Local Gateway design and configuration

Verified 2026-09-04 · 17 claims · sources tier 2

Also known as LGW.

Local Gateway design involves choosing between registration-based and certificate-based architectures, each governed by specific platform requirements and scaling limits 11​5​12​8. Proper configuration requires understanding these structural boundaries and minimum software versions to maintain reliable call processing 11​5.

How it works

Registration-based Local Gateway trunks authenticate using SIP digest credentials consisting of a shared username and password 4. Registration-based signalling is established outbound only from the enterprise to Webex Calling over SIP with TLS, so no inbound firewall rule is required 15. Webex Calling ignores the registration expiry value sent by the Local Gateway and enforces a value of 120 seconds, refreshing at approximately half that lifetime 14.

Certificate-based trunks authenticate with mutual certificates plus verification of the Local Gateway fully qualified domain name 4. Certificate-based trunks require a domain claimed and verified in Control Hub together with a DNS A or SRV record, whereas registration-based trunks impose no domain claim or DNS requirement 6. Additionally, a certificate-based Local Gateway must be directly reachable from the internet at a public IPv4 address, using one-to-one static NAT if the gateway itself holds a private address 7.

Video is not supported over Local Gateway call flows, and Cisco recommends an audio-only configuration on those trunks 17.

Platform differences and capacity

Supported Local Gateway hardware includes Cisco IOS XE ISR 1100 and 4000 series routers, Catalyst 8200 and 8300 series, Catalyst 8000V Edge Software, and certified third-party session border controllers, and the Local Gateway may be deployed on premises or hosted by a partner 16. However, registration-based trunks support only Cisco Unified Border Element, whereas certificate-based trunks additionally support several third-party session border controllers 13.

A registration-based Local Gateway trunk on CUBE requires Cisco IOS XE Bengaluru 17.6.1a or later, with 17.12.2 or later recommended 11. Conversely, a certificate-based Local Gateway trunk on CUBE requires Cisco IOS XE Cupertino 17.9.1a or later, with 17.12.2 or later recommended 5.

Concurrency scaling differs drastically between the two models. A registration-based Local Gateway is limited to 250 concurrent calls per registering gateway, a ceiling attributed to TLS and TCP signalling performance 12. Calls exceeding the registration-based Local Gateway concurrency ceiling are rejected by the Webex Calling access session border controller with a SIP 403 Forbidden response 10. Field reports suggest that a migration concentrating many users into a single Webex Calling location served by one registration-based Local Gateway can reach the 250 concurrent call ceiling at peak, producing SIP 403 rejections that look like a carrier fault rather than a design limit 1. In contrast, a certificate-based Local Gateway trunk supports up to 2000 concurrent calls over the internet, an order of magnitude more than the registration-based model 8.

Applicability

The claims in this article apply to multi-tenant and premises-based PSTN commercial deployments current as of September 4, 2026 16.

What remains uncertain

Gaps, disputed items, or specific details readers should verify independently include the exact behavior of third-party session border controllers outside of certified Cisco IOS XE hardware platforms, as well as any future adjustments to concurrency ceilings or forced timer intervals imposed by Webex Calling 16​12​14.

WarmTransfer. (2026, September 4). Local Gateway design and configuration. WarmTransfer. https://warmtransfer.net/knowledge/webex-calling-local-gateway

@misc{warmtransfer-webex-calling-local-gateway,
  title  = {Local Gateway design and configuration},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/webex-calling-local-gateway},
  note   = {Verified 2026-09-04}
}