# Webex Calling Local Gateway IOS XE command reference Canonical: https://warmtransfer.net/knowledge/webex-lgw-ios-xe-command-reference Last verified: 2026-10-02 The Webex Calling Local Gateway runs on Cisco IOS XE, where `mode border-element` under `voice service voip` enables Cisco Unified Border Element features[^32]. Cisco documents both registration-based and certificate-based trunks: a registration-based trunk supports up to 250 concurrent calls per trunk, and a certificate-based trunk supports more than 250[^37]. ## Software version requirements | Trunk or deployment | IOS XE requirement | |---|---| | Registration-based trunk | 17.6.1a or later, 17.12.2 or later recommended[^31] | | Certificate-based trunk on CUBE | 17.9.1a or later, 17.12.2 or later recommended[^29] | | Webex for Government | Dublin 17.12.1a or later[^30] | Cisco's Local Gateway configuration article states the registration-based requirement[^31]. Webex Calling media optimization on a Local Gateway requires a minimum CUBE software version of 17.3 or 16.12.5[^27]. WarmTransfer's reading of the sources is that the 16.12.5 or 17.3 media-optimization floor is not the binding version constraint for a new Local Gateway build, because the trunk itself needs IOS XE 17.6.1a or later[^26]. ## Connectivity and security commands - `key config-key password-encrypt` and `password encryption aes` protect the Local Gateway's registration and STUN credentials with symmetric encryption[^35]. - Cisco's CUBE hardening guide states that CUBE requires encrypted passwords from release 16.11 onward to encrypt SIP registration and other IOS XE passwords in the running configuration[^11]. - In the registration-based configuration, `crypto pki trustpoint EmptyTP` with `revocation-check none` creates a placeholder trustpoint that the sip-ua TLS configuration references[^18]. - `ip http client source-interface` points the trustpool download at the Webex-facing interface, and `crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b` then clears the existing trustpool and installs Cisco's root CA bundle[^56]. - Under `sip-ua`, `transport tcp tls v1.2` makes TLS 1.2 the only TLS version the Local Gateway uses for SIP signalling[^53]. - The `cn-san-validate server` keyword on `crypto signaling default trustpoint` permits the TLS connection only if the configured server hostname appears in the presented certificate's CN or SAN[^7]. - `sip-ua tcp-retry 1000` is counted in 5-millisecond increments, which gives a 5-second retry window in Cisco's Local Gateway configuration[^49]. A certificate-based trunk needs a public-CA-signed device certificate whose CN or a SAN matches, in lowercase, the FQDN or SRV configured in Control Hub, and a Server Authentication EKU alone is accepted[^6]. The network toward Webex Calling must use IPv4, and Local Gateway FQDN or SRV addresses configured in Control Hub must resolve to a public IPv4 address[^24]. ## Voice service voip commands - `ip address trusted list` defines the hosts and networks from which the Local Gateway expects legitimate VoIP calls, as protection against toll fraud[^55]. - CUBE trusts inbound connections from addresses configured as dial-peer session targets and in voice class server-group configurations by default, so these need no trusted-list entry[^54]. - `mode border-element` enables Cisco Unified Border Element features on the Local Gateway platform[^32]. - `allow-connections sip to sip` enables CUBE's basic SIP back-to-back user agent function on the Local Gateway[^1]. - The global `stun` configuration lets the Local Gateway send locally generated STUN requests over the negotiated media path to help open firewall pinholes[^47]. - In `stun flowdata agent-id tag boot-count`, the agent-id tag ranges 0 to 255, and the optional boot-count ranges 0 to 65535 and helps prevent anti-replay attacks after a router reload[^46]. - `asymmetric payload full` under `voice service voip` `sip` configures SIP asymmetric payload support for both DTMF and dynamic codec payloads[^3]. - `early-offer forced` makes the Local Gateway send SDP in the initial INVITE rather than waiting to offer media later in the dialog[^17]. ## Codec, ICE-Lite and SRTP classes Cisco's example `voice class codec 100` allows only G.711 for SIP trunk calls, with g711ulaw preferred first and g711alaw second[^8]. `voice class stun-usage 100` with `stun usage ice lite` enables ICE-Lite on all Webex Calling-facing dial-peers so that media optimization is negotiated wherever possible[^21]. CUBE implements ICE only in ICE-lite mode: it neither gathers candidates nor initiates connectivity checks, and it only responds to them[^12]. CUBE's ICE-Lite support does not work with IPv6, SDP passthrough, media flow-around, codec transparent mode, MTP, and other features the guide lists[^22]. Media optimization through the Local Gateway is skipped when cloud media services such as call recording are required, so recorded calls route media through the Webex cloud[^28]. `voice class srtp-crypto 100` with `crypto 1 AES_CM_128_HMAC_SHA1_80` makes SHA1_80 the only SRTP cipher suite CUBE offers, because Webex Calling supports only SHA1_80[^45]. ## Voice class tenant 100 on a registration-based trunk `voice class tenant 100` holds a set of SIP parameters used only for the Webex Calling trunk and leaves the global and PSTN-side configuration unaffected[^52]. When a dial-peer is bound to a CUBE tenant with `voice-class sip tenant`, settings apply in the order dial-peer first, then tenant, then global[^51]. - `registrar` uses the Control Hub Register Domain with scheme sips and `expires 240 refresh-ratio 50`, so the Local Gateway refreshes its registration every 2 minutes[^38]. - `credentials` answers the trunk registration challenge using the Control Hub Line/Port host, Authentication Username, and Authentication Password values with realm BroadWorks[^10]. - The `authentication username` lines answer per-call authentication challenges, one with realm BroadWorks and one with the Control Hub Registrar Domain as realm[^4]. - `no remote-party-id` disables the SIP Remote-Party-ID header, because Webex Calling supports P-Asserted-Identity instead[^33]. - In the IOS voice command reference, `asserted-id pai` or `ppi` takes priority over the Remote-Party-ID header and removes RPID from the outbound message[^2]. - `connection-reuse` makes the Local Gateway use the same persistent TLS connection for registration and call processing[^9]. - `url sips` is needed because the SRV query must use SIPS, which the Webex access SBC supports, while the sip-profile changes all other messages back to SIP[^59]. - `rel1xx disable` turns off reliable provisional responses (PRACK) on the Webex Calling trunk[^39]. - `outbound-proxy` points at the Webex Calling access SBC and must use the Outbound Proxy Address shown in Control Hub[^34]. - `privacy-policy passthru` passes privacy header values received on one call leg through to the next leg[^36]. ## SIP profiles and URI matching Rules 10 to 70 and 90 of `voice class sip-profiles 100` rewrite sips: to sip: in the Request-URI, To, From, Contact, and P-Asserted-Identity headers, because Webex proxies require the SIP scheme[^43]. Rule 80 appends the Control Hub trunk group OTG/DTG identifier to the From header so that Webex can uniquely identify the Local Gateway site within the enterprise[^42]. `voice class uri 100 sip` uses `pattern dtg=` followed by the Trunk OTG/DTG value from Control Hub to match incoming Webex INVITEs to the Webex trunk dial-peer[^58]. `incoming uri via` matches the topmost Via header of an incoming SIP request, which represents the neighbouring SIP entity that last forwarded it[^23]. In Cisco's Unified CM integration example, `voice class uri 300` with `pattern:5065` classifies Unified CM-to-Webex calls by the SIP Via port and separates them from Unified CM-to-PSTN calls on 5060[^57]. ## Dial-peers and call routing - `destination-pattern BAD.BAD` on the Local Gateway dial-peers is a dummy pattern, required because outbound calls are routed through an inbound dial-peer's destination dial-peer group rather than by number matching[^5]. - `session target sip-server` on dial-peer 100 sends calls from that dial-peer to the SIP server defined in tenant 100[^41]. - `max-conn 250` on Webex-facing dial-peer 100 restricts concurrent inbound and outbound calls, and for registration trunks the configured maximum should be 250[^25]. - A CUBE `voice class dpg` can group up to 20 outbound SIP dial-peers as the destination of an inbound dial-peer[^14]. - In the SIP PSTN design, dial-peer 100 points at `destination dpg 200` and dial-peer 200 at `destination dpg 100`, so any call arriving from Webex leaves to the PSTN and any call arriving from the PSTN leaves to Webex[^13]. - For a TDM PSTN trunk, Cisco's example routes calls through loop-back SIP dial-peers, using translation rules that add and strip call routing tags A1A and A2A, so that the Webex-facing leg stays SIP-to-SIP[^50]. ## Media, fax and emergency calling behaviour Video over Webex Calling Local Gateway call flows is not supported, and `voice-class sip audio forced` can be added to the Webex dial-peer to restrict calls to audio[^60]. T.38 fax transport is enabled by default on the Local Gateway configuration Cisco describes[^48]. For emergency location delivery, Cisco's article passes the Geolocation and Geolocation-Routing headers through `voice class sip-hdr-passthrulist` and passes the PIDF-LO body through `pass-thru content unsupp`[^16]. ## Webex for Government differences Local Gateway for Webex for Government supports only certificate-based trunks, and it does not support registration-based trunks, STUN or ICE-Lite, or T.38 fax[^20]. It requires Cisco IOS XE Dublin 17.12.1a or later[^30]. ## Diagnosing it Diagnostic signature DS 64117 checks the Webex SIP trunk registration every 60 seconds and alerts when the trunk unregisters, and diagnostic signatures need IOS XE 17.6.1 or later[^15]. ## See also - See also [Setting up a Webex Calling Local Gateway](https://warmtransfer.net/knowledge/webex-calling-local-gateway-setup). - See also [Troubleshooting a Webex Calling Local Gateway](https://warmtransfer.net/knowledge/webex-local-gateway-troubleshooting). - See also [Webex Calling ICE media path optimization](https://warmtransfer.net/knowledge/webex-calling-media-optimization). - See also [Webex for Government calling restrictions](https://warmtransfer.net/knowledge/webex-calling-webex-for-government). ## Applicability Applies to: Cisco Webex Calling Local Gateway, Cisco Unified Border Element, and Cisco IOS XE. Deployments: on-premises, multi-tenant, and webex-for-government. Sources checked 2026-10-02. A registration-based trunk requires Cisco IOS XE 17.6.1a or later, and a certificate-based trunk requires 17.9.1a or later; 17.12.2 or later is recommended for both[^31][^29]. Local Gateway for Webex for Government requires Cisco IOS XE Dublin 17.12.1a or later and supports only certificate-based trunks[^30][^20]. The CUBE encrypted-password requirement applies from release 16.11 onward[^11]. Diagnostic signatures need IOS XE 17.6.1 or later[^15]. ## What remains uncertain The verbatim `voice class tenant` and `sip-ua` command blocks for a certificate-based trunk are not covered by the sources below. Configuration differences for a Local Gateway on Cisco Secure Router with IOS XE 26.x are not covered by the sources below. Raw-HTML verification of every source excerpt and locator behind these claims is not covered by the sources below. The scope of the configuration validation that Control Hub performs on a managed gateway is not covered by the sources below. The exact GCM `srtp-crypto` keyword for Webex for Government is not covered by the sources below. The meaning of `no supplementary-service sip refer` in the Local Gateway template is not covered by the sources below. The root CA list for Webex for Government Local Gateway certificates is not covered by the sources below. The apparent mismatch between the sip-server host in Cisco's example configuration and the host in its explanation is not covered by the sources below. ## Sources [^1]: allow-connections sip to sip enables CUBE's basic SIP back-to-back user agent function on the Local Gateway. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: allow-connections sip to sip. Checked 2026-10-02. [^2]: In the IOS voice command reference, asserted-id pai or ppi takes priority over the Remote-Party-ID header and removes RPID from the outbound message. Source: [Cisco IOS Voice Command Reference - A through C - A](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/vcr1/vcr1-cr-book/vcr-a1.html), asserted-id command entry: usage guidelines. Checked 2026-10-02. [^3]: asymmetric payload full under voice service voip sip configures SIP asymmetric payload support for both DTMF and dynamic codec payloads. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: asymmetric payload full. Checked 2026-10-02. [^4]: The tenant authentication username lines answer per-call authentication challenges, one with realm BroadWorks and one with the Control Hub Registrar Domain as realm. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, authentication. Checked 2026-10-02. [^5]: destination-pattern BAD.BAD on the Local Gateway dial-peers is a dummy pattern, required because outbound calls are routed via an inbound dial-peer's destination dial-peer group rather than by number matching. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Dial-peer 100, 200, 300 and 400 explanation lists: destination-pattern BAD.BAD. Checked 2026-10-02. [^6]: A certificate-based Local Gateway trunk needs a public-CA-signed device certificate whose CN or a SAN matches, in lowercase, the FQDN or SRV configured in Control Hub, and a Server Authentication EKU alone is accepted. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Certificate-based trunk prerequisites: certificate requirements. Checked 2026-10-02. [^7]: The cn-san-validate server keyword on crypto signaling default trustpoint permits the TLS connection only if the configured server hostname appears in the presented certificate's CN or SAN. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: sip-ua explanation, crypto signaling default trustpoint. Checked 2026-10-02. [^8]: Cisco's example voice class codec 100 allows only G.711 for SIP trunk calls, preferring g711ulaw first and g711alaw second. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class codec 100 block and explanation. Checked 2026-10-02. [^9]: connection-reuse in tenant 100 makes the Local Gateway use the same persistent TLS connection for registration and call processing. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, connection-reuse. Checked 2026-10-02. [^10]: The tenant credentials command answers the trunk registration challenge using the Control Hub Line/Port host, Authentication Username and Authentication Password values with realm BroadWorks. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, credentials. Checked 2026-10-02. [^11]: Cisco's CUBE hardening guide states CUBE requires encrypted passwords from release 16.11 onward to encrypt SIP registration and other IOS XE passwords in the running configuration. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), Password encryption section. Checked 2026-10-02. [^12]: CUBE implements ICE only in ICE-lite mode: it neither gathers candidates nor initiates connectivity checks, and only responds to them. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: ICE-Lite Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-icelite.html), ICE-Lite Support: feature information / restrictions. Checked 2026-10-02. [^13]: In the SIP PSTN design, dial-peer 100 points at destination dpg 200 and dial-peer 200 at destination dpg 100, so any call arriving from Webex leaves to the PSTN and vice versa. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Call routing with dial-peer groups: voice class dpg 100 and 200 and destination dpg lines. Checked 2026-10-02. [^14]: A CUBE voice class dpg can group up to 20 outbound SIP dial-peers as the destination of an inbound dial-peer. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Outbound Dial Peer Group as an Inbound Dial-Peer Destination](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_multiple-outbound-dial-peer.html), Outbound Dial Peer Group as an Inbound Dial-Peer Destination: feature information. Checked 2026-10-02. [^15]: Diagnostic signature DS 64117 checks the Webex SIP trunk registration every 60 seconds and alerts when the trunk unregisters; diagnostic signatures need IOS XE 17.6.1 or later. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Diagnostic signatures section: prerequisites and signature list. Checked 2026-10-02. [^16]: For emergency location delivery, Cisco's article passes the Geolocation and Geolocation-Routing headers via voice class sip-hdr-passthrulist and the PIDF-LO body via pass-thru content unsupp. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), SIP header pass-through configuration for E911. Checked 2026-10-02. [^17]: early-offer forced makes the Local Gateway send SDP in the initial INVITE rather than waiting to offer media later in the dialog. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: early-offer forced. Checked 2026-10-02. [^18]: In the registration-based configuration, crypto pki trustpoint EmptyTP with revocation-check none creates a placeholder trustpoint that the sip-ua TLS configuration references. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: crypto pki trustpoint EmptyTP step. Checked 2026-10-02. [^19]: Local Gateway for Webex for Government must be configured with FIPS-compliant GCM SRTP ciphers in its voice class srtp-crypto. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Webex for Government certificate-based trunk: voice class srtp-crypto note. Checked 2026-10-02. [^20]: Local Gateway for Webex for Government supports only certificate-based trunks and does not support registration-based trunks, STUN or ICE-Lite, or T.38 fax. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Webex for Government limitations list. Checked 2026-10-02. [^21]: voice class stun-usage 100 with stun usage ice lite enables ICE-Lite on all Webex Calling-facing dial-peers so media optimization is negotiated wherever possible. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class stun-usage 100 block and explanation. Checked 2026-10-02. [^22]: CUBE's ICE-Lite support does not work with IPv6, SDP passthrough, media flow-around, codec transparent mode or MTP among other listed features. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: ICE-Lite Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-icelite.html), ICE-Lite Support: restrictions list. Checked 2026-10-02. [^23]: incoming uri via matches the topmost Via header of an incoming SIP request, which represents the neighbouring SIP entity that last forwarded it. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Matching Inbound Dial Peers by URI of Incoming SIP Calls](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-inbnd-dp-match-uri.html), Matching Inbound Dial Peers by URI: via header matching. Checked 2026-10-02. [^24]: The network toward Webex Calling must use IPv4, and Local Gateway FQDN or SRV addresses configured in Control Hub must resolve to a public IPv4 address. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Prerequisites / certificate and network requirements. Checked 2026-10-02. [^25]: The max-conn 250 command on Webex-facing dial-peer 100 restricts concurrent inbound and outbound calls, and for registration trunks the configured maximum should be 250. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: dial-peer voice 100 voip explanation list, max-conn 250. Checked 2026-10-02. [^26]: Because a Local Gateway trunk itself needs IOS XE 17.6.1a or later, the older 16.12.5 or 17.3 media-optimization floor is not the binding version constraint for a new Local Gateway build (inferred). Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Prerequisites version list read together with the ICE media optimization article CUBE version statement. Checked 2026-10-02. [^27]: Webex Calling media optimization on a Local Gateway requires a minimum CUBE software version of 17.3 or 16.12.5. Source: [Webex Calling media optimization with Interactive Connectivity Establishment (ICE)](https://help.webex.com/en-us/article/nt6eyxb/Webex-Calling-Media-Optimization-with-Interactive-Connectivity-Establishment(ICE)), Local Gateway / CUBE requirements paragraph. Checked 2026-10-02. [^28]: Media optimization through the Local Gateway is skipped when cloud media services such as call recording are required, so recorded calls route media through the Webex cloud. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class stun-usage 100 explanation: media optimization caveat. Checked 2026-10-02. [^29]: A certificate-based Webex Calling Local Gateway trunk on CUBE requires Cisco IOS XE 17.9.1a or later, with 17.12.2 or later recommended. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Before you begin / prerequisites: supported IOS XE versions for certificate-based trunk. Checked 2026-10-02. [^30]: Local Gateway for Webex for Government requires Cisco IOS XE Dublin 17.12.1a or later. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Before you begin / prerequisites: Webex for Government version requirement. Checked 2026-10-02. [^31]: Cisco's Local Gateway configuration article requires Cisco IOS XE 17.6.1a or later for a registration-based Webex Calling trunk and recommends 17.12.2 or later. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Before you begin / prerequisites: supported IOS XE versions for registration-based trunk. Checked 2026-10-02. [^32]: mode border-element under voice service voip enables Cisco Unified Border Element features on the Local Gateway platform. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: mode border-element. Checked 2026-10-02. [^33]: no remote-party-id in tenant 100 disables the SIP Remote-Party-ID header because Webex Calling supports P-Asserted-Identity instead. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, no remote-party-id. Checked 2026-10-02. [^34]: The tenant outbound-proxy command points at the Webex Calling access SBC and must use the Outbound Proxy Address shown in Control Hub. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, outbound-proxy. Checked 2026-10-02. [^35]: The key config-key password-encrypt and password encryption aes commands protect the Local Gateway's registration and STUN credentials with symmetric encryption. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: password encryption step. Checked 2026-10-02. [^36]: privacy-policy passthru in tenant 100 passes privacy header values received on one call leg through to the next leg. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, privacy-policy passthru. Checked 2026-10-02. [^37]: A registration-based Local Gateway trunk supports up to 250 concurrent calls per trunk, whereas a certificate-based trunk supports more than 250. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Registration-based versus certificate-based trunk comparison, concurrent calls row. Checked 2026-10-02. [^38]: The tenant registrar command uses the Control Hub Register Domain with scheme sips and expires 240 refresh-ratio 50, so the Local Gateway refreshes its registration every two minutes. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, registrar. Checked 2026-10-02. [^39]: rel1xx disable in tenant 100 turns off reliable provisional responses (PRACK) on the Webex Calling trunk. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, rel1xx disable. Checked 2026-10-02. [^40]: Cisco's Local Gateway overview lists Cisco Secure Routers as supported for both registration-based and certificate-based trunks from Cisco IOS XE 26.2.1. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Supported platforms / minimum software versions table, Cisco Secure Routers row. Checked 2026-10-02. [^41]: session target sip-server on dial-peer 100 makes calls from that dial-peer go to the SIP server defined in tenant 100. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: dial-peer voice 100 explanation, session target sip-server. Checked 2026-10-02. [^42]: Rule 80 of voice class sip-profiles 100 appends the Control Hub trunk group OTG/DTG identifier to the From header so Webex can uniquely identify the Local Gateway site within the enterprise. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class sip-profiles 100 explanation: rule 80. Checked 2026-10-02. [^43]: Rules 10 to 70 and 90 of voice class sip-profiles 100 rewrite sips: to sip: in the Request-URI, To, From, Contact and P-Asserted-Identity headers because Webex proxies require the SIP scheme. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class sip-profiles 100 block and explanation. Checked 2026-10-02. [^44]: The tenant sip-server command should name the Edge proxy SRV address provided in Control Hub as the target SIP server for the Webex trunk. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, sip-server. Checked 2026-10-02. [^45]: voice class srtp-crypto 100 with crypto 1 AES_CM_128_HMAC_SHA1_80 makes SHA1_80 the only SRTP cipher suite CUBE offers, because Webex Calling supports only SHA1_80. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class srtp-crypto 100 block and explanation. Checked 2026-10-02. [^46]: In stun flowdata agent-id tag boot-count, the agent-id tag ranges 0 to 255 and the optional boot-count ranges 0 to 65535 and helps prevent anti-replay attacks after a router reload. Source: [Cisco IOS Voice Command Reference - S commands - ss7 mtp2-variant through switchover method](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/vcr4/vcr4-cr-book/vcr-s12.html), stun flowdata agent-id: syntax description and usage guidelines. Checked 2026-10-02. [^47]: The global stun configuration lets the Local Gateway send locally generated STUN requests over the negotiated media path to help open firewall pinholes. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: stun. Checked 2026-10-02. [^48]: T.38 fax transport is enabled by default on the Local Gateway configuration described by Cisco. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Fax note in the configuration section. Checked 2026-10-02. [^49]: The sip-ua tcp-retry 1000 value is counted in 5-millisecond increments, giving a 5-second retry window in Cisco's Local Gateway configuration. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: sip-ua explanation, tcp-retry. Checked 2026-10-02. [^50]: For a TDM PSTN trunk, Cisco's example routes calls through loop-back SIP dial-peers using translation rules that add and strip call routing tags A1A and A2A, so the Webex-facing leg stays SIP-to-SIP. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), TDM PSTN trunk: translation rules, loop-back dial-peers 10 11 12 and dpg routing. Checked 2026-10-02. [^51]: When a dial-peer is bound to a CUBE tenant with voice-class sip tenant, settings apply in the order dial-peer first, then tenant, then global. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Configure Multiple Trunks Using Tenants](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-cube-multi-tenants.html), Configure Multiple Trunks Using Tenants: configuration precedence. Checked 2026-10-02. [^52]: voice class tenant 100 holds a set of SIP parameters used only for the Webex Calling trunk, leaving the global and PSTN-side configuration unaffected. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation. Checked 2026-10-02. [^53]: Under sip-ua, transport tcp tls v1.2 makes TLS 1.2 the only TLS version the Local Gateway uses for SIP signalling. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: sip-ua block. Checked 2026-10-02. [^54]: CUBE trusts inbound connections from addresses configured as dial-peer session targets and in voice class server-group configurations by default, so these need no trusted-list entry. Source: [Cisco Guide to Harden Cisco Unified Border Element (CUBE) Enterprise Devices](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/220380-cisco-guide-to-harden-cisco-unified-bord.html), IP address trusted list section. Checked 2026-10-02. [^55]: ip address trusted list under voice service voip defines the hosts and networks from which the Local Gateway expects legitimate VoIP calls, as protection against toll fraud. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice service voip explanation list: ip address trusted list. Checked 2026-10-02. [^56]: crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b clears the existing trustpool and installs Cisco's root CA bundle, after ip http client source-interface points the download at the Webex-facing interface. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security: trustpool import step. Checked 2026-10-02. [^57]: In Cisco's Unified CM integration example, voice class uri 300 pattern :5065 classifies Unified CM-to-Webex calls by the SIP Via port, separating them from Unified CM-to-PSTN calls on 5060. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Unified Communications Manager integration: voice class uri 300 and 400. Checked 2026-10-02. [^58]: voice class uri 100 sip uses pattern dtg= followed by the Trunk OTG/DTG value from Control Hub to match incoming Webex INVITEs to the Webex trunk dial-peer. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Voice class uri 100 sip block and explanation. Checked 2026-10-02. [^59]: url sips in tenant 100 is needed because the SRV query must use SIPS as the Webex access SBC supports, while the sip-profile changes all other messages back to SIP. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: voice class tenant 100 explanation, url sips. Checked 2026-10-02. [^60]: Video over Webex Calling Local Gateway call flows is not supported, and voice-class sip audio forced can be added to the Webex dial-peer to restrict calls to audio. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Registration-based trunk: dial-peer 100 optional audio forced note. Checked 2026-10-02.