Site survivability for Webex Calling

If you’re a partner organization, Partner Hub launches. To open Control Hub, click the Customer view in Partner Hub and select the applicable customer, or select My Organization to open Control Hub settings for the partner organization.

• Unassigned (empty value)—Click Assign Service and go to the next step.

• Survivability Gateway—If you want to edit existing gateway IP settings, go to Edit Survivability Gateway properties. Otherwise, go to the next procedure in the flow.

• Location—From the drop-down, select a location.

• Host Name—Enter the Fully Qualified Domain Name (FQDN) used when creating the certificate for the gateway. It could be a name that is included in the certificate Subject Alternate Name field (SAN). The FQDN and the IP address are only used for establishing a secure connection with the gateway. Hence, it is not mandatory to populate it in DNS.

• IP Address—In IPv4 format, enter the IP address of the Survivability Gateway. Devices register to this address while operating in Survivability mode.

If you’re a partner organization, Partner Hub launches. To open Control Hub, click the Customer view in Partner Hub and select the applicable customer, or select My Organization to open Control Hub settings for the partner organization.

enable
 configure terminal

• For Cisco ISR 4000 series:

  license boot level uck9
   license boot level securityk9
  

• For Cisco Catalyst 8300 and 8200 Series Edge Platforms, use the DNA Network Advantage feature license, or better, and enter the required throughput level. The following example uses 25Mbps bidirectional crypto throughput. Select the appropriate level for the number of calls that you anticipate.

  license boot level network-advantage addon dna-advantage
   platform hardware throughput crypto 25M
  

• For Cisco Catalyst 8000V Edge Software, use the DNA Network Essentials feature license, or better and enter the required throughput level. The following example uses 1Gbps throughput. Select the appropriate level for the number of calls that you anticipate.

  license boot level network-essentials addon dna-essentials
   platform hardware throughput level MB 1000
  

enable
 configure terminal

crypto key generate rsa general-keys label webex-sgw exportable modulus 2048

crypto pki trustpoint webex-sgw 
 enrollment terminal 
 fqdn <gateway_fqdn> 
 subject-name cn=<gateway_fqdn>
 subject-alt-name <gateway_fqdn>
 revocation-check crl 
 rsakeypair webex-sgw

When prompted, enter yes.

After the CSR displays on screen, use Notepad to copy the certificate to a file that you can send to a supported certificate authority (CA).

-----BEGIN CERTIFICATE REQUEST-----
 <Insert CSR here>
 -----END CERTIFICATE REQUEST-----

When prompted, paste the base 64 CER/PEM issuing CA certificate contents (not the device certificate) into the terminal.

When prompted, paste the base 64 CER/PEM certificate into the terminal.

crypto pki trustpoint <CA name>
 enrollment terminal
 revocation-check crl
 crypto pki authenticate <CA name>

When prompted, paste the base 64 CER/PEM certificate contents into the terminal.

sip-ua 
 no remote-party-id 
 retry invite 2 
 transport tcp tls v1.2 
 crypto signaling default trustpoint webex-sgw 
 handle-replaces

crypto pki export webex-sgw pkcs12 terminal password xyz123

crypto pki import <trustpoint name> pkcs12 <certificate file location> password <file password>

The following is a sample configuration for the command and details regarding the configurable parameters:

crypto pki import webex-sgw pkcs12 bootflash:certificate.pfx password xyz123

• <trustpoint name>—Name of the trustpoint that is created when using this command (For example, webex-sgw).

• <certificate file location>—Local or network URL pointing to the certificate file (For example, bootflash:certificate.pfx)

• <file password>—The password that's used when creating the PKCS12 file (For example, xyz123).

sip-ua 
 no remote-party-id 
 retry invite 2 
 transport tcp tls v1.2 
 crypto signaling default trustpoint webex-sgw 
 handle-replaces

enable
 configure terminal

where:

• enable—Enables privileged EXEC mode.

• configure terminal—Enables global configuration mode.

voice service voip
 ip address trusted list
    ipv4 <ip_address> <subnet_mask>
    ipv4 <ip_address> <subnet_mask>
  allow-connections sip to sip
  supplementary-service media-renegotiate
  no supplementary-service sip refer
  trace
  sip
   asymmetric payload full
   registrar server
  

Explanation of commands:

• ip address trusted list—Defines a list of nonregistering addresses that the Survivability Gateway must accept SIP messages from. For example, a SIP trunk peer address.

• <ip_address> and <subnet_mask> represent trusted address ranges. You don't need to enter directly connected subnets as the Survivability Gateway trusts them automatically.

• allow-connections sip to sip—Allows SIP to SIP connections in a VoIP network.

• no supplementary-service sip refer—Disable REFER method for call forward and call transfer supplementary services. Webex Calling doesn’t use these methods.

• sip—Enters service SIP configuration mode.

• registrar server—Enable the SIP registrar to allow Webex Calling clients to register to the gateway.

• asymmetric payload full—Enables video calling in survivability mode.

voice register global
 mode webex-sgw
 max-dn 50
 max-pool 50
 exit
 

Explanation of commands:

• voice register global—Enters global voice registration mode.

• mode webex-sgw—Enables Webex Calling Survivability mode and Survivable Remote Site Telephony for Unified Communications Manager endpoints.

  After mode webex-sgw configuration, Survivability Gateway listens on port 8933 for incoming secure connections from endpoints.

• max-dn—Limits the number of directory numbers that the router can handle. For this solution, always configure the maximum value available for your platform.

• max-pool—Sets the maximum number of devices that can register to the gateway. Set this value to the maximum that your platform allows, as described in Table 3.

ntp server <ip_address_of_primary_NTP_server>
 ntp server <ip_address_of_secondary_NTP_server>

dial-peer cor custom
 name Wx_calling_Internal
 name Wx_calling_Toll-free
 name Wx_calling_National
 name Wx_calling_International
 name Wx_calling_Operator_Assistance
 name Wx_calling_Chargeable_Directory_Assistance
 name Wx_calling_Special_Services1
 name Wx_calling_Special_Services2
 name Wx_calling_Premium_Services1
 name Wx_calling_Premium_Services2

The preceding example creates a set of custom class of restriction named categories (for example, Wx_calling_International). For details on how to use Class of Restrictions with dial peers, see "Class of Restrictions" in Dial Peer Configuration Guide, Cisco IOS Release 15M&T.

voice class codec 1
 codec preference 1 g711ulaw
 codec preference 2 g711alaw

Explanation of commands:

• voice class codec 1 enters voice-class configuration mode for the codec group 1.

• codec preference identifies the preferred codecs for this codec group.

voice register pool 1
 id network 0.0.0.0 mask 0.0.0.0
 dtmf-relay rtp-nte
 voice-class codec 1

Explanation of commands:

• voice register pool 1—Enters voice register pool configuration mode for SIP devices in this pool.

• id network and mask identify a SIP device, or set of network devices that use this pool. Use the addresses and masks that apply to your deployment. The address 0.0.0.0 allows devices from anywhere to register (if the device addresses are in the permit list).

• id extension-number—The pool applies to the Webex Calling user at extension 1234 specifically. Use the appropriate extensions for your network.

• dtmf-relay specifies the rtp-nte method for sending DTMF digits. In this example, Real-Time Transport (RTP) with Named phone event (NTE) payload type.

• voice-class codec 1—Assigns codec group 1 to this pool.

voice emergency response location 1
 elin 1 <number>
 subnet 1 <ip-group> <subnet-mask>

 voice emergency response location 2
 elin 1 <number>
 subnet 1 <ip-group> <subnet-mask>

 voice emergency response zone 1
 location 1
 location 2

 voice class e164-pattern-map 301
 voice class e164-pattern-map 351

Explanation of commands:

• voice emergency response location 1—Creates emergency response location group 1 for the enhanced 911 service. A subsequent command creates emergency response location group 2.

• elin 1 <number>—Assigns an elin to the emergency response location. For this elin, the <number> portion defines a PSTN number to replace the extension of the 911 caller (for example, 14085550100).

• subnet 1 <ip-group> <subnet-mask>—Defines a subnet group along with a specific subnet address for this emergency response location. Use this command to identify the caller network via an IP address and subnet mask. For example, subnet 1 192.168.100.0 /26.

• voice emergency response zone 1—Defines an emergency response zone.

• location 1 (and 2)—Assigns emergency response locations 1 and 2 to this emergency response zone.

• voice class e164-pattern-map 301 (and 351)—Identifies e164 pattern maps 301 and 351 for this voice class. You can use the map to define dial plans and emergency location identifiers.

call-manager-fallback
 moh enable-g711 "bootflash:<MOH_filename>"

Explanation of commands:

• call-manager-fallback—Enters SRST configuration mode.

• moh enable-g711 "bootflash:<MOH_filename>"—Enables unicast Music on Hold using G.711. Also provides the directory and audio filename (for example, bootflash:music-on-hold.au). The filename can’t exceed 128 characters.

If you’re a partner organization, Partner Hub launches. To open Control Hub, click the Customer view in Partner Hub and select the applicable customer or select My Organization to open Control Hub settings for the partner organization.

If you’re a partner organization, Partner Hub launches. To open Control Hub, click the Customer view in Partner Hub and select the applicable customer, or select My Organization to open Control Hub settings for the partner organization.

• Host Name—Use the host name or Fully Qualified Domain Name of the certificate to establish the TLS connection with clients and IP Address.

• IP Address—In IPv4 format, enter the IP address of the gateway to which devices register while operating in Survivability mode.