Overview

Webex Calling supports the colocation of a Survivability Gateway with a Local Gateway on the same Cisco IOS managed gateway. That is, you can use the same Cisco IOS gateway device to configure Local Gateway and Survivability Gateway services. Hence, you don’t need to have two different Cisco IOS managed gateways assigned as the Survivability Gateway and Local Gateway.

This article discusses the considerations for the colocation of Local Gateway and Survivability Gateway services in comparison to the standalone deployment of these services.

Due to detected vulnerabilities, Webex Calling will deprecate the RSAES-PKCS1-v1_5 encryption scheme used by the Site Survivability solution on September 1, 2024. Beyond this date, the RSAES-OAEP encryption scheme is mandatory.

To ensure continued operation with this encryption scheme, upgrade your Site Survivability Gateways to Cisco IOS XE Dublin 17.12.3 before September 1, 2024. No configuration changes are required to use the new encryption scheme following this upgrade.

Prerequisites

Cisco IOS XE Dublin 17.12.3 and later.

Limitations and restrictions

The following are the known limitations for colocation of services in Cisco IOS managed gateways:

  • High Availability isn’t supported for Local Gateways.

  • Config validation isn’t supported for Local Gateways.

  • In Control Hub, the gateway must be provisioned as a Survivability Gateway service.

  • If the customer has provisioned the gateway as a Local Gateway, they need to unassign, and then reassign the service as Survivability Gateway.

  • Colocation is specific to Cisco IOS Gateway. Customers using third-party Local Gateway must deploy Survivability Gateway separately.

  • Colocation for partner-deployed Local Gateway shared across multiple customers isn’t applicable.

For limitations and restrictions specific to the standalone gateway services, see Enroll Cisco IOS managed gateways to Webex Cloud and Site survivability for Webex Calling.

Call routing considerations for colocation

Call routing for colocation is based on a routing strategy that involves a combination of dial peer groups (DPG) and regular routing based on destination patterns. This is different from the call routing strategies used for standalone Cisco IOS managed gateway services. A standalone Local Gateway service uses a DPG-based call routing strategy. Standalone Survivability Gateway routes call using destination patterns.

Call Routing for Colocation of Local Gateway and Site Survivability Services

Consider the following when configuring call routing for colocation scenarios:

  • For calls from Webex Calling—The inbound dial-peer from Webex Calling is matched based on the Local Gateway hostname or DTG parameter in the URI. The inbound dial-peer is tied to a DPG having PSTN. The call is then routed to PSTN. In short, there’s no change in call routing from the existing Local Gateway routing strategy.

  • For calls from PSTN—Remove the call routing based on dial-peer groups. Route the calls using regular destination-pattern based routing. That is, an inbound dial-peer isn’t tied to a DPG in this strategy. Inbound dial-peer from PSTN is matched based on PSTN IP address in Via URI. Regular dial-peer look up would be done and a call would be routed based on dial-peer preference. The call is routed to a locally registered endpoint for survivability mode or to Webex Calling for active mode.

  • For calls from locally registered endpoints (applicable for site survivability mode during WAN outages)—Route the calls using regular destination-pattern based routing. In this strategy, an inbound dial-peer is matched to a line side dial-peer. Regular dial-peer look up is performed and a call would be routed based on dial-peer preference. The call is routed to a locally registered endpoint, PSTN, or Webex Calling.

  • A preference can be defined for each outbound dial-peer. This preference is used to decide the order of selection of dial-peers for the setup of an outgoing call. Lower the value, higher is the preference. For call routing in colocation, the dial-peer preference is set as follows:

    • Default preference of 0 to route calls to locally registered endpoints

    • Preference of 2 to route calls to Webex Calling trunk

    • Preference of 3 to route calls to PSTN trunk

The following table summarizes the call routing behavior for all inbound and outbound calls in Webex Calling that involves colocation of Cisco IOS managed gateway services:

Table 1. Call routing considerations for colocation
Inbound fromOutbound to

Gateway service

Call routing

Additional information

PSTN

Webex Calling

Colocation of Local Gateway and Survivability Gateway

Destination pattern (.T) based

Dial-peer having preference 2

PSTN

Local endpoints

Colocation of Local Gateway and Survivability Gateway

Destination pattern based

Using the dynamic dial-peers created based on registrations.

No configurations to perform on these system dial-peers. It would automatically have the highest precedence.

Local endpoints

PSTN

Colocation of Local Gateway and Survivability Gateway

Destination pattern based

Dial-peer having preference 3

Local endpoints

Webex Calling

Colocation of Local Gateway and Survivability Gateway

Destination pattern (.T) based

Dial-peer having preference 2

This is applicable only if Local Gateway trunk towards Webex Calling is still up even in Survivability Gateway mode.

Webex Calling

PSTN

Local Gateway

Dial-peer group based

Nailed-up connection to PSTN

Local endpoints

Local endpoints

Survivability Gateway

Destination pattern based

Using the dynamic dial-peers created based on registrations.

No additional dial-peer configuration changes are needed on these system dial-peers.

For detailed information on call routing considerations for colocation of Cisco IOS managed gateway services, refer to Webex Calling Preferred Architecture.

Configure colocation of services

If you need to assign a new Cisco IOS managed gateway for the colocation of Local Gateway and site survivability services, assign your gateway as a Survivability Gateway on the Control Hub. For information on assigning the Gateway as a Survivability Gateway, see Enroll Cisco IOS Managed Gateways to Webex Cloud to add the gateway to Control Hub.

Depending on the type of trunking that is used, you can configure colocation using one of the following:

Configure colocation for registration-based trunking

1

Configure certificates.

It’s mandatory that you use certificates signed by a trusted Certificate Authority. For more information on how to request and create certificates, see Configure certificates.

2

Configure global voice commands.

The voice configuration includes common settings related to both Local Gateway and Survivability Gateway services. The following is a sample global voice configuration:

voice service voip
  ip address trusted list
    ipv4 x.x.x.x y.y.y.y
  allow-connections sip to sip
  media statistics
  media bulk-stats
  no supplementary-service sip refer
  no supplementary-service sip handle-replaces
  fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
  stun
   stun flowdata agent-id 1 boot-count 4
   stun flowdata shared-secret 0 Password123$
  sip
   g729 annexb-all
   early-offer forced
   asymmetric payload full
   registrar server
3

Configuration specific to Survivability Gateway.

Set up voice register global, pool, and codec preferences for endpoints registering to Survivability Gateway. The following is a sample configuration specific to Survivability Gateway:

!
voice register global
 mode webex-sgw
 no allow-hash-in-dn
 max-dn 50
 max-pool 50
!
voice class codec 1
 codec preference 1 opus
 codec preference 2 g711ulaw
!
voice register pool  1
 id network 0.0.0.0 mask 0.0.0.0
 dtmf-relay rtp-nte
 voice-class codec 1
!
4

Configuration specific to Local Gateway. For more information, see Registration-based Local Gateway.

It includes configuration of the tenant used for registering the Local Gateway trunk to Webex Calling, the associated SIP profiles and codec preferences. The following is a sample configuration specific to Local Gateway:

voice class sip-profiles 200
rule 9 request ANY sip-header SIP-Req-URI modify "sips:(.*)" "sip:\1"
rule 10 request ANY sip-header To modify "<sips:(.*)" "<sip:\1"
rule 11 request ANY sip-header From modify "<sips:(.*)" "<sip:\1"
rule 12 request ANY sip-header Contact modify "<sips:(.*)>" "<sip:\1;transport=tls>" 
rule 13 response ANY sip-header To modify "<sips:(.*)" "<sip:\1"
rule 14 response ANY sip-header From modify "<sips:(.*)" "<sip:\1"
rule 15 response ANY sip-header Contact modify "<sips:(.*)" "<sip:\1"
rule 20 request ANY sip-header From modify ">" ";otg=hussain2572_lgu>"
rule 30 request ANY sip-header P-Asserted-Identity modify "sips:(.*)" sip:\1
!
voice class codec 99
codec preference 1 g711ulaw
codec preference 2 g711alaw 
!
voice class srtp-crypto 200
crypto 1 AES_CM_128_HMAC_SHA1_80
!
voice class stun-usage 200
stun usage firewall-traversal flowdata
stun usage ice lite
!
voice class tenant 200
  registrar dns:40462196.cisco-bcld.com scheme sips expires 240 refresh-ratio 50 tcp tls
  credentials number Hussain6346_LGU username Hussain2572_LGU password 0 meX7]~)VmF realm BroadWorks
  authentication username Hussain2572_LGU password 0 meX7]~)VmF realm BroadWorks
  authentication username Hussain2572_LGU password 0 meX7]~)VmF realm 40462196.cisco-bcld.com
  no remote-party-id
  sip-server dns:40462196.cisco-bcld.com
  connection-reuse
  srtp-crypto 200
  session transport tcp tls 
  url sips 
  error-passthru
  asserted-id pai 
  bind control source-interface GigabitEthernet0/0/1
  bind media source-interface GigabitEthernet0/0/1
  no pass-thru content custom-sdp 
  sip-profiles 200 
  outbound-proxy dns:la01.sipconnect-us10.cisco-bcld.com  
  privacy-policy passthru
5

Configuration specific to PSTN.

It includes setting up the tenant for PSTN and associated sip-profiles (if any), and codec preferences. The following is a sample configuration specific to PSTN:

!
voice class tenant 100 
 session transport udp
 url sip
 error-passthru
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 no pass-thru content custom-sdp
!
6

Configure inbound PSTN dial-peer.

It includes dial-peer selection for incoming PSTN calls based on header matching. The following is a sample configuration for inbound PSTN dial-peer:

!
voice class uri 100 sip
  host ipv4:192.168.80.13
!
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
session protocol sipv2
incoming uri via 100
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
emergency response callback
no vad
!
7

Configure outbound Webex Calling dial-peer.

It includes dial-peer selection for outbound Webex Calling trunk based on dial-peer group. The following is a sample configuration for outbound Webex Calling dial-peer:


dial-peer voice 200201 voip
description Outbound Webex Calling
destination e164-pattern-map 100
preference 2
session protocol sipv2
session target sip-server
voice-class codec 99
dtmf-relay rtp-nte
voice-class stun-usage 200
no voice-class sip localhost
voice-class sip tenant 200
srtp
no vad
!
8

Configure inbound Webex Calling dial-peer.

It includes dial-peer selection for incoming Webex Calling calls based on matching the DPG parameter in the Request-URI header. Dial-peer Group is used for routing the calls directly to the outbound PSTN. The following is a sample configuration for inbound Webex Calling dial-peer:


voice class dpg 200
 dial-peer 101 preference 1
!
!
voice class uri 200 sip
 pattern dtg=hussain2572
!
dial-peer voice 200201 voip
description Inbound Webex Calling
destination dpg 200
max-conn 250
incoming uri request 200
!
9

Configure outbound PSTN dial-peer.

It’s used for routing PSTN calls in Local Gateway and Survivability Gateway modes. Change the destination-pattern from the current BAD to a pattern suitable for PSTN calls. This is required for routing of PSTN calls from locally registered endpoints. You can do this either directly using destination-pattern or through E164 pattern-map. The following is a sample configuration for outbound PSTN dial-peer:

!
voice class e164-pattern-map 100
  e164 +91.T
  e164 +1.T
  e164 +.T
 !

!
dial-peer voice 101 voip 
description Outgoing dial-peer to IP PSTN
destination e164-pattern-map 100
preference 3
session protocol sipv2
session target ipv4:192.168.80.13
voice-class sip options-keepalive
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
!
10

Configure outbound PSTN dial-peers for emergency calls in survivability mode.

It is used for dial-peer selection based on E164 pattern match. These dial-peers are matched only for calls originating from endpoints registered directly to Survivability Gateway in Survivability mode. Provision one or more dial-peers based on the supported dial plan in survivability mode and the associated calling permissions. The following is a sample configuration for outbound PSTN dial-peers for emergency calls in survivability mode:

!
voice class e164-pattern-map 300
  e164 911
 !
dial-peer voice 300 voip
 description Outbound PSTN dial-peer for E911 call in Survivability Mode
 emergency response zone 1
 session protocol sipv2
 session target ipv4:10.65.125.202:9089
 destination e164-pattern-map 300
 voice-class codec 99
 voice-class sip tenant 100
 dtmf-relay rtp-nte
!
11

Configure dial-peer hunt.

It is used to select dial-peers for routing based on the preference set on dial-peers.

!
dial-peer hunt 2
!

Configure colocation for certificate-based trunking

Before you begin

Configuration of colocation for certificate-based trunking is similar to registration-based trunking, except for those specific to Local Gateway trunk and tenants.

1

Configure certificates.

It’s mandatory that you use certificates signed by a trusted Certificate Authority. For more information on how to request and create certificates, see Configure certificates.

2

Configure global voice commands.

The voice configuration includes common settings related to both Local Gateway and Survivability Gateway services. The following is a sample global voice configuration:

voice service voip
  ip address trusted list
    ipv4 x.x.x.x y.y.y.y
  allow-connections sip to sip
  media statistics
  media bulk-stats
  no supplementary-service sip refer
  no supplementary-service sip handle-replaces
  fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
  stun
   stun flowdata agent-id 1 boot-count 4
   stun flowdata shared-secret 0 Password123$
  sip
   g729 annexb-all
   early-offer forced
   asymmetric payload full
   registrar server
3

Configuration specific to Survivability Gateway.

Set up voice register global, pool and codec preferences for endpoints registering to Survivability Gateway. The following is a sample configuration specific to Survivability Gateway:

!
voice register global
 mode webex-sgw
 no allow-hash-in-dn
 max-dn 50
 max-pool 50
!
voice class codec 1
 codec preference 1 opus
 codec preference 2 g711ulaw
!
voice register pool  1
 id network 0.0.0.0 mask 0.0.0.0
 dtmf-relay rtp-nte
 voice-class codec 1
!
4

Configuration specific to Local Gateway. For more information, see Certificate-based trunking.

It includes configuration of the trunk and tenant required to perform certificate exchange in the Local Gateway, the associated SIP profiles and codec preferences. The following is a sample configuration specific to Local Gateway:

voice class codec 200
codec preference 1 g711ulaw
 codec preference 2 g711alaw
!
voice class sip-options-keepalive 200
 description Keepalive webex_mTLS
 up-interval 5
 transport tcp tls
!
voice class tls-profile 200
 description Webexcalling
 trustpoint sbc6
 cn-san validate bidirectional
 cn-san  1 us01.sipconnect.bcld.webex.com
!
voice class sip-profiles 200
 rule 10 request ANY sip-header Contact modify "@.*:" "@sbc6.tekvizionlabs.com:" 
 rule 20 response ANY sip-header Contact modify "@.*:" "@sbc6.tekvizionlabs.com:" 
!
voice class srtp-crypto 200
 crypto 1 AES_CM_128_HMAC_SHA1_80
!

voice class tenant 200
  no remote-party-id
  localhost sbc6.tekvizionlabs.com
  srtp-crypto 200
  session transport tcp tls 
  url sips 
  error-passthru
  asserted-id pai 
  bind control source-interface GigabitEthernet0/0/1
  bind media source-interface GigabitEthernet0/0/1
  no pass-thru content custom-sdp 
  sip-profiles 200 
  privacy-policy passthru
  tls-profile 200
!
5

Configuration specific to PSTN.

It includes setting up the tenant for PSTN and associated sip-profiles (if any), and codec preferences. The following is a sample configuration specific to PSTN:

!
voice class tenant 100 
 session transport udp
 url sip
 error-passthru
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 no pass-thru content custom-sdp
!
6

Configure inbound PSTN dial-peer.

It includes dial-peer selection for incoming PSTN calls based on header matching. The following is a sample configuration for inbound PSTN dial-peer:

!
voice class uri 100 sip
  host ipv4:192.168.80.13
!
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
session protocol sipv2
incoming uri via 100
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
emergency response callback
no vad
!
7

Configure outbound Webex Calling dial-peer.

It includes dial-peer selection for outbound Webex Calling trunk based on dial-peer group. The following is a sample configuration for outbound Webex Calling dial-peer:

dial-peer voice 200201 voip
description OutBound Webex Calling
session protocol sipv2
session target dns:<insert us01.sipconnect.bcld.webex.com>
session transport tcp tls
destination e164-pattern-map 100
voice-class codec 200
voice-class stun-usage 200
voice-class sip asserted-id pai
voice-class sip tenant 200
voice-class sip options-keepalive profile 200
voice-class sip bind control source-interface GigabitEthernet 0/0/2
voice-class sip bind media source-interface GigabitEthernet 0/0/2
dtmf-relay rtp-nte
srtp
no vad
!
8

Configure inbound Webex Calling dial-peer.

It includes dial-peer selection for incoming Webex Calling calls based on matching the DPG parameter in Request-URI header. Dial-peer Group is used for routing the calls directly to the outbound PSTN. The following is a sample configuration for inbound Webex Calling dial-peer:

voice class dpg 200
 dial-peer 101 preference 1
!
!
voice class uri 200 sip
 pattern dtg=hussain2572
!
dial-peer voice 200201 voip
description Inbound Webex Calling
destination dpg 200
max-conn 250
incoming uri request 200
!
9

Configure outbound PSTN dial-peer.

It is used for routing PSTN calls in Local Gateway and Survivability Gateway modes. Change the destination-pattern from current BAD to a pattern suitable for PSTN calls. This is required for routing of PSTN calls from locally registered endpoints. You can do this either directly using destination-pattern or through E164 pattern-map. The following is a sample configuration for outbound PSTN dial-peer:

!
voice class e164-pattern-map 100
  e164 +91.T
  e164 +1.T
  e164 +.T
 !

!
dial-peer voice 101 voip 
description Outgoing dial-peer to IP PSTN
destination e164-pattern-map 100
preference 3
session protocol sipv2
session target ipv4:192.168.80.13
voice-class sip options-keepalive
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
!
10

Configure outbound PSTN dial-peers for emergency calls in survivability mode.

It is used for dial-peer selection based on E164 pattern match. These dial-peers are matched only for calls originating from endpoints registered directly to Survivability Gateway in Survivability mode. Provision one or more dial-peers based on the supported dial plan in survivability mode and the associated calling permissions. The following is a sample configuration for outbound PSTN dial-peers for emergency calls in survivability mode:

!
voice class e164-pattern-map 300
  e164 911
 !
dial-peer voice 300 voip
 description Outbound PSTN dial-peer for E911 call in Survivability Mode
 emergency response zone 1
 session protocol sipv2
 session target ipv4:10.65.125.202:9089
 destination e164-pattern-map 300
 voice-class codec 99
 voice-class sip tenant 100
 dtmf-relay rtp-nte
!
11

Configure dial-peer hunt.

It is used to select dial-peers for routing based on the preference set on dial-peers.

!
dial-peer hunt 2
!