Local Gateway design and configuration

See also

Sources

1. 1
   A migration that concentrates many users into a single Webex Calling location served by 1 registration-based Local Gateway can reach the documented 250 concurrent call ceiling at peak, at which point Cisco states the limit is enforced and additional calls are rejected by the Webex Calling access session border controllers rather than by the carrier.inferred

   Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway page 23, Table 2 page 26 and Location Definitions pages 60-61 · Checked 2026-09-16
2. 2
   Cisco requires organisations in the United States and Canada using on-premises PSTN through a Local Gateway or Cisco Unified Border Element to configure a SIP copy list covering the From, P-Asserted-Identity and P-Attestation-Indicator headers together with 9 SIP profile rules, in order to pass verstat information through to Webex Calling, and states that applying the configuration when the service provider does not send the parameter does not affect calls.

   Secure Calling and Spam mitigation · Configure CUBE for spam indication section and its configuration block · Checked 2026-09-16
3. 3
   Media flows involving a Local Gateway are always anchored on the access session border controllers of the region in which that Local Gateway is deployed.

   Cisco Preferred Architecture for Webex Calling — Design Overview · Architectural Overview, paragraph following Figure 4 · Checked 2026-09-16
4. 4
   Webex for Government requires Cisco IOS XE Dublin 17.12.1a or later on the Local Gateway.

   Configure Local Gateway on Cisco IOS XE for Webex Calling · Webex for Government requirements · Checked 2026-09-04
5. 5
   During coexistence a Local Gateway can simultaneously provide PSTN access and an interconnect to the existing on-premises call control, and the on-premises call control may remain in permanent use alongside Webex Calling.

   Cisco Preferred Architecture for Webex Calling — Design Overview · Interconnect with On-Premises Call Control, page 31 · Checked 2026-09-04
6. 6
   Registration-based trunks authenticate with SIP digest credentials consisting of a shared username and password, while certificate-based trunks authenticate with mutual certificates plus verification of the Local Gateway fully qualified domain name.

   Get started with Local Gateway · Registration versus certificate comparison table · Checked 2026-09-04
7. 7
   A certificate-based Local Gateway trunk on CUBE requires Cisco IOS XE Cupertino 17.9.1a or later, with 17.12.2 or later recommended.

   Configure Local Gateway on Cisco IOS XE for Webex Calling · Platform requirements · Checked 2026-09-04
8. 8
   Certificate-based trunks require a domain claimed and verified in Control Hub together with a DNS A or SRV record, whereas registration-based trunks impose no domain claim or DNS requirement.

   Get started with Local Gateway · Registration versus certificate comparison table · Checked 2026-09-04
9. 9
   A certificate-based Local Gateway must be directly reachable from the internet at a public IPv4 address, using 1-to-one static NAT if the gateway itself holds a private address.

   Configure trunks, route groups, and dial plans for Webex Calling · Network and certificate requirements · Checked 2026-09-04
10. 10
    A certificate-based Local Gateway trunk supports up to 2000 concurrent calls over the internet, an order of magnitude more than the registration-based model.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Table 2, Certificate versus registration based Local Gateway, page 27 · Checked 2026-09-04
11. 11
    Webex Calling does not support wildcard certificates on the Local Gateway, and only certificates carrying the server authentication extended key usage are accepted.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Certificate-based Local Gateway, pages 24-25 · Checked 2026-09-04
12. 12
    Calls exceeding the registration-based Local Gateway concurrency ceiling are rejected by the Webex Calling access session border controller with a SIP 403 Forbidden response.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway, page 23 · Checked 2026-09-04
13. 13
    A registration-based Local Gateway trunk on CUBE requires Cisco IOS XE Bengaluru 17.6.1a or later, with 17.12.2 or later recommended.

    Configure Local Gateway on Cisco IOS XE for Webex Calling · Platform requirements · Checked 2026-09-04
14. 14
    A registration-based Local Gateway is limited to 250 concurrent calls per registering gateway, a ceiling attributed to TLS and TCP signalling performance.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway, page 23 · Checked 2026-09-04
15. 15
    Registration-based trunks support only Cisco Unified Border Element, whereas certificate-based trunks additionally support several third-party session border controllers.

    Get started with Local Gateway · Registration versus certificate comparison table · Checked 2026-09-04
16. 16
    Webex Calling ignores the registration expiry value sent by the Local Gateway and enforces a value of 120 seconds, refreshing at approximately half that lifetime.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway, pages 22-23 · Checked 2026-09-04
17. 17
    Registration-based Local Gateway signalling is established outbound only from the enterprise to Webex Calling over SIP with TLS, so no inbound firewall rule is required.

    Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway, pages 22-23 · Checked 2026-09-04
18. 18
    Supported Local Gateway hardware includes Cisco IOS XE ISR 1100 and 4000 series routers, Catalyst 8200 and 8300 series, Catalyst 8000V Edge Software, and certified third-party session border controllers; the Local Gateway may be deployed on premises or hosted by a partner.

    Transitioning from Unified CM to Webex Calling — Deployment Guide · Table 3, Local Gateway · Checked 2026-09-04
19. 19
    Video is not supported over Local Gateway call flows, and Cisco recommends an audio-only configuration on those trunks.

    Get started with Local Gateway · Video support note · Checked 2026-09-04
20. 20
    2 Detailed Call History Call outcome reason values name the local gateway: LocalGatewayLoop, a loop detected between the local gateway and Webex Calling, recorded as a Refusal, and MaxConcurrentTerminatingAlertingRequestsExceeded, the number of simultaneous unanswered calls to a local gateway for the same calling and called number exceeding the limit, recorded as a Failure.

    Reports: Detailed Call History — Get Detailed Call History · spec.responses.200 schema, Call outcome reason description, Refusal and Failure lists · Checked 2026-09-15
21. 21
    Media optimization with a Local Gateway requires network reachability between the device and the Local Gateway, achieved either by assigning a public IP address to the Local Gateway or by ensuring the Local Gateway host address is accessible to a device on the same network as the gateway.

    Webex Calling media optimization with Interactive Connectivity Establishment (ICE) · Prerequisites and limitations, reachability bullets · Checked 2026-09-16
22. 22
    Media optimization on a Local Gateway is enabled with the command STUN usage lite, the Local Gateway running Cisco Unified Border Element supports ICE-lite with several restrictions, and the feature requires a minimum CUBE software version of 17.3 or 16.12.5.

    Webex Calling media optimization with Interactive Connectivity Establishment (ICE) · Prerequisites and limitations, Local Gateway paragraphs · Checked 2026-09-16
23. 23
    Cisco publishes 3 Local Gateway capacity bands per gateway: up to 250 concurrent calls for about 2500 users on a registration-based over-the-top trunk, about 250 to 2000 concurrent calls for about 20000 users on a certificate-based over-the-top trunk, and about 2000 to 6500 concurrent calls for about 65000 users on a certificate-based interconnect trunk.

    Get started with Local Gateway · Calling capacity requirements, Table 5 Calling capacity guidelines (per local gateway) · Checked 2026-09-15
24. 24
    Cisco Secure Routers C8231-G2, C8231-E-G2, C8235-G2, C8235-E-G2, C8355-G2 and C8375-E-G2 are listed as Local Gateway platforms for both the registration-based and the certificate-based trunking model, at a minimum of Cisco IOS XE 26.2.1.

    Get started with Local Gateway · Table 3 Registration-based SBC and Table 4 Certificate-based SBC, Cisco Secure Routers rows · Checked 2026-09-15
25. 25
    Webex Calling accepts a Local Gateway certificate carrying only the Server Authentication extended key usage and does not validate or enforce the presence of Client Authentication extended key usage during TLS handshake establishment.

    Get started with Local Gateway · Table 2 Compare trunking models, CA and certificate requirements row; repeated under Troubleshooting TLS Handshake establishment · Checked 2026-09-15
26. 26
    Webex Calling does not support running Cisco Unified Communications Manager Express and a Local Gateway on a single instance of vCUBE.

    Get started with Local Gateway · Configure Local Gateway, note after step 3 · Checked 2026-09-15
27. 27
    The network connection between a Local Gateway and Webex Calling should have at most 100 ms one-way latency, 10 ms packet jitter and 0.5% packet loss.

    Get started with Local Gateway · Calling capacity requirements, Connection qualifications · Checked 2026-09-15
28. 28
    A TLS handshake failure after a Local Gateway certificate renewal may be a third-party session border controller enforcing strict extended key usage validation and rejecting a certificate without Client Authentication extended key usage, and Cisco states that any such requirement is determined by the session border controller vendor rather than by Webex Calling.

    Get started with Local Gateway · Troubleshooting TLS Handshake establishment, cause and resolution table plus the closing note · Checked 2026-09-15
29. 29
    5 of the third-party session border controller rows in the certificate-based Local Gateway table carry a documented ICE interoperability limitation: AudioCodes Mediant CE and VE, AudioCodes Mediant Appliances, Ribbon SBC 5000 Series and SBC 7000 and SBC SWe, Ribbon SBC SWe Edge, and Ribbon SBC 1000 and SBC 2000.

    Get started with Local Gateway · Table 4 Certificate-based SBC, Open caveats column · Checked 2026-09-15
30. 30
    Webex for Government does not support registration-based trunking, and the only Local Gateway platform its certificate-based column marks supported is Cisco Unified Border Element; every third-party session border controller row reads not supported for Webex for Government.

    Get started with Local Gateway · Supported session border controllers introduction, and the Webex for Government column of Table 3 and Table 4 · Checked 2026-09-15
31. 31
    Cisco ISR 1100 platforms do not support Local Gateway configuration validation.

    Get started with Local Gateway · Table 3 Registration-based SBC, CUBE row, Open caveats column · Checked 2026-09-15
32. 32
    The managed gateway connector is not supported on Cisco Secure Routers, for either trunking model.

    Get started with Local Gateway · Table 3 and Table 4, Cisco Secure Routers rows, Open caveats column · Checked 2026-09-15
33. 33
    On a registration-based Local Gateway trunk the firewall opens inbound pinholes from the gateway's outbound registration messages, and Cisco recommends opening them for all Webex Calling IP addresses and ports rather than only for the address and port the gateway registers to.

    Get started with Local Gateway · Table 2 Compare trunking models, Network firewall and NAT requirements row, registration-based column · Checked 2026-09-15
34. 34
    A Local Gateway deployed in controller mode as part of a Cisco SD-WAN solution cannot be enrolled to Control Hub and its gateway configuration cannot be validated, and the restriction is stated for every Cisco platform row in both trunking tables.

    Get started with Local Gateway · Table 3 and Table 4, Open caveats column, Cisco rows · Checked 2026-09-15
35. 35
    Configuring a Local Gateway in controller mode as part of a Cisco SD-WAN solution requires Cisco IOS XE Cupertino 17.7.1 or a later release.

    Get started with Local Gateway · Table 3 Registration-based SBC, CUBE row, Minimum version cell · Checked 2026-09-15
36. 36
    The certificate-based Local Gateway table publishes a minimum version for each of its 11 third-party rows: Oracle AP series and VME and Oracle SBC on Public Cloud at 9.3.0; AudioCodes Mediant CE and VE and Mediant Appliances at 7.40A.250.440; Ribbon SBC 5000 Series and SBC 7000 and SBC SWe at 10.1; Ribbon SBC SWe Edge at 11.0.2; Ribbon SBC 1000 and SBC 2000 at 11.0.1; Ribbon 8000 with SBC SWe Edge at 25.0; anynode SBC at 4.10; and Italtel NetMatch-S SBC at NetMatch-S-CI 5.8.0-20240111.

    Get started with Local Gateway · Table 4 Certificate-based SBC, Minimum version column, read as table cells · Checked 2026-09-15
37. 37
    For a Webex Calling deployment on a third-party session border controller, Cisco states that it supports Webex Calling up to the edge deployment and the Webex Calling registered Cisco IP phones, is not responsible for providing assistance for the session border controller itself, and is not responsible for support cases between the customer and the session border controller vendor.

    Get started with Local Gateway · Support for Third-party Local Gateway, Webex Calling support and Vendor support bullets · Checked 2026-09-15
38. 38
    Each Local Gateway is assigned during provisioning to 2 Webex media points of presence for redundancy, the assignment is managed through a DNS SRV record, and the 2 are normally the most appropriate geographically separated points of presence within the same region as the gateway.

    Get started with Local Gateway · Connectivity model and requirements, first paragraph · Checked 2026-09-15
39. 39
    A location that holds a local gateway cannot be deleted while that local gateway is being used for other locations.

    Configure Webex Calling for your organization · Configure premises-based PSTN (Local Gateway) in Control Hub, closing note · Checked 2026-09-15
40. 40
    Basic Automatic Call Distribution is not supported where the Survivability Gateway and the Local Gateway are colocated on one device.

    Site survivability for Webex Calling · Limitations and restrictions, Basic Automatic Call Distribution (B-ACD) · Checked 2026-09-16
41. 41
    A Webex Calling trunk reports 1 of 4 statuses, where Online means every Webex Calling edge proxy connected, Offline means none did, Impaired means at least 1 edge proxy did not, and Unknown means a connection is in progress for a recently added Local Gateway; the status refreshes every 3 minutes.

    Configure trunks, route groups, and dial plans for Webex Calling · Trunk status, filter table and the note beneath it · Checked 2026-09-15

Documents

Cite this page

WarmTransfer. (2026, September 16). Local Gateway design and configuration. WarmTransfer. https://warmtransfer.net/knowledge/webex-calling-local-gateway

@misc{warmtransfer-webex-calling-local-gateway,
  title  = {Local Gateway design and configuration},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/webex-calling-local-gateway},
  note   = {Verified 2026-09-16}
}