# Troubleshooting a Webex Calling Local Gateway Canonical: https://warmtransfer.net/knowledge/webex-local-gateway-troubleshooting Last verified: 2026-09-25 Webex Calling Local Gateways connect premises-based PSTN facilities and PBXs to the cloud platform via registration-based or certificate-based trunks[^4][^40]. Troubleshooting connectivity and call flow requires analyzing Control Hub trunk states, TLS security associations, SIP routing logic, and media path behaviors[^50][^4][^23]. ## Trunk States and Control Hub Diagnostics In Control Hub, trunk status updates every 3 minutes, and administrators can also refresh it manually[^51]. Control Hub trunk status definitions include Online, Offline, Impaired, and Unknown states:[^50][^49][^48][^52] * **Online**: The connection between all Webex Calling edge proxies and the Local Gateway is successful[^50]. * **Offline**: The connection between Webex Calling and the Local Gateway is unsuccessful[^49]. * **Impaired**: The connection between at least 1 Webex Calling edge proxy and the Local Gateway is unsuccessful, representing a partial failure rather than a full outage[^48]. * **Unknown**: Shown while the connection to a recently added Local Gateway is still being established[^52]. When trunk failures occur, Control Hub displays specific error conditions:[^10][^18][^14][^15][^17] * **DNS resolution failure**: The error stating "TLS Connection to Local Gateway failed due to DNS resolution failure" is resolved by ensuring the configured SRV or FQDN resolves properly in DNS[^10]. * **Transport issue**: The error stating "TLS Connection to Local Gateway failed due to a transport issue" is resolved by confirming that the resolved IP addresses and port of the Local Gateway are valid[^18]. * **SIP OPTIONS timeouts**: When the error indicates that SIP options sent to the Local Gateway received no response, CUBE must be configured to receive and respond to SIP OPTIONS[^14]. If the error states that the TLS connection and SIP OPTIONS from the Local Gateway to Webex Calling failed, CUBE must be configured to send OPTIONS requests[^15]. * **Service unavailable responses**: If the SIP OPTIONS response shows a server error or Service Unavailable, the documented fix is to check that the Local Gateway is not in maintenance mode and that call routing is not disabled[^17]. ## Certificate-Based Trunks and TLS Requirements A certificate-based trunk connects to Webex Calling using mutual TLS (mTLS) and is addressed by an FQDN or SRV address that must be unique within the organization and hosted on a verified or claimed domain[^4]. The gateway must be reachable from the internet on a public IPv4 address, directly or via static NAT, with firewall rules permitting TLS SIP signaling and UDP SRTP media[^2]. Supported session border controllers include Cisco CUBE, as well as third-party SBCs from Oracle, Ribbon, AudioCodes, anynode, and Italtel (NetMatch-S)[^56]. Certificate validation failures generate specific errors in Control Hub:[^13][^11][^12] * **Invalid or untrusted CA**: If an error indicates the gateway certificate is signed by an invalid Certificate Authority or that Webex is unable to trust the CA, the certificate must be replaced with one signed by a CA on Cisco's supported list[^13]. * **Expired certificates**: Control Hub lists separate errors for an expired gateway certificate, a certificate issued by an expired CA, and expired certificates within the chain; each is resolved by replacing the expired certificate[^11]. * **Missing CN or SAN**: If the error states that the FQDN configured for the gateway is missing from the CN or SAN, the certificate CN or SAN must be updated to contain the exact FQDN or SRV configured on the trunk[^12]. Cisco IOS XE gateways require specific TLS and trustpool parameters:[^1][^3][^59][^5][^57] * Control Hub converts all trunk FQDN entries to lowercase, requiring the Local Gateway certificate to use only lowercase letters[^1]. * Certificates with only the Server Authentication Extended Key Usage (EKU) are supported, and Webex Calling does not require a Client Authentication EKU[^3]. * Gateways import Cisco's root CA bundle (`ios_core.p7b`) into the IOS XE trustpool, which includes the IdenTrust Commercial Root CA1 certificate used by Webex Calling[^59]. * Configuring `cn-san-validate server` under crypto signaling causes the gateway to accept the TLS connection only if the host name configured in the tenant appears in the peer certificate's CN or SAN[^5]. * The `sip-ua timers connection establish` command defines how long the gateway waits to connect to a proxy before trying the next option, with a default of 20 seconds and a minimum of 5 seconds[^57]. ## Registration-Based Trunks On registration-based trunks, the Local Gateway performs SIP registration toward Webex Calling and must maintain an active registration to preserve connectivity[^40]. Configuration requires details from Control Hub: Register Domain (registrar), Line/Port host, Authentication Username and Password credentials, Trunk OTG/DTG values, and Outbound Proxy Address[^58]. * Inbound INVITE messages from Webex Calling are matched to the Webex-facing dial-peer using a `voice class uri` matching the trunk's DTG value (`pattern dtg=...`), which uniquely identifies the site within the enterprise[^26]. * Inbound calls from an IP PSTN provider match the PSTN dial-peer using a `voice class uri host` entry that matches the provider's source IP address[^27]. * On the Webex-facing dial-peer, `max-conn` should be set to no more than 250[^39]. * The tenant configuration disables the SIP Remote-Party-ID header via `no remote-party-id` because Webex Calling supports P-Asserted-Identity[^33]. * Cisco publishes a diagnostic signature that evaluates every 60 seconds whether a Local Gateway SIP trunk has unregistered from Webex Calling[^7]. These diagnostic signatures rely on SNMP (verified via `show snmp`) and are checked using `show call-home diagnostic-signature` and `show call-home diagnostic-signature statistics`[^8]. ## Signatures, Signaling, and Media Configuration Outbound SIP-TLS signaling from a Local Gateway to Webex Calling routes over TCP destination port 8934 for registration-based trunks and TCP destination port 5062 for certificate-based trunks[^44]. When configuring the tenant side toward Webex Calling, only SRV-based addresses are supported[^55]. Cisco recommends disabling SIP ALG on firewalls and NAT devices along the signaling path[^45]. Video calling over Webex Calling using Local Gateway call flows is not supported[^34]. For media handling: * Webex Calling supports only the SHA1_80 SRTP cipher suite (`AES_CM_128_HMAC_SHA1_80`), requiring the Local Gateway to offer only that suite toward Webex[^47]. * CUBE supports ICE-lite for Webex Calling media path optimization when running software 17.3 or 16.12.5 or later, enabled via the STUN usage ICE-lite configuration[^23]. Media optimization requires network reachability between the endpoint and the gateway via a public IP or an address reachable on the same network[^24]. Media optimization call metrics appear in Control Hub Media Quality analytics and the Troubleshooting tool[^22]. ## Command-Line Diagnostics and Known Failures For general registration diagnostics, CUBE provides the command `show sip-ua register status` to display the status of E.164 numbers registered with an external primary SIP registrar[^43]. CUBE SIP registration functionality can register numbers on behalf of FXS analog ports, ephone-dn virtual voice ports, and local SCCP phones, rather than being restricted to a single trunk identity[^46]. When troubleshooting audio loss: * CUBE commands `show voip rtp connections` and `show call active voice brief` verify whether active RTP streams are established[^42]. * On CUBE hairpin calls, no-audio conditions can stem from a deadlock where both call legs wait for incoming RTP before transmitting; documented remediation options include software MTP, media flow-around, media anti-trombone, and STUN packets[^21]. For call setup timing: * In premises-based PSTN deployments, if the PSTN provider's post-dial delay (PDD) exceeds 12 seconds, Webex Calling cancels the call automatically[^37]. * Extending the 12-second PDD limit requires opening a Webex Calling support case with TAC and attaching Local Gateway traces[^38]. * TAC trace collection involves running `debug ccsip messages` and `debug voice ccapi inout`, allocating a large debug buffer, and disabling console logging, monitor logging, and logging queue/rate limits[^6]. Cisco's TAC incoming call troubleshooting guidance explicitly excludes PSTN interconnection debugging and provides no Local Gateway debug steps[^54]. ## See Also * [Webex Calling PSTN options and selection](https://warmtransfer.net/knowledge/webex-calling-pstn-options) * [Webex Calling Site Survivability Gateway](https://warmtransfer.net/knowledge/webex-calling-survivability-gateway) * [CUBE troubleshooting commands](https://warmtransfer.net/knowledge/cube-troubleshooting-toolkit) * [SIP TLS handshake failures on trunks](https://warmtransfer.net/knowledge/sip-tls-handshake-failures) ## Applicability Applies to: Cisco Webex Calling, Cisco Webex Calling Local Gateway (CUBE), Cisco Webex Calling (Webex for Government), Cisco Unified Border Element (IOS XE), and Cisco Unified Border Element. Deployments: on-premises and multi-tenant. Sources checked 2026-09-25. Certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later, with 17.12.2 or later recommended[^28]. Registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later, with 17.12.2 or later recommended[^29]. Webex for Government deployments do not support registration-based Local Gateways, permitting only certificate-based trunks[^20]. Furthermore, Local Gateways deployed in Webex for Government do not support STUN/ICE-Lite for media path optimization[^19]. ## What remains uncertain The following operational areas and issues are not covered by the sources below: * Troubleshooting one-way audio on Webex Calling Local Gateway calls is not covered by the sources below. * Scenarios involving POTS dial-peers triggering registrations and trunk flapping without `no sip-register` are not covered by the sources below. * Any impact from a Webex Calling root CA change or IdenTrust transition affecting the Local Gateway trustpool is not covered by the sources below. * The specific command to verify TLS connections to Webex Calling (`show sip-ua connections tcp tls detail`) is not covered by the sources below. * Control Hub trunk status menu path conflicts are not covered by the sources below. * Materials from the Cisco Live TACCOL-2018 LGW connectivity troubleshooting presentation are not covered by the sources below. * SIP OPTIONS keepalive configuration parameters specifically for certificate-based Local Gateways are not covered by the sources below. * Dedicated troubleshooting notes for third-party SBC certificate trunks from AudioCodes, Oracle, or Ribbon are not covered by the sources below. ## Sources [^1]: Control Hub converts all trunk FQDN entries to lowercase, so the Local Gateway certificate should use only lowercase letters. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security (certificate-based). Checked 2026-09-25. [^2]: A certificate-based Local Gateway must be reachable from the internet on a public IPv4 address, directly or through static NAT, with firewall rules that allow TLS SIP signaling and UDP SRTP media. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, certificate-based trunk port and connectivity requirements. Checked 2026-09-25. [^3]: Certificates with only the Server Authentication Extended Key Usage are supported for certificate-based trunks. Webex Calling does not require a Client Authentication EKU. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, certificate requirements. Checked 2026-09-25. [^4]: A certificate-based trunk connects to Webex Calling over mutual TLS and is addressed by an FQDN or SRV address that must be unique within the organization and on a verified or claimed domain. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk types and certificate-based trunk requirements. Checked 2026-09-25. [^5]: The cn-san-validate server option on crypto signaling makes the Local Gateway accept the TLS connection only if the host name configured in the tenant appears in the peer certificate's CN or SAN. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security, sip-ua crypto signaling explanation. Checked 2026-09-25. [^6]: The TAC procedure for collecting Local Gateway call traces enables debug ccsip messages and debug voice ccapi inout, logs to a large debug-level buffer, and turns off console and monitor logging and logging rate and queue limits. Source: [Troubleshoot PDD in Webex Calling with Premises Based PSTN](https://www.cisco.com/c/en/us/support/docs/unified-communications/jabber-windows/221643-troubleshoot-pdd-in-webex-calling-with-p.html), Enable debug in Local Gateway section. Checked 2026-09-25. [^7]: Cisco publishes a diagnostic signature that checks every 60 seconds whether a Local Gateway SIP trunk has unregistered from the Webex Calling cloud. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Monitor and troubleshoot Registration based Local Gateway. Checked 2026-09-25. [^8]: Diagnostic signatures on the Local Gateway depend on SNMP (checked with show snmp) and are verified with show call-home diagnostic-signature and show call-home diagnostic-signature statistics. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Monitor and troubleshoot Registration based Local Gateway, diagnostic signatures prerequisites and verification. Checked 2026-09-25. [^9]: The trunk errors numbered 2, 6, 11 and 12 in Cisco's table are shown only when all edge proxy nodes have the issue. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, note under the error table. Checked 2026-09-25. [^10]: The Control Hub trunk error 'TLS Connection to Local Gateway failed due to DNS resolution failure' is resolved by making sure the configured SRV or FQDN resolves in DNS. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 1. Checked 2026-09-25. [^11]: The Control Hub trunk error list includes separate errors for an expired gateway certificate, a certificate issued by an expired CA, and expired certificates in the chain. Each is resolved by replacing the expired certificate. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 4, 5, 10 and 15. Checked 2026-09-25. [^12]: The trunk error 'the FQDN configured for your gateway is missing from CN or SAN' is resolved by making sure the certificate CN or SAN contains the FQDN or SRV configured on the trunk. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 6. Checked 2026-09-25. [^13]: When the trunk error says the gateway certificate is signed by an invalid Certificate Authority, or that Webex is unable to trust the CA, the fix is a certificate signed by a CA on Cisco's supported list. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 3 and 9. Checked 2026-09-25. [^14]: The trunk error 'SIP options sent to the Local Gateway received no response' is resolved by making sure CUBE is configured to receive SIP OPTIONS and respond to them. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 7. Checked 2026-09-25. [^15]: The trunk error saying the TLS connection and SIP OPTIONS from the Local Gateway to Webex Calling have failed is resolved by making sure CUBE is configured to send OPTIONS requests. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 11. Checked 2026-09-25. [^16]: The trunk error list includes errors for a revoked gateway certificate, in both directions of the TLS connection. The fix is to make sure the Local Gateway certificate is not revoked. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 13 and 14. Checked 2026-09-25. [^17]: When the SIP OPTIONS response shows a server error or Service Unavailable, the documented fix is to check that the Local Gateway is not in maintenance mode and that call routing is not disabled. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 12. Checked 2026-09-25. [^18]: The trunk error 'TLS Connection to Local Gateway failed due to a transport issue' is resolved by checking that the resolved IP addresses and port of the Local Gateway are valid. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, error table SI No. 2. Checked 2026-09-25. [^19]: The Local Gateway for Webex for Government does not support STUN/ICE-Lite for media path optimization. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure your Local Gateway for Webex for Government. Checked 2026-09-25. [^20]: Webex for Government does not support registration-based Local Gateway; only certificate-based trunks are supported there. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure your Local Gateway for Webex for Government. Checked 2026-09-25. [^21]: On CUBE hairpin calls, no audio can result from a deadlock where both ends wait for incoming RTP before sending. Documented fixes include software MTP, media flow-around, media anti-trombone and STUN packets. Source: [Troubleshoot No-way Audio Issue with Hairpin Calls on CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/214622-troubleshoot-no-audio-issues-with-hairpi.html), Problem and Solution sections. Checked 2026-09-25. [^22]: Data about calls using media optimization is shown in Control Hub's Media Quality analytics and in the Troubleshooting tool. Source: [Webex Calling media optimization with Interactive Connectivity Establishment (ICE)](https://help.webex.com/en-us/article/nt6eyxb/Webex-Calling-Media-Optimization-with-Interactive-Connectivity-Establishment(ICE)), Analytics for Media Optimization. Checked 2026-09-25. [^23]: The Local Gateway (CUBE) supports ICE-lite for Webex Calling media optimization, with restrictions. It requires CUBE software 17.3 or 16.12.5 or later and is enabled with the STUN usage ICE-lite configuration. Source: [Webex Calling media optimization with Interactive Connectivity Establishment (ICE)](https://help.webex.com/en-us/article/nt6eyxb/Webex-Calling-Media-Optimization-with-Interactive-Connectivity-Establishment(ICE)), Prerequisites and limitations. Checked 2026-09-25. [^24]: Media optimization with a Local Gateway needs network reachability between the device and the Local Gateway, either through a public IP address or because the Local Gateway host address is reachable on the same network. Source: [Webex Calling media optimization with Interactive Connectivity Establishment (ICE)](https://help.webex.com/en-us/article/nt6eyxb/Webex-Calling-Media-Optimization-with-Interactive-Connectivity-Establishment(ICE)), Prerequisites and limitations. Checked 2026-09-25. [^25]: An Impaired trunk (failing on some but not all edge proxies) may not show the transport, CN/SAN, OPTIONS-failure or server-error messages, so the absence of those messages does not rule those causes out for one proxy (inferred). Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Troubleshooting section, note under the error table; trunk status definitions. Checked 2026-09-25. [^26]: On a registration-based trunk, inbound INVITEs from Webex Calling are matched to the Webex dial-peer with a voice class uri that matches the trunk's DTG value (pattern dtg=...) from Control Hub. The DTG uniquely identifies the Local Gateway site within the enterprise. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class uri 100 sip. Checked 2026-09-25. [^27]: Inbound calls from an IP PSTN provider are matched to the PSTN dial-peer with a voice class uri host entry that matches the provider's source IP address. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure the PSTN trunk, voice class uri 200 sip. Checked 2026-09-25. [^28]: Certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later, and 17.12.2 or later is recommended. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security (certificate-based). Checked 2026-09-25. [^29]: All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later, and 17.12.2 or later is recommended. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security (registration-based). Checked 2026-09-25. [^30]: A registration or inbound-match failure on a registration-based trunk is plausibly caused by a mismatch between the tenant or URI configuration and the Control Hub trunk info values (registrar, credentials, DTG, outbound proxy), so those values are the first thing to compare (inferred). Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk. Checked 2026-09-25. [^31]: The trunk configuration article gives the Control Hub path to trunk status as Services > Calling > Call Routing > Trunk (disputed). Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, view trunk status procedure. Checked 2026-09-25. [^32]: The Get started with Local Gateway article gives the Control Hub path to trunk status as Services > PSTN & Routing > Gateway configurations > Trunk, then Trunk Info (disputed). Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Troubleshoot the Local Gateway / trunk status check. Checked 2026-09-25. [^33]: The Local Gateway tenant configuration disables the SIP Remote-Party-ID header (no remote-party-id) because Webex Calling supports P-Asserted-Identity. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class tenant 100 explanation. Checked 2026-09-25. [^34]: Video over Webex Calling using Local Gateway call flows is not supported. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk. Checked 2026-09-25. [^35]: Wildcard certificates are not permitted for Local Gateway certificate-based trunking. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Local Gateway trunking models. Checked 2026-09-25. [^36]: For a certificate-based Local Gateway, a firewall that allows outbound media but not Webex-initiated inbound SRTP to the Local Gateway's port range is a plausible cause of one-way audio (inferred). Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), Call media rows for Local Gateway; network configuration guidance. Checked 2026-09-25. [^37]: With premises-based PSTN, if the PSTN provider's post-dial delay exceeds 12 seconds, Webex Calling automatically cancels the call. Source: [Troubleshoot PDD in Webex Calling with Premises Based PSTN](https://www.cisco.com/c/en/us/support/docs/unified-communications/jabber-windows/221643-troubleshoot-pdd-in-webex-calling-with-p.html), Background / problem description. Checked 2026-09-25. [^38]: To get the PDD limit extended beyond 12 seconds, TAC advises opening a Webex Calling support case with Local Gateway traces attached. Source: [Troubleshoot PDD in Webex Calling with Premises Based PSTN](https://www.cisco.com/c/en/us/support/docs/unified-communications/jabber-windows/221643-troubleshoot-pdd-in-webex-calling-with-p.html), Solution section. Checked 2026-09-25. [^39]: On a registration-based trunk, max-conn on the Webex-facing dial-peer should be set to no more than 250. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, dial-peer voice 100 explanation. Checked 2026-09-25. [^40]: On a registration-based trunk, the Local Gateway performs SIP registration and must keep an active registration; the connection to Webex Calling depends on that registration. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk types. Checked 2026-09-25. [^41]: Media flows initiated from Webex Calling toward a customer-chosen Local Gateway port range (UDP SRTP from source ports 19560-65535) apply only to certificate-based Local Gateways. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), Call media rows for Local Gateway in the Webex Calling services port table. Checked 2026-09-25. [^42]: On CUBE, show voip rtp connections and show call active voice brief are used to check whether RTP streams are set up for an active call when troubleshooting missing audio. Source: [Troubleshoot No-way Audio Issue with Hairpin Calls on CUBE](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/214622-troubleshoot-no-audio-issues-with-hairpi.html), Verify / troubleshoot section. Checked 2026-09-25. [^43]: On CUBE, show sip-ua register status displays the status of the E.164 numbers that the SIP gateway has registered with an external primary SIP registrar. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Basic SIP Configuration](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-basic-config.html), SIP Register Support, verification steps. Checked 2026-09-25. [^44]: Outbound SIP-TLS signaling from a Local Gateway to Webex Calling uses TCP destination port 8934 for registration-based trunks and 5062 for certificate-based trunks. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), Call signaling rows for Local Gateway in the Webex Calling services port table. Checked 2026-09-25. [^45]: Cisco recommends turning off SIP ALG on firewalls and NAT devices in the Webex Calling path. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), Network configuration guidance, SIP ALG note. Checked 2026-09-25. [^46]: CUBE SIP register support registers E.164 numbers with a SIP proxy or registrar on behalf of FXS analog ports, ephone-dn virtual voice ports and local SCCP phones, not only a single trunk identity. Source: [Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Basic SIP Configuration](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/ios-xe/config/ios-xe-book/m_voi-sip-basic-config.html), SIP Register Support overview. Checked 2026-09-25. [^47]: Webex Calling supports only the SHA1_80 SRTP cipher suite (AES_CM_128_HMAC_SHA1_80), so the Local Gateway is configured to offer only that suite on the Webex side. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, voice class srtp-crypto 100 explanation. Checked 2026-09-25. [^48]: A trunk status of Impaired means the connection between at least one Webex Calling edge proxy and the Local Gateway is unsuccessful. It is a partial failure, not a full outage. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk status definitions. Checked 2026-09-25. [^49]: A trunk status of Offline means the connection between Webex Calling and the Local Gateway is unsuccessful. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk status definitions. Checked 2026-09-25. [^50]: In Control Hub, a Local Gateway trunk status of Online means the connection between all Webex Calling edge proxies and the Local Gateway is successful. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk status definitions. Checked 2026-09-25. [^51]: Control Hub updates trunk status every 3 minutes, and the admin can also refresh it manually. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk status; Troubleshooting section. Checked 2026-09-25. [^52]: A trunk status of Unknown is shown while the connection to a recently added Local Gateway is still being established. Source: [Configure trunks, route groups, and dial plans for Webex Calling](https://help.webex.com/article/n0xb944/Configure-Trunks-Route-Groups-and-Dial-Plans-for-Cisco-Webex-Calling), Trunk section, trunk status definitions. Checked 2026-09-25. [^53]: In the registration-based trunk configuration, T.38 fax transport is enabled by default. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk. Checked 2026-09-25. [^54]: Cisco's TAC note on incoming call problems for Webex Calling users explicitly does not cover PSTN interconnection troubleshooting, so it gives no Local Gateway debug guidance. Source: [Troubleshoot Incoming Call Problems for Webex Calling Users](https://www.cisco.com/c/en/us/support/docs/unified-communications/webex-calling/218153-troubleshoot-incoming-call-problems-for.html), Introduction. Checked 2026-09-25. [^55]: When configuring the tenant side of the Local Gateway toward Webex Calling, only SRV-based addresses are supported. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security. Checked 2026-09-25. [^56]: Besides Cisco CUBE, certificate-based trunking supports third-party SBCs from Oracle, Ribbon, AudioCodes, anynode and Italtel (NetMatch-S). Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Supported session border controllers. Checked 2026-09-25. [^57]: The sip-ua timers connection establish command sets how long the Local Gateway waits to connect to a proxy before trying the next option. The default is 20 seconds and the minimum is 5 seconds. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security, sip-ua configuration explanation. Checked 2026-09-25. [^58]: The registration-based Local Gateway configuration uses trunk details from Control Hub: Register Domain (registrar), Line/Port host, Authentication Username and Password (credentials), Trunk OTG/DTG value, and Outbound Proxy Address. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure Webex Calling registration-based trunk, trunk information illustration and tenant 100 explanation. Checked 2026-09-25. [^59]: The Local Gateway configuration imports Cisco's root CA bundle (ios_core.p7b) into the IOS XE trustpool. The bundle includes the IdenTrust Commercial Root CA1 certificate used by Webex Calling. Source: [Configure Local Gateway on Cisco IOS XE for Webex Calling](https://help.webex.com/en-us/article/jr1i3r/Configure-Local-Gateway-on-Cisco-IOS-XE-for-Webex-Calling), Configure connectivity and security, crypto pki trustpool import step. Checked 2026-09-25.