through the local SBC, hold and resume, blind transfer, forward to a single number or Teams user, redirect PSTN calls meant for call queues or auto attendants, use VoIP fallback, and call other local users behind the same SBA.Survivable Branch Appliance for Direct Routing · How it works (list of calling functionality in offline mode) · Checked 2026-09-24
- 30Direct Routing SBA is configured only through Teams PowerShell cmdlets; the Teams admin center does not yet support it.Survivable Branch Appliance for Direct Routing · Configuration · Checked 2026-09-24
- 31In SBA mode, expired client authentication tokens are accepted for up to 7 days. A client that must negotiate a new token (for example after a restart) cannot connect to the SBA, and neither can one that has not connected to that SBA in the last 24 hours.Survivable Branch Appliance for Direct Routing · Known issues and considerations · Checked 2026-09-24
- 32The Teams Survivable Branch Appliance is code that Microsoft gives to SBC vendors, who embed it in SBC firmware or ship it separately to run on its own VM or hardware.Survivable Branch Appliance for Direct Routing · Prerequisites · Checked 2026-09-24
- 33On the Webex Calling Survivability Gateway, hunt groups, call forwarding and the basic auto attendant need IOS XE 17.18.2 or later.Site survivability for Webex Calling · Supported platform models · Checked 2026-09-24
- 34Catalyst 8200 and 8300 Edge models acting as Webex Calling Survivability Gateways support up to 2500 endpoint registrations.Site survivability for Webex Calling · Supported platform models, Table 3 (C8200-1N-4T, C8300-1N1S-6T rows) · Checked 2026-09-24
- 35Emergency calling from a Webex Calling Survivability Gateway needs a PSTN circuit or SIP trunk and uses ELINs mapped by subnet to Emergency Response Locations.Site survivability for Webex Calling · Emergency calling / E911 configuration section · Checked 2026-09-24
- 36When one Survivability Gateway serves several physical locations, Enterprise Significant Numbers must be unique across those locations.Site survivability for Webex Calling · Limitations and restrictions · Checked 2026-09-24
- 37After an outage, registrations and call control go back to the Webex cloud only once the Webex network connection has been restored for at least 30 seconds.Site survivability for Webex Calling · Key conditions for Site Survivability · Checked 2026-09-24
- 38The Webex Calling Survivability Gateway supports up to 100 hunt groups with at most 32 users in each group.Site survivability for Webex Calling · Limitations and restrictions > User experience · Checked 2026-09-24
- 39The Webex Calling Survivability Gateway must use an IPv4 address; IPv6 is not supported.Site survivability for Webex Calling · Limitations and restrictions · Checked 2026-09-24
- 40An ISR 4321 acting as a Webex Calling Survivability Gateway supports a maximum of 50 endpoint registrations.Site survivability for Webex Calling · Supported platform models, Table 3 · Checked 2026-09-24
- 41In a multi-location Survivability Gateway setup, Cisco recommends keeping latency between the Survivability Gateway and its endpoints at 50 ms or less.Site survivability for Webex Calling · Multi location set up · Checked 2026-09-24
- 42Webex Calling Survivability Gateway features require Cisco IOS XE Dublin 17.12.3 or later.Site survivability for Webex Calling · Supported platform models · Checked 2026-09-24
- 43Conferencing and three-way calling are not supported while a Webex Calling site is in survivability mode.Site survivability for Webex Calling · Limitations and restrictions > User experience · Checked 2026-09-24
- 44In Webex Calling survivability mode the Park, Unpark, Barge, Pickup, Group Pickup and Call Pull softkeys are not supported.Site survivability for Webex Calling · Limitations and restrictions > User experience · Checked 2026-09-24
- 45Each site that deploys Webex Calling Site Survivability needs a Survivability Gateway inside that site's local network.Site survivability for Webex Calling · Key conditions for Site Survivability · Checked 2026-09-24
- 46During an outage, PSTN service at a Webex Calling survivability site works only through SIP trunks or PSTN circuits that stay reachable. The gateway reaches the PSTN through a voice interface card or a SIP trunk to a PSTN gateway.Site survivability for Webex Calling · Limitations and restrictions; PSTN connection options · Checked 2026-09-24
- 47The Webex Calling Survivability Gateway accepts only certificates from publicly known CAs; private or enterprise CA certificates cannot be used.Site survivability for Webex Calling · Configure certificates on Cisco IOS XE · Checked 2026-09-24
- 48The Webex Calling Survivability Gateway provides backup calling when a site loses its connection to the Webex cloud: endpoints register locally and keep intrasite calling, PSTN calling and emergency calling.Site survivability for Webex Calling · Overview / Key conditions for Site Survivability · Checked 2026-09-24
- 49The Survivability Gateway syncs user authentication and routing data from Webex daily, and an on-demand sync status update in Control Hub can take up to 30 minutes.Site survivability for Webex Calling · Limitations and restrictions; deployment considerations (daily sync) · Checked 2026-09-24
- 50For survivability, the Webex App on Windows and Mac must be at least version 43.2.Site survivability for Webex Calling · Supported endpoint models, Table 2 · Checked 2026-09-24
- 51If a phone already has an active standby connection to the SRST router, fallback takes 10 to 20 seconds after it loses Unified CM.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · How Fallback Occurs · Checked 2026-09-24
- 52Cisco Unified SRST lets a branch router handle calls for Cisco IP phones that have lost connection to their primary, secondary and tertiary Unified CM nodes.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · Cisco Unified SRST Feature Overview (introduction) · Checked 2026-09-24
- 53During SCCP SRST operation the MeetMe, GPickUp, Park and Confrn function keys are dimmed because SRST does not support them.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · Restrictions for Configuring Cisco Unified SCCP SRST · Checked 2026-09-24
- 54Starting with Cisco IOS XE 17.9.3 and Dublin 17.11.1a, a Survivability Gateway configuration and a Unified SRST configuration can run together on the same gateway.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · Survivability Gateway Colocation with Unified SRST · Checked 2026-09-24
- 55Enabling Cisco Unified SIP SRST requires an SRST feature license.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · Prerequisites for Configuring Cisco Unified SIP SRST · Checked 2026-09-24
- 56Secure SRST supports TLS 1.3 starting with Unified SRST 14.4 (IOS XE 17.14.1a), in addition to TLS 1.0, 1.1 and 1.2.Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview · Secure SRST · Checked 2026-09-24
- 57IOS XE 17.18.2 adds Unified SRST support on the Cisco 8300 Series Secure Routers.Release Notes for Cisco Unified Survivable Remote Site Telephony, 15.0 · New features, Cisco IOS XE 17.18.2 · Checked 2026-09-24
- 58IOS XE 17.18.1a adds Unified SRST support for the Cisco Desk Phone 9861 and 9871.Release Notes for Cisco Unified Survivable Remote Site Telephony, 15.0 · New features, Cisco IOS XE 17.18.1a · Checked 2026-09-24
- 59Cisco Unified SRST 15.0 ships in IOS XE 17.18.1a, 17.18.2 and 26.1.1.Release Notes for Cisco Unified Survivable Remote Site Telephony, 15.0 · Introduction / release-to-IOS XE mapping · Checked 2026-09-24
- 60In IOS XE 26.1.1, Unified SRST's default configuration no longer supports insecure TLS versions 1.0 and 1.1 or the discontinued ciphers.Release Notes for Cisco Unified Survivable Remote Site Telephony, 15.0 · New features, Cisco IOS XE 26.1.1 · Checked 2026-09-24
Documents
Cisco Unified Communications Manager Express System Administrator Guide - SRST Fallback Mode
Cisco Unified SRST Administration Guide (All Versions) - Cisco Unified SRST Feature Overview
Cisco Unified SRST Administration Guide (All Versions) - Enhanced SRST
Colocation of Local Gateway and Site Survivability on Cisco IOS Managed Gateways
Get Started with Enhanced Survivability
Release Notes for Cisco Unified Survivable Remote Site Telephony, 15.0
Site survivability for Webex Calling
Survivable Branch Appliance for Direct Routing
System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure SRST
Cite this page
APA
WarmTransfer. (2026, September 24). Remote site survivability patterns. WarmTransfer. https://warmtransfer.net/knowledge/survivability-remote-site
BibTeX
@misc{warmtransfer-survivability-remote-site,
title = {Remote site survivability patterns},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/survivability-remote-site},
note = {Verified 2026-09-24}
}