Configuration · guide

Setting up a Webex Calling Local Gateway

Cisco IOS XE

Verified 2026-09-24 · 63 sources · tier 2–6

For voice engineers who administer both a Webex Calling organization in Control Hub and the IOS XE router that will act as CUBE.

Cisco IOS XE CUBE operates as a Webex Calling Local Gateway to carry voice traffic between Webex Calling and premises-based connections 50. The deployment relies on SIP TLS signalling and SRTP media sessions established according to the chosen trunk architecture 49.

Before you start

Cisco's Local Gateway configuration procedure assumes a dedicated gateway platform with no existing voice configuration 25.
The connection between on-premises and Webex Calling must be designed and sized for the expected number of concurrent calls and required redundancy 61, with one-way latency between the gateway and the Webex Calling access SBC not exceeding 100 ms 62.
A Control Hub location can be assigned only 1 PSTN option: Cisco Calling Plans, Cloud Connect, or on-premises PSTN via Local Gateway 63.
The task flow involves configuring the trunk in Control Hub, configuring the SBC for the Local Gateway role, and verifying trunk status in Control Hub 50.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Which kind of Webex Calling trunk will the gateway use?

Does Unified CM sit behind the gateway?

Two questions. One permanent page you can send to your manager.

Step 1 Confirm the platform and release

Registration-based trunk

Do

Confirm that the Cisco CUBE router runs Cisco IOS XE Bengaluru 17.6.1a or later 42. Note that registration-based trunks are supported only on Cisco CUBE 44.

Verify

Suggested check: verify that the reported software version meets or exceeds the minimum required release.

Rollback

Suggested rollback: if the platform does not meet software requirements, upgrade the image before continuing.

Certificate-based trunk

Do

Confirm that the Cisco CUBE router runs Cisco IOS XE Cupertino 17.9.1a or later 3. If the deployment is in Webex for Government, CUBE must be used instead of a third-party SBC 31, and it must run Cisco IOS XE Dublin 17.12.1a or later 33.

Verify

Suggested check: confirm that the reported software version meets or exceeds the required release.

Rollback

Suggested rollback: if the platform does not meet software requirements, upgrade the image before continuing.

Step 2 Open network paths to Webex Calling

Registration-based trunk

Do

Allow outbound TCP signalling from the gateway's external interface to the Webex Calling subnets on port 8934 for SIP TLS 39. Do not configure inbound signalling firewall pinholes, because a registration-based gateway reuses the connection it opens 38. The gateway can operate behind dynamic NAT 8.

Verify

Suggested check: review perimeter firewall policy to ensure outbound traffic to destination subnets is allowed from the outside interface.

Rollback

Suggested rollback: remove the outbound firewall access rule.

Certificate-based trunk

Do

Configure the perimeter network so the gateway has a public IP address or static NAT 8, and publish public DNS A or SRV records for the gateway's FQDN 7. Allow outbound TCP signalling from the gateway's external interface to Webex Calling subnets on port 5062 for SIP TLS 39. Allow inbound SIP TLS signalling from Webex Calling subnets to the customer-chosen gateway IP address and port 38.

Verify

Suggested check: query public DNS servers to verify that the gateway FQDN resolves to the configured public or static NAT IP address, and confirm that both inbound and outbound firewall rules are active.

Rollback

Suggested rollback: remove the inbound and outbound firewall access rules and remove the public DNS records.

Step 3 Create the trunk in Control Hub

Registration-based trunk

Do

In Control Hub, navigate to Services > Calling > Call Routing > Trunk and click Add Trunk 19. Select the location, enter a trunk name no longer than 24 characters 18, and choose Registering as the trunk type 21. Set the Max Concurrent Calls value according to the Local Gateway's capacity 14, with a limit of up to 250 concurrent calls per trunk 43. Once saved, copy the Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address, username, and password into a local file 1510.

Verify

Confirm that the trunk appears in Control Hub with a status of Unknown, indicating that connection is in progress for the new gateway 20. Suggested check: verify that all trunk credential parameters have been copied.

Rollback

Delete the trunk from Control Hub if needed, ensuring it is not currently in use 11. If credentials are lost, regenerate them from the trunk information screen using Retrieve Username and Reset Password 16.

Certificate-based trunk

Do

Ensure the organization has a verified domain 9. In Control Hub, navigate to Services > Calling > Call Routing > Trunk and click Add Trunk 19. Select the location, enter a trunk name no longer than 24 characters 18, and select Certificate-based as the trunk type 21. Enter the device type, SBC address as an FQDN or SRV that is unique across the organization, domain, and port 219. Set the Max Concurrent Calls according to gateway capacity 14, noting that certificate-based trunks support more than 250 concurrent calls 6.

Verify

Confirm that the trunk appears in Control Hub with a status of Unknown 20.

Rollback

Delete the trunk in Control Hub, which is permitted only while it is not in use 11.

Step 4 Import trust store and configure TLS

Registration-based trunk

Do

Import the Cisco root CA bundle using:

crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b

56. Configure sip-ua to enforce TLS 1.2 by setting transport tcp tls v1.2 48. Apply crypto signaling default trustpoint <tp> cn-san-validate server under sip-ua, which causes the gateway to permit the TLS connection only if the tenant host name appears in the CN or SAN of the certificate received from the Webex outbound proxy 24.

Verify

Suggested check: run trustpool and running-config verification commands to confirm root certificates and user-agent parameters are present.

Rollback

Suggested rollback: remove the trustpoint and validation lines under sip-ua.

Certificate-based trunk

Do

Import the Cisco root CA bundle using:

crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b

56. Obtain and install a device certificate signed by a public CA from Cisco's supported root CA list 445. Certificates containing only the Server Authentication EKU are supported 47. Configure sip-ua with transport tcp tls v1.2 48 and configure crypto signaling default trustpoint <tp> cn-san-validate server referencing the device trustpoint 24.

Verify

Suggested check: confirm the installed certificate displays the expected CN or SAN matching the address configured in Control Hub.

Rollback

Suggested rollback: delete the device certificate trustpoint and remove the crypto signaling default trustpoint configuration under sip-ua.

Step 5 Configure global voice service and trusted list

No Unified CM behind gateway

Do

Under voice service voip, navigate to sip configuration and enter early-offer forced so SDP is sent in the initial INVITE 28. Under voice service voip, configure ip address trusted list with the regional Webex Calling data-centre subnets and the PSTN trunk gateway addresses 54. By default, the Local Gateway blocks all incoming VoIP messages from IP addresses not in the trusted list 55.

Verify

Suggested check: verify that early offer and the trusted IP address entries for both regional subnets and PSTN gateways are listed.

Rollback

Suggested rollback: remove the added entries from the ip address trusted list and remove early-offer forced from voice service voip.

Unified CM sits behind gateway

Do

Under voice service voip, navigate to sip and configure early-offer forced so SDP is sent in the initial INVITE 28. Configure ip address trusted list to include the regional Webex Calling data-centre subnets, the PSTN trunk gateway addresses, and the IP addresses of all Unified CM servers that send calls to the gateway 54. Without these entries, the Local Gateway blocks incoming VoIP messages from them by default 55.

Verify

Suggested check: verify that the trusted IP list includes regional subnets, PSTN addresses, and node addresses.

Rollback

Suggested rollback: remove the IP entries from ip address trusted list and remove early-offer forced.

Step 6 Define SRTP, ICE-lite, and inbound matching classes

Do

In voice class configuration, configure AES_CM_128_HMAC_SHA1_80 as the only SRTP cipher suite CUBE offers in SDP offers and answers 49. Note that Local Gateway for Webex for Government requires FIPS-compliant GCM ciphers instead 32. Create a voice class stun-usage configured with stun usage ice lite to allow media optimisation on Webex Calling-facing dial-peers 35. Create voice class uri 100 sip configured with pattern dtg=<trunk group value from Control Hub> to select the inbound Webex Calling dial-peer 26.

Verify

Suggested check: confirm the SRTP crypto class, STUN usage class, and URI class definitions are present in the configuration.

Rollback

Suggested rollback: remove the SRTP crypto class, the STUN usage class, and the URI class.

Step 7 Build the Webex Calling tenant and dial-peer

Registration-based trunk

Do

In the registration-based tenant, configure the registrar with the Register Domain, configure credentials using the Line/Port host along with Authentication Username and Password, and configure outbound-proxy with the Outbound Proxy Address copied from Control Hub 52. Make AES_CM_128_HMAC_SHA1_80 the SRTP suite offered 49. Configure the Webex dial-peer: bind the tenant, match the inbound dial-peer using the DTG pattern 26, configure srtp, attach stun usage ice lite 35, configure a dummy destination pattern 27, and set max-conn to at most 250 37.

Verify

Run the command to check registration:

show sip-ua register status

Confirm the numbers registered with the external SIP registrar show registered indicating success 23.

Rollback

Suggested rollback: remove the Webex dial-peer from configuration, then delete the tenant.

Certificate-based trunk

Do

Create the tenant and make AES_CM_128_HMAC_SHA1_80 the SRTP suite offered 49. Do not configure registrar or digest credentials in the tenant, because certificate-based trunks authenticate via certificate verified against the gateway FQDN 53. Configure the Webex dial-peer: bind the tenant, configure srtp, attach stun usage ice lite 35, and configure a dummy destination pattern 27.

Verify

Run the command to verify active SIP user-agent TLS transport connections:

show sip-ua connections tcp tls detail

Confirm that connection tables show active TLS connections toward Webex Calling, noting that a Tenant field is displayed from Cisco IOS XE 17.8.1a 22.

Rollback

Suggested rollback: remove the Webex dial-peer and delete the tenant.

Step 8 Build on-premises dial-peers

No Unified CM behind gateway

Do

Configure a PSTN dial-peer targeting the ITSP gateway IP address or host, and configure a dummy destination pattern on it 27. Configure an inbound PSTN matching rule using a voice class uri targeting the provider's host, and ensure that host is included in the trusted list 54.

Verify

Suggested check: verify that the dial-peer voice summary shows the PSTN dial-peer in an operational state of up.

Rollback

Suggested rollback: remove the PSTN dial-peer and its matching URI class.

Unified CM sits behind gateway

Do

Define local DNS SRV entries (ip host _sip._udp...) on the gateway for the Unified CM nodes so session targets can reach multiple nodes 60. Configure one dial-peer pointing to the SRV target for Webex Calling traffic and another dial-peer pointing to the SRV target for PSTN traffic 60. Maintain the port split: route calls from Unified CM arriving on port 5060 to PSTN and calls arriving on port 5065 to Webex Calling 58. In Unified CM, configure the incoming port in the Webex Calling trunk's SIP Trunk Security Profile to 5065 59. Configure the PSTN dial-peer toward the provider with a dummy destination pattern 27.

Verify

Suggested check: verify that both node dial-peers and the provider dial-peer are listed and up, and verify the security profile configuration.

Rollback

Suggested rollback: remove the dial-peers and the host SRV entries, and revert the SIP Trunk Security Profile incoming port setting.

Step 9 Wire dial-peer groups

No Unified CM behind gateway

Do

A dummy destination pattern is required on dial-peers when outbound calls are routed using an inbound dial-peer group 27.

Verify

Suggested check: verify that the running configuration displays destination dial-peer group references.

Rollback

Suggested rollback: remove dial-peer group routing references.

Unified CM sits behind gateway

Do

In Cisco's Unified CM design, calls arriving at the gateway from Unified CM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling 58. A dummy destination pattern is required on dial-peers when outbound calls are routed using an inbound dial-peer group 27.

Verify

Suggested check: verify dial-peer group memberships and destination bindings in the running configuration.

Rollback

Suggested rollback: remove destination dial-peer group bindings.

Step 10 Save configuration and reload

Do

Save the running configuration to startup configuration, and reload the platform if this is the first time CUBE features have been configured on it 46.

Verify

Suggested check: after reload completes, verify that running configuration parameters are intact.

Rollback

Suggested rollback: restore the previously archived startup configuration if settings failed to initialize properly.

Step 11 Configure call routing in Webex Calling

No Unified CM behind gateway

Do

In Control Hub, navigate to Calling > Locations, select the location, and under Assign or Manage configure the PSTN connection to Premises-based PSTN (Local Gateway) using the configured trunk 13. If multiple trunks are used for redundancy, assign them to a route group supporting up to 10 trunks with priorities, where calls are spread randomly among same-priority trunks and fall back to lower priorities when higher ones fail 17.

Verify

Confirm in Control Hub that the location's PSTN connection displays the selected trunk or route group 13.

Rollback

Suggested rollback: reconfigure the location's PSTN connection in Control Hub to its prior selection.

Unified CM sits behind gateway

Do

In Control Hub, set the location's PSTN connection to Premises-based PSTN (Local Gateway) pointing to the trunk or route group 1317. Navigate to Call Routing > Dial Plans and create a dial plan to route calls matching enterprise extension, E.164, or SIP URI domain patterns to on-premises Unified CM through the trunk or route group 12. See also Unified CM and Webex Calling coexistence during a migration.

Verify

Confirm that the location displays Premises-based PSTN and that the dial plan appears in Control Hub with the configured extension patterns assigned to the trunk or route group 1312.

Rollback

Suggested rollback: delete the dial plan entries routing to the trunk and revert the location's PSTN connection in Control Hub.

Step 12 Verify end to end

Registration-based trunk

Do

In Control Hub, verify the trunk status under Services > Calling > Call Routing > Trunk 19. On the gateway, check registration status with show sip-ua register status 23 and check TLS connection details with show sip-ua connections tcp tls detail 22.

Verify

Verify that Control Hub reports the trunk status as Online, noting that Impaired indicates at least 1 Webex Calling edge proxy cannot connect to it 20. Confirm that show sip-ua register status shows registered 23. Suggested check: place test calls to verify two-way audio.

Rollback

Suggested rollback: if the trunk fails to register or remains impaired, review registration credentials and configuration.

Certificate-based trunk

Do

In Control Hub, check that the trunk status displays Online under Call Routing > Trunk 20. On the gateway, execute show sip-ua connections tcp tls detail to verify established TLS connections to Webex Calling 22. Inbound call signalling from Webex Calling to the customer-chosen gateway address and port exercises the certificate-based inbound path 38.

Verify

Confirm that Control Hub displays trunk status as Online 20. If the trunk shows Impaired, at least 1 Webex Calling edge proxy cannot connect 20; verify the inbound firewall rule, public DNS resolution, and that the certificate's CN or SAN matches the SBC address configured in Control Hub 387924. Suggested check: place test calls to verify call delivery.

Rollback

Suggested rollback: if the trunk does not establish TLS connectivity, re-examine certificate chain validity, DNS host records, and inbound port accessibility.

Applicability

Applies to: Cisco IOS XE CUBE, Cisco Webex Calling, Cisco Webex Calling Control Hub, Cisco Webex Calling for Government, Cisco Webex audio, Cisco Unified CM, and Cisco Local Gateway. Deployments: on-premises and multi-tenant. Sources checked 2026-09-24. Certificate-based trunks require Cisco IOS XE Cupertino 17.9.1a or later 3, whereas registration-based trunks require Cisco IOS XE Bengaluru 17.6.1a or later 42. Deployments on Webex for Government require Cisco IOS XE Dublin 17.12.1a or later, require CUBE hardware, require certificate-based trunks, and mandate FIPS-compliant GCM ciphers 33313032. High availability as box-to-box CUBE redundancy using Redundancy Group infrastructure is documented for Cisco IOS XE 17.9.1 or later 34. For TDM PSTN connections, Cisco's design specifies loop-back call routing so media optimisation remains available on the Webex leg 51.

What remains uncertain

The specific syntax of loop-back call routing configuration for TDM PSTN interfaces is not covered by the sources below. The exact CUBE configuration commands for FIPS-compliant GCM ciphers on Webex for Government are not covered by the sources below. Specific Unified CM calling search spaces, partitions, and route patterns needed on the cluster are not covered by the sources below.

Sources

1
On Catalyst 8000 Edge platforms the Local Gateway requires at least a DNA Essentials licence, and DNA Advantage where voice cards or DSPs are used.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations / prerequisites (licences) · Checked 2026-09-24
2
The gateway certificate's CN or SAN must contain the gateway FQDN exactly as configured on the Control Hub trunk.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Certificate-based trunk, Configure connectivity and security (certificate requirements) · Checked 2026-09-24
3
A certificate-based trunk on Cisco CUBE requires IOS XE Cupertino 17.9.1a or later.
Get started with Local Gateway · Supported platforms, certificate-based trunk list · Checked 2026-09-24
4
For a certificate-based trunk, the device certificate must be signed by a public CA from Cisco's supported root CA list.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Certificate-based trunk, Configure connectivity and security · Checked 2026-09-24
5
The certificate-based tenant example points 'sip-server' at a Webex sipconnect DNS name (example: us25.sipconnect.bcld.webex.com) rather than using registrar and credentials.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Certificate-based trunk section, voice class tenant block · Checked 2026-09-24
6
A certificate-based Local Gateway trunk supports more than 250 concurrent calls per trunk.
Get started with Local Gateway · Trunk types comparison table, concurrent calls row · Checked 2026-09-24
7
A certificate-based trunk requires public DNS A or SRV records for the gateway; a registration-based trunk does not.
Get started with Local Gateway · Trunk types comparison table, DNS configuration row · Checked 2026-09-24
8
A certificate-based trunk requires the gateway to have a public IP address or static NAT, whereas a registration-based trunk works behind dynamic NAT.
Get started with Local Gateway · Trunk types comparison table, NAT requirements row · Checked 2026-09-24
9
A certificate-based trunk requires a verified domain, accepts the SBC address as an FQDN or SRV, and that address must be unique across the organization.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, certificate-based fields · Checked 2026-09-24
10
Cisco recommends copying the registering trunk information from Control Hub into a local file for use when configuring the Local Gateway.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, note after trunk information · Checked 2026-09-24
11
A trunk can be deleted in Control Hub only when it is not in use.
Configure trunks, route groups, and dial plans for Webex Calling · Delete a trunk · Checked 2026-09-24
12
Webex Calling dial plans route calls matching enterprise extension, E.164 or SIP URI domain patterns to on-premises destinations through a trunk or route group.
Configure trunks, route groups, and dial plans for Webex Calling · Dial plans · Checked 2026-09-24
13
A location uses the gateway for PSTN when its PSTN connection is set to Premises-based PSTN (Local Gateway) under Calling > Locations > Assign or Manage.
Configure trunks, route groups, and dial plans for Webex Calling · Premises-based PSTN configuration for a location · Checked 2026-09-24
14
The Control Hub trunk's Max Concurrent Calls value must be set according to the Local Gateway's capacity.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, Max Concurrent Calls field · Checked 2026-09-24
15
After a registering trunk is created, Control Hub shows the Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address, and a username and password.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, trunk information after save · Checked 2026-09-24
16
Lost registering-trunk credentials can't be recovered; they must be regenerated from the trunk information screen with Retrieve Username and Reset Password.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, note on lost credentials · Checked 2026-09-24
17
A route group holds up to 10 trunks with priorities; calls are spread randomly among same-priority trunks and fall back to lower priorities when higher ones fail.
Configure trunks, route groups, and dial plans for Webex Calling · Route groups · Checked 2026-09-24
18
A Webex Calling trunk name can't be more than 24 characters long.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, trunk name field · Checked 2026-09-24
19
A Local Gateway trunk is created in Control Hub under Services > Calling > Call Routing > Trunk with Add Trunk.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, steps · Checked 2026-09-24
20
Control Hub reports a trunk as Online, Offline, Impaired or Unknown; Unknown means connection in progress for a newly added gateway and Impaired means at least one Webex Calling edge proxy can't connect to it.
Configure trunks, route groups, and dial plans for Webex Calling · Trunk status table · Checked 2026-09-24
21
When adding a trunk, Control Hub asks for a location, a trunk name, and a trunk type of Registering or Certificate-based; certificate-based trunks also take a device type, SBC address, domain and port.
Configure trunks, route groups, and dial plans for Webex Calling · Configure a trunk, steps · Checked 2026-09-24
22
'show sip-ua connections {tcp [tls] | udp} {brief | detail}' displays the SIP user-agent transport connection tables, including a Tenant field from IOS XE 17.8.1a.
Cisco IOS Voice Command Reference - S commands - show sip service through show trunk hdlc · show sip-ua connections, syntax and field table · Checked 2026-09-24
23
'show sip-ua register status' displays the numbers the gateway has registered with an external SIP registrar, with a 'registered' field showing whether each registration succeeded.
Cisco IOS Voice Command Reference - S commands - show sip service through show trunk hdlc · show sip-ua register status, description and field table · Checked 2026-09-24
24
With 'crypto signaling default trustpoint <tp> cn-san-validate server', the gateway permits the TLS connection only if the host name configured in the tenant appears in the CN or SAN of the certificate received from the Webex outbound proxy.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure connectivity and security, sip-ua command explanations · Checked 2026-09-24
25
Cisco's Local Gateway configuration article assumes a dedicated gateway platform with no existing voice configuration.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations · Checked 2026-09-24
26
The Local Gateway selects the inbound Webex Calling dial-peer with 'voice class uri 100 sip' matching 'pattern dtg=<trunk group value from Control Hub>'.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, voice class uri 100 block · Checked 2026-09-24
27
A dummy destination pattern (the Cisco example uses BAD.BAD) is required on dial-peers when outbound calls are routed using an inbound dial-peer group.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, dial-peer 100 explanation · Checked 2026-09-24
28
The Local Gateway 'voice service voip' sip configuration uses 'early-offer forced' so SDP is sent in the initial INVITE.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, voice service voip block · Checked 2026-09-24
29
One integrator guide advises replacing underscores with periods in the 'pattern dtg' value on the gateway.field report
Cisco WebEx Calling: Local Gateway configuration to Unified CM · voice class uri section · Checked 2026-09-24
30
Webex for Government supports certificate-based Local Gateway trunks and does not support registration-based trunks.
Get started with Local Gateway · Trunk types comparison table, Webex for Government row · Checked 2026-09-24
31
Webex for Government does not support third-party SBCs as Local Gateway; CUBE must be used.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations · Checked 2026-09-24
32
Local Gateway for Webex for Government requires FIPS-compliant GCM ciphers to be configured.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Webex for Government note in connectivity and security section · Checked 2026-09-24
33
All Webex for Government Local Gateways must run IOS XE Dublin 17.12.1a or later.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations · Checked 2026-09-24
34
Cisco documents Local Gateway high availability as layer-2 box-to-box CUBE redundancy using the Redundancy Group infrastructure on IOS XE 17.9.1 or later, with the Local Gateway configuration then applied to both CUBEs.
Implement CUBE high availability as Local Gateway · Introduction and prerequisites · Checked 2026-09-24
35
'stun usage ice lite' is applied to all Webex Calling-facing dial-peers to allow media optimisation whenever possible.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, voice class stun-usage explanation · Checked 2026-09-24
36
On ISR 4000 series routers the Local Gateway requires Unified Communications and Security licences.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations / prerequisites (licences) · Checked 2026-09-24
37
For registration trunks, the max-conn value on the Webex Calling dial-peer should be at most 250.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, dial-peer 100 explanation · Checked 2026-09-24
38
Inbound SIP TLS signalling from Webex Calling to a customer-chosen gateway address and port applies only to certificate-based gateways; a registration-based gateway reuses the connection it opened.
Port Reference Information for Cisco Webex Calling · Local Gateway row: Call signaling from Webex Calling (SIP TLS) to Local Gateway · Checked 2026-09-24
39
Local Gateway SIP TLS signalling to Webex Calling goes from the gateway's external interface over TCP to the Webex Calling subnets on port 8934 for registration-based trunks and port 5062 for certificate-based trunks.
Port Reference Information for Cisco Webex Calling · Local Gateway row: Call signaling to Webex Calling (SIP TLS) · Checked 2026-09-24
40
In the SIP PSTN design, the Webex Calling dial-peer uses 'destination dpg' to send calls to the PSTN dial-peer group and the PSTN dial-peer sends calls to the Webex Calling dial-peer group.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with SIP PSTN trunk, voice class dpg blocks · Checked 2026-09-24
41
Cisco recommends IOS XE 17.12.2 for Local Gateway with either trunk type.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Key considerations / prerequisites (IOS XE versions) · Checked 2026-09-24
42
A registration-based trunk on Cisco CUBE requires IOS XE Bengaluru 17.6.1a or later.
Get started with Local Gateway · Supported platforms, registration-based trunk list · Checked 2026-09-24
43
A registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk.
Get started with Local Gateway · Trunk types comparison table, concurrent calls row · Checked 2026-09-24
44
Registration-based Local Gateway trunks are supported only on Cisco CUBE, while certificate-based trunks are supported on SBCs from several vendors.
Get started with Local Gateway · Trunk types comparison table, supported devices row; supported platforms list · Checked 2026-09-24
45
Cisco's supported root CAs for Webex audio and video platforms are those in all of the Microsoft, Apple and Mozilla root stores, plus the Cisco-specific roots in the Trusted Core bundle.
What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms? · Trusted External Root bundle description · Checked 2026-09-24
46
After the Local Gateway configuration, save the configuration and reload the platform if this is the first time CUBE features have been configured on it.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with SIP PSTN trunk, closing paragraph · Checked 2026-09-24
47
For certificate-based trunks, gateway certificates that contain only the Server Authentication EKU are supported.
Get started with Local Gateway · Security / certificate note · Checked 2026-09-24
48
The Local Gateway sip-ua configuration includes 'transport tcp tls v1.2' so SIP over TLS uses TLS 1.2.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure connectivity and security, sip-ua block · Checked 2026-09-24
49
In the Local Gateway configuration, voice class srtp-crypto 100 makes AES_CM_128_HMAC_SHA1_80 the only SRTP cipher suite CUBE offers in SDP offers and answers.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, srtp-crypto explanation · Checked 2026-09-24
50
Cisco's Local Gateway task flow is: configure the trunk in Control Hub, then configure the SBC for the Local Gateway role, then verify the trunk's status in Control Hub.
Get started with Local Gateway · Deployment task flow · Checked 2026-09-24
51
For a TDM PSTN, Cisco's Local Gateway design uses loop-back call routing so media optimisation remains possible on the Webex call leg.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with TDM PSTN trunk, first paragraph · Checked 2026-09-24
52
In the registration-based tenant, the registrar takes the Register Domain value, the credentials take the Line/Port host and Authentication Username and Password, and the outbound-proxy takes the Outbound Proxy Address, all copied from Control Hub.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, voice class tenant 100 explanations · Checked 2026-09-24
53
Registration-based trunks authenticate with digest credentials (username and password); certificate-based trunks authenticate with a certificate verified against the gateway FQDN.
Get started with Local Gateway · Trunk types comparison table, authentication row · Checked 2026-09-24
54
The gateway's 'ip address trusted list' should contain the regional Webex Calling data-centre subnets plus the addresses of Unified CM servers (if used) and PSTN trunk gateways.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, ip address trusted list explanation · Checked 2026-09-24
55
By default the Local Gateway blocks all incoming VoIP messages from IP addresses that are not in its trusted list.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Webex Calling registration-based trunk, voice service voip explanation · Checked 2026-09-24
56
The Local Gateway imports the Cisco root CA bundle with 'crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b'.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure connectivity and security · Checked 2026-09-24
57
In the Unified CM design, calls from Webex Calling are sent to a Unified CM dial-peer group rather than straight to the PSTN, and the Unified CM (port 5065) dial-peer sends calls to the Webex Calling group.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment, voice class dpg blocks · Checked 2026-09-24
58
In Cisco's Unified CM design, calls arriving at the gateway from Unified CM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment · Checked 2026-09-24
59
When the Webex Calling trunk is created in Unified CM, its SIP Trunk Security Profile incoming port must be set to 5065.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment · Checked 2026-09-24
60
The Unified CM design defines local DNS SRV entries on the gateway ('ip host _sip._udp...') so a dial-peer session target reaches multiple Unified CM nodes.
Configure Local Gateway on Cisco IOS XE for Webex Calling · Configure Local Gateway with an existing Unified CM environment, ip host explanation · Checked 2026-09-24
61
Cisco says the connection between on-premises and Webex Calling must be designed and sized for the expected number of concurrent calls and the required redundancy.
Design to migrate from Unified CM to Webex Calling · Design to migrate from Unified CM to Webex Calling > PSTN · Checked 2026-09-24
62
Cisco says one-way latency between the Local Gateway and the Webex Calling access SBC should not exceed 100 ms.
Prepare to migrate from Unified CM to Webex Calling · Prepare to migrate > PSTN connectivity · Checked 2026-09-24
63
A Control Hub location can be assigned only one PSTN option: Cisco Calling Plans, Cloud Connect, or on-premises PSTN via Local Gateway.
Prepare to migrate from Unified CM to Webex Calling · Prepare to migrate > PSTN connectivity · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 24). Setting up a Webex Calling Local Gateway. WarmTransfer. https://warmtransfer.net/guides/webex-calling-local-gateway-setup

BibTeX

@misc{warmtransfer-webex-calling-local-gateway-setup,
  title  = {Setting up a Webex Calling Local Gateway},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/webex-calling-local-gateway-setup},
  note   = {Verified 2026-09-24}
}