Webex Calling Plans, Trunks, and Route Groups provide you the ability to configure Webex Calling to manage calls between Webex Calling hosted users and premises PBX(s) users. This solution lets you configure hosted users to use Cloud PSTN (CCP or Cisco PSTN) or Premises-based PSTN.
A Trunk is a connection between Webex Calling and the premises, which stops on the premises with a local gateway or other supported device. Once you create a trunk, you can assign it to a route group. A Route Group is a group of trunks that allow Webex Calling to distribute calls over multiple trunks or to provide redundancy. A Local Gateway is an on-premises device(s) that interconnects the trunk, on-premises PSTN, and/or PBX.
Trunks, route groups, and dial plans provide the following benefits:
-
Load-balancing and failover across trunks to Webex Calling and the premises.
-
Ability for Webex Calling users to utilize cloud PSTN (Cloud Connected PSTN (CCP) or Cisco PSTN) and still be able to reach PBX users in the enterprise.
-
Routing of calls to different premises PBXs.
-
Tandem functionality to route calls between premises PBXs.
-
Broader range of migration and coexistence scenarios with premises PBXs, including mixed sites with premises users and Webex Calling users.
-
In-depth visibility of call routing decisions.
Once your location is enabled, you must set up PSTN connectivity for Webex Calling users within that location. The following PSTN options are available:

-
Cisco PSTN—Choose this option if you’d like a bundled solution that allows you to order new PSTN numbers and port existing numbers to Cisco. The Cisco PSTN option is only available under the following conditions:
-
You have purchased and enabled the Cisco Calling Plan.
-
The location is in a country where Cisco Calling Plan is supported.
-
-
Cloud Connected PSTN—Choose this option if you’re looking for a cloud solution that doesn’t require deployment of local hardware, and then select a CCP provider of choice. Cloud PSTN (Cisco PSTN or Cloud Connected PSTN) can only be used to provide PSTN access for Webex Calling users. Calls originating from premises users can’t access cloud PSTN.
-
Premises-based PSTN (Local Gateway)—Choose this option if you want to keep your current PSTN provider. Trunks for premises-based PSTN through local gateway can also be used to connect to premises PBXs. You can retain existing local gateway functionality is retained without making any configuration changes. Locations using local gateway are set to Premises-based PSTN and local gateways become trunks.
Configure your selected PSTN connection within Control Hub by selecting Assign or Manage and select the PSTN connection of choice.
, select the location you want to modify, then selectTrunk
A trunk is a connection between Webex Calling and the premises, terminated on the premises with a supported session border controller acting as a Local Gateway. See Configure Local Gateway on Cisco IOS XE for Webex Calling to understand the various trunking models and requirements for devices and configuration.
For a registration trunk model, Session Border Controller (SBC) performs SIP registration. Registration-based trunk requires the local gateway to maintain the SIP registration is active. The connection is implicit to registration.
Before you begin
All trunks must be assigned to a location in Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
||
2 |
Select Add Trunk. |
||
3 |
Select a Location from the drop-down list. |
||
4 |
Enter a Name for the trunk. |
||
5 |
Select Registering from the Trunk Type drop-down list. |
||
6 |
Dual Identity Support setting impacts the handling of the From header and P-Asserted-Identity (PAI) header when sending an initial SIP INVITE to the trunk for an outbound call. With Dual Identity enabled, Webex Calling populates From and PAI (and both identity headers can be different). With Dual Identity disabled, PAI and From are identical and are set to what the From header was set to with Dual Identiity enabled. Below are some example scenarios to better understand the usage of this setting:
|
||
7 |
Click Save. |
What to do next
The trunk information appears on the screen Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address. We recommend that you copy this information from Control Hub and paste it into a local text file or document so you can refer to it when you’re ready to configure the local gateway. If you lose the credentials, you must regenerate them from the trunk information screen in Control Hub. Click Retrieve Username and Reset Password to generate a new set of authentication credentials to use on the trunk.
This action impacts service, so it's recommended to be done during nonbusiness hours. If you are configuring a trunk to connect your local gateway to Webex Calling, see: Configure Local Gateway on IOS-XE for Webex Calling. |
A trunk is the connection between Webex Calling and the premises, terminating on the premises with a local gateway or other supported device.
Before you begin
All trunks must be assigned to a location within Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
||
2 |
Select Add Trunk. |
||
3 |
Select a location and name of the trunk.
|
||
4 |
Dual Identity Support setting impacts the handling of the From header and P-Asserted-Identity (PAI) header when sending an initial SIP INVITE to the trunk for an outbound call. With Dual Identity enabled, Webex Calling populates From and PAI (and both identity headers can be different). With Dual Identity disabled, PAI and From are identical and are set to what the From header was set to with Dual Identiity enabled. Below are some example scenarios to better understand the usage of this setting:
|
||
5 |
Click Save. |
What to do next
The trunk information appears on the screen Register Domain, Trunk Group OTG/DTG, Line/Port, Outbound Proxy Address. We recommend that you copy this information from Control Hub and paste it into a local text file or document so you can refer to it when you’re ready to configure the local gateway. If you lose the credentials, you must re-generate them from the trunk information screen in Control Hub. Click Retrieve Username and Reset Password to generate a new set of authentication credentials to use on the trunk.
This action impacts service, so it's recommended to do during non-business hours. |
You can edit the trunk name or view the trunk details and usage in Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
||
2 |
Select the trunk you want to view or modify. |
||
3 |
On the side panel, next to the trunk name, click the You can also view the usage information for the trunk. |
||
4 |
To view additional details, click Manage next to Trunks.
|
||
5 |
Dual Identity Support setting impacts the handling of the From header and P-Asserted-Identity (PAI) header when sending an initial SIP INVITE to the trunk for an outbound call. With Dual Identity disabled, PAI and From are identical and are set to what the From header was set to with Dual Identiity enabled. Below are some example scenarios to better understand the usage of this setting:
|
You can delete a trunk as long as it's not in use.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
2 |
Select the trunk you want to delete. |
3 |
Click the |
To check the trunk status in Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
2 |
Select the trunk you want to check the status. |
3 |
Click Trunk Info. |
Example
The following are the different registration-based trunk status:
-
Online—Successful registration of Local Gateway to Webex Calling.
-
Offline—Unsuccessful registration of Local Gateway to Webex Calling.
While adding a certificate-based trunk, you must enter a Fully Qualified Domain Name (FQDN). Then, Webex Calling uses a combination of the FQDN and the local gateway's certificate to trust a Local Gateway.
Requirements for configuring a Local Gateway from the Control Hub:
-
Local Gateway’s cloud-facing network MUST be using a public IPv4 address and an FQDN or SRV address resolving to this address MUST be resolvable on the internet.
-
All SIP & media ports on the external interface MUST be accessible from the internet and not behind a NAT and hence required firewall updates MUST be done on the enterprise network components:
-
Refer to the Webex Calling port reference Guide to understand the required ports that would need access on the premise side & cloud side.
-
-
A signed certificate is required for a successful authorization and authentication of calls from the trunk. The certificate must meet the following requirements:
-
The certificate MUST be signed by a CA mentioned in What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms?
-
The trust bundle mentioned in What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms? should be uploaded on to the CUBE.
-
The certificate should be valid always:
-
Signed certificates MUST always have a valid expiry.
-
Root or intermediate certificates MUST have a valid expiry and should not be revoked.
-
Certificates MUST be signed for client and server usage.
-
Certificates MUST contain the Fully Qualified Domain Name (FQDN) as a common name or subject alternate name in the certificate with the FQDN chosen in the Control Hub. For example:
-
A trunk configured from your organization’s Control Hub with london.lgw.cisco.com:5061 as the FQDN Must contain london.lgw.cisco.com in the certificate CN or SAN.
-
A trunk configured from your organization’s Control Hub with london.lgw.cisco.com as the SRV MUST contain london.lgw.cisco.com in the certificate CN or SAN. The records that the SRV address resolves to (CNAME/A Record/ IP Address) are optional in SAN.
-
-
Certificates may be shared between more than one Local Gateway, however, the FQDN requirements that are mentioned in the previous bullet point must be satisfied.
-
-
Before you begin
-
All trunks must be assigned to a location in Control Hub.
-
Admin MUST choose to have the Local Gateway resolved through an FQDN or a Service Record (SRV) and this option shall exit during configuring your trunk. However, there are a few rules:
-
Admin MUST have a unique host address (FQDN or SRV) per trunk across your entire organization. For example:
-
A trunk with FQDN london.lgw.cisco.com:5062 can only be created if there exists no other trunk with a host address london.lgw.cisco.com.
-
A trunk with SRV address london.lgw.cisco.com can only be created if there exists no other trunk with a host address london.lgw.cisco.com. This is not allowed even if there exists a trunk with the same FQDN and a port combination.
-
-
If the gateway's address is an FQDN, then a port must be configured. Standard SIP ports such as 5061 or 5062 may be chosen and appropriate firewall configuration should be done so that the IPV4 and port combination is addressable from a cloud service.
-
If an SRV address is chosen, then the service type must have a prefix of "_sips._tcp". Records within the service record must have an appropriate weight and priority and have a TTL not less than 300 seconds.
Appropriate firewall configuration is needed to open the transport addresses (IPv4, port) specified in the SRV record(s).
-
-
Admin must choose a host address from a verified / claimed top-level domain name per the Manage domains article.
1 |
From the customer view in https://admin.webex.com, go to . |
||
2 |
Select Add Trunk. |
||
3 |
Select a Location from the drop-down list. |
||
4 |
Enter a Name for the trunk. |
||
5 |
Select Certificate-based from the Trunk Type drop-down list. |
||
6 |
Select a Device Type from the drop-down.
|
||
7 |
Enter the Session Border Controller (SBC) Address, Domain, and Port. This is the FQDN or SRV address for Webex Calling to reach out to your Enterprise SBC.
|
||
8 |
Enter the maximum number of concurrent calls.
|
||
9 |
Click Save.
|
What to do next
-
Save the Webex Calling Edge addresses shown on the final screen.
-
To configure a CUBE as your Local Gateway, see: Configure Local Gateway on IOS-XE for Webex Calling
You can edit the trunk name or view the trunk details and usage in Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
||||
2 |
Select the trunk you want to view or modify. |
||||
3 |
On the side panel, next to the trunk name, click the You can also view the usage information for the trunk. |
||||
4 |
To view additional details, click Manage next to Trunks.
|
||||
5 |
Dual Identity Support setting impacts the handling of the From header and P-Asserted-Identity (PAI) header when sending an initial SIP INVITE to the trunk for an outbound call. Below are some example scenarios to better understand the usage of this setting:
|
You can delete a trunk as long as it's not in use.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
2 |
Select the trunk you want to delete. |
3 |
Click the |
To check the trunk status in Control Hub.
1 |
Log in to Control Hub https://admin.webex.com, go to . |
2 |
Select the trunk you want to check the status. |
3 |
Click Trunk Info. |
Example
The following are the different certificate-based trunk status:
-
Online: Successful connection between all the Webex Calling Edge proxies and Local Gateway.
-
Offline: Unsuccessful connection between the Webex Calling and Local Gateway.
-
Impaired: Unsuccessful connection between at least 1 Webex Calling Edge proxy and Local Gateway.
-
Unknown: In the process of establishing a connection between Webex Calling and the Local Gateway that is recently added.
SI No. |
Error Description |
Action |
---|---|---|
1. |
TLS Connection to Local Gateway failed due to DNS resolution failure of the FQDN configured for your gateway |
Verify the DNS configurations for the SRV /FQDN configured and ensure they are resolvable |
2. |
TLS Connection to Local Gateway failed due to a transport issue |
Verify that the resolved IP addresses and port to the Local Gateway are valid |
3. |
TLS Connection to Local Gateway failed as the gateway's certificate is signed by an invalid Certificate Authority |
Verify and ensure that the Local Gateway certificate is signed by a valid Certificate Authority (What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms?) |
4. |
TLS Connection to Local Gateway failed as the gateway's certificate has expired |
Verify and ensure that the Local Gateway certificate is not expired |
5. |
TLS Connection to Local Gateway failed as the gateway's certificate has been issued by an expired Certificate Authority |
Verify and ensure that the Local Gateway certificate is not signed by an expired Certificate authority certificate chain |
6. |
TLS Connection to Local Gateway failed as the FQDN configured for your gateway is missing from CN or SAN |
Verify and ensure that the Local Gateway certificate has CN / SAN same as the FQDN/SRV configured |
7. |
SIP options sent to the Local Gateway received no response |
Verify and ensure that the CUBE is configured to receive OPTIONS requests and respond. Verify the CUBE configuration |
8. |
TLS connection from Local Gateway to Webex Calling failed due to an invalid gateway certificate |
Verify and ensure that the Local Gateway certificate is valid |
9. |
TLS connection from Local Gateway to Webex Calling failed as we were unable to trust the Certificate Authority |
Verify and ensure that the Local Gateway certificate is signed by the valid Certificate Authority (What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms?) |
10. |
TLS connection from Local Gateway to Webex Calling failed due to expired certificates in the chain |
Verify and ensure that the Local Gateway certificate is not signed by the expired certificate chain |
11. |
TLS connection and SIP options from Local Gateway to Webex Calling have failed |
Verify and ensure that the CUBE is configured to send OPTIONS requests |
12. |
SIP options response from the Local Gateway indicates a Server error or Service Unavailable |
Verify and ensure that the Local Gateway is not in Maintenance mode or call routing is not disabled |
13. |
TLS Connection to Local Gateway failed as Local gateway's certificate has been revoked |
Verify and ensure that the Local Gateway certificate is not revoked |
14. |
TLS Connection from Local Gateway to Webex Calling failed as the gateway's certificate has been revoked |
Verify and ensure that the Local Gateway certificate is not revoked |
15. |
TLS Connection from Local Gateway to Webex Calling failed as the gateway's certificate has expired |
Verify and ensure that the Local Gateway certificate is not expired |
16. |
TLS Connection from Local Gateway to Webex Calling failed due to a certificate error |
Verify and ensure that the Local Gateway certificate is valid and meets requirements |
17. |
TLS Connection to Local Gateway from Webex Calling failed due to a certificate error |
erify and ensure that the Local Gateway certificate is valid and meets requirements |
Error SI No.: 2,6,11, and 12 are shown only when all the edge proxy nodes experience an issue. |
Route group
A Route Group is a group of trunks that allow Webex Calling to distribute calls over multiple trunks or to provide redundancy.
Before you begin
-
Add trunks before configuring a route group.
-
Route groups can include configured trunks from multiple locations.
-
Trunks can be configured singularly or assigned to a route group. Add trunks to route groups to provide redundancy and scalability.
-
Each route group must include at least one trunk with a maximum of 10 trunks per route group.
-
When configuring a route group, you set a priority level to the trunks within that route group. This setting enables calls to be routed in a load-balanced manner.
-
Calls are distributed randomly among trunks with the same priority. If a trunk that is set as highest priority is not available, the system attempts to route the call to a trunk with a lower priority setting. For example:
-
Trunk 1 and Trunk 2 are set at priority level 1.
-
Trunk 3 is set at priority level 2.
-
Webex Calling routes calls to Trunk 1 and Trunk 2 in a load-balanced manner.
-
If Trunk 1 and Trunk 2 are unreachable, calls are routed to Trunk 3.
-
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select . |
3 |
Name the route group, then select the trunk(s) to add from the drop-down menu. |
4 |
Select the priority level for the trunk. |
5 |
Click Save. |
What to do next
From the confirmation screen, you can visit the Locations page to configure the PSTN connection to individual locations, or you can visit the Dial Plans page to use this route group as the routing choice for a dial plan. A route group can also be used as a routing choice for unknown extension routing on a location.
You can change an existing route group's name, add trunks, modify the number of trunks assigned, and change the trunk priority levels. From the route group details page, you can also view the Calls to On-Premises Extensions, Dial Plans, and PSTN Connection.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select the route group you want to modify. |
3 |
On the side panel, next to the route group name, click the |
4 |
To add or edit trunks in the route group, click Manage next to Trunks. You can add a trunk from the drop-down menu, edit the priority level of an existing trunk within the table, and/or delete an existing trunk from the table. |
5 |
Click Save. |
You can delete a route group as long as it's not in use.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select the route group you want to delete. |
3 |
Click the |
Dial plans allow you to route calls to on-premises destinations by use of trunks or route groups. They are configured globally for an enterprise and apply to all users, regardless of location. A dial plan also specifies the routing choice (trunk or route group) for calls that match any of its dial patterns. Specific dial patterns can be defined as part of your dial plan. A dial pattern represents on-premises extensions:
-
ESN/on-net numbers
-
+E.164 patterns
-
SIP URI domains
Numeric Dial Patterns
Numeric patterns can either represent E.164 numbers or enterprise numbers. Patterns for E.164 numbers start with a leading +, followed by a sequence of digits (1-9), and then optional wildcard characters.
Enterprise Dial Pattern
An enterprise dial pattern is represented by a sequence of digits (1-9), followed by optional wildcard characters. Valid wildcard characters are ! (matches any sequence of digits) and X (matches a single digit, 0-9). The ! wildcard can only occur once at the end and only in an E.164 pattern.
Enterprise Dial Plan Examples |
|
---|---|
+1408555XXXX |
11-digit +E.164 number starting with +1408555 |
+14085551234 |
Exact dial string +14085551234 |
+496100! |
Any dial string starting with +496100 |
84969XXX |
8-digit ESN starting with 84969 |
84969764 |
Exact 8-digit ESN 84969764 |
SIP URI Dial Pattern Syntax:
Only domains (right-hand side of SIP URI after @) are matched. Options are either:
-
Fully qualified domain
-
Domain with a leading * (indicating all sub-domains of given domain)
Examples:
SIP URI Dial Patter Syntax Examples |
||
---|---|---|
Prefix |
Meaning |
Examples |
example.com |
Only URIs with host portion “example.com” |
alice@example.com |
us.example.com |
Only URIs with host portion “us.example.com” |
alice@us.example.com |
*.example.com |
URIs with host portion being sub-domain of “example.com” |
alice@eu.example.com alice@sales.us.example.com Note: alice@example.com is not matched |
Once you’ve created your trunks and route groups, you can configure a dial plan in Control Hub.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Click Dial Plans, then Create Dial Plan. |
3 |
Enter a Name for the dial plan. |
4 |
Select a Routing Choice. Select either a previously created trunk or route group. |
5 |
(Optional) You can manually create or import a dial pattern for the route choices selected. |
6 |
Click Save. |
What to do next
You can also bulk-add dial patterns after your dial plan is created. To bulk-add dial patterns using a CSV file, go to the Dial Plans screen and select the Actions drop-down menu from the dial plan to edit, and then choose Import Dial Patterns CSV or Export Dial Patters CSV. Choose Download Template or Import CSV File and click Submit.
You can change an existing dial plan's name, routing choices, and dial patterns in Control Hub.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select the dial plan you want to modify. |
3 |
On the side panel, next to the dial plan name, click |
4 |
To change the Routing Choice choose another option from the drop-down menu. |
5 |
To manually add a new dial pattern, click Add dial patterns. Or click Import CSV to bulk-add dial patterns. |
6 |
To remove a dial pattern, click the |
7 |
Click Save. |
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select the dial plan you want to delete. |
3 |
Click |
You can enable the Calls to On-Premises Extensions setting in Control Hub. This setting applies to users within a location that are registered to a PBX and allows you to route unknown extensions (calling number length of 2-6 digits) to the PBX using an existing trunk or route group.
Before you begin
The Calls to On-Premises Extensions setting is enabled per location.
This setting allows preservation of dialing habits in a mixed cloud/premises environment. Users can continue to use abbreviated dialing (for example, 4 digits), even if the site is partially migrated to Webex Calling.
When enabled, calls made by users at the location to an unknown extension (between 2-6 digits) are routed to the selected route group/trunk as premises calls.
Calls routed through trunks at the location from an unknown extension are handled as premises calls. This is referring to upstream calls incoming into Webex Calling from a trunk.
Calls are considered as originating from an unknown extension when the caller ID does not match any of the existing dial plan patterns.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select the location to modify. |
3 |
On the panel, click Internal Dialing. |
4 |
Check the box next to Enable routing unknown extensions to the Premises as internal calls to enable this setting. |
5 |
Select a routing choice from the drop-down menu. |
6 |
Click Save. |
In Control Hub you can configure call routing settings between Webex Calling and premises. These settings determine how your unknown numbers are handled when using trunks and route groups to an on-premises PBX, and the caller ID format for calls routed between Webex Calling and your PBX.
1 |
From the customer view in https://admin.webex.com, go to . |
||
2 |
Scroll to Call Routing between Webex Calling and premises and choose how you would like to handle unknown numbers.
|
||
3 |
Choose your caller ID format.
|
||
4 |
Click Save. ![]() |
The Verify Call Routing tool in Control Hub provides:
-
Simulation of calls to analyze routing decisions.
-
Useful guidance during the design and configuration phases of a deployment.
-
Events in Webex Analytics Platform that include call routing decisions.
-
Support in troubleshooting instances.
1 |
From the customer view in https://admin.webex.com, go to . |
2 |
Select Verify Call Routing. |
3 |
From the drop-down menu, choose Select Call Source of a user or a trunk to verify. |
4 |
Enter a number or URI. |
5 |
Click See Routing Result to view the call routing. |
Example 1: Multi-site PBX
Deployment description
-
Enterprise customer with 100 sites across US.
-
Multi-site PBX deployment (or network of PBX’s), with main PBX spread over two main sites for HA.
-
8-digit enterprise dial plan: 8 + 3-digit site code + 4-digit extension.
-
30 sites remain on-premises, 70 sites move to Webex Calling. PSTN remains on-premises, through SIP Trunks at the two main sites.
-
No mixed sites. For each site users are either all on-premises or all cloud-registered.
Deployment solution
-
Single Dial Plan with 30 E.164 + 30 ESN patterns that routes calls for the on-premises users to a Route Group with two Trunks, terminating on two local gateways at the two main sites.


Example 2: Mixed cloud-PBX sites
Deployment description
-
Enterprise customer with 50 sites across the US: 10 large sites and 40 small branches.
-
PBX’s at large sites, key switches at branches.
-
7-digit Enterprise dial plan: 8 + 2-digit site code + 4-digit extension.
-
Webex Calling only at branches, slow migration from PBX’s at large sites (mixed sites with both Webex Calling and PBX users).
-
Cloud-connected PSTN for all cloud users (premises users continue to use existing PSTN).
-
Cloud and PBX users at each large site must retain extension-only dialing capabilities.
Deployment solution
-
Dial plans to route calls to each of the PBX’s from any other site. Also, for each large site, Calls to On-Premises Extensions configured to route calls to a trunk that terminates on a local gateway at the site.


Configurable limitations for trunks, route groups, and dial plans |
|
---|---|
Description |
Maximum Limitation |
Dial patterns that a CSV can upload to a dial plan |
10000 |
Trunks that can be configured per location |
100 |
Route groups per enterprise customer |
10000 |
Trunks configurable within a route group |
10 |
Dial plans configurable per enterprise customer |
10000 |
Dial patterns configurable with one dial plan |
10000 |