You may notice some articles displaying content inconsistently. Pardon our dust as we update our site.
cross icon
In this article
Commands A through C
    Commands D through I
      Commands K through R
        Commands S
          Commands T through Z
            In this article
            cross icon
            Commands A through C
              Commands D through I
                Commands K through R
                  Commands S
                    Commands T through Z

                      Webex Managed Gateway Command Reference

                      list-menuIn this article
                      list-menuFeedback?

                      Use this article for the list of commands to configure the Cisco managed gateway.

                      Commands A through C

                      To enable the authentication, authorization, and accounting (AAA) access control model, use the aaa new-model command in global configuration mode. To disable the AAA access control model, use the no form of this command.

                      aaa new-model

                      no aaa new-model

                      This command has no arguments or keywords.

                      Command Default: AAA is not enabled.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command enables the AAA access control system.

                      Example: The following configuration initializes AAA:

                      Device(config)# aaa new-model
                      Related CommandsDescriptions
                      aaa accounting

                      Enables AAA accounting of requested services for billing or security purposes.

                      aaa authentication arap

                      Enables an AAA authentication method for ARAP using TACACS+.

                      aaa authentication enable default

                      Enables AAA authentication to determine if a user can access the privileged command level.

                      aaa authentication login

                      Sets AAA authentication at login.

                      aaa authentication ppp

                      Specifies one or more AAA authentication method for use on serial interfaces running PPP.

                      aaa authorization

                      Sets parameters that restrict user access to a network.

                      To set authentication, authorization, and accounting (AAA) authentication at login, use the aaa authentication login command in global configuration mode. To disable AAA authentication, use the no form of this command.

                      aaa authentication login {default | list-name } method1 [method2...]

                      no aaa authentication login {default | list-name } method1 [method2...]

                      default

                      Uses the listed authentication methods that follow this keyword as the default list of methods when a user logs in.

                      list-name

                      Character string used to name the list of authentication methods activated when a user logs in. See the “Usage Guidelines” section for more information.

                      method1 [method2.…]

                      The list of methods that the authentication algorithm tries in the given sequence. You must enter at least one method; you may enter up to four methods. Method keywords are described in the table below.

                      Command Default: AAA authentication at login is disabled.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: If the default keyword is not set, only the local user database is checked. This has the same effect as the following command:

                      aaa authentication login default local

                      On the console, login will succeed without any authentication checks if default keyword is not set.

                      The default and optional list names that you create with the aaa authentication login command are used with the login authentication command.

                      Create a list by entering the aaa authentication login list-name method command for a particular protocol. The list-name argument is the character string used to name the list of authentication methods activated when a user logs in. The method argument identifies the list of methods that the authentication algorithm tries, in the given sequence. The “Authentication Methods that cannot be used for the list-name Argument” section lists authentication methods that cannot be used for the list-name argument and the table below describes the method keywords.

                      To create a default list that is used if no list is assigned to a line, use the login authentication command with the default argument followed by the methods you want to use in default situations.

                      The password is prompted only once to authenticate the user credentials and in case of errors due to connectivity issues, multiple retries are possible through the additional methods of authentication. However, the switchover to the next authentication method happens only if the previous method returns an error, not if it fails. To ensure that the authentication succeeds even if all methods return an error, specify none as the final method in the command line.

                      If authentication is not specifically set for a line, the default is to deny access and no authentication is performed. Use the more system:running-config command to display currently configured lists of authentication methods.

                      Authentication Methods that cannot be used for the list-name Argument

                      The authentication methods that cannot be used for the list-name argument are as follows:

                      • auth-guest

                      • enable

                      • guest

                      • if-authenticated

                      • if-needed

                      • krb5

                      • krb-instance

                      • krb-telnet

                      • line

                      • local

                      • none

                      • radius

                      • rcmd

                      • tacacs

                      • tacacsplus

                      In the table below, the group radius, group tacacs +, group ldap, and group group-name methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs-server host commands to configure the host servers. Use the aaa group server radius, aaa group server ldap, and aaa group server tacacs+ commands to create a named group of servers.

                      The table below describes the method keywords.

                      Keyword

                      Description

                      cache group-name

                      Uses a cache server group for authentication.

                      enable

                      Uses the enable password for authentication. This keyword cannot be used.

                      group group-name

                      Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command.

                      group ldap

                      Uses the list of all Lightweight Directory Access Protocol (LDAP) servers for authentication.

                      group radius

                      Uses the list of all RADIUS servers for authentication.

                      group tacacs+

                      Uses the list of all TACACS+ servers for authentication.

                      krb5

                      Uses Kerberos 5 for authentication.

                      krb5-telnet

                      Uses Kerberos 5 Telnet authentication protocol when using Telnet to connect to the router.

                      line

                      Uses the line password for authentication.

                      local

                      Uses the local username database for authentication.

                      local-case

                      Uses case-sensitive local username authentication.

                      none

                      Uses no authentication.

                      passwd-expiry

                      Enables password aging on a local authentication list.

                      The radius-server vsa send authentication command is required to make the passwd-expiry keyword work.

                      Example: The following example shows how to create an AAA authentication list called MIS-access . This authentication first tries to contact a TACACS+ server. If no server is found, TACACS+ returns an error and AAA tries to use the enable password. If this attempt also returns an error (because no enable password is configured on the server), the user is allowed access with no authentication.

                      aaa authentication login MIS-access group tacacs+ enable none

                      The following example shows how to create the same list, but it sets it as the default list that is used for all login authentications if no other list is specified:

                      aaa authentication login default group tacacs+ enable none

                      The following example shows how to set authentication at login to use the Kerberos 5 Telnet authentication protocol when using Telnet to connect to the router:

                      aaa authentication login default krb5

                      The following example shows how to configure password aging by using AAA with a crypto client:

                      aaa authentication login userauthen passwd-expiry group radius

                      Related Commands

                      Description

                      aaa new-model

                      Enables the AAA access control model.

                      login authentication

                      Enables AAA authentication for logins.

                      To set the parameters that restrict user access to a network, use the aaa authorization command in global configuration mode. To remove the parameters, use the no form of this command.

                      aaa authorization { auth-proxy | cache | commandslevel | config-commands | configuration | console | exec | ipmobile | multicast | network | policy-if | prepaid | radius-proxy | reverse-access | subscriber-service | template} {default | list-name } [method1 [method2.… ]]

                      no aaa authorization { auth-proxy | cache | commandslevel | config-commands | configuration | console | exec | ipmobile | multicast | network | policy-if | prepaid | radius-proxy | reverse-access | subscriber-service | template} {default | list-name } [method1 [method2.… ]]

                      auth-proxy

                      Runs authorization for authentication proxy services.

                      cache

                      Configures the authentication, authorization, and accounting (AAA) server.

                      commands

                      Runs authorization for all commands at the specified privilege level.

                      level

                      Specific command level that should be authorized. Valid entries are 0 through 15.

                      config-commands

                      Runs authorization to determine whether commands entered in configuration mode are authorized.

                      configuration

                      Downloads the configuration from the AAA server.

                      console

                      Enables the console authorization for the AAA server.

                      exec

                      Runs authorization to determine if the user is allowed to run an EXEC shell. This facility returns user profile information such as the autocommand information.

                      ipmobile

                      Runs authorization for mobile IP services.

                      multicast

                      Downloads the multicast configuration from the AAA server.

                      network

                      Runs authorization for all network-related service requests, including Serial Line Internet Protocol (SLIP), PPP, PPP Network Control Programs (NCPs), and AppleTalk Remote Access (ARA).

                      policy-if

                      Runs authorization for the diameter policy interface application.

                      prepaid

                      Runs authorization for diameter prepaid services.

                      radius-proxy

                      Runs authorization for proxy services.

                      reverse-access

                      Runs authorization for reverse access connections, such as reverse Telnet.

                      subscriber-service

                      Runs authorization for iEdge subscriber services such as virtual private dialup network (VPDN).

                      template

                      Enables template authorization for the AAA server.

                      default

                      Uses the listed authorization methods that follow this keyword as the default list of methods for authorization.

                      list-name

                      Character string used to name the list of authorization methods.

                      method1 [method2... ]

                      (Optional) Identifies an authorization method or multiple authorization methods to be used for authorization. A method may be any one of the keywords listed in the table below.

                      Command Default: Authorization is disabled for all actions (equivalent to the method keyword none ).

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the aaa authorization command to enable authorization and to create named methods lists, which define authorization methods that can be used when a user accesses the specified function. Method lists for authorization define the ways in which authorization will be performed and the sequence in which these methods will be performed. A method list is a named list that describes the authorization methods (such as RADIUS or TACACS+) that must be used in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method, or until all the defined methods are exhausted.

                      The Cisco IOS software attempts authorization with the next listed method only when there is no response from the previous method. If authorization fails at any point in this cycle--meaning that the security server or the local username database responds by denying the user services--the authorization process stops and no other authorization methods are attempted.

                      If the aaa authorization command for a particular authorization type is issued without a specified named method list, the default method list is automatically applied to all interfaces or lines (where this authorization type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no authorization takes place. The default authorization method list must be used to perform outbound authorization, such as authorizing the download of IP pools from the RADIUS server.

                      Use the aaa authorization command to create a list by entering the values for the list-name and the method arguments, where list-name is any character string used to name this list (excluding all method names) and method identifies the list of authorization methods tried in the given sequence.

                      The aaa authorization command supports 13 separate method lists. For example:

                      aaa authorization configuration methodlist1 group radius

                      aaa authorization configuration methodlist2 group radius

                      ...

                      aaa authorization configuration methodlist13 group radius

                      In the table below, the group group-name, group ldap, group radius , and group tacacs + methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs-server host commands to configure the host servers. Use the aaa group server radius , aaa group server ldap , and aaa group server tacacs+ commands to create a named group of servers.

                      Cisco IOS software supports the following methods for authorization:

                      • Cache Server Groups--The router consults its cache server groups to authorize specific rights for users.

                      • If-Authenticated --The user is allowed to access the requested function provided the user has been authenticated successfully.

                      • Local --The router or access server consults its local database, as defined by the username command, to authorize specific rights for users. Only a limited set of functions can be controlled through the local database.

                      • None --The network access server does not request authorization information; authorization is not performed over this line or interface.

                      • RADIUS --The network access server requests authorization information from the RADIUS security server group. RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server, with the appropriate user.

                      • TACACS+ --The network access server exchanges authorization information with the TACACS+ security daemon. TACACS+ authorization defines specific rights for users by associating attribute-value (AV) pairs, which are stored in a database on the TACACS+ security server, with the appropriate user.

                      Example: The following example shows how to define the network authorization method list named mygroup, which specifies that RADIUS authorization will be used on serial lines using PPP. If the RADIUS server fails to respond, local network authorization will be performed.

                      aaa authorization network mygroup group radius local 

                      Related Commands

                      Description

                      aaa accounting

                      Enables AAA accounting of requested services for billing or security purposes.

                      aaa group server radius

                      Groups different RADIUS server hosts into distinct lists and distinct methods.

                      aaa group server tacacs+

                      Groups different TACACS+ server hosts into distinct lists and distinct methods.

                      aaa new-model

                      Enables the AAA access control model.

                      radius-server host

                      Specifies a RADIUS server host.

                      tacacs-server host

                      Specifies a TACACS+ host.

                      username

                      Establishes a username-based authentication system.

                      To allow connections between specific types of endpoints in a VoIP network, use the allow-connections command in voice service configuration mode. To refuse specific types of connections, use the no form of this command.

                      allow-connections from-type to to-type

                      no allow-connections from-type to to-type

                      from-type

                      Originating endpoint type. The following choices are valid:

                      • sip — Session Interface Protocol (SIP).

                      to

                      Indicates that the argument that follows is the connection target.

                      to-type

                      Terminating endpoint type. The following choices are valid:

                      • sip — Session Interface Protocol (SIP).

                      Command Default: SIP-to-SIP connections are disabled by default.

                      Command Mode: Voice-service configuration (config-voi-serv)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command is used to allow connections between specific types of endpoints in a Cisco multiservice IP-to-IP gateway. The command is enabled by default and cannot be changed.

                      Example: The following example specifies that connections between SIP endpoints are allowed:

                      
                      Device(config-voi-serv)# allow-connections sip to sip
                      

                      Command

                      Description

                      voice service

                      Enters voice service configuration mode.

                      To allow the insertion of '#' at any place in voice register dn, use the allow-hash-in-dn command in voice register global mode. To disable this, use the no form of this command.

                      allow-hash-in-dn

                      no allow-hash-in-dn

                      allow-hash-in-dn

                      Allow the insertion of hash at all places in voice register dn.

                      Command Default: The command is disabled by default.

                      Command Mode: voice register global configuration (config-register-global)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Before this command was introduced, the characters supported in voice register dn were 0-9, +, and *. The new command is enabled whenever the user requires the insertion of # in voice register dn. The command is disabled by default. You can configure this command only in Cisco Unified SRST and Cisco Unified E-SRST modes. The character # can be inserted at any place in voice register dn. When this command is enabled, users are required to change the default termination character(#) to another valid character using dial-peer terminator command under configuration mode.

                      Example: The following example shows how to enable the command in mode E-SRST, SRST and how to change the default terminator:

                      
                      Router(config)#voice register global
                      Router(config-register-global)#mode esrst
                      Router(config-register-global)#allow-hash-in-dn
                      
                      Router(config)#voice register global
                      Router(config-register-global)#no mode [Default SRST mode]
                      Router(config-register-global)#allow-hash-in-dn
                      
                      Router(config)#dial-peer terminator ?
                      WORD Terminator character: '0'-'9', 'A'-'F', '*', or '#'
                      
                      Router(config)#dial-peer terminator *

                      Command

                      Description

                      dial-peer terminator

                      Configures the character used as a terminator for variable-length dialed numbers.

                      To enter redundancy application configuration mode, use the application redundancy command in redundancy configuration mode.

                      application redundancy

                      This command has no arguments or keywords.

                      Command Default: None

                      Command Mode: Redundancy configuration (config-red)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use this application redundancy command to configure application redundancy for high availability.

                      Example: The following example shows how to enter redundancy application configuration mode:

                      
                      Device# configure terminal
                      Device(config)# redundancy
                      Device(config-red)# application redundancy
                      Device(config-red-app)#

                      Command

                      Description

                      group (firewall)

                      Enters redundancy application group configuration mode.

                      To set the default gateway for an application, use the app-default-gateway command in application hosting configuration mode. To remove the default gatway, use the no form of this command.

                      app-default-gateway [ip-address guest-interface network-interface-number]

                      no app-default-gateway [ip-address guest-interface network-interface-number]

                      guest-interface network-interface-number

                      Configures the guest interface. The network-interface-number maps to the container Ethernet number.

                      ip-address

                      IP address of the default gateway.

                      Command Default: The default gateway is not configured.

                      Command Mode: Application hosting configuration (config-app-hosting)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the app-default-gateway command to set default gateway for an application. The gateway connectors are applications installed on the Cisco IOS XE GuestShell container.

                      Example: The following example shows how to set the default gateway for the application:

                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-default-gateway 10.3.3.31 guest-interface 1
                      Device(config-app-hosting)# 

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      To configure an application, and to enter application hosting configuration mode, use the app-hosting appid command in global configuration mode. To remove the application, use the no form of this command.

                      app-hosting appid application-name

                      application-name

                      Specifies an application name.

                      Command Default: No application is configured.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines:The application name argument can be up to 32 alphanumeric characters.

                      You can update the application hosting configuration, after configuring this command.

                      Example: The following example shows how to configure an application:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device (config-app-hosting)# 

                      To override the application-provided resource profile, use the app-resoure profile command in application hosting configuration mode. To revert to the application-specified resource profile, use the no form of this command.

                      app-resoure profile profile-name

                      no app-resoure profile profile-name

                      profile-name

                      Name of the resource profile.

                      Command Default: Resource profile is configured.

                      Command Mode: Application hosting configuration (config-app-hosting)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Reserved resources specified in the application package can be changed by setting a custom resource profile. Only the CPU, memory, and virtual CPU (vCPU) resources can be changed. For the resource changes to take effect, stop and deactivate the application, then activate and start it again.

                      Only custom profile is supported.

                      The command configures the custom application resource profile, and enters custom application resource profile configuration mode.

                      Example: The following example shows how to change the allocation of resources of an application:

                      
                      Device# configure terminal
                      Device(config)# application-hosting appid iox_app
                      Device(config-app-hosting)# app-resource profile custom
                      Device(config-app-resource-profile-custom)#
                      

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      To configure a virtual network interface gateway for an application, use the app-vnic gateway command in application hosting configuration mode. To remove the configuration, use the no form of this command.

                      This command is supported only on routing platforms. It is not supported on switching platforms.

                      app-vnic gateway virtualportgroup number guest-interface network-interface-number

                      no app-vnic gateway virtualportgroup number guest-interface network-interface-number

                      virtualportgroup number

                      Configures a VirtualPortGroup interface for the gateway.

                      guest-interface network-interface-number Configures a guest interface for the gateway.

                      Command Default: The virtual network gateway is not configured.

                      Command Mode: Application hosting configuration (config-app-hosting)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: After you configure the virtual network interface gateway for an application, the command mode changes to application-hosting gateway configuration mode. In this mode, you can configure the IP address of the guest interface.

                      Example: The following example shows how to configure the management gateway of an application:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-vnic gateway1 virtualportgroup 0 guest-interface 1
                      Device(config-app-hosting-gateway)# guest-ipaddress 10.0.0.3 netmask 255.255.255.0
                      Device(config-app-hosting-gateway)#

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      guest-ipaddress

                      Configures an IP address for the guest interface.

                      To enable support for the asserted ID header in incoming Session Initiation Protocol (SIP) requests or response messages, and to send the asserted ID privacy information in outgoing SIP requests or response messages, use the asserted-id command in voice service VoIP-SIP configuration mode or voice class tenant configuration mode. To disable the support for the asserted ID header, use the no form of this command.

                      asserted-id { pai | ppi } system

                      no asserted-id { pai | ppi } system

                      pai

                      (Optional) Enables the P-Asserted-Identity (PAI) privacy header in incoming and outgoing SIP requests or response messages.

                      ppi

                      (Optional) Enables the P-Preferred-Identity (PPI) privacy header in incoming SIP requests and outgoing SIP requests or response messages.

                      system

                      Specifies that the asserted-id use the global forced CLI setting. This keyword is available only for the tenant configuration mode.

                      Command Default: The privacy information is sent using the Remote-Party-ID (RPID) header or the FROM header.

                      Command Mode: Voice service VoIP-SIP configuration (conf-serv-sip) and Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: If you choose the pai keyword or the ppi keyword, the gateway builds the PAI header or the PPI header, respectively, into the common SIP stack. The pai keyword or the ppi keyword has the priority over the Remote-Party-ID (RPID) header, and removes the RPID header from the outbound message, even if the router is configured to use the RPID header at the global level.

                      Example: The following example shows how to enable support for the PAI privacy header:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# voice service voip
                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# asserted-id pai

                      The following example shows asserted ID used in the voice class tenant configuration mode:

                      Router(config-class)# asserted-id system

                      Command

                      Description

                      calling-info pstn-to-sip

                      Specifies calling information treatment for PSTN-to-SIP calls.

                      privacy

                      Sets privacy in support of RFC 3323.

                      voice-class sip asserted-id

                      Enables support for the asserted ID header in incoming and outgoing SIP requests or response messages in dial-peer configuration mode.

                      To configure Session Initiation Protocol (SIP) asymmetric payload support, use the asymmetric payload command in SIP configuration mode or voice class tenant configuration mode. To disable asymmetric payload support, use the no form of this command.

                      asymmetricpayload { dtmf | dynamic-codecs | full | system }

                      no asymmetricpayload { dtmf | dynamic-codecs | full | system }

                      dtmf

                      (Optional) Specifies that the asymmetric payload support is dual-tone multi-frequency (DTMF) only.

                      dynamic-codecs

                      (Optional) Specifies that the asymmetric payload support is for dynamic codec payloads only.

                      full

                      (Optional) Specifies that the asymmetric payload support is for both DTMF and dynamic codec payloads.

                      system

                      (Optional) Specifies that the asymmetric payload uses the global value.

                      Command Default: This command is disabled.

                      Command Mode: Voice service SIP configuration (conf-serv-sip), Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Enter SIP configuration mode from voice-service configuration mode, as shown in the example.

                      For the Cisco UBE the SIP asymmetric payload-type is supported for audio/video codecs, DTMF, and NSE. Hence, dtmf and dynamic-codecs keywords are internally mapped to the full keyword to provide asymmetric payload-type support for audio/video codecs, DTMF, and NSE.

                      Example: The following example shows how to set up a full asymmetric payload globally on a SIP network for both DTMF and dynamic codecs:

                      
                      Router(config)# voice service voip
                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# asymmetric payload full

                      The following example shows how to set up a full asymmetric payload globally in the voice class tenant configuration mode:

                      Router(config-class)# asymmetric payload system

                      Command

                      Description

                      sip

                      Enters SIP configuration mode from voice-service VoIP configuration mode.

                      voice-class sip asymmetric payload

                      Configures SIP asymmetric payload support on a dial peer.

                      To enable SIP digest authentication on an individual dial peer, use the authentication command in dial peer voice configuration mode. To disable SIP digest authentication, use the no form of this command.

                      authentication username username password { 0 | 6 | 7 } password [realm realm | challenge | all ]

                      no authentication username username password { 0 | 6 | 7 } password [realm realm | challenge | all ]

                      username

                      Specifies the username for the user who is providing authentication.

                      username

                      A string representing the username for the user who is providing authentication. A username must be at least four characters.

                      password

                      Specifies password settings for authentication.

                      0

                      Specifies encryption type as cleartext (no encryption).

                      6

                      Specifies secure reversible encryption for passwords using type 6 Advanced Encryption Scheme (AES).

                      Requires AES primary key to be preconfigured.

                      7

                      Specifies encryption type as encrypted.

                      password

                      A string representing the password for authentication. If no encryption type is specified, the password will be cleartext format. The string must be between 4 and 128 characters.

                      realm

                      (Optional) Specifies the domain where the credentials are applicable.

                      realm

                      (Optional) A string representing the domain where the credentials are applicable.

                      all

                      (Optional) Specifies all the authentication entries for the user (dial-peer).

                      Command Default: SIP digest authentication is disabled.

                      Command Mode: Dial peer voice configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The following configuration rules are applicable when enabling digest authentication:

                      • Only one username can be configured per dial peer. Any existing username configuration must be removed before configuring a different username.

                      • A maximum of five password or realm arguments can be configured for any one username.

                      The username and password arguments are used to authenticate a user. An authenticating server/proxy issuing a 407/401 challenge response includes a realm in the challenge response and the user provides credentials that are valid for that realm. Because it is assumed that a maximum of five proxy servers in the signaling path can try to authenticate a given request from a user-agent client (UAC) to a user-agent server (UAS), a user can configure up to five password and realm combinations for a configured username.

                      The user provides the password in plain text but it is encrypted and saved for 401 challenge response. If the password is not saved in encrypted form, a junk password is sent and the authentication fails.

                      • The realm specification is optional. If omitted, the password configured for that username applies to all realms that attempt to authenticate.

                      • Only one password can be configured at a time for all configured realms. If a new password is configured, it overwrites any previously configured password.

                      This means that only one global password (one without a specified realm) can be configured. If you configure a new password without configuring a corresponding realm, the new password overwrites the previous one.

                      • If a realm is configured for a previously configured username and password, that realm specification is added to that existing username and password configuration. However, once a realm is added to a username and password configuration, that username and password combination is valid only for that realm. A configured realm cannot be removed from a username and password configuration without first removing the entire configuration for that username and password--you can then reconfigure that username and password combination with or without a different realm.

                      • In an entry with both a password and realm, you can change either the password or realm.

                      • Use the no authentication all command to remove all the authentication entries for the user.

                      It is mandatory to specify the encryption type for the password. If a clear text password (type 0) is configured, it is encrypted as type 6 before saving it to the running configuration.

                      If you specify the encryption type as 6 or 7, the entered password is checked against a valid type 6 or 7 password format and saved as type 6 or 7 respectively.

                      Type-6 passwords are encrypted using AES cipher and a user-defined primary key. These passwords are comparatively more secure. The primary key is never displayed in the configuration. Without the knowledge of the primary key, type 6 passwords are unusable. If the primary key is modified, the password that is saved as type 6 is re-encrypted with the new primary key. If the primary key configuration is removed, the type 6 passwords cannot be decrypted, which may result in the authentication failure for calls and registrations.

                      When backing up a configuration or migrating the configuration to another device, the primary key is not dumped. Hence the primary key must be configured again manually.

                      To configure an encrypted preshared key, see Configuring an Encrypted Preshared Key.

                      Following warning message is displayed when encryption type 7 is configured.

                      Warning: Command has been added to the configuration using a type 7 password. However, type 7 passwords will soon be deprecated. Migrate to a supported password type 6.

                      Example: The following example shows how to configure the command in tenant configuration:

                      
                      voice class tenant 200
                        registrar dns:40461111.cisco.com scheme sips expires 240
                      refresh-ratio 50 tcp tls
                        credentials number ABC5091_LGW username XYZ1076_LGw
                      password 0 abcxxxxxxx realm Broadworks 
                        authentication username ABC5091_LGw password 0 abcxxxxxxx
                      realm BroadWorks
                      

                      The following example shows how to enable the digest authentication:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# dial-peer voice 1 pots
                      Router(config-dial-peer)# authentication username MyUser password 6 MyPassword realm MyRealm.example.com
                      

                      The following example shows how to remove a previously configured digest authentication:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# dial-peer voice 1 pots
                      Router(config-dial-peer)# no authentication username MyUser 6 password MyPassword
                      

                      Command

                      Description

                      authentication (SIP UA)

                      Enables SIP digest authentication globally.

                      credentials (SIP UA)

                      Configures a Cisco UBE to send a SIP registration message when in the UP state.

                      localhost

                      Configures global settings for substituting a DNS local hostname in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages.

                      registrar

                      Enables Cisco IOS SIP gateways to register E.164 numbers on behalf of FXS, EFXS, and SCCP phones with an external SIP proxy or SIP registrar.

                      voice-class sip localhost

                      Configures settings for substituting a DNS local hostname in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages on an individual dial peer, overriding the global setting.

                      To bind the source address for signaling and media packets to the IPv4 or IPv6 address of a specific interface, use the bind command in SIP configuration mode. To disable binding, use the no form of this command.

                      bind { control | media | all } source-interface interface-id { ipv4-address ipv4-address | ipv6-address ipv6-address }

                      no bind { control | media | all } source-interface interface-id { ipv4-address ipv4-address | ipv6-address ipv6-address }

                      control

                      Binds Session Initiation Protocol (SIP) signaling packets.

                      media

                      Binds only media packets.

                      all

                      Binds SIP signaling and media packets. The source address (the address that shows where the SIP request came from) of the signaling and media packets is set to the IPv4 or IPv6 address of the specified interface.

                      source-interface

                      Specifies an interface as the source address of SIP packets.

                      interface-id

                      Specifies one of the following interfaces:

                      • Async : ATM interface

                      • BVI : Bridge-Group Virtual Interface

                      • CTunnel : CTunnel interface

                      • Dialer : Dialer interface

                      • Ethernet : IEEE 802.3

                      • FastEthernet : Fast Ethernet

                      • Lex : Lex interface

                      • Loopback : Loopback interface

                      • Multilink : Multilink-group interface

                      • Null : Null interface

                      • Serial : Serial interface (Frame Relay)

                      • Tunnel : Tunnel interface

                      • Vif : PGM Multicast Host interface

                      • Virtual-Template : Virtual template interface

                      • Virtual-TokenRing : Virtual token ring

                      ipv4-address ipv4-address

                      (Optional) Configures the IPv4 address. Several IPv4 addresses can be configured under one interface.

                      ipv6-address ipv6-address

                      (Optional) Configures the IPv6 address under an IPv4 interface. Several IPv6 addresses can be configured under one IPv4 interface.

                      Command Default: Binding is disabled.

                      Command Mode: SIP configuration (conf-serv-sip) and Voice class tenant.

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Async, Ethernet, FastEthernet, Loopback, and Serial (including Frame Relay) are interfaces within the SIP application.

                      If the bind command is not enabled, the IPv4 layer still provides the best local address.

                      Example: The following example sets up binding on a SIP network:

                      
                      Router(config)# voice serv voip
                      Router(config-voi-serv)# sip
                      Router(config-serv-sip)# bind control source-interface FastEthernet 0
                      

                      Command

                      Description

                      sip

                      Enters SIP configuration mode from voice service VoIP configuration mode.

                      To enable the basic configurations for Call-Home, use the call-home reporting command in global configuration mode.

                      call-home reporting { anonymous | contact-email-addr } [ http-proxy { ipv4-address | ipv6-address | name } port port-number ]

                      anonymous

                      Enables Call-Home TAC profile to send only crash, inventory, and test messages and send the messages anonymously.

                      contact-email-addr email-address

                      Enables Smart Call Home service full reporting capability and sends a full inventory message from Call-Home TAC profile to Smart Call Home server to start full registration process.

                      http-proxy { ipv4-address | ipv6-address | name }

                      Configures an IPv4 or IPv6 address or server name. Maximum length is 64 characters.

                      The HTTP proxy option allows you to make use of your own proxy server to buffer and secure Internet connections from your devices.

                      port port-number

                      Specifies port number. Range is 1 to 65535.

                      Command Default: No default behavior or values

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: After successfully enabling Call-Home either in anonymous or full registration mode using the call-home reporting command, an inventory message is sent out. If Call-Home is enabled in full registration mode, a full inventory message for full registration mode is sent out. If Call-Home is enabled in anonymous mode, an anonymous inventory message is sent out. For more information about the message details, see Alert Group Trigger Events and Commands.

                      Example: The following example allows you to enable Smart Call Home service full reporting capability and to send a full inventory message:

                      
                      Device# configure terminal
                      Device(config)# call-home reporting contact-email-addr sch-smart-licensing@cisco.com

                      To enable Cisco Unified SRST support and enter call-manager-fallback configuration mode, use the call-manager-fallback command in global configuration mode. To disable Cisco Unified SRST support, use the no form of this command.

                      call-manager-fallback

                      no call-manager-fallback

                      This command has no arguments or keywords.

                      Command Default: No default behavior or values.

                      Command Mode: Global configuration

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Example: The following example shows how to enter call-manager-fallback configuration mode:

                      
                      Device(config)# call-manager-fallback
                      Device(config-cm-fallback)#

                      Command

                      Description

                      cor

                      Configures COR on the dial peers associated with directory numbers.

                      To enable server, client, or bidirectional identity validation of a peer certificate during TLS handshake, use the command cn-san validate in voice class tls-profile configuration mode. To disable certificate identity validation, use no form of this command.

                      cn-san validate { server | client | bidirectional }

                      no cn-san validate { server | client | bidirectional }

                      validate server

                      Enables server identity validation through Common Name (CN) and Subject Alternate Name (SAN) fields in the server certificate during client-side SIP/TLS connections.

                      validate client

                      Enables client identity validation through CN and SAN fields in the client certificate during server side SIP/TLS connections.

                      validate bidirectional

                      Enables both client and server identity validation through CN-SAN fields.

                      Command Default: Identity validation is disabled.

                      Command Mode: Voice class configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Server identity validation is associated with a secure signaling connection through the global crypto signaling and voice class tls-profile configurations.

                      The command is enhanced to include the client and bidirectional keywords. The client option allows a server to validate the identity of a client by checking CN and SAN hostnames included in the provided certificate against a trusted list of cn-san FQDNs. The connection will only be established if a match is found. This list of cn-san FQDNs is also now used to validate a server certificate, in addition to the session target host name. The bidirectional option validates peer identity for both client and server connections by combining both server and client modes. Once you configure cn-san validate, the identity of the peer certificate is validated for every new TLS connection.

                      The voice class tls-profile tag command can be associated to a voice-class tenant. For CN-SAN validation of the client certificate, define a list of allowed hostnames and patterns using the command cn-san tag san-name.

                      Examples: The following example illustrates how to configure a voice class tls-profile and associate server identity validation functionality:

                      
                      Router(config)#voice class tls-profile 2
                      Router(config-class)#cn-san validate server
                      
                      Router(config)#voice class tls-profile 3
                      Router(config-class)#cn-san validate client
                        
                      
                      Router(config)#voice class tls-profile 4
                      Router(config-class)#cn-san validate bidirectional

                      Command

                      Description

                      voice class tls-profile

                      Provides suboptions to configure the commands that are required for a TLS session.

                      cn-san tag san-name

                      List of CN-SAN names used to validate the peer certificate for inbound or outbound TLS connections.

                      To configure a list of Fully Qualified Domain Name (FQDN) name to validate against the peer certificate for inbound or outbound TLS connections, use the cn-san command in voice class tls-profile configuration mode. To delete cn-san certificate validation entry, use the no form of this command.

                      cn-san {1-10} fqdn

                      no cn-san {1-10} fqdn

                      1-10

                      Specifies the tag of cn-san FQDN list entry.

                      fqdn

                      Specifies the FQDN or a domain wildcard in the form of *.domain-name.

                      Command Default: No cn-san names are configured.

                      Command Mode: Voice class tls-profile configuration mode (config-class)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Dublin 17.12.1a

                      This command was introduced.

                      Usage Guidelines: FQDN used for peer certificate validation are assigned to a TLS profile with up to ten cn-san entries. At least one of these entries must be matched to an FQDN in either of the certificate Common Name (CN) or Subject-Alternate-Name (SAN) fields before a TLS connection is established. To match any domain host used in an CN or SAN field, a cn-san entry may be configured with a domain wildcard, strictly in the form *.domain-name (e.g. *.cisco.com). No other use of wildcards is permitted.

                      For inbound connections, the list is used to validate CN and SAN fields in the client certificate. For outbound connections, the list is used along with the session target hostname to validate CN and SAN fields in the server certificate.

                      Server certificates may also be verified by matching the SIP session target FQDN to a CN or SAN field.

                      Example: The following example globally enables cn-san names:

                      Device(config)# voice class tls-profile 1
                      Device(config-class)# cn-san 2 *.webex.com 
                      

                      Command

                      Description

                      voice class tls-profile

                      Provides suboptions to configure the commands that are required for a TLS session.

                      To specify a list of preferred codecs to use on a dial peer, use the codec preference command in voice class configuration mode. To disable this functionality, use the no form of this command.

                      codec preference value codec-type

                      no codec preference value codec-type

                      value

                      The order of preference; 1 is the most preferred and 14 is the least preferred.

                      codec-type

                      Values for the preferred codec are as follows:

                      • g711alaw —G.711 a-law 64,000 bps.

                      • g711ulaw —G.711 mu-law 64,000 bps.

                      • opus —Opus upto 510 kbps.

                      Command Default: If this command is not entered, no specific types of codecs are identified with preference.

                      Command Mode: voice class configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The routers at opposite ends of the WAN may have to negotiate the codec selection for the network dial peers. The codec preference command specifies the order of preference for selecting a negotiated codec for the connection. The table below describes the voice payload options and default values for the codecs and packet voice protocols.

                      Table 1. Voice Payload-per-Frame Options and Defaults

                      Codec

                      Protocol

                      Voice Payload Options (in Bytes)

                      Default Voice Payload (in Bytes)

                      g711alaw g711ulaw

                      VoIP VoFR VoATM

                      80, 160 40 to 240 in multiples of 40 40 to 240 in multiples of 40

                      160 240 240

                      opus

                      VoIP

                      Variable

                      --

                      Example: The following example shows how to configure codec profile:

                      
                      voice class codec 99
                       codec preference 1 opus
                       codec preference 2 g711ulaw
                       codec preference 3 g711alaw 
                      exit
                      

                      Command

                      Description

                      voice class codec

                      Enters voice-class configuration mode and assigns an identification tag number to a codec voice class.

                      To use global listener port for sending requests over UDP, use the connection-reuse command in sip-ua mode or voice class tenant configuration mode. To disable, use no form of this command.

                      connection-reuse { via-port | system }

                      no connection-reuse { via-port | system }

                      via-port

                      Sends responses to the port present in via header.

                      system

                      Specifies that the connection-reuse requests use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: Local Gateway uses an ephemeral UDP port for sending requests over UDP.

                      Command Modes: SIP UA configuration (config-sip-ua), voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Executing this command enables the use listener port for sending requests over UDP. Default listener port for regular non-secure SIP is 5060 and secure SIP is 5061. Configure listen-port [non-secure | secure] port command in voice service voip > sip configuration mode to change the global UDP port.

                      Examples:

                      In sip-ua mode:

                      
                      Device> enable 
                      Device# configure terminal
                      Device(config)# sip-ua
                      Device(config-sip-ua)# connection-reuse via-port

                      In voice class tenant mode:

                      
                      Device> enable 
                      Device# configure terminal
                      Device(config)# voice class tenant 1
                      Device(config-class)# connection-reuse via-port

                      Command

                      Description

                      listen-port

                      Changes UDP/TCP/TLS SIP listen Port.

                      To change the CPU quota or unit allocated for an application, use the cpu command in custom application resource profile configuration mode. To revert to the application-provided CPU quota, use the no form of this command.

                      cpu unit

                      no cpu unit

                      unit

                      CPU quota to be allocated for an application. Valid values are from 0 to 20000.

                      Command Default: Default CPU depends on the platform.

                      Command Mode: Custom application resource profile configuration (config-app-resource-profile-custom)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: A CPU unit is the minimal CPU allocation by the application. Total CPU units is based on normalized CPU units measured for the target device.

                      Within each application package, an application-specific resource profile is provided that defines the recommended CPU load, memory size, and number of virtual CPUs (vCPUs) required for the application. Use this command to change the allocation of resources for specific processes in the custom resource profile.

                      Reserved resources specified in the application package can be changed by setting a custom resource profile. Only the CPU, memory, and vCPU resources can be changed. For the resource changes to take effect, stop and deactivate the application, then activate it and start it again.

                      Resource values are application-specific, and any adjustment to these values must ensure that the application can run reliably with the changes.

                      Example: The following example shows how to override the application-provided CPU quota using a custom resource profile:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-resource profile custom
                      Device(config-app-resource-profile-custom)# cpu 7400
                      

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      app-resource profile

                      Overrides the application-provided resource profile.

                      To configure a Cisco IOS Session Initiation Protocol (SIP) time-division multiplexing (TDM) gateway, a Cisco Unified Border Element (Cisco UBE), or Cisco Unified Communications Manager Express (Cisco Unified CME) to send a SIP registration message when in the UP state, use the credentials command in SIP UA configuration mode or voice class tenant configuration mode. To disable SIP digest credentials, use the no form of this command.

                      credentials { dhcp | number number username username } password { 0 | 6 | 7 } password realm realm

                      no credentials { dhcp | number number username username } password { 0 | 6 | 7 } password realm realm

                      dhcp

                      (Optional) Specifies the Dynamic Host Configuration Protocol (DHCP) is to be used to send the SIP message.

                      number number

                      (Optional) A string representing the registrar with which the SIP trunk will register (must be at least four characters).

                      username username

                      A string representing the username for the user who is providing authentication (must be at least four characters). This option is only valid when configuring a specific registrar using the number keyword.

                      password

                      Specifies password settings for authentication.

                      0

                      Specifies the encryption type as cleartext (no encryption).

                      6

                      Specifies secure reversible encryption for passwords using type 6 Advanced Encryption Scheme (AES).

                      Requires AES primary key to be preconfigured.

                      7

                      Specifies the encryption type as encrypted.

                      password

                      A string representing the password for authentication. If no encryption type is specified, the password will be cleartext format. The string must be between 4 and 128 characters.

                      realm realm

                      (Optional) A string representing the domain where the credentials are applicable.

                      Command Default: SIP digest credentials are disabled.

                      Command Mode: SIP UA configuration (config-sip-ua) and Voice class tenant configuration (config-class).

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The following configuration rules are applicable when credentials are enabled:

                      • Only one password is valid for all domain names. A new configured password overwrites any previously configured password.

                      • The password will always be displayed in encrypted format when the credentials command is configured and the show running-config command is used.

                      The dhcp keyword in the command signifies that the primary number is obtained via DHCP and the Cisco IOS SIP TDM gateway, Cisco UBE, or Cisco Unified CME on which the command is enabled uses this number to register or unregister the received primary number.

                      It is mandatory to specify the encryption type for the password. If a clear text password (type 0) is configured, it is encrypted as type 6 before saving it to the running configuration.

                      If you specify the encryption type as 6 or 7, the entered password is checked against a valid type 6 or 7 password format and saved as type 6 or 7 respectively.

                      Type-6 passwords are encrypted using AES cipher and a user-defined primary key. These passwords are comparatively more secure. The primary key is never displayed in the configuration. Without the knowledge of the primary key, type 6 passwords are unusable. If the primary key is modified, the password that is saved as type 6 is re-encrypted with the new primary key. If the primary key configuration is removed, the type 6 passwords cannot be decrypted, which may result in the authentication failure for calls and registrations.

                      When backing up a configuration or migrating the configuration to another device, the primary key is not dumped. Hence the primary key must be configured again manually.

                      To configure an encrypted preshared key, see Configuring an Encrypted Preshared Key.

                      Warning: Command has been added to the configuration using a type 7 password. However, type 7 passwords will soon be deprecated. Migrate to a supported password type 6.

                      In YANG, you cannot configure the same username across two different realms.

                      Example: The following example shows how to configure SIP digest credentials using the encrypted format:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# credentials dhcp password 6 095FB01AA000401 realm example.com
                      

                      The following example shows how to disable SIP digest credentials where the encryption type was specified:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# no credentials dhcp password 6 095FB01AA000401 realm example.com
                      

                      Command

                      Description

                      authentication (dial peer)

                      Enables SIP digest authentication on an individual dial peer.

                      authentication (SIP UA)

                      Enables SIP digest authentication.

                      localhost

                      Configures global settings for substituting a DNS localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages.

                      registrar

                      Enables Cisco IOS SIP TDM gateways to register E.164 numbers for FXS, EFXS, and SCCP phones on an external SIP proxy or SIP registrar.

                      voice-class sip localhost

                      Configures settings for substituting a DNS localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages on an individual dial peer, overriding the global setting.

                      To specify the preference for a SRTP cipher-suite that will be offered by Cisco Unified Border Element (CUBE) in the SDP in offer and answer, use the crypto command in voice class configuration mode. To disable this functionality, use the no form of this command.

                      crypto preference cipher-suite

                      no crypto preference cipher-suite

                      preference

                      Specifies the preference for a cipher-suite. The range is from 1 to 4, where 1 is the highest.

                      cipher-suite

                      Associates the cipher-suite with the preference. The following cipher-suites are supported:

                      • AEAD_AES_256_GCM

                      • AEAD_AES_128_GCM

                      • AES_CM_128_HMAC_SHA1_80

                      • AES_CM_128_HMAC_SHA1_32

                      Command Default: If this command is not configured, the default behavior is to offer the srtp-cipher suites in the following preference order:

                      • AEAD_AES_256_GCM

                      • AEAD_AES_128_GCM

                      • AES_CM_128_HMAC_SHA1_80

                      • AES_CM_128_HMAC_SHA1_32

                      Command Mode: voice class srtp-crypto (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: If you change the preference of an already configured cipher-suite, the preference is overwritten.

                      Example:

                      Specify preference for SRTP cipher-suites

                      The following is an example for specifying the preference for SRTP cipher-suites:

                      Device> enable
                      Device# configure terminal 
                      Device(config)# voice class srtp-crypto 100 
                      Device(config-class)# crypto 1 AEAD_AES_256_GCM
                      Device(config-class)# crypto 2 AEAD_AES_128_GCM
                      Device(config-class)# crypto 4 AES_CM_128_HMAC_SHA1_32

                      Overwrite a cipher-suite preference

                      Specify SRTP cipher-suite preference:

                      Device> enable
                      Device# configure terminal 
                      Device(config)# voice class srtp-crypto 100 
                      Device(config-class)# crypto 1 AEAD_AES_256_GCM
                      Device(config-class)# crypto 2 AEAD_AES_128_GCM
                      Device(config-class)# crypto 4 AES_CM_128_HMAC_SHA1_32

                      The following is the snippet of show running-config command output showing the cipher-suite preference:

                      
                      Device# show running-config
                      voice class srtp-crypto 100
                      crypto 1 AEAD_AES_256_GCM
                      crypto 2 AEAD_AES_128_GCM
                      crypto 4 AES_CM_128_HMAC_SHA1_32
                      
                      

                      If you want to change the preference 4 to AES_CM_128_HMAC_SHA1_80, execute the following command:

                      
                      Device(config-class)# crypto 4 AES_CM_128_HMAC_SHA1_80

                      The following is the snippet of show running-config command output showing the change in cipher-suite:

                      
                      Device# show running-config
                      voice class srtp-crypto 100
                      crypto 1 AEAD_AES_256_GCM
                      crypto 2 AEAD_AES_128_GCM
                      crypto 4 AES_CM_128_HMAC_SHA1_80
                      
                      

                      If you want to change the preference of AES_CM_128_HMAC_SHA1_80 to 3, execute the following commands:

                      
                      Device(config-class)# no crypto 4
                      Device(config-class)# crypto 3 AES_CM_128_HMAC_SHA1_80

                      The following is the snippet of show running-config command output showing the cipher-suite preference overwritten:

                      
                      Device# show running-config
                      voice class srtp-crypto 100
                      crypto 1 AEAD_AES_256_GCM
                      crypto 2 AEAD_AES_128_GCM
                      crypto 3 AES_CM_128_HMAC_SHA1_80
                      
                      

                      Command

                      Description

                      srtp-crypto

                      Assigns a previously configured crypto-suite selection preference list globally or to a voice class tenant.

                      voice class sip srtp-crypto

                      Enters voice class configuration mode and assigns an identification tag for a srtp-crypto voice class.

                      show sip-ua calls

                      Displays active user agent client (UAC) and user agent server (UAS) information on Session Initiation Protocol (SIP) calls.

                      show sip-ua srtp

                      Displays Session Initiation Protocol (SIP) user-agent (UA) Secure Real-time Transport Protocol (SRTP) information.

                      To generate Rivest, Shamir, and Adelman (RSA) key pairs, use the crypto key generate rsa command in global configuration mode.

                      crypto key generate rsa [ { general-keys | usage-keys | signature | encryption } ] [ label key-label ] [ exportable ] [ modulus modulus-size ] [ storage devicename : ] [ redundancy on devicename : ]

                      general-keys

                      (Optional) Specifies that a general-purpose key pair will be generated, which is the default.

                      usage-keys

                      (Optional) Specifies that two RSA special-usage key pairs, one encryption pair and one signature pair, will be generated.

                      signature

                      (Optional) Specifies that the RSA public key generated will be a signature special usage key.

                      encryption

                      (Optional) Specifies that the RSA public key generated will be an encryption special usage key.

                      label key-label

                      (Optional) Specifies the name that is used for an RSA key pair when they are being exported.

                      If a key label is not specified, the fully qualified domain name (FQDN) of the router is used.

                      exportable

                      (Optional) Specifies that the RSA key pair can be exported to another Cisco device, such as a router.

                      modulus modulus-size

                      (Optional) Specifies the IP size of the key modulus.

                      By default, the modulus of a certification authority (CA) key is 1024 bits. The recommended modulus for a CA key is 2048 bits. The range of a CA key modulus is from 350 to 4096 bits.

                      storage devicename :

                      (Optional) Specifies the key storage location. The name of the storage device is followed by a colon (:).

                      redundancy

                      (Optional) Specifies that the key should be synchronized to the standby CA.

                      on devicename :

                      (Optional) Specifies that the RSA key pair will be created on the specified device, including a Universal Serial Bus (USB) token, local disk, or NVRAM. The name of the device is followed by a colon (:).

                      Keys created on a USB token must be 2048 bits or less.

                      Command Default: RSA key pairs do not exist.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the crypto key generate rsa command to generate RSA key pairs for your Cisco device (such as a router).

                      RSA keys are generated in pairs--one public RSA key and one private RSA key.

                      If your router already has RSA keys when you issue this command, you will be warned and prompted to replace the existing keys with new keys.

                      The crypto key generate rsa command is not saved in the router configuration; however, the RSA keys generated by this command are saved in the private configuration in NVRAM (which is never displayed to the user or backed up to another device) the next time the configuration is written to NVRAM.

                      • Special-Usage Keys: If you generate special-usage keys, two pairs of RSA keys will be generated. One pair will be used with any Internet Key Exchange (IKE) policy that specifies RSA signatures as the authentication method, and the other pair will be used with any IKE policy that specifies RSA encrypted keys as the authentication method.

                        A CA is used only with IKE policies specifying RSA signatures, not with IKE policies specifying RSA-encrypted nonces. (However, you could specify more than one IKE policy and have RSA signatures specified in one policy and RSA-encrypted nonces in another policy.)

                        If you plan to have both types of RSA authentication methods in your IKE policies, you may prefer to generate special-usage keys. With special-usage keys, each key is not unnecessarily exposed. (Without special-usage keys, one key is used for both authentication methods, increasing the exposure of that key).

                      • General-Purpose Keys: If you generate general-purpose keys, only one pair of RSA keys will be generated. This pair will be used with IKE policies specifying either RSA signatures or RSA encrypted keys. Therefore, a general-purpose key pair might get used more frequently than a special-usage key pair.

                      • Named Key Pairs: If you generate a named key pair using the key-label argument, you must also specify the usage-keys keyword or the general-keys keyword. Named key pairs allow you to have multiple RSA key pairs, enabling the Cisco IOS software to maintain a different key pair for each identity certificate.

                      • Modulus Length: When you generate RSA keys, you will be prompted to enter a modulus length. The longer the modulus, the stronger the security. However, a longer modules takes longer to generate (see the table below for sample times) and takes longer to use.

                        Table 2. Sample Times by Modulus Length to Generate RSA Keys

                        Router

                        360 bits

                        512 bits

                        1024 bits

                        2048 bits (maximum)

                        Cisco 2500

                        11 seconds

                        20 seconds

                        4 minutes, 38 seconds

                        More than 1 hour

                        Cisco 4700

                        Less than 1 second

                        1 second

                        4 seconds

                        50 seconds

                        Cisco IOS software does not support a modulus greater than 4096 bits. A length of less than 512 bits is normally not recommended. In certain situations, the shorter modulus may not function properly with IKE, so we recommend using a minimum modulus of 2048 bits.

                        Additional limitations may apply when RSA keys are generated by cryptographic hardware. For example, when RSA keys are generated by the Cisco VPN Services Port Adapter (VSPA), the RSA key modulus must be a minimum of 384 bits and must be a multiple of 64.

                      • Specifying a Storage Location for RSA Keys: When you issue the crypto key generate rsa command with the storage devicename : keyword and argument, the RSA keys will be stored on the specified device. This location will supersede any crypto key storage command settings.

                      • Specifying a Device for RSA Key Generation: You may specify the device where RSA keys are generated. Devices supported include NVRAM, local disks, and USB tokens. If your router has a USB token configured and available, the USB token can be used as cryptographic device in addition to a storage device. Using a USB token as a cryptographic device allows RSA operations such as key generation, signing, and authentication of credentials to be performed on the token. The private key never leaves the USB token and is not exportable. The public key is exportable.

                        RSA keys may be generated on a configured and available USB token, by the use of the on devicename : keyword and argument. Keys that reside on a USB token are saved to persistent token storage when they are generated. The number of keys that can be generated on a USB token is limited by the space available. If you attempt to generate keys on a USB token and it is full you will receive the following message:

                        % Error in generating keys:no available resources 

                        Key deletion will remove the keys stored on the token from persistent storage immediately. (Keys that do not reside on a token are saved to or deleted from nontoken storage locations when the copy or similar command is issued).

                      • Specifying RSA Key Redundancy Generation on a Device: You can specify redundancy for existing keys only if they are exportable.

                      Example: The following example generates a general-usage 1024-bit RSA key pair on a USB token with the label “ms2” with crypto engine debugging messages shown:

                      Device(config)# crypto key generate rsa label ms2 modulus 2048 on usbtoken0:
                      The name for the keys will be: ms2 
                      % The key modulus size is 2048 bits 
                      % Generating 1024 bit RSA keys, keys will be on-token, non-exportable... 
                      Jan 7 02:41:40.895: crypto_engine: Generate public/private keypair [OK] 
                      Jan 7 02:44:09.623: crypto_engine: Create signature 
                      Jan 7 02:44:10.467: crypto_engine: Verify signature 
                      Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_CREATE_PUBKEY(hw)(ipsec) 
                      Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_PUB_DECRYPT(hw)(ipsec)

                      Now, the on-token keys labeled “ms2” may be used for enrollment.

                      The following example generates special-usage RSA keys:

                      Device(config)# crypto key generate rsa usage-keys
                      The name for the keys will be: myrouter.example.com
                      Choose the size of the key modulus in the range of 360 to 2048 for your Signature Keys. Choosing a key modulus greater than 512 may take a few minutes.
                      How many bits in the modulus[512]? <return>
                      Generating RSA keys.... [OK].
                      Choose the size of the key modulus in the range of 360 to 2048 for your Encryption Keys. Choosing a key modulus greater than 512 may take a few minutes.
                      How many bits in the modulus[512]? <return>
                      Generating RSA keys.... [OK].

                      The following example generates general-purpose RSA keys:

                      Device(config)# crypto key generate rsa general-keys
                      The name for the keys will be: myrouter.example.com
                      Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
                      How many bits in the modulus[512]? <return>
                      Generating RSA keys.... [OK].

                      The following example generates the general-purpose RSA key pair “exampleCAkeys”:

                      crypto key generate rsa general-keys label exampleCAkeys
                      crypto ca trustpoint exampleCAkeys
                       enroll url 
                      http://exampleCAkeys/certsrv/mscep/mscep.dll
                       rsakeypair exampleCAkeys 1024 1024

                      The following example specifies the RSA key storage location of “usbtoken0:” for “tokenkey1”:

                      crypto key generate rsa general-keys label tokenkey1 storage usbtoken0:

                      The following example specifies the redundancy keyword:

                      Device(config)# crypto key generate rsa label MYKEYS redundancy

                      The name for the keys will be: MYKEYS

                      Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.

                      How many bits in the modulus [512]:

                      % Generating 512 bit RSA keys, keys will be non-exportable with redundancy...[OK]

                      Command

                      Description

                      copy

                      Copies any file from a source to a destination, use the copy command in privileged EXEC mode.

                      crypto key storage

                      Sets the default storage location for RSA key pairs.

                      debug crypto engine

                      Displays debug messages about crypto engines.

                      hostname

                      Specifies or modifies the hostname for the network server.

                      ip domain-name

                      Defines a default domain name to complete unqualified hostnames (names without a dotted-decimal domain name).

                      show crypto key mypubkey rsa

                      Displays the RSA public keys of your router.

                      show crypto pki certificates

                      Displays information about your PKI certificate, certification authority, and any registration authority certificates.

                      To authenticate the certification authority (CA) (by getting the certificate of the CA), use the crypto pki authenticate command in global configuration mode.

                      crypto pki authenticate name

                      name

                      The name of the CA. This is the same name used when the CA was declared with the cryptocaidentity command.

                      Command Default: No default behavior or values.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command is required when you initially configure CA support at your router.

                      This command authenticates the CA to your router by obtaining the self-signed certificate of the CA that contains the public key of the CA. Because the CA signs its own certificate, you should manually authenticate the public key of the CA by contacting the CA administrator when you enter this command.

                      If you are using Router Advertisements (RA) mode (using the enrollment command) when you issue the crypto pki authenticate command, then registration authority signing and encryption certificates will be returned from the CA and the CA certificate.

                      This command is not saved to the router configuration. However. the public keys embedded in the received CA (and RA) certificates are saved to the configuration as part of the Rivest, Shamir, and Adelman (RSA) public key record (called the “RSA public key chain”).

                      If the CA does not respond by a timeout period after this command is issued, the terminal control will be returned so that it remains available. If this happens, you must reenter the command. Cisco IOS software will not recognize CA certificate expiration dates set for beyond the year 2049. If the validity period of the CA certificate is set to expire after the year 2049, the following error message will be displayed when authentication with the CA server is attempted: error retrieving certificate :incomplete chain If you receive an error message similar to this one, check the expiration date of your CA certificate. If the expiration date of your CA certificate is set after the year 2049, you must reduce the expiration date by a year or more.

                      Example: In the following example, the router requests the certificate of the CA. The CA sends its certificate and the router prompts the administrator to verify the certificate of the CA by checking the CA certificate’s fingerprint. The CA administrator can also view the CA certificate’s fingerprint, so you should compare what the CA administrator sees to what the router displays on the screen. If the fingerprint on the router’s screen matches the fingerprint viewed by the CA administrator, you should accept the certificate as valid.

                      
                      Router(config)# crypto pki authenticate myca
                      Certificate has the following attributes:
                      Fingerprint: 0123 4567 89AB CDEF 0123
                      Do you accept this certificate? [yes/no] y#

                      Command

                      Description

                      debug crypto pki transactions

                      Displays debug messages for the trace of interaction (message type) between the CA and the router.

                      enrollment

                      Specifies the enrollment parameters of your CA.

                      show crypto pki certificates

                      Displays information about your certificate, the certificate of the CA, and any RA certificates.

                      To import a certificate manually via TFTP or as a cut-and-paste at the terminal, use the crypto pki import command in global configuration mode.

                      crypto pki import name certificate

                      name certificate

                      Name of the certification authority (CA). This name is the same name used when the CA was declared with the crypto pki trustpoint command.

                      Command Default: No default behavior or values

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: You must enter the crypto pki import command twice if usage keys (signature and encryption keys) are used. The first time the command is entered, one of the certificates is pasted into the router; the second time the command is entered, the other certificate is pasted into the router. (It does not matter which certificate is pasted first.)

                      Example: The following example shows how to import a certificate via cut-and-paste. In this example, the CA trustpoint is “MS.”

                      
                      crypto pki trustpoint MS
                       enroll terminal
                       crypto pki authenticate MS
                      !
                      crypto pki enroll MS
                      crypto pki import MS certificate
                      

                      Command

                      Description

                      crypto pki trustpoint

                      Declares the CA that your router should use.

                      enrollment

                      Specifies the enrollment parameters of your CA.

                      enrollment terminal

                      Specifies manual cut-and-paste certificate enrollment.

                      To declare the trustpoint that your router should use, use the crypto pki trustpoint command in global configuration mode. To delete all identity information and certificates associated with the trustpoint, use the no form of this command.

                      crypto pki trustpoint name redundancy

                      no crypto pki trustpoint name redundancy

                      name

                      Creates a name for the trustpoint. (If you previously declared the trustpoint and just want to update its characteristics, specify the name you previously created.)

                      redundancy

                      (Optional) Specifies that the key, and any certificates associated with it, should be synchronized to the standby certificate authority (CA).

                      Command Default: Your router does not recognize any trustpoints until you declare a trustpoint using this command. Your router uses unique identifiers during communication with Online Certificate Status Protocol (OCSP) servers, as configured in your network.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines:

                      Declaring Trustpoints

                      Use the crypto pki trustpoint command to declare a trustpoint, which can be a self-signed root certificate authority (CA) or a subordinate CA. Issuing the crypto pki trustpoint command puts you in ca-trustpoint configuration mode.

                      You can specify characteristics for the trustpoint using the following subcommands:

                      • crl —Queries the certificate revocation list (CRL) to ensure that the certificate of the peer has not been revoked.

                      • default (ca-trustpoint) —Resets the value of ca-trustpoint configuration mode subcommands to their defaults.

                      • enrollment —Specifies enrollment parameters (optional).

                      • enrollment http-proxy —Accesses the CA by HTTP through the proxy server.

                      • enrollment selfsigned —Specifies self-signed enrollment (optional).

                      • match certificate —Associates a certificate-based access control list (ACL) defined with the crypto ca certificate map command.

                      • ocsp disable-nonce —Specifies that your router will not send unique identifiers, or nonces, during OCSP communications.

                      • primary —Assigns a specified trustpoint as the primary trustpoint of the router.

                      • root —Defines the TFTP to get the CA certificate and specifies both a name for the server and a name for the file that will store the CA certificate.

                      Specifying Use of Unique Identifiers

                      When using OCSP as your revocation method, unique identifiers, or nonces, are sent by default during peer communications with the OCSP server. The use of unique identifiers during OCSP server communications enables more secure and reliable communications. However, not all OCSP servers support the use of unique dentures, see your OCSP manual for more information. To disable the use of unique identifiers during OCSP communications, use the ocsp disable-nonce subcommand.

                      Example: The following example shows how to declare the CA named ka and specify enrollment and CRL parameters:

                      
                      crypto pki trustpoint ka
                       enrollment url http://kahului:80
                      

                      The following example shows a certificate-based ACL with the label Group defined in a crypto pki certificate map command and included in the match certificate subcommand of the crypto pki trustpoint command:

                      
                      crypto pki certificate map Group 10
                       subject-name co ou=WAN
                       subject-name co o=Cisco
                      !
                      crypto pki trustpoint pki1
                       match certificate Group
                      

                      The following example shows a self-signed certificate being designated for a trustpoint named local using the enrollment selfsigned subcommand of the crypto pki trustpoint command:

                      
                      crypto pki trustpoint local
                       enrollment selfsigned
                      

                      The following example shows the unique identifier being disabled for OCSP communications for a previously created trustpoint named ts:

                      
                      crypto pki trustpoint ts 
                       ocsp disable-nonce
                      

                      The following example shows the redundancy keyword specified in the crypto pki trustpoint command:

                      
                      Router(config)#crypto pki trustpoint mytp
                      Router(ca-trustpoint)#redundancy
                      Router(ca-trustpoint)#show
                       redundancy
                       revocation-check crl
                      end
                      

                      Command

                      Description

                      crl

                      Queries the CRL to ensure that the certificate of the peer has not been revoked.

                      default (ca-trustpoint)

                      Resets the value of a ca-trustpoint configuration subcommand to its default.

                      enrollment

                      Specifies the enrollment parameters of your CA.

                      enrollment http-proxy

                      Accesses the CA by HTTP through the proxy server.

                      primary

                      Assigns a specified trustpoint as the primary trustpoint of the router.

                      root

                      Obtains the CA certificate via TFTP.

                      To manually import (download) the certification authority (CA) certificate bundle into the public key infrastructure (PKI) trustpool to update or replace the existing CA bundle, use the crypto pki trustpool import command in global configuration mode. To remove any of the configured parameters, use the no form of this command.

                      crypto pki trustpool import clean [ terminal | url url ]

                      no crypto pki trustpool import clean [ terminal | url url ]

                      clean

                      Specifies the removal of the downloaded PKI trustpool certificates before the new certificates are downloaded. Use the optional terminal keyword to remove the existing CA certificate bundle terminal setting or the url keyword and url argument to remove the URL file system setting.

                      terminal

                      Specifies the importation of a CA certificate bundle through the terminal (cut-and-paste) in Privacy Enhanced Mail (PEM) format.

                      url url

                      Specifies the importation of a CA certificate bundle through the URL.

                      Command Default: The PKI trustpool feature is enabled. The router uses the built-in CA certificate bundle in the PKI trustpool, which is updated automatically from Cisco.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines:

                      Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper.

                      PKI trustpool certificates are automatically updated from Cisco. When the PKI trustpool certificates are not current, use the crypto pki trustpool import command to update them from another location.

                      The url argument specifies or changes the URL file system of the CA. The table below lists the available URL file systems.

                      Table 3. URL File Systems

                      File System

                      Description

                      archive:

                      Imports from the archive file system.

                      cns:

                      Imports from the Cluster Namespace (CNS) file system.

                      disk0:

                      Imports from the disc0 file system.

                      disk1:

                      Imports from the disc1 file system.

                      ftp:

                      Imports from the FTP file system.

                      http:

                      Imports from the HTTP file system. The URL must be in the following formats:

                      • http://CAname:80, where CAname is the Domain Name System (DNS)

                      • http://ipv4-address:80. For example: http://10.10.10.1:80.

                      • http://[ipv6-address]:80. For example: http://[2001:DB8:1:1::1]:80. The IPv6 address is in hexadecimal notation and must be enclosed in brackets in the URL.

                      https:

                      Imports from the HTTPS file system. The URL must use the same formats as the HTTP: file system formats.

                      null:

                      Imports from the null file system.

                      nvram:

                      Imports from NVRAM file system.

                      pram:

                      Imports from Parameter Random-access Memory (PRAM) file system.

                      rcp:

                      Imports from the remote copy protocol (rcp) file system.

                      scp:

                      Imports from the secure copy protocol (scp) file system.

                      snmp:

                      Imports from the Simple Network Management Protocol (SNMP).

                      system:

                      Imports from the system file system.

                      tar:

                      Imports from the UNIX tar file system.

                      tftp:

                      Imports from the TFTP file system.

                      The URL must be in the from: tftp://CAname/filespecification.

                      tmpsys:

                      Imports from the Cisco IOS tmpsys file system.

                      unix:

                      Imports from the UNIX file system.

                      xmodem:

                      Imports from the xmodem simple file transfer protocol system.

                      ymodem:

                      Imports from the ymodem simple file transfer protocol system.

                      Example: The following example shows how to remove all downloaded PKI trustpool CA certificates and subsequently update the CA certificates in the PKI trustpool by downloading a new CA certification bundle:

                      Router(config)# crypto pki trustpool import clean
                      Router(config)# crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b

                      The following example shows how to update the CA certificates in the PKI trustpool by downloading a new CA certification bundle without removing all downloaded PKI trustpool CA certificates:

                      Router(config)# crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b

                      Command

                      Description

                      cabundle url

                      Configures the URL from which the PKI trustpool CA bundle is downloaded.

                      chain-validation

                      Enables chain validation from the peer's certificate to the root CA certificate in the PKI trustpool.

                      crl

                      Specifes the certificate revocation list (CRL) query and cache options for the PKI trustpool.

                      crypto pki trustpool policy

                      Configures PKI trustpool policy parameters.

                      default

                      Resets the value of a ca-trustpool configuration command to its default.

                      match

                      Enables the use of certificate maps for the PKI trustpool.

                      ocsp

                      Specifies OCSP settings for the PKI trustpool.

                      revocation-check

                      Disables revocation checking when the PKI trustpool policy is being used.

                      show

                      Displays the PKI trustpool policy of the router in ca-trustpool configuration mode.

                      show crypto pki trustpool

                      Displays the PKI trustpool certificates of the router and optionally shows the PKI trustpool policy.

                      source interface

                      Specifies the source interface to be used for CRL retrieval, OCSP status, or the downloading of a CA certificate bundle for the PKI trustpool.

                      storage

                      Specifies a file system location where PKI trustpool certificates are stored on the router.

                      vrf

                      Specifies the VRF instance to be used for CRL retrieval.

                      To identify the trustpoint trustpoint-name keyword and argument used during the Transport Layer Security (TLS) handshake that corresponds to the remote device address, use the crypto signaling command in SIP user agent (UA) configuration mode. To reset to the default trustpoint string, use the no form of this command.

                      crypto signaling { default | remote-addr ip-address subnet-mask } [ tls-profile tag | trustpoint trustpoint-name ] [ cn-san-validation server ] [ client-vtp trustpoint-name ] [ ecdsa-cipher | curve-size 384 | strict-cipher ]

                      no crypto signaling { default | remote-addr ip-address subnet-mask } [ tls-profile tag | trustpoint trustpoint-name ] [ cn-san-validation server ] [ client-vtp trustpoint-name ] [ ecdsa-cipher | curve-size 384 | strict-cipher ]

                      default

                      (Optional) Configures the default trustpoint.

                      remote-addr ip-address subnet-mask

                      (Optional) Associates an Internet Protocol (IP) address to a trustpoint.

                      tls-profile tag

                      (Optional) Associates TLS profile configuration to the command crypto signaling.

                      trustpoint trustpoint-name

                      (Optional) trustpoint trustpoint-name name refers to the device's certificate generated as part of the enrollment process using Cisco IOS public-key infrastructure (PKI) commands.

                      cn-san-validate server

                      (Optional) Enables the server identity validation through Common Name (CN) and Subject Alternate Name (SAN) fields in the server certificate during client-side SIP/TLS connections.

                      client-vtp trustpoint-name

                      (Optional) Assigns a client verification trustpoint to SIP-UA.

                      ecdsa-cipher

                      (Optional) When the ecdsa-cipher keyword is not specified, the SIP TLS process uses the larger set of ciphers depending on the support at the Secure Socket Layer (SSL).

                      Following are the cipher suites supported:

                      • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

                      • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

                      curve-size 384

                      (Optional) Configures the specific size of elliptic curves to be used for a TLS session.

                      strict-cipher

                      (Optional) The strict-cipher keyword supports only the TLS Rivest, Shamir, and Adelman (RSA) encryption with the Advanced Encryption Standard-128 (AES-128) cipher suite.

                      Following are the cipher suites supported:

                      • TLS_RSA_WITH_AES_128_CBC_SHA

                      • TLS_DHE_RSA_WITH_AES_128_CBC_SHA1

                      • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

                      • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

                      When the strict-cipher keyword is not specified, the SIP TLS process uses the default set of ciphers depending on the support at the Secure Socket Layer (SSL).

                      Command Default: The crypto signaling command is disabled.

                      Command Mode: SIP UA configuration (sip-ua)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The trustpoint trustpoint-name keyword and argument refers to the CUBE certificate generated as part of the enrollment process using Cisco IOS PKI commands.

                      When a single certificate is configured, it is used by all the remote devices and is configured by the default keyword.

                      When multiple certificates are used, they may be associated with remote services using the remote-addr argument for each trustpoint. The remote-addr and default arguments may be used together to cover all services as required.

                      The default cipher suite in this case is the following set that is supported by the SSL layer on CUBE:

                      • TLS_RSA_WITH_RC4_128_MD5

                      • TLS_RSA_WITH_AES_128_CBC_SHA

                      • TLS_DHE_RSA_WITH_AES_128_CBC_SHA1

                      • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

                      • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

                      • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

                      • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

                      The keyword cn-san-validate server enables server identity validation through the CN and SAN fields in the certificate when establishing client-side SIP/TLS connections. Validation of the CN and SAN fields of the server certificate ensures that the server-side domain is a valid entity. When creating a secure connection with a SIP server, CUBE validates the configured session target domain name against the CN/SAN fields in the server’s certificate before establishing a TLS session. Once you configure cn-san-validate server, validation of the server identity happens for every new TLS connection.

                      The tls-profile option associates the TLS policy configurations made through the associated voice class tls-profile configuration. In addition to the TLS policy options available directly with the crypto signaling command, a tls-profile also includes the sni send option.

                      sni send enables Server Name Indication (SNI), a TLS extension that allows a TLS client to indicate the name of the server it is trying to connect to during the initial TLS handshake process. Only the fully qualified DNS hostname of the server is sent in the client hello. SNI does not support IPv4 and IPv6 addresses in the client hello extension. After receiving a "hello" with the server name from the TLS client, the server uses the appropriate certificate in the subsequent TLS handshake process. SNI requires TLS version 1.2.

                      The TLS policy features will only be available through a voice class tls-profile configuration.

                      The crypto signaling command continues to support previously existing TLS crypto options. You can use either the voice class tls-profile tag or crypto signaling command to configure a trustpoint. We recommend that you use the voice class tls-profile tag command to perform TLS profile configurations.

                      Example: The following example configures the CUBE to use the trustpointtrustpoint-name keyword and argument when it establishes or accepts the TLS connection with a remote device with IP address 172.16.0.0:

                      
                      configure terminal
                      sip-ua
                       crypto signaling remote-addr 172.16.0.0 trustpoint user1

                      The following example configures the CUBE to use trustpoint trustpoint-name keyword and argument when it establishes or accepts the TLS connection with any remote devices:

                      
                      configure terminal
                      sip-ua
                       crypto signaling default trustpoint cube

                      The following example configures the CUBE to use its trustpoint trustpoint-name keyword and argument when it establishes or accepts the TLS connection with any remote devices with IP address 172.16.0.0:

                      
                      configure terminal
                      sip-ua
                       crypto signaling remote-addr 172.16.0.0 trustpoint cube ecdsa-cipher
                      

                      The following example configures the specific size of elliptic curves to be used for a TLS session:

                      
                      configure terminal
                      sip-ua
                       crypto signaling default trustpoint cubeTP ecdsa-cipher curve-size 384
                      

                      The following example configures the CUBE to perform the server identity validation through Common Name (CN) and Subject Alternate Name (SAN) fields in the server certificate:

                      
                      configure terminal
                      sip-ua
                       crypto signaling default trustpoint cubeTP cn-san-validate server 

                      The following example, associates voice class configurations done using the command voice class tls-profile tag to the command crypto signaling:

                      /* Configure TLS Profile Tag */
                      Router#configure terminal
                      Router(config)#voice class tls-profile 2
                      Router(config-class)#trustpoint TP1
                      exit
                      /* Associate TLS Profile Tag to Crypto Signaling */
                      Router(config)#sip-ua
                      Router(config-sip-ua)#crypto signaling default tls-profile 2
                      Router(config-sip-ua)#crypto signaling remote-addr 192.0.2.1 255.255.255.255 tls-profile 2
                      

                      Command

                      Description

                      sip-ua

                      Enables the SIP user agent configuration commands.

                      voice class tls-profile tag

                      Enables configuration of voice class commands required for a TLS session.

                      Commands D through I

                      To add a description to a dial peer, use the description command in dial peer configuration mode. To remove the description, use the no form of this command.

                      description string

                      no description string

                      string

                      Specifies the text string up to 64 alphanumeric characters.

                      Command Mode: Disabled

                      Command Default: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the description command to include descriptive text about the dial peer. The show command output displays description and does not affect the operation of the dial peer.

                      Example: The following example shows a description included in a dial peer:

                      
                      dial-peer voice 1 pots
                       description inbound PSTN calls

                      The following example shows the outbound dial-peers to the PSTN with UDP and RTP configuration:

                      
                      dial-peer voice 300 voip 
                       description outbound to PSTN 
                       destination-pattern +1[2-9]..[2-9]......$ 
                       translation-profile outgoing 300
                       rtp payload-type comfort-noise 13 
                       session protocol sipv2 
                       session target sip-server
                       voice-class codec 1 
                       voice-class sip tenant 300 
                       dtmf-relay rtp-nte 
                       no vad

                      Command

                      Description

                      dial-peer voice

                      Defines a dial peer.

                      show dial-peer voice

                      Displays configuration information for dial peers.

                      To specify a description for the e164 pattern map, use the description command in the voice class configuration mode. To delete a configured description, use the no form of this command.

                      description string

                      no description string

                      string

                      Character string from 1 to 80 characters for e164 pattern map.

                      Command Default: No default behavior or values

                      Command Mode: Voice class configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This feature allows administrators to reduce the number of total dial-peers by combining many possible number matches (destination-patterns, incoming called-number, and so on) into a single pattern map. Outbound dial-peer e164-pattern-map support is added.

                      An e164-pattern-map can be configured via the the CLI or pre-configured and saves as a .cfg file. The .cfg file is then added to the flash of the gateway and then referenced when configuring the rest of the command. The .cfg file can utilize 5000 entries.

                      Example: The following example shows how to configure emergency calling in voice class configuration mode:

                      
                      voice class e164-pattern-map 301
                       description Emergency services numbers
                        e164 911
                        e164 988
                       !
                      voice class e164-pattern-map 351
                       description Emergency ELINs
                        e164 14085550100
                        e164 14085550111
                       !

                      The following example shows how to configure multiple patterns for outbound dial peer:

                      
                      Device# voice class e164-pattern-map 1111  
                      Device(voice-class)# url http://http-host/config-files/pattern-map.cfg
                      Device(voice-class)# description For Outbound Dial Peer
                      Device(voice-class)# exit

                      To add a description to an interface configuration, use the description command in interface configuration mode. To remove the description, use the no form of this command.

                      description string

                      no description string

                      string

                      Comment or a description to help you remember what is attached to this interface. This string is limited to 238 characters.

                      Command Default: No description is added.

                      Command Mode: Interface configuration (config-if)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The description command is meant solely as a comment to be put in the configuration to help you remember what certain interfaces are used for. The description appears in the output of the following EXEC commands: more nvram:startup-config , show interfaces, and more system:running-config.

                      Example: The following example shows how to add a description for a GigabitEthernet interface:

                      
                      interface GigabitEthernet0/0/0 
                       description Interface facing PSTN and/or CUCM
                       ip address 192.168.80.14 255.255.255.0!
                      
                      interface GigabitEthernet0/0/1
                       description Interface facing Webex Calling
                       ip address 192.168.43.197 255.255.255.0

                      Command

                      Description

                      more nvram:startup-config

                      Displays the startup configuration file contained in NVRAM or specified by the CONFIG_FILE environment variable.

                      more system:running-config

                      Displays the running configuration.

                      show interfaces

                      Displays statistics for all interfaces configured on the router or access server.

                      To provide a TLS profile group description, and associate it to a TLS profile, use the command description in voice class configuration mode. To delete the TLS profile group description, use the no form of this command.

                      description tls-profile-group-label

                      no description tls-profile-group-label

                      tls-profile-group-label

                      Allows you to provide a description for the TLS profile group.

                      Command Default: No default behavior or values

                      Command Mode: Voice class configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The TLS profile group description is associated to a TLS profile through the command voice class tls-profile tag. The tag associates the TLS profile group description to the command crypto signaling.

                      Example: The following example illustrates how to create a voice class tls-profile and associate a description TLS profile group:

                      
                      Device(config)#voice class tls-profile 2
                      Device(config-class)#description tlsgroupname

                      The following example shows how to configure the SIP options profile:

                      
                      voice class sip-options-keepalive 100
                       description keepalive webex_mTLS
                       up-interval 5
                       !

                      Command

                      Description

                      voice class tls-profile

                      Provides sub-options to configure the commands that are required for a TLS session.

                      crypto signaling

                      Identifies the trustpoint or the tls-profile tag that is used during the TLS handshake process.

                      To specify a dial peer group from which an outbound dial peer can be chosen, use the destination dpg command in dial-peer configuration mode.

                      destination dpg dial-peer-group-id

                      no destination dpg dial-peer-group-id

                      dial-peer-group-id

                      Specifies a dial peer group id.

                      Command Default: A destination dpg is not linked to a dial peer.

                      Command Mode: Dial-peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: When an inbound dial-peer is bound to an outbound dial-peer using dpg the destination-pattern is not used for matching.

                      Example: This following example shows how to associate outbound dial peer group with an inbound dial peer group:

                      
                      Device(config)# dial-peer voice 100 voip
                      Device(config-dial-peer)# incoming called-number 13411
                      Device(config-dial-peer)# destination dpg 200
                      Device(config-dial-peer)# end

                      To link an E.164 pattern map to a dial peer, use the destination e164-pattern-map command in dial peer configuration mode. To remove the link of an E.164 pattern map from a dial peer, use the no form of this command.

                      destination e164-pattern-map tag

                      no destination e164-pattern-map tag

                      tag

                      A number that defines a destination E.164 pattern map. The range is from 1 to 10000.

                      Command Default: An E.164 pattern map is not linked to a dial peer.

                      Command Mode: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: To support dial peer with multiple destination patterns, which involve massive dial peer configuration, use an E.164 destination pattern map. You can create a destination E.164 pattern map and then link it to one or more dial peers. Based on the validation of a pattern map, you can enable or disable one or more dial peers linked to the destination E.164 pattern map. To get the status of the configured E.164 pattern map, use the show dial-peer voice command in dial peer configuration mode.

                      Example: The following example shows how to link an E.164 pattern map to a dial peer:

                      Device(config)# dial-peer voice 123 voip system
                      Device(config-dial-peer)# destination e164-pattern-map 2154

                      Command

                      Description

                      destination-pattern

                      Specifies either the prefix or the full E.164 telephone number to be used for a dial peer

                      e164

                      Configures an E.164 entry on a destination E.164 pattern map.

                      show dial-peer voice

                      Displays configuration information and call statistics for dial peers.

                      url

                      Specifies the URL of a text file that has E.164 pattern entries configured on a destination E.164 pattern map.

                      To specify either the prefix or the full E.164 telephone number to be used for a dial peer, use the destination-pattern command in dial peer configuration mode. To disable the configured prefix or telephone number, use the no form of this command.

                      destination-pattern [ + ] string [ T ]

                      no destination-pattern [ + ] string [ T ]

                      +

                      (Optional) Character that indicates an E.164 standard number.

                      string

                      Series of digits that specify a pattern for the E.164 or private dialing plan telephone number. Valid entries are the digits 0 through 9, the letters A through D, and the following special characters:

                      • The asterisk (*) and pound sign (#) that appear on standard touch-tone dial pads.

                      • Comma (,), which inserts a pause between digits.

                      • Period (.), which matches any entered digit (this character is used as a wildcard).

                      • Percent sign (%), which indicates that the preceding digit occurred zero or more times; similar to the wildcard usage.

                      • Plus sign (+), which indicates that the preceding digit occurred one or more times.

                      The plus sign used as part of a digit string is different from the plus sign that can be used preceding a digit string to indicate that the string is an E.164 standard number.

                      • Circumflex (^), which indicates a match to the beginning of the string.

                      • Dollar sign ($), which matches the null string at the end of the input string.

                      • Backslash symbol (\), which is followed by a single character, and matches that character. Can be used with a single character with no other significance (matching that character).

                      • Question mark (?), which indicates that the preceding digit occurred zero or one time.

                      • Brackets ([ ]), which indicate a range. A range is a sequence of characters enclosed in the brackets; only numeric characters from 0 to 9 are allowed in the range.

                      • Parentheses (( )), which indicate a pattern and are the same as the regular expression rule.

                      T

                      (Optional) Control character that indicates that the destination-pattern value is a variable-length dial string. Using this control character enables the router to wait until all digits are received before routing the call.

                      Command Default: The command is enabled with a null string.

                      Command Mode: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the destination-pattern command to define the E.164 telephone number for a dial peer.

                      The pattern you configure is used to match dialed digits to a dial peer. The dial peer is then used to complete the call. When a router receives voice data, it compares the called number (the full E.164 telephone number) in the packet header with the number configured as the destination pattern for the voice-telephony peer. The router then strips out the left-justified numbers that correspond to the destination pattern. If you have configured a prefix, the prefix is prepended to the remaining numbers, creating a dial string that the router then dials. If all numbers in the destination pattern are stripped out, the user receives a dial tone.

                      There are areas in the world (for example, certain European countries) where valid telephone numbers can vary in length. Use the optional control character T to indicate that a particular destination-pattern value is a variable-length dial string. In this case, the system does not match the dialed numbers until the interdigit timeout value has expired.

                      Cisco IOS software does not verify the validity of the E.164 telephone number; it accepts any series of digits as a valid number.

                      Example: The following example shows configuration of the E.164 telephone number 555-0179 for a dial peer:

                      
                      dial-peer voice 10 pots
                       destination-pattern +5550179

                      The following example shows configuration of a destination pattern in which the pattern "43" is repeated multiple times preceding the digits "555":

                      
                      dial-peer voice 1 voip
                       destination-pattern 555(43)+

                      The following example shows configuration of a destination pattern in which the preceding digit pattern is repeated multiple times:

                      
                      dial-peer voice 2 voip
                       destination-pattern 555%

                      The following example shows configuration of a destination pattern in which the digit-by-digit matching is prevented and the entire string is received:

                      
                      dial-peer voice 2 voip
                       destination-pattern 555T

                      Command

                      Description

                      answer-address

                      Specifies the full E.164 telephone number to be used to identify the dial peer of an incoming call.

                      dial-peer terminator

                      Designates a special character to be used as a terminator for variable-length dialed numbers.

                      incoming called-number (dial-peer)

                      Specifies a digit string that can be matched by an incoming call to associate that call with a dial peer.

                      prefix

                      Specifies the prefix of the dialed digits for a dial peer.

                      timeouts interdigit

                      Configures the interdigit timeout value for a specified voice port.

                      To specify the ISDN directory number for the telephone interface, use the destination-pattern command in interface configuration mode. To disable the specified ISDN directory number, use the no form of this command.

                      destination-pattern isdn

                      no destination-pattern isdn

                      isdn

                      Local ISDN directory number assigned by your telephone service provider.

                      Command Default: A default ISDN directory number is not defined for this interface.

                      Command Mode: Interface configuration (config-if)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command is applicable to the Cisco 800 series routers.

                      You must specify this command when creating a dial peer. This command does not work if it is not specified within the context of a dial peer. For information on creating a dial peer, refer to the Cisco 800 Series Routers Software Configuration Guide.

                      Do not specify an area code with the local ISDN directory number.

                      Example: The following example specifies 555-0101 as the local ISDN directory number:

                      destination-pattern 5550101

                      Command

                      Description

                      dial-peer voice

                      Enters dial peer configuration mode, defines the type of dial peer, and defines the tag number associated with a dial peer.

                      no call-waiting

                      Disables call waiting.

                      port (dial peer)

                      Enables an interface on a PA-4R-DTR port adapter to operate as a concentrator port.

                      ring

                      Sets up a distinctive ring for telephones, fax machines, or modems connected to a Cisco 800 series router.

                      show dial-peer voice

                      Displays configuration information and call statistics for dial peers.

                      To enter call-home diagnostic signature mode, use the diagnostic-signature command in call-home configuration mode.

                      diagnostic-signature

                      This command has no arguments or keywords.

                      Command Default: No default behavior or values.

                      Command Mode: call-home configuration (cfg-call-home)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The Diagnostic Signatures (DS) feature downloads digitally signed signatures to devices. DSes provides the ability to define more types of events and trigger types to perform the required actions than the standard Call Home feature supports.

                      Example: The following example shows how to enable the periodic downloading request for diagnostic signature (DS) files:

                      
                      Device> enable
                      Device# configure terminal
                      Device(config)# service call-home
                      Device(config)# call-home
                      Device(cfg-call-home)# contact-email-addr userid@example.com
                      Device(cfg-call-home)# mail-server 10.1.1.1 priority 4
                      Device(cfg-call-home)# profile user-1
                      Device(cfg-call-home-profile)# destination transport-method http
                      Device(cfg-call-home-profile)# destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService 
                      Device(cfg-call-home-profile)# subscribe-to-alert-group inventory periodic daily 14:30
                      Device(cfg-call-home-profile)# exit
                      Device(cfg-call-home)# diagnostic-signature
                      Device(cfg-call-home-diag-sign)# profile user1
                      Device(cfg-call-home-diag-sign)# environment ds_env1 envarval 
                      Device(cfg-call-home-diag-sign)# end 

                      To specify that named class of restrictions (COR) apply to dial peers, use the dial-peer corcustom command in global configuration mode.

                      dial-peer cor custom

                      This command has no arguments or keywords.

                      Command Default: No default behavior or keywords.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: You must use the dial-peer cor custom command and the name command to define the names of capabilities before you can specify COR rules and apply them to specific dial peers.

                      Examples of possible names might include the following: call1900, call527, call9, and call911.

                      You can define a maximum of 64 COR names.

                      Example: The following example defines two COR names:

                      
                      dial-peer cor custom
                       name wx-calling_Internal
                       name wx-calling_Toll-fre
                       name wx-calling_National
                       name wx-calling_International
                       name wx-calling_Operator_Assistance
                       name wx-calling_chargeable_Directory_Assistance
                       name wx-calling_Special_Sevices1 
                       name wx-calling_Special_Sevices2
                       name wx-calling_Premium_Sevices1
                       name wx-calling_Premium_Sevices2

                      Command

                      Description

                      name (dial peer cor custom)

                      Provides a name for a custom COR.

                      To specify a hunt selection order for dial peers, use the dial-peerhunt command in global configuration mode. To restore the default selection order, use the no form of this command.

                      dial-peer hunt hunt-order-number

                      no dial-peer hunt hunt-order-number

                      hunt-order-number

                      A number from 0 to 7 that selects a predefined hunting selection order:

                      • 0--Longest match in phone number, explicit preference, random selection. This is the default hunt order number.

                      • 1--Longest match in phone number, explicit preference, least recent use.

                      • 2--Explicit preference, longest match in phone number, random selection.

                      • 3--Explicit preference, longest match in phone number, least recent use.

                      • 4--Least recent use, longest match in phone number, explicit preference.

                      • 5--Least recent use, explicit preference, longest match in phone number.

                      • 6--Random selection.

                      • 7--Least recent use.

                      Command Default: The default is the longest match in the phone number, explicit preference, random selection (hunt order number 0).

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the dial-peerhunt dial peer configuration command if you have configured hunt groups. "Longest match in phone number" refers to the destination pattern that matches the greatest number of the dialed digits. "Explicit preference" refers to the preference command setting in the dial-peer configuration. "Least recent use" refers to the destination pattern that has waited the longest since being selected. "Random selection" weighs all the destination patterns equally in a random selection mode.

                      Example: The following example configures the dial peers to hunt in the following order: (1) longest match in phone number, (2) explicit preference, (3) random selection.

                      
                      dial-peer hunt 0

                      Command

                      Description

                      destination-pattern

                      Specifies the prefix or the complete telephone number for a dial peer.

                      preference

                      Specifies the preferred selection order of a dial peer within a hunt group.

                      show dial-peer voice

                      Displays configuration information for dial peers.

                      To configure dial-peer group as a destination, use the dial-peer preference command in voice class configuration mode. To disable the capability, use the no form of this command.

                      dial-peer dial-peer-id [ preference preference-order ]

                      no dial-peer dial-peer-id [ preference preference-order ]

                      preference preference-order

                      Specifies the priority with preference order for each dial peer.

                      dial-peer-id

                      Identifies the dial-peer.

                      Command Default: 0 being the default and highest preference

                      Command Mode: voice class configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: If preference is not specified, the order of selection is random or as specified by the dial-peer hunt command.

                      The lower the preference number, the higher the priority. The highest priority is given to the dial peer with preference order 0.

                      Use the dial-peer preference command to associate a configured dial peer with this dial-peer group and configures a preference value.

                      Example: The following example shows how to configure dial-peer group used for routing the calls directly to the outbound PSTN:

                      
                      voice class dpg 200
                       dial-peer 101 preference 1

                      To define a particular dial peer, to specify the method of voice encapsulation, and to enter dial peer configuration mode, use the dial-peer voice command in global configuration mode. To delete a defined dial peer, use the no form of this command.

                      dial-peer voice tag { pots | voip system

                      no dial-peer voice tag { pots | voip system

                      tag

                      Digits that define a particular dial peer. Range is from 1 to 2147483647.

                      pots

                      Indicates that this is a POTS peer that uses VoIP encapsulation on the IP backbone.

                      voip

                      Indicates that this is a VoIP peer that uses voice encapsulation on the POTS network.

                      system

                      Indicates that this is a system that uses VoIP.

                      Command Default: No dial peer is defined. No method of voice encapsulation is specified.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the dial-peer voice global configuration command to switch to dial peer configuration mode from global configuration mode and to define a particular dial peer. Use the exit command to exit dial peer configuration mode and return to global configuration mode.

                      A newly created dial peer remains defined and active until you delete it with the no form of the dial-peervoice command. To disable a dial peer, use the noshutdown command in dial peer configuration mode.

                      Example: The following example shows how the dial-peervoice command is used to configure the extended echo canceller. In this instance, pots indicates that this is a POTS peer using VoIP encapsulation on the IP backbone, and it uses the unique numeric identifier tag 133001.

                      
                      Device(config)# dial-peer voice 133001 pots
                      

                      The following example shows how to configure the command:

                      
                      Device(config)# dial-peer voice 101 voip

                      Command

                      Description

                      destination-pattern

                      Specifies the prefix, the full E.164 telephone number, or an ISDN directory number to be used for a dial peer.

                      To enable the direct inward dialing (DID) call treatment for an incoming called number, use the direct-inward-dial command in dial peer configuration mode. To disable DID on the dial peer, use the no form of this command.

                      direct-inward-dial

                      no direct-inward-dial

                      This command has no arguments or keywords.

                      Command Default: No default behavior or values.

                      Command Mode: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the direct-inward-dial command to enable the DID call treatment for an incoming called number. When this feature is enabled, the incoming call is treated as if the digits were received from the DID trunk. The called number is used to select the outgoing dial peer. No dial tone is presented to the caller.

                      Use the no form of this command to disable DID on the dial peer. When the command is disabled, the called number is used to select the outgoing dial peer. The caller is prompted for a called number via dial tone.

                      This command is applicable only to plain old telephone service (POTS) dial peers for on-ramp store-and-forward fax functions.

                      Example: The following example enables DID call treatment for the incoming called number:

                      
                      dial-peer voice 10 pots
                       direct-inward-dial

                      The following example shows how to configure the command for VoIP:

                      
                      dial-peer voice 20 voip
                       direct-inward-dial

                      To specify how a Session Initiation Protocol (SIP) gateway relays dual tone multifrequency (DTMF) tones between telephony interfaces and an IP network, use the dtmf-relay command in dial peer voice configuration mode. To remove all signaling options and send the DTMF tones as part of the audio stream, use the no form of this command.

                      dtmf-relay { rtp-nte [ digit-drop | sip-info | sip-kpml | sip-notify ] | sip-info [ rtp-nte | digit-drop | sip-kpml | sip-notify ] | sip-kpml [ rtp-nte | digit-drop | sip-info | sip-notify ] | sip-notify [ rtp-nte | digit-drop | sip-info | sip-kpml ] }

                      no dtmf-relay { rtp-nte | sip-info | sip-kpml | sip-notify }

                      rtp-nte

                      Forwards DTMF tones by using RTP with the Named Telephone Event (NTE) payload type.

                      digit-drop

                      Passes digits out-of-band and drops in-band digits.

                      The digit-drop keyword is only available when the rtp-nte keyword is configured.

                      sip-info

                      Forwards DTMF tones using SIP INFO messages. This keyword is available only if the VoIP dial peer is configured for SIP.

                      sip-kpml

                      Forwards DTMF tones using SIP KPML over SIP SUBSCRIBE/NOTIFY messages. This keyword is available only if the VoIP dial peer is configured for SIP.

                      sip-notify

                      Forwards DTMF tones using SIP NOTIFY messages. This keyword is available only if the VoIP dial peer is configured for SIP.

                      Command Default: DTMF tones are disabled and sent in-band. That is, they are left in the audio stream.

                      Command Mode: Dial peer voice configuration (config-dial-peer-voice)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: DTMF tones are disabled and sent in-band. That is, they are left in the audio stream..

                      This command specifies how a SIP gateway relays DTMF tones between telephony interfaces and an IP network.

                      You must include one or more keywords when using this command.

                      To avoid sending both in-band and out-of band tones to the outgoing leg when sending IP-to-IP gateway calls in-band (rtp-nte) to out-of band (h245-alphanumeric), configure the dtmf-relay command using the rtp-nte and digit-drop keywords on the incoming SIP dial peer. On the H.323 side, and for H.323 to SIP calls, configure this command using either the h245-alphanumeric or h245-signal keyword.

                      The SIP-NOTIFY method sends NOTIFY messages bidirectionally between the originating and terminating gateways for a DTMF event during a call. If multiple DTMF relay mechanisms are enabled on a SIP dial peer and are negotiated successfully, the SIP-NOTIFY method takes precedence.

                      SIP NOTIFY messages are advertised in an invite message to the remote end only if the dtmf-relay command is set.

                      You can configure dtmf-relay sip-info only if the allow-connections sip to sip command is enabled at the global level.

                      For SIP, the gateway chooses the format according to the following priority:

                      1. sip-notify (highest priority)

                      2. rtp-nte

                      3. None--DTMF sent in-band

                      The gateway sends DTMF tones only in the format that you specify if the remote device supports it. If the H.323 remote device supports multiple formats, the gateway chooses the format according to the following priority:

                      1. cisco-rtp (highest priority)

                      2. h245-signal

                      3. h245-alphanumeric

                      4. rtp-nte

                      5. None--DTMF sent in-band

                      The principal advantage of the dtmf-relay command is that it sends DTMF tones with greater fidelity than is possible in-band for most low-bandwidth codecs, such as G.729 and G.723. Without the use of DTMF relay, calls established with low-bandwidth codecs may have trouble accessing automated DTMF-based systems, such as voice mail, menu-based Automatic Call Distributor (ACD) systems, and automated banking systems.

                      • The sip-notify keyword is available only if the VoIP dial peer is configured for SIP.

                      • The digit-drop keyword is available only when the rtp-nte keyword is configured.

                      Example: The following example configures DTMF relay with the cisco-rtp keyword when DTMF tones are sent to dial peer 103:

                      
                      dial-peer voice 103 voip
                       dtmf-relay cisco-rtp 
                      

                      The following example configures DTMF relay with the cisco-rtp and h245-signal keywords when DTMF tones are sent to dial peer 103:

                      
                      dial-peer voice 103 voip
                       dtmf-relay cisco-rtp h245-signal
                      

                      The following example configures the gateway to send DTMF in-band (the default) when DTMF tones to are sent dial peer 103:

                      
                      dial-peer voice 103 voip
                       no dtmf-relay
                      

                      The following example configures DTMF relay with the digit-drop keyword to avoid both in-band and out-of band tones being sent to the outgoing leg on H.323 to H.323 or H.323 to SIP calls:

                      
                      dial-peer voice 1 voip
                       session protocol sipv2
                       dtmf-relay h245-alphanumeric rtp-nte digit-drop 
                      

                      The following example configures DTMF relay with the rtp-nte keyword when DTMF tones are sent to dial peer 103:

                      
                      dial-peer voice 103 voip
                       dtmf-relay rtp-nte
                      

                      The following example configures the gateway to send DTMF tones using SIP NOTIFY messages to dial peer 103:

                      
                      dial-peer voice 103 voip
                       session protocol sipv2
                       dtmf-relay sip-notify
                      

                      The following example configures the gateway to send DTMF tones using SIP INFO messages to dial peer 10:

                      
                      dial-peer voice 10 voip
                        dtmf-relay sip-info
                      

                      Command

                      Description

                      notify telephone-event

                      Configures the maximum interval between two consecutive NOTIFY messages for a particular telephone event.

                      To configure the content of an E.164 pattern map, use the e164 command in the voice class e164 pattern map mode. To remove the configuration from the content of an E.164 pattern map, use the no form of this command.

                      e164 pattern

                      no e164 pattern

                      pattern

                      A full E.164 telephone number prefix.

                      Command Default: The content of an E.164 pattern map is not configured.

                      Command Mode: Voice class e164 pattern map configuration (config-voice class e164-pattern-map)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: You can create an E.164 pattern map in dial peer configuration mode before configuring the content of an E.164 pattern map in voice class E.164 pattern map mode. You must use the correct format of the E.164 pattern number when you add an E.164 pattern entry to a destination E.164 pattern map. You can also add multiple destination E.164 patterns to a pattern map.

                      Example: The following example shows how an E.164 pattern entry is configured on a destination E.164 pattern map:

                      Device(config)# voice class e164-pattern-map
                      Device(config-voice class e164-pattern-map)# e164 605

                      Command

                      Description

                      destination e164-pattern-map

                      Links an E.164 pattern map to a dial peer.

                      show voice class e164-pattern-map

                      Displays the information of the configuration of an E.164 pattern map.

                      url

                      Specifies the URL of a text file that has E.164 patterns configured on a destination E.164 pattern map.

                      To force the Local Gateway to send a SIP invite with Early-Offer (EO) on the Out-Leg (OL), use the early-offer command in SIP, voice class tenant configuration mode, or dial peer configuration mode. To disable early-offer, use the no form of this command.

                      early-offer forced { renegotiate | always | system }

                      no early-offer forced { renegotiate | always | system }

                      forced

                      Forcefully sends Early-Offer on the SIP Out-Leg.

                      renegotiate

                      Triggers a Delayed-Offer Re-invite to exchange complete media capability if the negotiated codecs are one of the following:

                      • aaclld - Audio codec AACLD 90000 bps

                      • mp4a - Wideband audio codec

                      always

                      Always triggers a Delayed-Offer Re-invite to exchange complete media capabilities.

                      system

                      Specifies that Early-Offer use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations

                      Command Default: Disabled. The Local Gateway does not distinguish SIP Delayed-Offer to Early-Offer call flows.

                      Command Modes: Voice service VoIP configuration (conf-serv-sip), Dial-peer configuration (config-dial-peer), and Voice class tenant configuration (config-class).

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use this command to forcefully configure a Cisco UBE to send a SIP invite with EO on the Out-Leg (OL), Delayed-Offer to Early-Offer for all VoIP calls, SIP audio calls, or individual dial peers.

                      Example: The following example shows SIP Early-Offer invites being configured globally:

                      
                      Device(conf-serv-sip)# early-offer forced
                      

                      The following example shows SIP Early-Offer invites being configured per dial peer:

                      
                      Device(config-dial-peer)# voice-class sip early-offer forced
                      

                      The following example shows SIP Early-Offer invites being in the voice class tenant configuration mode:

                      
                      Device(config-class)# early-offer forced system
                      

                      To create a PSTN number that replaces a 911 caller’s extension, use the elin command in voice emergency response location configuration mode. To remove the number, use the no form of this command.

                      elin { 1 | 2 } number

                      no elin { 1 | 2 } number

                      {1 | 2}

                      Specifies the number index.

                      number

                      Specifies the PSTN number that replaces a 911 caller’s extension.

                      Command Default: No replacement number is created.

                      Command Mode: Voice emergency response location configuration (cfg-emrgncy-resp-location)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the elin command to specify an ELIN, a PSTN number that will replace the caller’s extension.

                      The PSAP will see this number and use it to query the ALI database to locate the caller. The PSAP also uses this command for callbacks.

                      You can configure a second ELIN using the elin 2 command. If two ELINs are configured, the system selects an ELIN using a round-robin algorithm. If an ELIN is not defined for the ERL, the PSAP sees the original calling number.

                      Example: The following example shows how to configure the extension that is replaced with 1408 555 0100 before it goes to the PSAP. The PSAP will see that the caller’s number as 1408 555 0100:

                      
                      voice emergency response location 1
                       elin 1 14085550100
                       subnet 1 192.168.100.0 /26

                      Command

                      Description

                      subnet

                      Defines which IP address are part of this ERL.

                      To define a dial peer that is used by the system to route emergency calls to a PSAP, use the emergency response zone command in voice dial-peer configuration mode. To remove the definition of the dial peer as an outgoing link to the PSAP, use the no form of this command.

                      emergency response zone zone-tag

                      no emergency response zone zone-tag

                      zone-tag

                      Identifier (1-100) for the emergency response zone.

                      Command Default: The dial peer is not defined as an outgoing link to the PSAP. Therefore, E911 services are not enabled.

                      Command Mode: Dial-peer configuration (config-dial-peer)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use this command to specify that any calls using this dial peer are processed by the E911 software. To enable any E911 processing, the emergency response zone command must be enabled under a dial peer.

                      If no zone tag is specified, the system looks for a matching ELIN to the E911 caller’s phone by searching each emergency response location that was configured using the emergencyresponselocation command.

                      If a zone tag is specified, the system looks for a matching ELIN using sequential steps according to the contents of the configured zone. For example, if the E911 caller’s phone has an explicit ERL assigned, the system first looks for that ERL in the zone. If not found, it then searches each location within the zone according to assigned priority numbers, and so on. If all steps fail to find a matching ELIN, the default ELIN is assigned to the E911 caller’s phone. If no default ELIN is configured, the E911 caller’s automatic number identification (ANI) number is communicated to the Public Safety Answering Point (PSAP).

                      This command can be defined in multiple dial peers. The zone tag option allows only ERLs defined in that zone to be routed on this dial peer. Also, this command allows callers dialing the same emergency number to be routed to different voice interfaces based on the zone that includes their ERL.

                      Example: The following example shows a dial peer defined as an outgoing link to the PSAP. Emergency response zone 10 is created and only calls from this zone are routed through 1/0/0.

                      
                      dial-peer voice 911 pots
                      	destination-pattern 9911
                      	prefix 911
                      	emergency response zone 10
                      	port 1/0/0
                      	

                      Command

                      Description

                      emergency response callback

                      Defines a dial peer that is used for 911 callbacks from the PSAP.

                      emergency response location

                      Associates an ERL to either a SIP phone, ephone, or dial peer.

                      voice emergency response location

                      Creates a tag for identifying an ERL for E911 services.

                      voice emergency response zone

                      Creates an emergency response zone within which ERLs can be grouped.

                      To associate an emergency response location (ERL) for Enhanced 911 Services with a dial peer, ephone, ephone-template, voice register pool, or voice register template, use the emergency response location command in dial peer, ephone, ephone-template, voice register pool, or voice register template configuration mode. To remove the association, use the no form of this command.

                      emergency response location tag

                      no emergency response location tag

                      tag

                      Unique number that identifies an existing ERL tag defined by the voiceemergencyresponselocation command.

                      Command Default: No ERL tag is associated with a dial peer, ephone, ephone-template, voice register pool, or voice register template.

                      Command Modes:

                      Dial-peer configuration (config-dial-peer)

                      Ephone configuration (config-ephone)

                      Ephone-template configuration (config-ephone-template)

                      Voice register pool configuration (config-register-pool)

                      Voice register template configuration (config-register-template)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the emergency response location command to assign an ERL to phones individually. Depending on the type of phones (endpoints) that you have, you can assign an ERL to a phone:

                      • Dial-peer configuration

                      • Ephone

                      • Ephone-template

                      • Voice register pool

                      • Voice register template

                      These methods of associating a phone with an ERL are alternatives to assigning a group of phones that are on the same subnet as an ERL.

                      The tag used by this command is an integer from 1 to 2147483647 and refers to an existing ERL tag that is defined by the voice emergency response location command. If the tag does not refer to a valid ERL configuration, the phone is not associated to an ERL. For IP phones, the IP address is used to find the inclusive ERL subnet. For phones is on a VoIP trunk or FXS/FXO trunk, the PSAP gets a reorder tone.

                      Example: The following example shows how to assign an ERL to a phone’s dial peer:

                      
                      dial-peer voice 12 pots
                       emergency response location 18
                      

                      The following example shows how to assign an ERL to a phone’s ephone:

                      
                      ephone  41
                       emergency response location 22
                      

                      The following example shows how to assign an ERL to one or more SCCP phones:

                      
                      ephone-template 6
                       emergency response location 8
                      

                      The following example shows how to assign an ERL to a phone’s voice register pool:

                      
                      voice register pool 4
                       emergency response location 21
                      

                      The following example shows how to assign an ERL to one or more SIP phones:

                      
                      voice register template 4
                       emergency response location 8

                      Command

                      Description

                      emergency response callback

                      Defines a dial peer that is used for 911 callbacks from the PSAP.

                      emergency response zone

                      Defines a dial peer that is used by the system to route emergency calls to the PSAP.

                      voice emergency response location

                      Creates a tag for identifying an ERL for the enhanced 911 service.

                      To define a dial peer that is used for 911 callbacks from the PSAP, use the emergency response callback command in voice dial-peer configuration mode. To remove the definition of the dial peer as an incoming link from the PSAP, use the no form of this command.

                      emergency response callback

                      no emergency response callback

                      This command has no arguments or keywords.

                      Command Default: The dial peer is not defined as an incoming link from the PSAP.

                      Command Mode: Dial-peer configuration (config-dial-peer)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command defines which dial peer is used for 911 callbacks from the PSAP. You can define multiple dial peers with this command.

                      Example: The following example shows a dial peer defined as an incoming link from the PSAP. If 408 555-0100 is configured as the ELIN for an ERL, this dial peer recognizes that an incoming call from 408 555-0100 is a 911 callback.

                      
                      dial-peer voice 100 pots
                       incoming called-number 4085550100
                       port 1/1:D
                       direct-inward-dial
                       emergency response callback
                      

                      The following example shows a dial-peer defined as an inbound dial-peer for emergency E911 call:

                      
                      dial-peer voice 301 pots
                       description Inbound dial-peer for E911 call
                       emergency response callback
                       incoming called e164-pattern-map 351
                       direct-inward-dial

                      Command

                      Description

                      emergency response location

                      Associates an ERL to either a SIP phone, ephone, or dial peer.

                      emergency response zone

                      Defines a dial peer that is used by the system to route emergency calls to the PSAP.

                      voice emergency response location

                      Creates a tag for identifying an ERL for the enhanced 911 service.

                      To specify manual cut-and-paste certificate enrollment method, use the enrollment terminal command in certificate trustpoint configuration mode.

                      enrollment terminal [ pem ]

                      enrollment terminal [ pem ]

                      pem

                      Configures the trustpoint to generate PEM-formatted certificate requests to the console terminal.

                      Command Default: No default behavior or values

                      Command Mode: Ca-trustpoint configuration (ca-trustpoint)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: A user may want to manually cut-and-paste certificate requests and certificates when he or she does not have a network connection between the router and certification authority (CA). When this command is enabled, the router displays the certificate request on the console terminal, allowing the user to enter the issued certificate on the terminal.

                      The pem Keyword

                      Use the pem keyword to issue certificate requests (via the crypto ca enroll command) or receive issued certificates (via the crypto ca import certificate command) in PEM-formatted files through the console terminal. If the CA server does not support simple certificate enrollment protocol (SCEP), the certificate request can be presented to the CA server manually.

                      Example: The following example shows how to manually specify certificate enrollment via cut-and-paste. In this example, the CA trustpoint is “MS.”

                      
                      crypto ca trustpoint MS
                       enrollment terminal
                       crypto ca authenticate MS
                      !
                      crypto ca enroll MS
                      crypto ca import MS certificate

                      The following example shows how to configure the command:

                      
                      crypto pki trustpoint <CA name>
                       enrollment terminal
                       revocation-check crl
                       crypto pki authenticate <CA name>

                      Command

                      Description

                      crypto ca authenticate

                      Authenticates the CA (by getting the certificate of the CA).

                      crypto ca enroll

                      Obtains the certificates of your router from the certification authority.

                      crypto ca import

                      Imports a certificate manually via TFTP or cut-and-paste at the terminal.

                      crypto ca trustpoint

                      Declares the CA that your router should use.

                      To set a value to an environment variable for a diagnostic signature that is available on a device, use the environment command in call-home diagnostic-signature configuration mode. To remove the value for an existing environment variable, use the no form of this command. To set default value to an environment variable, use the default form of this command.

                      environment ds_ env_varnameds_env_varvalue

                      no environment ds_ env_varname

                      default environment ds_ env_varname

                      ds_ env_varname

                      Environment variable name for the diagnostic signature feature. The range is from 4 to 31 characters including the ds_ prefix.

                      The variable name must have a prefix ds_; for example, ds_env1.

                      ds_env_varvalue

                      Environment variable value for the diagnostic signature feature. The range is from 1 to 127 characters.

                      Command Default: The value for an environment variable for a diagnostic signature is not set.

                      Command Mode: Call-home diagnostic-signature configuration (cfg-call-home-diag-sign)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: If a diagnostic signature file requires embedding of the environment variable specific to a device, you must set a value for the environment variable by using the environment command. There are two special environment variables: ds_signature_id and ds_hostname. These environment variables are assigned a default value automatically when the diagnostic signature files are being installed.

                      Example: The following example shows how to specify the environment variable name (for example, ds_env1) and the environment variable value (for example, abc) for a diagnostic signature feature:

                      
                      Device> enable
                      Device# configure terminal
                      Device(config)# call-home
                      Device(cfg-call-home)# diagnostic-signature
                      Device(cfg-call-home-diag-sign)# environment ds_env1 abc
                      Device(cfg-call-home-diag-sign)# end

                      The following example shows how to configure the environment variable ds_email with the email address of the administrator to notify you:

                      
                      configure terminal 
                       call-home  
                        diagnostic-signature 
                        environment ds_email <email address> 
                      end

                      Command

                      Description

                      active (diagnostic signature)

                      Activates the diagnostic signatures on a device.

                      call-home

                      Enters call-home configuration mode.

                      diagnostic signature

                      Enters call-home diagnostic-signature configuration mode.

                      To enable the passage of error messages from the incoming SIP leg to the outgoing SIP leg, use the error-passthru command in Voice service SIP configuration mode. To disable error pass-through, use the no form of this command.

                      error-passthru system

                      no error-passthru system

                      system

                      Specifies that the error-passthrough command use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: Disabled

                      Command Mode: Voice service SIP configuration (conf-serv-sip) and Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines:
                      • Like-to-like error messages are not passed from the incoming SIP leg to the outgoing SIP leg. Error messages are passed through the the Local Gateway when the error-passthru command is configured.

                      The following example shows the error message configured to pass from the incoming SIP leg to the outgoing SIP leg:

                      
                      Router(conf-serv-sip)# error-passthru
                      

                      Example: The following example shows how to passthrough an error message in the voice class tenant configuration mode:

                      Router(config-class)# error-passthru system

                      To specify the global default ITU-T T.38 standard fax protocol to be used for all VoIP dial peers, use the fax protocol t38 command in voice-service configuration mode. To return to the default fax protocol, use the no form of this command.

                      Cisco AS5350, Cisco AS5400, Cisco AS5850 Platforms

                      fax protocol t38 [ nse force ] [ version { 0 | 3 } ] [ ls-redundancy value [ hs-redundancyvalue ]] [ fallback { none | pass-through { g711ulaw | g711alaw } } ]

                      no faxprotocol

                      All Other Platforms

                      fax protocol t38 [ nse force ] [ version { 0 | 3 } ] [ ls-redundancy value [ hs-redundancyvalue ]] [ fallback { cisco none | pass-through { g711ulaw | g711alaw } } ]

                      no faxprotocol

                      nse

                      (Optional) Uses network services engines (NSE) to switch to T.38 fax relay.

                      force

                      (Optional) Unconditionally, uses Cisco NSEs to switch to T.38 fax relay. This option allows T.38 fax relay to be used between Session Initiation Protocol (SIP) gateways.

                      version {0 | 3}

                      (Optional) Specifies a version for configuring fax speed:

                      • 0 —Configures version 0, which uses T.38 version 0 (1998—G3 faxing)

                      • 3 —Configures version 3, which uses T.38 version 3 (2004—V.34 or SG3 faxing)

                      ls -redundancyvalue

                      (Optional) (T.38 fax relay only) Specifies the number of redundant T.38 fax packets to be sent for the low-speed V.21-based T.30 fax machine protocol. Range varies by platform from 0 (no redundancy) to 5 or 7. For details, refer to command-line interface (CLI) help. Default is 0.

                      hs -redundancyvalue

                      (Optional) (T.38 fax relay only) Specifies the number of redundant T.38 fax packets to be sent for high-speed V.17, V.27, and V.29 T.4 or T.6 fax machine image data. Range varies by platform from 0 (no redundancy) to 2 or 3. For details, refer to the command-line interface (CLI) help. Default is 0.

                      fallback

                      (Optional) A fallback mode is used to transfer a fax across a VoIP network if T.38 fax relay could not be successfully negotiated at the time of the fax transfer.

                      cisco

                      (Optional) Cisco-proprietary fax protocol.

                      none

                      (Optional) No fax pass-through or T.38 fax relay is attempted. All special fax handling is disabled, except for modem pass-through if configured with the modempass-through command.

                      pass -through

                      (Optional) The fax stream uses one of the following high-bandwidth codecs:

                      • g711ulaw —Uses the G.711 mu-law codec.

                      • g711alaw —Uses the G.711 a-law codec.

                      Command Default: ls-redundancy 0 hs-redundancy 0 fallback none for the Cisco AS5350, Cisco AS5400, and Cisco AS5850 platforms ls-redundancy 0 hs-redundancy 0 fallback cisco for all other platforms.

                      Command Mode: Voice-service configuration (config-voi-srv)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the fax protocol t38 command and the voice service voip command to configure T.38 fax relay capability for all VoIP dial peers. If the fax protocol t38 (voice-service) command is used to set fax relay options for all dial peers and the faxprotocolt38 (dial-peer) command is used on a specific dial peer, the dial-peer configuration takes precedence over the global configuration for that dial peer.

                      If you specify version 3 in the fax protocol t38 command and negotiate T.38 version 3, the fax rate is automatically set to 33600.

                      The ls -redundancy and hs-redundancy keywords are used to send redundant T.38 fax packets. Setting the hs-redundancy keyword to a value greater than 0 causes a significant increase in the network bandwidth consumed by the fax call.

                      Use the nse force option when the SIP gateway is interoperating with a call agent does not support the interworking and negotiation of T.38 fax relay and NSE attributes at the time of call setup.

                      Do not use the cisco keyword for the fallback option if you specified version 3 for SG3 fax transmission.

                      Example: The following example shows how to configure the T.38 fax protocol for VoIP:

                      
                      voice service voip
                       fax protocol t38
                      

                      The following example shows how to use NSEs to unconditionally enter T.38 fax relay mode:

                      
                      voice service voip
                       fax protocol t38 nse
                      

                      The following example shows how to specify the T.38 fax protocol for all VoIP dial peers, set low-speed redundancy to a value of 1, and set high-speed redundancy to a value of 0:

                      
                      voice service voip
                       fax protocol t38 ls-redundancy 1 hs-redundancy 0

                      Command

                      Description

                      fax protocol (dial peer)

                      Specifies the fax protocol for a specific VoIP dial peer.

                      fax protocol (voice-service)

                      Specifies the global default fax protocol to be used for all VoIP dial peers.

                      fax protocol t38 (dial peer)

                      Specifies the ITU-T T.38 standard fax protocol to be used for a specific VoIP dial peer.

                      voice service voip

                      Enters voice-service configuration mode.

                      To configure fully qualified domain name (fqdn) to the gateway, use the fqdn command in ca-trustpoint configuration mode. To remove the name, use the no form of this command.

                      fqdn gateway_fqdn

                      no fqdn gateway_fqdn
                      gateway_fqdn

                      Specifies the gateway domain name.

                      Command Default: No default behavior or values.

                      Command Mode: Ca-trustpoint configuration (ca-trustpoint)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The gateway fully qualified domain name (fqdn) must use the same value that you used when assigning the survivability service to the gateway.

                      Example: The following example shows how to configure FQDN to the gateway:

                      
                      crypto pki trustpoint webex-sgw 
                       enrollment terminal 
                       fqdn <gateway_fqdn> 
                       subject-name cn=<gateway_fqdn>
                       subject-alt-name <gateway_fqdn>
                       revocation-check crl 
                       rsakeypair webex-sgw

                      To configure Cisco IOS Session Initiation Protocol (SIP) gateway to treat the G.729br8 codec as superset of G.729r8 and G.729br8 codecs to interoperate with the Cisco Unified Communications Manager, use the g729 annexb-all command in voice service SIP configuration mode or voice class tenant configuration mode. To return to the default global setting for the gateway, where G.729br8 codec represents only the G.729br8 codec, use the no form of this command.

                      g729 annexb-all system

                      no g729 annexb-all system

                      annexb-all

                      Specifies that the G.729br8 codec is treated as a superset of G.729r8 and G.729br8 codecs to communicate with Cisco Unified Communications Manager.

                      system

                      Specifies that the codec use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations

                      Command Default: G.729br8 codec is not viewed as superset of G.729r8 and G.729br8 codecs.

                      Command Modes:

                      Voice service SIP configuration (conf-serv-sip)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: There are four variations of the G.729 coder-decoder (codec), which fall into two categories:

                      High Complexity

                      • G.729 (g729r8)--a high complexity algorithm codec on which all other G.729 codec variations are based.

                      • G.729 Annex-B (g729br8 or G.729B)--a variation of the G.729 codec that allows the DSP to detect and measure voice activity and convey suppressed noise levels for re-creation at the other end. Additionally, the Annex-B codec includes Internet Engineering Task Force (IETF) voice activity detection (VAD) and comfort noise generation (CNG) functionality.

                      Medium Complexity

                      • G.729 Annex-A (g729ar8 or G.729A)--a variation of the G.729 codec that sacrifices some voice quality to lessen the load on the DSP. All platforms that support G.729 also support G.729A.

                      • G.729A Annex-B (g729abr8 or G.729AB)--a variation of the G.729 Annex-B codec that, like G.729B, sacrifices voice quality to lessen the load on the DSP. Additionally, the G.729AB codec also includes IETF VAD and CNG functionality.

                      The VAD and CNG functionality is what causes the instability during communication attempts between two DSPs where one DSP is configured with Annex-B (G.729B or G.729AB) and the other without (G.729 or G.729A). All other combinations interoperate. To configure a Cisco IOS SIP gateway for interoperation with Cisco Unified Communications Manager (formerly known as the Cisco CallManager, or CCM), use the g729-annexb-all command in voice service SIP configuration mode to allow connection of calls between two DSPs with incompatible G.729 codecs. Use the voice-classsipg729annexb-all command in dial peer voice configuration mode to configure G.729 codec interoperation settings for a dial peer that override global settings for the Cisco IOS SIP gateway.

                      Example: The following example configures a Cisco IOS SIP gateway (globally) to be able to connect calls between otherwise incompatible G.729 codecs:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# voice service voip
                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# g729 annexb-all
                      

                      The following example configures a Cisco IOS SIP gateway (globally) to be able to connect calls between otherwise incompatible G.729 codecs in the voice class tenant configuration mode:

                      Router(config-class)# g729 annexb-all system

                      Command

                      Description

                      voice-class sip g729 annexb-all

                      Configures an individual dial peer on a Cisco IOS SIP gateway to view a G.729br8 codec as superset of G.729r8 and G.729br8 codecs.

                      To configure a application redundancy group and to enter the application redundancy group configuration mode, use the group command in application redundancy configuration mode.

                      group group-name

                      group-name

                      Specifies the application redundancy group name.

                      Command Default: Application redundancy group is not defined.

                      Command Mode: application redundancy configuration mode (config-red-app)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the group command to configure application redundancy for high availability.

                      Example: The following example shows how to configure the group name and enter the application redundancy group configuration mode:

                      
                      Device(config)#redundancy
                      Device(config-red)#application redundancy
                      Device(config-red-app)#group 1
                      Device(config-red-app-grp)#
                      

                      Command

                      Description

                      application redundancy

                      Enters the application redundancy configuration mode.

                      To configure an IP address for a guest interface, use the guest-ipaddress command in application-hosting gateway, application-hosting management-gateway, or application-hosting VLAN-access IP configuration modes. To remove the guest interface IP address, use the no form of this command.

                      guest-ipaddress [ ip-address netmask netmask ]

                      no guest-ipaddress [ ip-address netmask netmask ]

                      netmask netmask

                      Specifies the subnet mask for the guest IP address.

                      ip-address

                      Specifies IP address of the guest interface.

                      Command Default:The guest interface IP address is not configured.

                      Command Modes:

                      Application-hosting gateway configuration (config-app-hosting-gateway)

                      Application-hosting management-gateway configuration (config-app-hosting-mgmt-gateway)

                      Application-hosting VLAN-access IP configuration (config-config-app-hosting-vlan-access-ip)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Configure this command, after configuring the app-vnic gateway, the app-vnic management, or app-vnic AppGigabitEthernet vlan-access commands.

                      Use the guest-ipaddress command to configure the guest interface address for the front-panel VLAN port for application-hosting.

                      Example: The following example shows how to configure the guest interface address for a virtual network interface gateway:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-vnic gateway1 VirtualPortGroup 0 guest-interface 1
                      Device(config-app-hosting-gateway)# guest-ipaddress 10.0.0.3 netmask 255.255.255.0

                      The following example shows how to configure the guest interface address for a management gateway:

                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-vnic management guest-interface 0
                      Device(config-app-hosting-mgmt-gateway)# guest-ipaddress 172.19.0.24 netmask 255.255.255.0

                      The following example shows how to configure the guest interface address for the front-panel VLAN port:

                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-vnic AppGigabitEthernet trunk
                      Device(config-config-app-hosting-trunk)# vlan 1 guest-interface 9
                      Device(config-config-app-hosting-vlan-access-ip)# guest-ipaddress 192.168.0.2 
                      netmask 255.255.255.0
                      Device(config-config-app-hosting-vlan-access-ip)#

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      app-vnic gateway

                      Configures a virtual network interface gateway.

                      app-vnic AppGigabitEthernet trunk

                      Configures a front-panel trunk port and enters application-hosting trunk configuration mode.

                      app-vnic management

                      Configures the management gateway of a virtual network interface.

                      vlan (App Hosting)

                      Configures a VLAN guest interface and enters application-hosting VLAN-access IP configuration mode.

                      To configure a Cisco IOS device to handle Session Initiation Protocol (SIP) INVITE with Replaces header messages at the SIP protocol level, use the handle-replaces command in SIP UA configuration mode or voice class tenant configuration mode. To return to the default handling of SIP INVITE with Replaces header messages where messages are handled at the application layer, use the no form of this command.

                      handle-replaces system

                      no handle-replaces system

                      system

                      Specifies that the default handling of SIP INVITE with Replaces header messages use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations

                      Command Default: Handling of SIP INVITE with Replaces header messages takes place at the application layer.

                      Command Modes:

                      SIP UA configuration (config-sip-ua)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: On Cisco IOS devices running software version, SIP INVITE with Replaces header messages (such as those associated with Call Replacement during a Consult Call transfer scenario) are handled at the SIP protocol level. The default behavior for Cisco IOS devices is to handle SIP INVITE with Replaces header messages at the application layer. To configure your Cisco IOS device to handle SIP INVITE with Replaces header messages at the SIP protocol level, use the handle-replaces command in SIP UA configuration mode.

                      Example: The following example shows how to configure fallback to legacy handling of SIP INVITE messages:

                      
                      Device(config)# sip-ua
                      Device(config-sip-ua)# handle-replaces
                      

                      The following example shows how to configure fallback to legacy handling of SIP INVITE messages in the voice class tenant configuration mode:

                      
                      Device(config-class)# handle-replaces system

                      Command

                      Description

                      supplementary-service sip

                      Enables SIP supplementary service capabilities for call forwarding and call transfers across a SIP network.

                      To match a call based on the host field, a valid domain name, IPv4 address, IPv6 address, or the complete domain name in a Session Initiation Protocol (SIP) uniform resource identifier (URI), use the host command in voice URI class configuration mode. To remove the host match, use the no form of this command.

                      host { ipv4: ipv4- address | ipv6: ipv6:address | dns: dns-name | hostname-pattern }

                      no host { ipv4: ipv4- address | ipv6: ipv6:address | dns: dns-name | hostname-pattern }

                      ipv4: ipv4-address

                      Specifies a valid IPv4 address.

                      ipv6: ipv6-address

                      Specifies a valid IPv6 address.

                      dns: dns-name

                      Specifies a valid domain name. The maximum length of a valid domain name is 64 characters.

                      hostname-pattern

                      Cisco IOS regular expression pattern to match the host field in a SIP URI. The maximum length of a hostname pattern is 32 characters.

                      Command Default: The calls are not matched on the host field, IPv4 address, IPv6 address, valid domain name, or complete domain name in the SIP URI.

                      Command Mode: Voice URI class configuration (config-voice-uri-class)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: You can use this command only in a voice class for SIP URIs.

                      You cannot use host (sip uri) command if you use the pattern command in the voice class. The pattern command matches on the entire URI, whereas this command matches only a specific field.

                      You can configure ten instances of the host command by specifying IPv4 addresses, IPv6 addresses, or domain name service (DNS) names for each instance. You can configure the host command specifying the hostname-pattern argument only once.

                      Example: The following example defines a voice class that matches on the host field in a SIP URI:

                      
                      voice class uri r100 sip
                       user-id abc123 
                       host server1
                       host ipv4:10.0.0.0
                       host ipv6:[2001:0DB8:0:1:FFFF:1234::5] 
                       host dns:example.sip.com
                       phone context 408

                      Command

                      Description

                      pattern

                      Matches a call based on the entire SIP or TEL URI.

                      phone context

                      Filters out URIs that do not contain a phone-context field that matches the configured pattern.

                      user-id

                      Matches a call based on the user-id field in the SIP URI.

                      voice class uri

                      Creates or modifies a voice class for matching dial peers to calls containing a SIP or TEL URI.

                      voice class uri sip preference

                      Sets a preference for selecting voice classes for a SIP URI.

                      To explicitly identify a locally available individual Cisco SIP IP phone, or when running Cisco Unified Session Initiation Protocol (SIP) Survivable Remote Site Telephony (SRST), set of Cisco SIP IP phones, use the id command in voice register pool configuration mode. To remove local identification, use the no form of this command.

                      id [ { phone-number e164-number | extension-number extension-number } ]

                      no id [ { phone-number e164-number | extension-number extension-number } ]

                      phone-number e164-number

                      Configures the phone-number in E.164 format for Webex Calling user (available only under mode webex-sgw).

                      extension-number extension-number

                      Configures extension number for Webex Calling user (available only under mode webex-sgw).

                      Command Default: No SIP IP phone is configured.

                      Command Mode: Voice register pool configuration (config-register-pool)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Configure this command before configuring any other command in voice register pool configuration mode.

                      Example: The following is a sample output from the show phone-number e164-numbercommand:

                      voice register pool 10
                       id phone-number +15139413701
                       dtmf-relay rtp-nte
                       voice-class codec 10

                      The following is a sample output from the show extension-number extension-number command:

                      voice register pool 10
                       id extension-number 3701
                       dtmf-relay rtp-nte
                       voice-class codec 10

                      Command

                      Description

                      mode (voice register global)

                      Enables the mode for provisioning SIP phones in a Cisco Unified Call Manager Express (Cisco Unified CME) system.

                      To explicitly identify a locally available individual Cisco SIP IP phone, or when running Cisco Unified Session Initiation Protocol (SIP) Survivable Remote Site Telephony (SRST), set of Cisco SIP IP phones, use the id network command in voice register pool configuration mode. To remove local identification, use the no form of this command.

                      id network address mask mask

                      no id network address mask mask

                      network address mask mask

                      This keyword/argument combination is used to accept SIP Register messages for the indicated phone numbers from any IP phone within the specified IPv4 and IPv6 subnets. The ipv6 address can only be configured with an IPv6 address or a dual-stack mode.

                      Command Default: No SIP IP phone is configured.

                      Command Mode: Voice register pool configuration (config-register-pool)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The id network and mask identify a SIP device, or set of network devices that use this pool. Use the addresses and masks that apply to your deployment. The address 0.0.0.0 allows devices from anywhere to register (if the device addresses are in the permit list).

                      Example: The following example shows how to configure default voice register pool per location:

                      
                      voice register pool 1
                       id network 0.0.0.0 mask 0.0.0.0
                       dtmf-relay rtp-nte
                       voice-class codec 1

                      To configure multiple pattern support on a voice dial peer, use the incoming called command in dial peer configuration mode. To remove the capability, use the no form of this command.

                      { destination | incoming called | incoming calling } e164-pattern-map pattern-map-group-id

                      no { destination | incoming called | incoming calling } e164-pattern-map pattern-map-group-id

                      destination

                      Use the destination keyword for outbound dial peers.

                      incoming called

                      Use the incoming called keyword for inbound dial peers using called numbers.

                      incoming calling

                      Use the incoming calling keyword for inbound dial peers using calling numbers.

                      pattern-map-group-id

                      Links a pattern-map group with a dial peer.

                      Command Default: An incoming called e164 pattern map is not linked to a dial peer.

                      Command Mode: Dial-peer configuration mode (config-dial-peer)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The multiple pattern support on a voice dial peer feature enables you to configure multiple patterns on a VoIP dial peer using an E.164 pattern map. A dial peer can be configured to match multiple patterns to an incoming calling or called number or an outgoing destination number.

                      Example: The following example shows how to configure multiple ptterns on a VoIP dial peer using an e164 pattern map:

                      Device(config-dial-peer)# incoming calling e164-pattern-map 1111

                      To specify the voice class used to match a VoIP dial peer to the uniform resource identifier (URI) of an incoming call, use the incoming uri command in dial peer voice configuration mode. To remove the URI voice class from the dial peer, use the no form of this command.

                      incoming uri { from request to via } tag

                      no incoming uri { from request to via } tag

                      tag

                      Alphanumeric label that uniquely identifies the voice class. This tag argument must be configured with the voice class uri command.

                      from

                      From header in an incoming SIP Invite message.

                      request

                      Request-URI in an incoming SIP Invite message.

                      to

                      To header in an incoming SIP Invite message.

                      via

                      Via header in an incoming SIP Invite message.

                      Command Default: No voice class is specified.

                      Command Mode: Dial peer voice configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines:

                      • Before you use this command, configure the voice class by using the voice class uri command.

                      • The keywords depend on whether the dial peer is configured for SIP with the session protocol sipv2 command. The from, request, to, and via keywords are available only for SIP dial peers.

                      • This command applies rules for dial peer matching. The tables below show the rules and the order in which they are applied when the incoming uri command is used. The gateway compares the dial-peer command to the call parameter in its search to match an inbound call to a dial peer. All dial peers are searched based on the first match criterion. Only if no match is found does the gateway move on to the next criterion.

                      Table 1. Dial-Peer Matching Rules for Inbound URI in SIP Calls

                      Match Order

                      Cisco IOS Command

                      Incoming Call Parameter

                      1

                      incoming uri via

                      Via URI

                      2

                      incoming uri request

                      Request-URI

                      3

                      incoming uri to

                      To URI

                      4

                      incoming uri from

                      From URI

                      5

                      incoming called-number

                      Called number

                      6

                      answer-address

                      Calling number

                      7

                      destination-pattern

                      Calling number

                      8

                      carrier-id source

                      Carrier-ID associated with the call

                      Table 2. Dial-Peer Matching Rules for Inbound URI in H.323 Calls

                      Match Order

                      Cisco IOS Command

                      Incoming Call Parameter

                      1

                      incoming uri called

                      Destination URI in H.225 message

                      2

                      incoming uri calling

                      Source URI in H.225 message

                      3

                      incoming called-number

                      Called number

                      4

                      answer-address

                      Calling number

                      5

                      destination-pattern

                      Calling number

                      6

                      carrier-id source

                      Source carrier-ID associated with the call

                      • You can use this command multiple times in the same dial peer with different keywords. For example, you can use incoming uri called and incoming uri calling in the same dial peer. The gateway then selects the dial peer based on the matching rules described in the tables above.

                      Example: The following example matches on the destination telephone URI in incoming H.323 calls by using the ab100 voice class:

                      
                      dial-peer voice 100 voip
                       incoming uri called ab100
                      

                      The following example matches on the incoming via URI for SIP calls by using the ab100 voice class:

                      
                      dial-peer voice 100 voip 
                       session protocol sipv2
                       incoming uri via ab100

                      Command

                      Description

                      answer-address

                      Specifies the calling number to match for a dial peer.

                      debug voice uri

                      Displays debugging messages related to URI voice classes.

                      destination-pattern

                      Specifies the telephone number to match for a dial peer.

                      dial-peer voice

                      Enters dial peer voice configuration mode to create or modify a dial peer.

                      incoming called-number

                      Specifies the incoming called number matched to a dial peer.

                      session protocol

                      Specifies the session protocol in the dial peer for calls between the local and remote router.

                      show dialplan incall uri

                      Displays which dial peer is matched for a specific URI in an incoming voice call.

                      voice class uri

                      Creates or modifies a voice class for matching dial peers to calls containing a SIP or TEL URI.

                      To configure an interface type and to enter interface configuration mode, use the interface command in global configuration mode. To exit from the interface configuration mode, use the no form of this command.

                      interface type slot/ subslot/ port

                      no interface type slot/ subslot/ port

                      type

                      Type of interface to be configured. See the table below.

                      slot/ subslot/ port

                      Chassis slot number. Secondary slot number on a SIP where a SPA is installed. Port or interface number. The slash (/) is required.

                      Command Default: No interface types are configured.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The table below displays the keywords that represent the types of interfaces that can be configured with the interface command. Replace the type argument with the appropriate keyword from the table.

                      Table 3. Interface Type Keywords

                      Keyword

                      Interface Type

                      analysis-module

                      Analysis module interface. The analysis module interface is a Fast Ethernet interface on the router that connects to the internal interface on the Network Analysis Module (NAM). This interface cannot be configured for subinterfaces or for speed, duplex mode, and similar parameters.

                      async

                      Port line used as an asynchronous interface.

                      dialer

                      Dialer interface.

                      ethernet

                      Ethernet IEEE 802.3 interface.

                      fastethernet

                      100-Mbps Ethernet interface.

                      fddi

                      FDDI interface.

                      gigabitethernet

                      1000 Mbps Ethernet interface.

                      loopback

                      Software-only loopback interface that emulates an interface that is always up. It is a virtual interface supported on all platforms. The number argument is the number of the loopback interface that you want to create or configure. There is no limit on the number of loopback interfaces that you can create.

                      tengigabitethernet

                      10 Gigabit Ethernet interface.

                      Example: The following example shows how to enter interface configuration mode:

                      Device(config)# interface gigabitethernet 0/0/0
                      Device(config-if)#

                      Command

                      Description

                      channel-group (Fast EtherChannel)

                      Assigns a Fast Ethernet interface to a Fast EtherChannel group.

                      group-range

                      Creates a list of asynchronous interfaces that are associated with a group interface on the same device.

                      mac-address

                      Sets the MAC layer address.

                      show interfaces

                      Displays information about interfaces.

                      To configure an IP address and subnet mask for an interface, use the ip address command in interface configuration mode. To remove an IP address configuration, use the no form of this command.

                      ip address ip-address subnet-mask

                      no ip address ip-address subnet-mask

                      ip-address

                      IP address to assign.

                      subnet-mask

                      Mask for the associated IP subnet.

                      Command Default: No IP address is defined for the interface.

                      Command Mode: Interface configuration mode (config-if)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: An interface can have one primary IP address and multiple secondary IP addresses. Packets generated by the Cisco IOS software always use the primary IP address. Therefore, all routers and access servers on a segment should share the same primary network number.

                      You can disable IP processing on a particular interface by removing its IP address with the no ip address command. If the software detects another host using one of its IP addresses, it will print an error message on the console.

                      Example: The following example assigns the IP address 10.3.0.24 and the subnet mask 255.255.255.0 to Ethernet interface:

                      
                      Device(config)# interface ethernet 0/1
                      Device(config-if)# ip address 10.3.0.24 255.255.255.0

                      Command

                      Description

                      match ip source

                      Specifies a source IP address to match to required route maps that have been set up based on VRF connected routes.

                      show ip interface

                      Displays the usability status of interfaces configured for IP.

                      To set up toll-fraud prevention support on a device, use the ip address trusted command in voice-service configuration mode. To disable the setup, use the no form of this command.

                      ip address trusted { authenticate | call-block cause code | list }

                      no ip address trusted { authenticate | call-block cause code | list }

                      authenticate

                      Enables IP address authentication on incoming Session Initiation Protocol (SIP) trunk calls.

                      call-block cause code

                      Enables issuing a cause code when an incoming call is rejected on the basis of failed IP address authentication. By default, the device issues a call-reject (21) cause code.

                      list

                      Enables manual addition of IPv4 and IPv6 addresses to the trusted IP address list.

                      Command Default: Toll-fraud prevention support is enabled.

                      Command Mode: Voice service configuration (conf-voi-serv)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the ip address trusted command to modify the default behavior of a device, which is to not trust a call setup from a VoIP source. With the introduction of this command, the device checks the source IP address of the call setup before routing the call.

                      A device rejects a call if the source IP address does not match an entry in the trusted IP address list that is a trusted VoIP source. To create a trusted IP address list, use the ip address trusted list command in voice service configuration mode, or use the IP addresses that have been configured using the session target command in dial peer configuration mode. You can issue a cause code when an incoming call is rejected on the basis of failed IP address authentication.

                      Example: The following example displays how to enable IP address authentication on incoming SIP trunk calls for toll-fraud prevention support:

                      
                      Device(config)# voice service voip
                      Device(conf-voi-serv)# ip address trusted authenticate
                      

                      The following example displays the number of rejected calls:

                      
                      Device# show call history voice last 1 | inc Disc
                      
                      DisconnectCause=15  
                      DisconnectText=call rejected (21)
                      DisconnectTime=343939840 ms
                      

                      The following example displays the error message code and the error description:

                      
                      Device# show call history voice last 1 | inc Error
                      
                      InternalErrorCode=1.1.228.3.31.0
                      

                      The following example displays the error description:

                      
                      Device# show voice iec description 1.1.228.3.31.0
                      
                      IEC Version: 1
                      Entity: 1 (Gateway)
                      Category: 228 (User is denied access to this service)
                      Subsystem: 3 (Application Framework Core)
                      Error: 31 (Toll fraud call rejected)
                      Diagnostic Code: 0
                      

                      The following example shows how to issue a cause code when an incoming call is rejected on the basis of failed IP address authentication:

                      
                      Device(config)# voice service voip
                      Device(conf-voi-serv)# ip address trusted call-block cause call-reject

                      The following example displays how to enable the addition of IP addresses to a trusted IP address list:

                      
                      Device(config)# voice service voip
                      Device(conf-voi-serv)# ip address trusted list

                      Command

                      Description

                      voice iec syslog

                      Enables viewing of internal error codes as they are encountered in real time.

                      To configure the default password used for connections to remote HTTP servers, use the ip http client password command in global configuration mode. To remove a configured default password from the configuration, use the no form of this command.

                      ip http client password { 0 password| 7 password | password }

                      no ip http client password { 0 password| 7 password | password }

                      0

                      0 specifies that an unencrypted password follows. The default is an unencrypted password.

                      7

                      7 specifies that an encrypted password follows.

                      password

                      The password string to be used in HTTP client connection requests sent to remote HTTP servers.

                      Command Default: No default password exists for the HTTP connections.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command is used to configure a default password before a file is downloaded from a remote web server using the copy http:// or copy https:// command. The default password will be overridden by a password specified in the URL of the copy command.

                      The password is encrypted in the configuration files.

                      Example: In the following example, the default HTTP password is configured as Password and the default HTTP username is configured as User2 for connections to remote HTTP or HTTPS servers:

                      
                      Router(config)# ip http client password Password
                      Router(config)# ip http client username User2
                      Router(config)# do show running-config | include ip http client

                      Command

                      Description

                      copy

                      Copies a file from any supported remote location to a local file system, or from a local file system to a remote location, or from a local file system to a local file system.

                      debug ip http client

                      Enables debugging output for the HTTP client.

                      ip http client cache

                      Configures the HTTP client cache.

                      ip http client connection

                      Configures the HTTP client connection.

                      ip http client proxy-server

                      Configures an HTTP proxy server.

                      ip http client response

                      Configures HTTP client characteristics for managing HTTP server responses to request messages.

                      ip http client source-interface

                      Configures a source interface for the HTTP client.

                      ip http client username

                      Configures a login name for all HTTP client connections.

                      show ip http client

                      Displays a report about the HTTP client.

                      To configure an HTTP proxy server, use the ip http client proxy-server command in global configuration mode. To disable or change the proxy server, use the no form of this command.

                      ip http client proxy-server proxy-name proxy-port port-number

                      no ip http client proxy-server proxy-name proxy-port port-number

                      proxy-port

                      Specifies a proxy port for HTTP file system client connections.

                      proxy-name

                      Name of the proxy server.

                      port-number

                      Integer in the range of 1 to 65535 that specifies a port number on the remote proxy server.

                      Command Default: No default behavior or values

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command configures the HTTP client to connect to a remote proxy server for HTTP file system client connections.

                      Example: The following example shows how to configure the HTTP proxy server named edge2 at port 29:

                      Device(config)# ip http client proxy-server edge2 proxy-port 29

                      Command

                      Description

                      copy

                      Copies a file from any supported remote location to a local file system, or from a local file system to a remote location, or from a local file system to a local file system.

                      debug ip http client

                      Enables debugging output for the HTTP client.

                      ip http client cache

                      Configures the HTTP client cache.

                      ip http client connection

                      Configures the HTTP client connection.

                      ip http client password

                      Configures a password for all HTTP client connections.

                      ip http client response

                      Configures HTTP client characteristics for managing HTTP server responses to request messages.

                      ip http client source-interface

                      Configures a source interface for the HTTP client.

                      ip http client username

                      Configures a login name for all HTTP client connections.

                      show ip http client

                      Displays a report about the HTTP client.

                      To configure the default username used for connections to remote HTTP servers, use the ip http client username command in global configuration mode. To remove a configured default HTTP username from the configuration, use the no form of this command.

                      ip http client username username

                      no ip http client username username

                      username

                      String that is the username (login name) to be used in HTTP client connection requests sent to remote HTTP servers.

                      Command Default: No default username exists for the HTTP connections.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command is used to configure a default username before a file is copied to or from a remote web server using the copy http:// or copy https:// command. The default username will be overridden by a username specified in the URL of the copy command.

                      Example: In the following example, the default HTTP password is configured as Secret and the default HTTP username is configured as User1 for connections to remote HTTP or HTTPS servers:

                      
                      Device(config)# ip http client password Secret
                      Device(config)# ip http client username User1

                      Command

                      Description

                      copy

                      Copies a file from any supported remote location to a local file system, or from a local file system to a remote location, or from a local file system to a local file system.

                      debug ip http client

                      Enables debugging output for the HTTP client.

                      ip http client cache

                      Configures the HTTP client cache.

                      ip http client connection

                      Configures the HTTP client connection.

                      ip http client password

                      Configures a password for all HTTP client connections.

                      ip http client response

                      Configures HTTP client characteristics for managing HTTP server responses to request messages.

                      ip http client source-interface

                      Configures a source interface for the HTTP client.

                      ip http client proxy-server

                      Configures an HTTP proxy server.

                      show ip http client

                      Displays a report about the HTTP client.

                      To configure IP name-server to enable DNS lookup and ping to ensure that server is reachable, use the ip name-server command in global configuration mode. To remove the addresses specified, use the no form of this command.

                      ip name-server server-address1 [ server-address2 … server-address6 ]

                      no ip name-server server-address1 [ server-address2 … server-address6 ]

                      server-address1

                      Specifies IPv4 or IPv6 addresses of a name server.

                      server-address2 … server-address6

                      (Optional) Specifies IP addresses of additional name servers (a maximum of six name servers).

                      Command Default: No name server addresses are specified.

                      Command Mode: Global configuration mode (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The Managed Gateway uses DNS to resolve Webex Calling proxy addresses. Configures other DNS servers:

                      • Cisco IOS resolver name servers

                      • DNS server forwarders

                      If the Cisco IOS name server is being configured to respond only to domain names for which it is authoritative, there is no need to configure other DNS servers.

                      Example: The following example shows how to configure IP name-server to enable DNS lookup:

                      Device(config)# ip name-server 8.8.8.8

                      Command

                      Description

                      ip domain-lookup

                      Enables the IP DNS-based hostname-to-address translation.

                      ip domain-name

                      Defines a default domain name to complete unqualified hostnames (names without a dotted decimal domain name).

                      To establish static routes, use the ip route command in global configuration mode. To remove static routes, use the no form of this command.

                      ip route [ vrf vrf-name ] prefix mask { ip-address interface-type interface-number [ ip-address ] } [ dhcp ] [ distance ] [ name next-hop-name ] [ permanent | track number ] [ tag tag ]

                      no ip route [ vrf vrf-name ] prefix mask { ip-address interface-type interface-number [ ip-address ] } [ dhcp ] [ distance ] [ name next-hop-name ] [ permanent | track number ] [ tag tag ]

                      vrf vrf-name

                      (Optional) Configures the name of the VRF by which static routes should be specified.

                      prefix

                      IP route prefix for the destination.

                      mask

                      Prefix mask for the destination.

                      ip-address

                      IP address of the next hop that can be used to reach that network.

                      interface-type interface-number

                      Network interface type and interface number.

                      dhcp

                      (Optional) Enables a Dynamic Host Configuration Protocol (DHCP) server to assign a static route to a default gateway (option 3).

                      Specify the dhcp keyword for each routing protocol.

                      distance (Optional) Administrative distance. The default administrative distance for a static route is 1.
                      name next-hop-name (Optional) Applies a name to the next hop route.
                      permanent (Optional) Specifies that the route will not be removed, even if the interface shuts down.
                      track number (Optional) Associates a track object with this route. Valid values for the number argument range from 1 to 500.
                      tag tag (Optional) Tag value that can be used as a “match” value for controlling redistribution via route maps.

                      Command Default: No static routes are established.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Adding a static route to an Ethernet or other broadcast interface (for example, ip route 0.0.0.0 0.0.0.0 Ethernet 1/2) will cause the route to be inserted into the routing table only when the interface is up. This configuration is not generally recommended. When the next hop of a static route points to an interface, the router considers each of the hosts within the range of the route to be directly connected through that interface, and therefore it will send Address Resolution Protocol (ARP) requests to any destination addresses that route through the static route.

                      A logical outgoing interface, for example, a tunnel, needs to be configured for a static route. If this outgoing interface is deleted from the configuration, the static route is removed from the configuration and hence does not show up in the routing table. To have the static route inserted into the routing table again, configure the outgoing interface once again and add the static route to this interface.

                      The practical implication of configuring the ip route 0.0.0.0 0.0.0.0 ethernet 1/2 command is that the router will consider all of the destinations that the router does not know how to reach through some other route as directly connected to Ethernet interface 1/2. So the router will send an ARP request for each host for which it receives packets on this network segment. This configuration can cause high processor utilization and a large ARP cache (along with memory allocation failures). Configuring a default route or other static route that directs the router to forward packets for a large range of destinations to a connected broadcast network segment can cause your router to reload.

                      Specifying a numerical next hop that is on a directly connected interface will prevent the router from using proxy ARP. However, if the interface with the next hop goes down and the numerical next hop can be reached through a recursive route, you may specify both the next hop and interface (for example, ip route 0.0.0.0 0.0.0.0 ethernet 1/2 10.1.2.3) with a static route to prevent routes from passing through an unintended interface.

                      Example: The following example shows how to choose an administrative distance of 110. In this case, packets for network 10.0.0.0 will be routed to a router at 172.31.3.4 if dynamic information with an administrative distance less than 110 is not available.

                      ip route 10.0.0.0 255.0.0.0 172.31.3.4 110

                      Specifying the next hop without specifying an interface when configuring a static route can cause traffic to pass through an unintended interface if the default interface goes down.

                      The following example shows how to route packets for network 172.31.0.0 to a router at 172.31.6.6:

                      ip route 172.31.0.0 255.255.0.0 172.31.6.6

                      The following example shows how to route packets for network 192.168.1.0 directly to the next hop at 10.1.2.3. If the interface goes down, this route is removed from the routing table and will not be restored unless the interface comes back up.

                      ip route 192.168.1.0 255.255.255.0 Ethernet 0 10.1.2.3

                      Command

                      Description

                      network (DHCP)

                      Configures the subnet number and mask for a DHCP address pool on a Cisco IOS DHCP server.

                      redistribute (IP)

                      Redistributes routes from one routing domain into another routing domain.

                      To enable IP processing on an interface without assigning an explicit IP address to the interface, use the ip unnumbered command in interface configuration mode or subinterface configuration mode. To disable the IP processing on the interface, use the no form of this command.

                      ip unnumbered type number [ poll ]

                      no ip unnumbered type number [ poll ]

                      poll

                      (Optional) Enables IP connected host polling.

                      type

                      Type of interface. For more information, use the question mark (? ) online help function.

                      number

                      Interface or subinterface number. For more information about the numbering syntax for your networking device, use the question mark (? ) online help function.

                      Command Default: Unnumbered interfaces are not supported.

                      Command Modes:

                      Interface configuration (config-if)

                      Subinterface configuration (config-subif)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: When an unnumbered interface generates a packet (for example, for a routing update), it uses the address of the specified interface as the source address of the IP packet. It also uses the address of the specified interface in determining which routing processes are sending updates over the unnumbered interface.

                      The following restrictions are applicable for this command:

                      • This command is not supported on Cisco 7600 Series Routers that are configured with a Supervisor Engine 32.

                      • Serial interfaces using High-Level Data Link Control (HDLC), PPP, Link Access Procedure Balanced (LAPB), Frame Relay encapsulations, and Serial Line Internet Protocol (SLIP), and tunnel interfaces can be unnumbered.

                      • This interface configuration command cannot be used with X.25 or Switched Multimegabit Data Service (SMDS) interfaces.

                      • You cannot use the ping EXEC command to determine whether the interface is up because the interface has no address. Simple Network Management Protocol (SNMP) can be used to remotely monitor interface status.

                      • It is not possible to netboot a Cisco IOS image over a serial interface that is assigned an IP address with the ip unnumbered command.

                      • You cannot support IP security options on an unnumbered interface.

                      The interface that you specify using the type and number arguments must be enabled (listed as “up” in the show interfaces command display).

                      If you are configuring Intermediate System-to-Intermediate System (IS-IS) across a serial line, you must configure the serial interfaces as unnumbered. This configuration allows you to comply with RFC 1195, which states that IP addresses are not required on each interface.

                      Example: The following example shows how to assign the address of Ethernet 0 to the first serial interface:

                      
                      Device(config)# interface ethernet 0
                      Device(config-if)# ip address 10.108.6.6 255.255.255.0
                      !
                      Device(config-if)# interface serial 0
                      Device(config-if)# ip unnumbered ethernet 0

                      The following example shows how to enable polling on a Gigabit Ethernet interface:

                      
                      Device(config)# interface loopback0
                      Device(config-if)# ip address 10.108.6.6 255.255.255.0
                      !
                      Device(config-if)# ip unnumbered gigabitethernet 3/1
                      Device(config-if)# ip unnumbered loopback0 poll

                      To configure IPv4 addresses and subnet mask to the trusted IP address list, use the ipv4 command in voice service configuration mode. To remove IPv4 addresses from the trusted list, use the no form of this command.

                      ipv4 ip-address subnet-mask

                      no ipv4 ip-address subnet-mask

                      ip-address

                      Specifies the IPv4 address assigned.

                      subnet-mask

                      Specifies the mask for the associated IPv4 subnet.

                      Command Default: No IPv4 address is defined.

                      Command Mode: voice service voip configuration (conf-voi-serv)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The ip-address and subnet-mask variables represent trusted address ranges. You don't have to enter the connected subnets directly as the Gateway trusts them automatically.

                      Example: The following example shows how to manully add the IPv4 addresses to the trusted IP address list in voice service configuration mode:

                      
                      voice service voip
                       ip address trusted list
                          ipv4 <ip_address> <subnet_mask>
                          ipv4 <ip_address> <subnet_mask>
                        allow-connections sip to sip
                        supplementary-service media-renegotiate
                        no supplementary-service sip refer
                        trace
                        sip
                         asymmetric payload full
                         registrar server

                      Commands K through R

                      To store a type 6 encryption key in private NVRAM, use the key config-key command in global configuration mode. To disable the encryption, use the no form of this command.

                      key config-key password-encrypt [ text ]

                      no key config-key password-encrypt [ text ]

                      text

                      (Optional) Password or master key.

                      It is recommended that you do not use the text argument but instead use interactive mode (using the enter key after you enter the key config-key password-encryption command) so that the preshared key will not be printed anywhere and, therefore, cannot be seen.

                      Command Default: No type 6 password encryption

                      Command Mode: Global configuration mode (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: You can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. Use the key config-key password-encryption command with the password encryption aes command to configure and enable the password (symmetric cipher Advanced Encryption Standard [AES] is used to encrypt the keys). The password (key) configured using the key config-key password-encryption command is the primary encryption key that is used to encrypt all other keys in the router.

                      If you configure the password encryption aes command without configuring the key config-key password-encryption command, the following message is printed at startup or during any nonvolatile generation (NVGEN) process, such as when the show running-config or copy running-config startup-config commands have been configured:

                      
                      “Can not encrypt password. Please configure a configuration-key with ‘key config-key’”

                      Example: The following example shows that a type 6 encryption key is to be stored in NVRAM:

                      Device(config)# key config-key password-encrypt Password123
                      Device(config)# password encryption aes

                      Command

                      Description

                      password encryption aes

                      Enables a type 6 encrypted preshared key.

                      password logging

                      Provides a log of debugging output for a type 6 password operation.

                      To boot a new software license on switching platforms, use the license boot level command in global configuration mode. To return to the previously configured license level, use the no form of this command.

                      license boot level license-level

                      no license boot level license-level

                      license-level

                      Level at which the switch is booted (for example, ipservices).

                      The license levels available in a universal/universalk9 image are:

                      • entservices

                      • ipbase

                      • lanbase

                      The license levels available in a universal-lite/universal-litek9 image are:

                      • ipbase

                      • lanbase

                      Command Default: The device boots the configured image.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the license boot level command for these purposes:

                      • Downgrade or upgrade licenses

                      • Enable or disable an evaluation or extension license

                      • Clear an upgrade license

                      This command forces the licensing infrastructure to boot the configured license level instead of the license hierarchy maintained by the licensing infrastructure for a given module.

                      • When the switch reloads, the licensing infrastructure checks the configuration in the startup configuration for any licenses. If there is a license in the configuration, the switch boots with that license. If there is no license, the licensing infrastructure follows the image hierarchy to check for licenses.

                      • If the forced boot evaluation license expires, the licensing infrastructure follows the regular hierarchy to check for licenses.

                      • If the configured boot license is already expired, the licensing infrastructure follows the hierarchy to check for licenses.

                      This command takes effect at the next reboot of any of the supervisors (Act or stby). This configuration must be saved to the startup configuration for it to be effective. After you configure the level, the next time the standby supervisor boots up, this configuration is applied to it.

                      To boot the standby supervisor to a different level than active, configure that level by using this command and then bring up the standby.

                      If the show license all command displays the license as "Active, Not in Use, EULA not accepted," you can use the license boot level command to enable the license and accept the end-user license agreement (EULA).

                      Example: The following example shows how to activate the ipbase license on the device upon the next reload:

                      license boot level ipbase

                      The following example configures licenses that apply only to a specific platform (Cisco ISR 4000 series):

                      license boot level uck9
                       license boot level securityk9

                      Command

                      Description

                      license install

                      Installs a stored license file.

                      license save

                      Saves a copy of a permanent license to a specified license file.

                      show license all

                      Shows information about all licenses in the system.

                      To set a specific SIP listen port in a tenant configuration, use the listen-port command in voice class tenant configuration mode. By default, tenant level listen port is not set and global level SIP listen port is used. To disable tenant level listen port, use the no form of this command.

                      listen-port { secure port-number | non-secure port-number }

                      no listen-port { secure port-number | non-secure port-number }

                      secure

                      Specifies the TLS port value.

                      non-secure

                      Specified the TCP or UDP port value.

                      port-number

                      • Secure port number range: 1–65535.

                      • Non-secure port number range: 5000–5500.

                      Port range is restricted to avoid conflicts with RTP media ports that also use UDP transport.

                      Command Default: The port number will not be set to any default value.

                      Command Mode: Voice Class Tenant configuration mode

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Before the introduction of this feature, it was only possible to configure the listen port for SIP signaling at the global level and this value could only be changed if the call processing service was shut down first. It is now possible to specify a listen port for both secure and non-secure traffic within a tenant configuration, allowing SIP trunks to be selected more flexibly. Tenant listen ports may be changed without shutting down the call processing service, provided that there are no active calls on the associated trunk. If the listen port configuration is removed, all active connections associated with the port are closed.

                      For reliable call processing, ensure that signaling and media interface binding is configured for all tenants that include a listen port and also that interface binding (for VRF and IP address) and listen port combinations are unique across all tenants and global configurations.

                      Example: The following is a configuration example for listen-port secure:

                      Device(config)#voice class tenant 1
                      VOICECLASS configuration commands:
                        aaa                  sip-ua AAA related configuration
                        authentication       Digest Authentication Configuration
                        credentials          User credentials for registration 
                        ...
                        ...
                        listen-port         Configure UDP/TCP/TLS SIP listen port (have bind
                                            configured under this tenant for the config to take
                                            effect)
                        ...
                      
                      Device(config-class)#listen-port ?
                        non-secure  Change UDP/TCP SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                        secure      Change TLS SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                      
                      Device(config-class)#listen-port secure ?
                        <0-65535>  Port-number
                      
                      Device(config-class)#listen-port secure 5062

                      The following is a configuration example for listen-port non-secure:

                      Device(config)#voice class tenant 1
                      VOICECLASS configuration commands:
                        aaa                  sip-ua AAA related configuration
                        authentication       Digest Authentication Configuration
                        credentials          User credentials for registration 
                        ...
                        ...
                        listen-port         Configure UDP/TCP/TLS SIP listen port (have bind
                                            configured under this tenant for the config to take
                                            effect)
                       ...
                      
                      Device(config-class)#listen-port ?
                        non-secure  Change UDP/TCP SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                        secure      Change TLS SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                      
                      Device(config-class)#listen-port non-secure ?
                        <5000-5500>  Port-number
                      
                      Device(config-class)#listen-port non-secure 5404

                      The following is a configuration example for nolisten-port:

                      Device(config-class)# no listen-port ?
                        non-secure  Change UDP/TCP SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                        secure      Change TLS SIP listen port (have bind configured under this
                                    tenant for the config to take effect)
                      
                      Device(config-class)#no listen-port secure ?
                        <0-65535>  Port-number
                      
                      Device(config-class)#no listen-port secure

                      Command

                      Description

                      call service stop

                      Shutdown SIP service on CUBE.

                      bind

                      Binds the source address for signaling and media packets to the IPv4 or IPv6 address of a specific interface.

                      To globally configure Cisco IOS voice gateways, Cisco Unified Border Elements (Cisco UBEs), or Cisco Unified Communications Manager Express (Cisco Unified CME) to substitute a Domain Name System (DNS) hostname or domain as the localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers in outgoing messages, use the localhost command in voice service SIP configuration mode or voice class tenant configuration mode. To remove a DNS localhost name and disable substitution for the physical IP address, use the no form of this command.

                      localhost dns: [ hostname ] domain [ preferred ]

                      no localhost dns: [ hostname ] domain [ preferred ]

                      dns: [hostname. ] domain

                      Alphanumeric value representing the DNS domain (consisting of the domain name with or without a specific hostname) in place of the physical IP address that is used in the host portion of the From, Call-ID, and Remote-Party-ID headers in outgoing messages.

                      This value can be the hostname and the domain separated by a period (dns: hostname.domain ) or just the domain name (dns: domain ). In both case, the dns: delimiter must be included as the first four characters.

                      preferred

                      (Optional) Designates the specified DNS hostname as preferred.

                      Command Default: The physical IP address of the outgoing dial peer is sent in the host portion of the From, Call-ID, and Remote-Party-ID headers in outgoing messages.

                      Command Modes:

                      Voice service SIP configuration (conf-serv-sip)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the localhost command in voice service SIP configuration mode to globally configure a DNS localhost name to be used in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages on Cisco IOS voice gateways, Cisco UBEs, or Cisco Unified CME. When multiple registrars are configured you can then use the localhost preferred command to specify which host is preferred.

                      To override the global configuration and specify DNS localhost name substitution settings for a specific dial peer, use the voice-class sip localhost command in dial peer voice configuration mode. To remove a globally configured DNS localhost name and use the physical IP address in the From, Call-ID, and Remote-Party-ID headers in outgoing messages, use the no localhost command.

                      Example: The following example shows how to globally configure a preferred DNS localhost name using only the domain for use in place of the physical IP address in outgoing messages:

                      localhost dns:cube1.lgwtrunking.com

                      To limit messages logged to the syslog servers based on severity, use the logging trap command in global configuration mode . To return the logging to remote hosts to the default level, use the no form of this command.

                      logging trap level

                      no logging trap level

                      severity-level

                      (Optional) The number or name of the desired severity level at which messages should be logged. Messages at or numerically lower than the specified level are logged. Severity levels are as follows (enter the number or the keyword):

                      • [0 | emergencies]—System is unusable

                      • [1 | alerts]—Immediate action needed

                      • [2 | critical]—Critical conditions

                      • [3 | errors]—Error conditions

                      • [4 | warnings]—Warning conditions

                      • [5 | notifications]—Normal but significant conditions

                      • [6 | informational]—Informational messages

                      • [7 | debugging]—Debugging messages

                      Command Default: Syslog messages at level 0 to level 6 are generated, but will only be sent to a remote host if the logging host command is configured.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: A trap is an unsolicited message sent to a remote network management host. Logging traps should not be confused with SNMP traps (SNMP logging traps require the use of the CISCO -SYSLOG-MIB, are enabled using the snmp-server enable traps syslog command, and are sent using the Simple Network Management Protocol.)

                      The show logging EXEC command displays the addresses and levels associated with the current logging setup. The status of logging to remote hosts appears in the command output as “trap logging”.

                      The table below lists the syslog definitions that correspond to the debugging message levels. Additionally, four categories of messages are generated by the software, as follows:

                      • Error messages about software or hardware malfunctions at the LOG_ERR level.

                      • Output for the debug commands at the LOG_WARNING level.

                      • Interface up/down transitions and system restarts at the LOG_NOTICE level.

                      • Reload requests and low process stacks at the LOG_INFO level.

                      Use the logging host and logging trap commands to send messages to a remote syslog server.

                      Level Arguments

                      Level

                      Description

                      Syslog Definition

                      emergencies 0System unusableLOG_EMERG
                      alerts 1Immediate action neededLOG_ALERT
                      critical 2Critical conditionsLOG_CRIT
                      errors 3Error conditionsLOG_ERR
                      warnings 4Warning conditionsLOG_WARNING
                      notifications 5Normal but significant conditionLOG_NOTICE
                      informational 6Informational messages onlyLOG_INFO
                      debugging 7Debugging messagesLOG_DEBUG

                      Example: In the following example, system messages of levels 0 (emergencies) through 5 (notifications) are sent to the host at 209.165.200.225:

                      
                      Device(config)# logging host 209.165.200.225
                      Device(config)# logging trap notifications
                      Device(config)# end 
                      
                      Device# show logging 
                      
                      Syslog logging: enabled (0 messages dropped, 1 messages rate-limited,
                                      0 flushes, 0 overruns, xml disabled, filtering disabled)
                          Console logging: level emergencies, 0 messages logged, xml disabled,
                                           filtering disabled
                          Monitor logging: level debugging, 0 messages logged, xml disabled,
                                           filtering disabled
                          Buffer logging: level debugging, 67 messages logged, xml disabled,
                                          filtering disabled
                          Logging Exception size (4096 bytes)
                          Count and timestamp logging messages: enabled
                          Trap logging: level notifications
                      , 71 message lines logged 
                      Log Buffer (4096 bytes):
                      00:00:20: %SYS-5-CONFIG_I: Configured from memory by console
                       .
                       .
                       .

                      Command

                      Description

                      logging host

                      Enables remote logging of system logging messages and specifies the syslog server host that messages should be sent to.

                      To configure an SMTP e-mail server address for Call Home, use the mail-server command in call home configuration mode. To remove one or all mail servers, use the no form of this command.

                      mail-server { ipv4-address | name } priority number

                      no mail-server { ipv4-address | name } priority number

                      ipv4-address

                      Specifies IPv4 address of the mail server.

                      name

                      Specifies fully qualified domain name (FQDN) of 64 characters or less.

                      priority number

                      Specifies number from 1 to 100, where a lower number defines a higher priority.

                      all

                      Removes all configured mail servers.

                      Command Default: No e-mail server is configured.

                      Command Mode: Call home configuration (cfg-call-home)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: To support the e-mail transport method in the Call Home feature, you must configure at least one Simple Mail Transfer Protocol (SMTP) mail server using the mail-server command. You can specify up to four backup e-mail servers, for a maximum of five total mail-server definitions.

                      Consider the following guidelines when configuring the mail server:

                      • Only IPv4 addressing is supported.

                      • Backup e-mail servers can be defined by repeating the mail-server command using different priority numbers.

                      • The mail-server priority number can be configured from 1 to 100. The server with the highest priority (lowest priority number) is tried first.

                      Example: The following examples shows how to configure the secure email server to be used to send proactive notification:

                      
                      configure terminal 
                       call-home  
                        mail-server <username>:<pwd>@<email server> priority 1 secure tls 
                       end 

                      The following example shows how to remove configuration of the configured mail servers:

                      Device(cfg-call-home)# no mail-server all

                      Command

                      Description

                      call-home (global configuration)

                      Enters call home configuration mode for configuration of Call Home settings.

                      show call-home

                      Displays Call Home configuration information.

                      To set the maximum number of SIP phone directory numbers (extensions) that are supported by a Cisco router, use the max-dn command in voice register global configuration mode. To reset to the default, use the no form of this command.

                      max-dn max-directory-numbers

                      no max-dn max-directory-numbers

                      max directory numbers

                      Maximum number of extensions (ephone-dns) supported by the Cisco router. The maximum number is version and platform dependent; type ? to display range.

                      Command Default: Default is zero.

                      Command Mode: Voice register global configuration (config-register-global)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command limits the number of SIP phone directory numbers (extensions) available in the Local Gateway. The max-dn command is platform specific. It defines the limit for the voice register dn command. The max-pool command similarly limits the number of SIP phones in a Cisco CME system.

                      You can increase the number of allowable extensions to the maximum; but after the maximum allowable number is configured, you cannot reduce the limit without rebooting the router. You cannot reduce the number of allowable extensions without removing the already-configured directory numbers with dn-tags that have a higher number than the maximum number to be configured.

                      This command can also be used for Cisco Unified SIP SRST.

                      Example: The following example shows how to set the maximum number of directory numbers to 48:

                      
                      Device(config)# voice register global
                      Device(config-register-global)# max-dn 48

                      Command

                      Description

                      voice register dn

                      Enters voice register dn configuration mode to define an extension for a SIP phone line.

                      max-pool (voice register global)

                      Sets the maximum number of SIP voice register pools that are supported in a Local Gateway environment.

                      To set the maximum number of Session Initiation Protocol (SIP) voice register pools that are supported in Cisco Unified SIP SRST, use the max-pool command in voice register global configuration mode (voice register global). To reset the maximum number to the default, use the no form of this command.

                      max-pool max-voice-register-pools

                      no max-pool max-voice-register-pools

                      max-voice-register-pools

                      Maximum number of SIP voice register pools supported by the Cisco router. The upper limit of voice register pools is platform-dependent; type ? for range.

                      Command Default: No default behaviour or values.

                      Command Mode: Voice register global configuration (config-register-global)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: This command limits the number of SIP phones that are supported by Cisco Unified SIP SRST. The max-pool command is platform-specific and defines the limit for the voice register pool command.

                      The max-dn command similarly limits the number of directory numbers (extensions) in Cisco Unified SIP SRST.

                      Example:

                      voice register global
                        max-dn   200
                        max-pool 100
                        system message "SRST mode"

                      Command

                      Description

                      voice register dn

                      Enters voice register dn configuration mode to define an extension for a SIP phone line.

                      max-dn (voice register global)

                      Sets the maximum number of SIP voice register pools that are supported in a Cisco SIP SRST or Cisco CME environment.

                      To enable media packets to pass directly between the endpoints, without the intervention of the Cisco Unified Border Element (Cisco UBE), and to enable the incoming and outgoing IP-to-IP call gain/loss feature for audio call scoring on either the incoming dial peer or the outgoing dial peer, enter the media command in dial peer, voice class, or voice service configuration mode. To return to the default IPIPGW behavior, use the no form of this command.

                      media [ { bulk-stats | flow-around | flow-through | forking | monitoring [video] [ max-calls ] | statistics | transcoder high-density | anti-trombone | sync-streams } ]

                      no media [ { bulk-stats | flow-around | flow-through | forking | monitoring [video] [ max-calls ] | statistics | transcoder high-density | anti-trombone | sync-streams } ]

                      bulk-stats

                      (Optional) Enables a periodic process to retrieve bulk call statistics.

                      flow-around

                      (Optional) Enables media packets to pass directly between the endpoints, without the intervention of the Cisco UBE. The media packet is to flow around the gateway.

                      flow-through

                      (Optional) Enables media packets to pass through the endpoints, without the intervention of the Cisco UBE.

                      forking

                      (Optional) Enables the media forking feature for all calls.

                      monitoring

                      Enables the monitoring feature for all calls or a maximum number of calls.

                      video

                      (Optional) Specifies video quality monitoring.

                      max-calls

                      The maximum number of calls that are monitored.

                      statistics

                      (Optional) Enables media monitoring.

                      transcoder high-density

                      (Optional) Converts media codecs from one voice standard to another to facilitate the interoperability of devices using different media standards.

                      anti-trombone

                      (Optional) Enables media anti-trombone for all calls. Media trombones are media loops in SIP entity due to call transfer or call forward.

                      sync-streams

                      (Optional) Specifies that both audio and video streams go through the DSP farms on Cisco UBE and Cisco Unified CME.

                      Command Default: The default behavior of the Cisco UBE is to receive media packets from the inbound call leg, terminate them, and then reoriginate the media stream on an outbound call leg.

                      Command Modes:

                      Dial peer configuration (config-dial-peer)

                      Voice class configuration (config-class)

                      Voice service configuration (config-voi-serv)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: With the default configuration, the Cisco UBE receives media packets from the inbound call leg, terminates them, and then reoriginates the media stream on an outbound call leg. Media flow-around enables media packets to be passed directly between the endpoints, without the intervention of the Cisco UBE. The Cisco UBE continues to handle routing and billing functions. Media flow-around for SIP-to-SIP calls is not supported.

                      The media bulk-stats and media statistics are only supported.

                      You can specify media flow-around for a voice class, all VoIP calls, or individual dial peers.

                      The transcoderhigh-density keyword can be enabled in any of the configuration modes with the same command format. If you are configuring the transcoder high-density keyword for dial peers, make sure that the mediatranscoder high-density command is configured on both the in and out legs.

                      The software does not support configuring the transcoderhigh-density keyword on any dial peer that is to handle video calls. The following scenarios are not supported:

                      • Dial peers used for video at any time. Configuring the media transcoder high-density command directly under the dial-peer or a voice-class media configuration is not supported.

                      • Dial peers configured on a Cisco UBE used for video calls at any time. The global configuration of the media transcoder high-density command under voice service voip is not supported.

                      The media bulk-stats command may impact performance when there are a large number of active calls. For networks where performance is crucial in customer's applications, it is recommended that the media bulk-stats command not be configured.

                      To enable the media command on a Cisco 2900 or Cisco 3900 series Unified Border Element voice gateway, you must first enter the modeborder-element command. This enables the mediaforking and mediamonitoring commands. Do not configure the modeborder-element command on the Cisco 2800 or Cisco 3800 series platforms.

                      You can specify media anti-trombone for a voice class, all VoIP calls, or individual dial peers.

                      The anti-trombone keyword can be enabled only when no media interworking is required in both the out-legs. The anti-trombone will not work if call leg is flow-through and another call leg is flow-around.

                      Example: The following example shows media bulk-stats being configured for all VoIP calls:

                      Device(config)# voice service voip
                      Device(config-voi-serv)# allow-connections sip to sip
                      Device(config-voi-serv)# media statistics

                      The following example shows media flow-around configured on a dial peer:

                      
                      Router(config)# dial-peer voice 2 voip 
                      Router(config-dial-peer) media flow-around

                      The following example shows media flow-around configured for all VoIP calls:

                      
                      Router(config)# voice service voip 
                      Router(config-voi-serv) media flow-around

                      The following example shows media flow-around configured for voice class calls:

                      
                      Router(config)# voice class media 1
                      Router(config-class) media flow-around 

                      Media Flow-though Examples

                      The following example shows media flow-around configured on a dial peer:

                      
                      Router(config)# dial-peer voice 2 voip 
                      Router(config-dial-peer) media flow-through 

                      The following example shows media flow-around configured for all VoIP calls:

                      
                      Router(config)# voice service voip 
                      Router(config-voi-serv) media flow-through 

                      The following example shows media flow-around configured for voice class calls:

                      
                      Router(config)# voice class media 2
                      Router(config-class) media flow-through

                      Media Statistics Examples

                      The following example shows media monitoring configured for all VoIP calls:

                      
                      Router(config)# voice service voip
                       
                      Router(config-voi-serv)# media statistics

                      The following example shows media monitoring configured for voice class calls:

                      
                      Router(config)# voice class media 1
                      Router(config-class)# mediastatistics

                      Media Transcoder High-density Examples

                      The following example shows the mediatranscoder keyword configured for all VoIP calls:

                      
                      Router(config)# voice service voip
                       
                      Router(conf-voi-serv)# media transcoder high-density

                      The following example shows the mediatranscoder keyword configured for voice class calls:

                      
                      Router(config)# voice class media 1
                      Router(config-voice-class)# media transcoder high-density

                      The following example shows the mediatranscoder keyword configured on a dial peer:

                      
                      Router(config)# dial-peer voice 36 voip 
                      Router(config-dial-peer)# media transcoder high-density

                      Media Monitoring on a Cisco UBE Platform

                      The following example shows how to configure audio call scoring for a maximum of 100 calls:

                      
                      mode border-element
                      media monitoring 100

                      The following example shows the media anti-trombone command configured for all VoIP calls:

                      Device(config)# voice service voip
                      Device(conf-voi-serv)# media anti-trombone

                      The following example shows the media anti-trombone command configured for voice class calls:

                      Device(config)# voice service media 1
                      Device(conf-voice-class)# media anti-trombone

                      The following example shows the media anti-trombone command configured for a dial peer:

                      Device(config)# dial-peer voice 36 voip 
                      Device(config-dial-peer)# media anti-trombone

                      The following example specifies that both audio and video RTP streams go through the DSP farms when either audio or video transcoding is needed:

                      Device(config)# voice service voip 
                      Device(config-voi-serv)# media transcoder sync-streams

                      The following example specifies that both audio and video RTP streams go through the DSP farms when either audio or video transcoding is needed and the RTP streams flow around Cisco Unified Border Element.

                      Device(config)# voice service voip 
                      Device(config-voi-serv)# media transcoder high-density sync-streams

                      Command

                      Description

                      dial-peer voice

                      Enters dial peer configuration mode.

                      mode border-element

                      Enables the media monitoring capability of the media command.

                      voice class

                      Enters voice class configuration mode.

                      voice service

                      Enters voice service configuration mode.

                      To change the memory allocated by the application, use the memory command in custom application resource profile configuration mode. To revert to the application-provided memory size, use the no form of this command.

                      memory memory

                      memorymemorynomemorymemory
                      memory

                      Memory allocation in MB. Valid values are from 0 to 4096.

                      Command Default: The default memory size depends on the platform.

                      Command Mode: Custom application resource profile configuration (config-app-resource-profile-custom)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Within each application package, an application-specific resource profile is provided that defines the recommended CPU load, memory size, and number of virtual CPUs (vCPUs) required for the application. Use this command to change the allocation of resources for specific processes in the custom resource profile.

                      Reserved resources specified in the application package can be changed by setting a custom resource profile. Only the CPU, memory, and vCPU resources can be changed. For the resource changes to take effect, stop and deactivate the application, then activate it and start it again.

                      Example: The following example shows how to override the application-provided memory using a custom resource profile:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-resource profile custom
                      Device(config-app-resource-profile-custom)# memory 2048
                      Device(config-app-resource-profile-custom)#

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      app-resource profile

                      Overrides the application-provided resource profile.

                      To enable Webex Calling survivability mode for Cisco Webex Calling endpoints, use the mode webex-sgw command. To disable the webex-sgw, use the no form of this command.

                      mode webex-sgw

                      no mode webex-sgw

                      This command has no arguments or keywords.

                      Command Default: By default, webex-sgw mode is disabled.

                      Command Mode: Voice Register Global

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: If any other mode is configured, ensure to enable no mode of it before configuring mode webex-sgw.

                      Example: The following example shows that webex-sgw mode is enabled:

                      Device(config)# voice register global
                      Device(config-register-global)# mode webex-sgw

                      Command

                      Description

                      show voice register global

                      Displays all global configuration information that is associated with SIP phones.

                      To enable music on hold (MOH), use the moh command in call-manager-fallback configuration mode. To disable music on hold, use the no form of this command.

                      moh filename

                      no moh filename

                      filename

                      Filename of the music file. The music file must be in the system flash.

                      Command Default: MOH is enabled.

                      Command Mode: Call-manager-fallback configuration

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The moh command allows you to specify the .au and .wav format music files that are played to callers who have been put on hold. MOH works only for G.711 calls and on-net VoIP and PSTN calls. For all other calls, callers hear a periodic tone. For example, internal calls between Cisco IP phones do not get MOH; instead callers hear a tone.

                      Music-on-hold files can be .wav or .au file format; however, the file format must contain 8-bit 8-kHz data; for example, CCITT a-law or u-law data format.

                      MOH can be used as a fallback MOH source when using MOH live feed. See the moh-live (call-manager-fallback) command for more information.

                      Example: The following example enables MOH and specifies the music files:

                      
                      Router(config)# call-manager-fallback 
                      Router(config-cm-fallback)# moh minuet.wav
                      Router(config-cm-fallback)# moh minuet.au

                      Command

                      Description

                      call-manager-fallback

                      Enables Cisco Unified SRST support and enters call-manager-fallback configuration mode.

                      moh-live (call-manager-fallback)

                      Specifies that a particular telephone number is to be used for an outgoing call that is to be the source for an MOH stream for SRST.

                      To enable an interface to support the Maintenance Operation Protocol (MOP), use the mop enabled command in interface configuration mode. To disable MOP on an interface, use the no form of this command.

                      mop enabled

                      no mop enabled

                      This command has no arguments or keywords.

                      Command Default: Enabled on Ethernet interfaces and disabled on all other interfaces.

                      Command Mode: Interface configuration (config-if)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the mop enabled command to enable an interface to support the MOP.

                      Example: The following example enables MOP for serial interface 0:

                      
                      Device(config)# interface serial 0
                      Device(config-if)# mop enabled

                      To enable an interface to send out periodic Maintenance Operation Protocol (MOP) system identification messages, use the mop sysid command in interface configuration mode. To disable MOP message support on an interface, use the no form of this command.

                      mop sysid

                      no mop sysid

                      This command has no arguments or keywords.

                      Command Default: Enabled

                      Command Mode: Interface configuration (config-if)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: You can still run MOP without having the background system ID messages sent. This command lets you use the MOP remote console, but does not generate messages used by the configurator.

                      Example: The following example enables serial interface 0 to send MOP system identification messages:

                      
                      Device(config)# interface serial 0
                      Device(config-if)# mop sysid

                      Command

                      Description

                      mop device-code

                      Identifies the type of device sending MOP sysid messages and request program messages.

                      mop enabled

                      Enables an interface to support the MOP.

                      To configure a name for the redundancy group, use the name command in application redundancy group configuration mode. To remove the name of a redundancy group, use the no form of this command.

                      name redundancy-group-name

                      no name redundancy-group-name

                      redundancy-group-name

                      Specifies redundancy group name.

                      Command Default: The redundancy group is not configured with a name.

                      Command Mode: Redundancy application group configuration mode (config-red-app-grp)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the name command to configure alias of the redundancy group.

                      Example: The following examples shows how to configure the name of the RG group:

                      
                      Device(config)#redundancy
                      Device(config-red)#application redundancy
                      Device(config-red-app)#group 1
                      Device(config-red-app-grp)#name LocalGateway-HA

                      Command

                      Description

                      application redundancy

                      Enters redundancy application configuration mode.

                      group (firewall)

                      Enters redundancy application group configuration mode.

                      shutdown

                      Shuts down a group manually.

                      To configure a Domain Name System (DNS) server, use the name-server command in application hosting configuration mode. To remove the DNS server configuration, use the no form of this command.

                      name-server number [ ip-address ]

                      no name-server number [ ip-address ]

                      number

                      Identifies the DNS server.

                      ip-address

                      IP address the of the DNS server.

                      Command Default: DNS server is not configured.

                      Command Mode: Application hosting configuration (config-app-hosting)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: While configuring a static IP address in a Linux container for application hosting, only the last configured name server configuration is used.

                      Example: The following example shows how to configure a DNS server for a virtual network interface gateway:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid iox_app
                      Device(config-app-hosting)# app-vnic gateway1 VirtualPortGroup 0 guest-interface 1
                      Device(config-app-hosting-gateway1)# guest-ipaddress 10.0.0.3 netmask 255.255.255.0
                      Device(config-app-hosting-gateway1)# exit
                      Device(config-app-hosting)# name-server0 10.2.2.2
                      Device(config-app-hosting)# end

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      app-hosting gateway

                      Configures a virtual network interface gateway.

                      guest-ipaddress

                      Configures an IP address for the guest interface.

                      To enable the NETCONF interface on your network device, use the netconfig-yang command in the global configuration mode. To disable the NETCONF interface, use the no form of this command.

                      netconfig-yang

                      no netconfig-yang

                      This command has no arguments or keywords.

                      Command Default: NETCONF interface is not enabled.

                      Command Mode: Global configuration (config)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: After the initial enablement through the CLI, network devices can be managed subsequently through a model based interface. The complete activation of model-based interface processes may require up to 90 seconds.

                      Example: The following example shows how to enable the NETCONF interface on the network device:

                      Device (config)# netconf-yang

                      The following example shows how to enable SNMP trap after NETCONF-YANG starts:

                      Device (config)# netconf-yang cisco-ia snmp-trap-control trap-list 1.3.6.1.4.1.9.9.41.2.0.1

                      To configure network time protocol (NTP) servers for time synchronization, use the ntp-server command in global configuration mode. To disable this capability, use the no form of this command.

                      ntp server ip-address

                      no ntp server ip-address

                      ip-address

                      Specifies the primary or secondary IPv4 addresses of the NTP server.

                      Command Default: No servers are configured by default.

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: The NTP service can be activated by entering any ntp command. When you use the ntp server command, the NTP service is activated (if it has not already been activated) and software clock synchronization is configured simultaneously.

                      When you enter the no ntp server command, only the server synchronization capability is removed from the NTP service. The NTP service itself remains active, along with any other previously configured NTP functions.

                      Example: The following example shows how to configure primary and secondary IP addresses of the NTP servers required for time synchronization:

                      
                      ntp server <ip_address_of_primary_NTP_server>
                      ntp server <ip_address_of_secondary_NTP_server>

                      To configure a Session Initiation Protocol (SIP) outbound proxy for outgoing SIP messages globally on a Cisco IOS voice gateway, use the outbound-proxy command in voice service SIP configuration mode or voice class tenant configuration mode. To globally disable forwarding of SIP messages to a SIP outbound proxy globally, use the no form of this command.

                      voice-class sip outbound-proxy { dhcp | ipv4: ipv4-address | ipv6: ipv6-address | dns: host: domain } [ :port-number ]

                      no voice-class sip outbound-proxy { dhcp | ipv4: ipv4-address | ipv6: ipv6-address | dns: host: domain } [ :port-number ]

                      dhcp

                      Specifies that the outbound-proxy IP address is retrieved from a DHCP server.

                      ipv4: ipv4-address

                      Configures proxy on the server, sending all initiating requests to the specified IPv4 address destination. The colon is required.

                      ipv6:[ ipv6- address ]

                      Configures proxy on the server, sending all initiating requests to the specified IPv6 address destination. Brackets must be entered around the IPv6 address. The colon is required.

                      dns: host:domain

                      Configures proxy on the server, sending all initiating requests to the specified domain destination. The colons are required.

                      : port-number

                      (Optional) Port number for the Session Initiation Protocol (SIP) server. The colon is required.

                      Command Default: An outbound proxy is not configured.

                      Command Mode: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The voice-class sip outbound-proxy command, in dial peer configuration mode, takes precedence over the command in SIP global configuration mode.

                      Brackets must be entered around the IPv6 address.

                      Example: The following example shows how to configure the voice-class sip outbound-proxy command on a dial peer to generate an IPv4 address (10.1.1.1) as an outbound proxy:

                      
                      Router> enable
                      Router# configure
                       terminal
                      Router(config)# dial
                      -peer
                       voice
                       111
                       voip
                      Router(config-dial-peer)# voice-class sip outbound-proxy ipv4:10.1.1.1
                      

                      The following example shows how to configure the voice-class sip outbound-proxy command on a dial peer to generate a domain (sipproxy:cisco.com) as an outbound proxy:

                      
                      Router> enable
                      Router# configure
                       terminal
                      Router(config)# dial
                      -peer
                       voice
                       111
                       voip
                      Router(config-dial-peer)# voice-class sip outbound-proxy dns:sipproxy:cisco.com
                      

                      The following example shows how to configure the voice-class sip outbound-proxy command on a dial peer to generate an outbound proxy using DHCP:

                      
                      Router> enable
                      Router# configure
                       terminal
                      Router(config)# dial
                      -peer
                       voice
                       111
                       voip
                      Router(config-dial-peer)# voice-class sip outbound-proxy dhcp
                      

                      Command

                      Description

                      dial -peervoice

                      Defines a particular dial peer, specifies the method of voice encapsulation, and enters dial peer configuration mode.

                      voice service

                      Enters voice-service configuration mode and specifies a voice encapsulation type.

                      To enable the pass-through of Session Description Protocol (SDP) from in-leg to the out-leg, use the pass-thru content command either in global VoIP SIP configuration mode or dial-peer configuration mode. To remove a SDP header from a configured pass-through list, use the no form of the command.

                      pass-thru content [ custom-sdp | sdp{ mode | system } |unsupp ]

                      no pass-thru content [ custom-sdp | sdp{ mode | system } |unsupp ]

                      custom-sdp

                      Enables the pass-through of custom SDP using SIP Profiles.

                      sdp

                      Enables the pass-through of SDP content.

                      mode

                      Enables the pass-through SDP mode.

                      system

                      Specifies that the pass-through configuration use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      unsupp

                      Enables the pass-through of all unsupported content in a SIP message or request.

                      Command Default: Disabled

                      Command Modes:

                      SIP configuration (conf-serv-sip)

                      Dial peer configuration (config-dial-peer)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Example: The following example shows how to configure pass-through of custom SDP using SIP Profiles peer rules in global VoIP SIP configuration mode:

                      
                      Router(conf-serv-sip)# pass-thru content custom-sdp
                      
                      

                      The following example shows how to configure pass-through of custom SDP using SIP Profiles in dial-peer configuration mode:

                      
                      Router(config-dial-peer)# voice-class sip pass-thru content custom-sdp
                      
                      

                      The following example shows how to configure pass-through of SDP in global VoIP SIP configuration mode:

                      
                      Router(conf-serv-sip)# pass-thru content sdp
                      
                      

                      The following example shows how to configure pass-through of SDP in voice class tenant configuration mode:

                      
                      Router(config-class)# pass-thru content sdp system
                      
                      

                      The following example shows how to configure pass-through of unsupported content types in dial-peer configuration mode:

                      
                      Router(config-dial-peer)# voice-class sip pass-thru content unsupp
                      
                      

                      To configure a pimary key for type-6 encryption and enable the Advanced Encryption Standard (AES) password encryption feature, use the password encryption aes command in global configuration mode. To disable the password, use the no form of this command.

                      password encryption aes

                      no password encryption aes

                      This command has no arguments or keywords.

                      Command Default: By default, AES password encryption feature is disabled. Preshared keys are not encrypted.

                      Command Mode: Global configuration mode (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: You can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. Use the key config-key password-encryption command with the password encryption aes command to configure and enable the password (symmetric cipher Advanced Encryption Standard [AES] is used to encrypt the keys). The password (key) configured using the no key config-key password-encryption command is the master encryption key that is used to encrypt all other keys in the router.

                      If you configure the password encryption aes command without configuring the key config-key password-encryption command, the following message is printed at startup or during any nonvolatile generation (NVGEN) process, such as when the show running-config or copy running-config startup-config commands have been configured:

                      “Can not encrypt password. Please configure a configuration-key with ‘key config-key’”

                      Changing a Password

                      If the password (master key) is changed, or reencrypted, using the key config-key password-encryption command), the list registry passes the old key and the new key to the application modules that are using type 6 encryption.

                      Deleting a Password

                      If the master key that was configured using the key config-key password-encryption command is deleted from the system, a warning is printed (and a confirm prompt is issued) that states that all type 6 passwords will become useless. As a security measure, after the passwords have been encrypted, they will never be decrypted in the Cisco IOS software. However, passwords can be reencrypted as explained in the previous paragraph.

                      If the password configured using the key config-key password-encryption command is lost, it cannot be recovered. The password should be stored in a safe location.

                      Unconfiguring Password Encryption

                      If you later unconfigure password encryption using the no password encryption aes command, all existing type 6 passwords are left unchanged, and as long as the password (master key) that was configured using the key config-key password-encryption command exists, the type 6 passwords will be decrypted as and when required by the application.

                      Storing Passwords

                      Because no one can “read” the password (configured using the key config-key password-encryption command), there is no way that the password can be retrieved from the router. Existing management stations cannot “know” what it is unless the stations are enhanced to include this key somewhere, in which case the password needs to be stored securely within the management system. If configurations are stored using TFTP, the configurations are not standalone, meaning that they cannot be loaded onto a router. Before or after the configurations are loaded onto a router, the password must be manually added (using the key config-key password-encryption command). The password can be manually added to the stored configuration but is not recommended because adding the password manually allows anyone to decrypt all passwords in that configuration.

                      Configuring New or Unknown Passwords

                      If you enter or cut and paste cipher text that does not match the master key, or if there is no master key, the cipher text is accepted or saved, but an alert message is printed. The alert message is as follows:

                      “ciphertext>[for username bar>] is incompatible with the configured master key.”
                      

                      If a new master key is configured, all the plain keys are encrypted and made type 6 keys. The existing type 6 keys are not encrypted. The existing type 6 keys are left as is.

                      If the old master key is lost or unknown, you have the option of deleting the master key using the no key config-key password-encryption command. Deleting the master key using the no key config-key password-encryptioncommand causes the existing encrypted passwords to remain encrypted in the router configuration. The passwords will not be decrypted.

                      Example: The following example shows how to encrypt the Type 6 passwords using AES cipher and user-defined primary key:

                      conf t
                      key config-key password-encrypt Password123
                      password encryption aes

                      The following example shows that a type 6 encrypted preshared key has been enabled:

                      Device (config)# password encryption aes

                      Command

                      Description

                      key config-key password-encryption

                      Stores a type 6 encryption key in private NVRAM.

                      password logging

                      Provides a log of debugging output for a type 6 password operation.

                      To match a call based on the entire Session Initiation Protocol (SIP) or telephone (TEL) uniform resource identifier (URI), use the pattern command in voice URI class configuration mode. To remove the match, use the no form of this command.

                      pattern uri-pattern

                      no pattern uri-pattern

                      uri-pattern

                      Cisco IOS regular expression (regex) pattern that matches the entire URI. Can be up to 128 characters.

                      Command Default: No default behavior or values

                      Command Mode: Voice URI class configuration

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The Local Gateway doesn't currently support underscore "_" in the match pattern. As a workaround, you can use dot "." (match any) to match the "_".

                      This command matches a regular expression pattern to the entire URI.

                      When you use this command in a URI voice class, you cannot use any other pattern-matching command such as the host, phone context, phone number, or user-id commands.

                      Example: The following example shows how to define a pattern to uniquely identify a Local Gateway site within an enterprise based on Control Hub's trunk group OTG/DTG parameter:

                      voice class uri 200 sip
                      pattern dtg=hussain2572.lgu

                      The following example shows how to define Unified CM signaling VIA port for the Webex Calling trunk:

                      voice class uri 300 sip
                      pattern :5065

                      The following example shows how to define Unified CM source signaling IP and VIA port for PSTN trunk:

                      voice class uri 302 sip
                      pattern 192.168.80.60:5060

                      Command

                      Description

                      destination uri

                      Specifies the voice class to use for matching the destination URI that is supplied by a voice application.

                      host

                      Matches a call based on the host field in a SIP URI.

                      incoming uri

                      Specifies the voice class used to match a VoIP dial peer to the URI of an incoming call.

                      phone context

                      Filters out URIs that do not contain a phone-context field that matches the configured pattern.

                      phone number

                      Matches a call based on the phone number field in a TEL URI.

                      show dialplan incall uri

                      Displays which dial peer is matched for a specific URI in an incoming voice call.

                      show dialplan uri

                      Displays which outbound dial peer is matched for a specific destination URI.

                      user id

                      Matches a call based on the user-id field in the SIP URI.

                      voice class uri

                      Creates or modifies a voice class for matching dial peers to calls containing a SIP or TEL URI.

                      To reserve persistent disk space for an application, use the persist-disk command in configuration mode. To remove the reserved space, use the no form of this command.

                      persist-disk unit

                      no persist-disk unit

                      unit

                      Persistent disk reservation in MB. Valid values are from 0 to 65535.

                      Command Default: If the command is not configured, the storage size is determined based on the application requirement.

                      Command Mode: Custom application resource profile configuration (config-app-resource-profile-custom)

                      ReleaseModification

                      Local Gateway

                      Cisco IOS XE Amsterdam 17.3.4a

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: If the persist-disk command is not configured then the storage size is determined based on the application requirement.

                      Example: The following example shows how to reserve:

                      
                      Device# configure terminal
                      Device(config)# app-hosting appid lxc_app
                      Device(config-app-hosting)# app-resource profile custom
                      Device(config-app-resource-profile-custom)# persist-disk 1

                      Command

                      Description

                      app-hosting appid

                      Configures an application and enters application hosting configuration mode.

                      app-resource profile

                      Overrides the application-provided resource profile.

                      To indicate the preferred order of an outbound dial peer within a hunt group, use the preference command in dial-peer configuration mode. To remove the preference, use the no form of this command.

                      preference value

                      no preference value

                      value

                      An integer from 0 to 10. A lower number indicates a higher preference. The default is 0, which is the highest preference.

                      Command Default: The longest matching dial peer supersedes the preference value.

                      Command Mode: Dial-peer configuration (dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the preference command to indicate the preferred order for matching dial peers in a hunt group. Setting a preference enables the desired dial peer to be selected when multiple dial peers within a hunt group are matched for a dial string.

                      The hunting algorithm preference is configurable. For example, to specify that a call processing sequence go to destination A, then to destination B, and finally to destination C, you would assign preferences (0 being the highest preference) to the destinations in the following order:

                      • Preference 0 to A

                      • Preference 1 to B

                      • Preference 2 to C

                      Use the preference command only on the same pattern type. For example, destination uri and destination-pattern are two different pattern types. By default, destination uri has higher preference than destination-pattern.

                      Example: The following example shows how to configure outbound Webex Calling dial-peer that includes dial-peer selection for outbound Webex Calling trunk based on dial-peer group:

                      
                      dial-peer voice 200201 voip
                       description Outbound Webex Calling
                       destination e164-pattern-map 100
                       preference 2
                      exit

                      To configure the initial priority and failover threshold for a redundancy group, use the priority command in application redundancy group configuration mode. To remove the capability, use the no form of this command.

                      priority priority-value failover threshold threshold-value

                      no priority priority-value failover threshold threshold-value

                      priority-value

                      Specifies the priority value.

                      threshold-value

                      Specifies the threshold value.

                      Command Default: No default behavior or values.

                      Command Mode: Application redundancy group configuration mode (config-red-app-grp)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Both active and standby routers should have the same priority and threshold values.

                      Example: The following example shows how to configure an RG for use with VoIP HA under the application redundancy sub-mode:

                      Device(config)#redundancy
                      Device(config-red)#application redundancy
                      Device(config-red-app)#group 1
                      Device(config-red-app-grp)#name LocalGateway-HA
                      Device(config-red-app-grp)#priority 100 failover threshold 75

                      To configure the privacy header policy options at the global level, use the privacy-policy command in voice service VoIP SIP configuration mode or voice class tenant configuration mode. To disable privacy header policy options, use the no form of this command.

                      privacy-policy { passthru | send-always | strip { diversion | history-info } [ system ] }

                      no privacy-policy { passthru | send-always | strip { diversion | history-info } [ system ] }

                      passthru

                      Passes the privacy values from the received message to the next call leg.

                      send-always

                      Passes a privacy header with a value of None to the next call leg, if the received message does not contain privacy values but a privacy header is required.

                      strip

                      Strips the diversion or history-info headers received from the next call leg.

                      diversion

                      Strips the diversion headers received from the next call leg.

                      history-info

                      Strips the history-info headers received from the next call leg.

                      system

                      Specifies that the privacy header policy options use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: No privacy-policy settings are configured.

                      Command Mode: Voice service VoIP SIP configuration (conf-serv-sip)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: If a received message contains privacy values, use the privacy-policy passthru command to ensure that the privacy values are passed from one call leg to the next. If the received message does not contain privacy values but the privacy header is required, use the privacy-policy send-always command to set the privacy header to None and forward the message to the next call leg. If you want to strip the diversion and history-info from the headers received from the next call leg, use the privacy-policy strip command. You can configure the system to support all the options at the same time.

                      Example: The following example shows how to enable the pass-through privacy policy:

                      
                      Router> enable
                       
                      Router# configure
                       terminal
                      Router(config)# voice
                       service
                       voip
                       
                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# privacy-policy passthru
                      

                      The following example shows how to enable the send-always privacy policy:

                      Router(config-class)# privacy-policy send-always system

                      The following example shows how to enable the strip privacy policy:

                      
                      Router> enable
                       
                      Router# configure
                       terminal
                      Router(config)# voice
                       service
                       voip
                       
                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# privacy-policy strip diversion
                      Router(conf-serv-sip)# privacy-policy strip history-info
                      

                      The following example shows how to enable the pass-through, send-always privacy, and strip policies:

                      
                      Router> enable
                       
                      Router# configure
                       terminal
                      Router(config)# voice
                       service
                       voip
                       
                      

                      The following example shows how to enable the send-always privacy policy in the voice class tenant configuration mode:

                      Router(conf-voi-serv)# sip
                      Router(conf-serv-sip)# privacy-policy passthru
                      Router(conf-serv-sip)# privacy-policy send-always
                      Router(conf-serv-sip)# privacy-policy strip diversion
                      Router(conf-serv-sip)# privacy-policy strip history-info

                      Command

                      Description

                      asserted-id

                      Sets the privacy level and enables either PAID or PPID privacy headers in outgoing SIP requests or response messages.

                      voice-class sip privacy-policy

                      Configures the privacy header policy options at the dial-peer configuration level.

                      To configure the control interface protocol and to enter the redundancy application protocol configuration mode, use the protocol command in application redundancy configuration mode. To remove the protocol instance from the redundancy group, use the no form of this command.

                      protocol number

                      no protocol number

                      number

                      Specifies the protocol instance that will be attached to a control interface.

                      Command Default: Protocol instance is not defined in a redundancy group.

                      Command Mode: Application redundancy configuration mode (config-red-app)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The configuration for the control interface protocol consists of the following elements:

                      • Authentication information

                      • Group name

                      • Hello time

                      • Hold time

                      • Protocol instance

                      • Use of the bidirectional forwarding direction (BFD) protocol

                      Example: The following example shows how to configure protocol instance and enter the redundancy application protocol configuration mode:

                      Device(config-red-app)# protocol 1
                      Device(config-red-app-prtcl)# timers hellotime 3 holdtime 10
                      Device(config-red-app-prtcl)# exit
                      Device(config-red-app)#

                      To enter redundancy configuration mode, use the redundancy command in global configuration mode.

                      redundancy

                      This command has no arguments or keywords.

                      Command Default: None

                      Command Mode: Global configuration (config)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the exit command to exit redundancy configuration mode.

                      Example: The following example shows how to enter redundancy configuration mode:

                      
                      Device(config)#redundancy
                      Device(config-red)#application redundancy

                      Command

                      Description

                      show redundancy

                      Displays redundancy facility information.

                      To enable redundancy for the application and to control the redundancy process, use the redundancy-group command in voice service voip configuration mode. To disable redundancy process, use the no form of this command.

                      redundancy-group group-number

                      no redundancy-group group-number

                      group-number

                      Specifies the redundancy group number.

                      Command Default: No default behavior or values.

                      Command Mode: voice service voip configuration mode (config-voi-serv)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Adding and removing redundancy-group command requires a reload for the updated configuration to take effect. Reload the platforms after all the configuration has been applied.

                      Example: The following example shows how to configure redundancy group to enable the CUBE application:

                      
                      Device(config)#voice service voip
                      Device(config-voi-serv)#redundancy-group 1
                      % Created RG 1 association with Voice B2B HA; reload the router for the new configuration to take effect
                      Device(config-voi-serv)# exit

                      To associate the interface with the redundancy group created, use the redundancy group command in interface mode. To dissociate the interface, use the no form of this command.

                      redundancy group group-number { ipv4 ipv6 } ip-address exclusive

                      no redundancy group group-number { ipv4 ipv6 } ip-address exclusive

                      group-number

                      Specifies the redundancy group number.

                      ip-address

                      Specifies IPv4 or IPv6 address.

                      exclusive

                      Associates the redundancy group to the interface.

                      Command Default: No default behavior or values

                      Command Mode: Interface configuration (config-if)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Associates the interface with the redundancy group. It is mandatory to use a separate interface for redundancy, that is, the interface used for voice traffic cannot be used as control and data interface. You can configure a maximum of two redundancy groups. Hence, there can be only two Active and Standby pairs within the same network.

                      Example: The following example shows how to associate the IPv4 interface with the redundancy group:

                      
                      Device(config)#interface GigabitEthernet1
                      Device(config-if)# redundancy rii 1
                      Device(config-if)# redundancy group 1 ip 198.18.1.228 exclusive
                      Device(config-if)# exit

                      Command

                      Description

                      ipv6 address ip-address

                      Physical IPv6 address configuration of the device.

                      To enable Session Initiation Protocol (SIP) gateways to register E.164 numbers with an external SIP proxy or SIP registrar, use the registrar command in SIP UA configuration mode. To disable registration of E.164 numbers, use the no form of this command.

                      registrar { dhcp | [ registrar-index ] registrar-server-address [ : port ] } [ auth-realm realm ] [ expires seconds ] [ random-contact ] [ refresh-ratio ratio-percentage ] [ scheme { sip | sips } ] [ tcp] [ type ] [ secondary ] server | { expires | system }

                      no registrar { dhcp | [ registrar-index ] registrar-server-address [ : port ] } [ auth-realm realm ] [ expires seconds ] [ random-contact ] [ refresh-ratio ratio-percentage ] [ scheme { sip | sips } ] [ tcp] [ type ] [ secondary ] server | { expires | system }

                      dhcp

                      (Optional) Specifies that the domain name of the primary registrar server is retrieved from a DHCP server (cannot be used to configure secondary or multiple registrars).

                      registrar-index

                      (Optional) A specific registrar to be configured, allowing configuration of multiple registrars (maximum of six). Range is 1–6.

                      registrar-server-address

                      The SIP registrar server address to be used for endpoint registration. This value can be entered in one of three formats:

                      • dns: address —the Domain Name System (DNS) address of the primary SIP registrar server (the dns: delimiter must be included as the first four characters).

                      • ipv4: address —the IP address of the SIP registrar server (the ipv4: delimiter must be included as the first five characters).

                      • ipv6:[address]—the IPv6 address of the SIP registrar server (the ipv6: delimiter must be included as the first five characters and the address itself must include opening and closing square brackets).

                      : port ]

                      (Optional) The SIP port number (the colon delimiter is required).

                      auth-realm

                      (Optional) Specifies the realm for preloaded authorization.

                      realm

                      The realm name.

                      expires seconds

                      (Optional) Specifies the default registration time, in seconds. Range is 60–65535 . Default is 3600.

                      random-contact

                      (Optional) Specifies the Random String Contact header that is used to identify the registration session.

                      refresh-ratio ratio-percentage

                      (Optional) Specifies the registration refresh ratio, in percentage. Range is 1–100 . Default is 80.

                      scheme {sip | sips}

                      (Optional) Specifies the URL scheme. The options are SIP (sip) or secure SIP (sips), depending on your software installation. The default is sip.

                      tcp

                      (Optional) Specifies TCP. If not specified, the default is UDP UDP.

                      type

                      (Optional) The registration type.

                      The type argument cannot be used with the dhcp option.

                      secondary

                      (Optional) Specifies a secondary SIP registrar for redundancy if the primary registrar fails. This option is not valid if DHCP is specified.

                      When there are two registrars, REGISTER message is sent to both the registrar servers, even if the primary registrar sends a 200 OK and the trunk is registered to the primary registrar.

                      If you want to send the registration to the secondary registrar, only when the primary fails, then use DNS SRV.

                      You cannot configure any other optional settings once you enter the secondary keyword—specify all other settings first.

                      expires

                      (Optional) Specifies the registration expiration time

                      system

                      (Optional) Specifies the usage of global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: Registration is disabled.

                      Command Modes:

                      SIP UA configuration (config-sip-ua)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the registrar dhcp or registrar registrar-server-address command to enable the gateway to register E.164 phone numbers with primary and secondary external SIP registrars. Endpoints on Cisco IOS SIP time-division multiplexing (TDM) gateways, Cisco Unified Border Elements (CUBEs), and Cisco Unified Communications Manager Express (Cisco Unified CME) can be registered to multiple registrars using the registrar registrar-index command.

                      By default, Cisco IOS SIP gateways do not generate SIP register messages.

                      When entering an IPv6 address, you must include square brackets around the address value.

                      Example: The following example shows how to configure registration with a primary and secondary registrar:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# retry invite 3
                      Router(config-sip-ua)# retry register 3
                      Router(config-sip-ua)# timers register 150
                      Router(config-sip-ua)# registrar ipv4:209.165.201.1 expires 14400 secondary
                      

                      The following example shows how to configure a device to register with the SIP server address received from the DHCP server. The dhcp keyword is available only for configuration by the primary registrar and cannot be used if configuring multiple registrars.

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# registrar dhcp expires 14400
                      

                      The following example shows how to configure a primary registrar using an IP address with TCP:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# retry invite 3
                      Router(config-sip-ua)# retry register 3
                      Router(config-sip-ua)# timers register 150
                      Router(config-sip-ua)# registrar ipv4:209.165.201.3 tcp
                      

                      The following example shows how to configure a URL scheme with SIP security:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# retry invite 3
                      Router(config-sip-ua)# retry register 3
                      Router(config-sip-ua)# timers register 150
                      Router(config-sip-ua)# registrar ipv4:209.165.201.7 scheme sips
                      

                      The following example shows how to configure a secondary registrar using an IPv6 address:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# registrar ipv6:[3FFE:501:FFFF:5:20F:F7FF:FE0B:2972] expires 14400 secondary
                      

                      The following example shows how to configure all POTS endpoints to two registrars using DNS addresses:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# registrar 1 dns:example1.com expires 180
                      Router(config-sip-ua)# registrar 2 dns:example2.com expires 360
                      

                      The following example shows how to configure the realm for preloaded authorization using the registrar server address:

                      
                      Router> enable
                      Router# configure terminal
                      Router(config)# sip-ua
                      Router(config-sip-ua)# registrar 2 192.168.140.3:8080 auth-realm example.com expires 180
                      

                      The following example shows how to configure registrar in the voice class tenant configuration mode:

                      Router(config-class)# registrar server system

                      Command

                      Description

                      authentication (dial peer)

                      Enables SIP digest authentication on an individual dial peer.

                      authentication (SIP UA)

                      Enables SIP digest authentication.

                      credentials (SIP UA)

                      Configures a Cisco UBE to send a SIP registration message when in the UP state.

                      localhost

                      Configures global settings for substituting a DNS local host name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages.

                      retry register

                      Sets the total number of SIP register messages to send.

                      show sip-ua register status

                      Displays the status of E.164 numbers that a SIP gateway has registered with an external primary or secondary SIP registrar.

                      timers register

                      Sets how long the SIP UA waits before sending register requests.

                      voice-class sip localhost

                      Configures settings for substituting a DNS localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID headers of outgoing messages on an individual dial peer, overriding the global setting.

                      To enable SIP registrar functionality, use the registrar server command in SIP configuration mode. To disable SIP registrar functionality, use the no form of the command.

                      registrar server [ expires [ maxsec ] [ min sec ] ]

                      no registrar server [ expires [ maxsec ] [ min sec ] ]

                      expires

                      (Optional) Sets the active time for an incoming registration.

                      max sec

                      (Optional) Maximum expires time for a registration, in seconds. The range is from 600 to 86400. The default is 3600.

                      min sec

                      (Optional) Minimum expires time for a registration, in seconds. The range is from 60 to 3600. The default is 60.

                      Command Default: Disabled

                      Command Mode: SIP configuration

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: When this command is entered, the router accepts incoming SIP Register messages. If SIP Register message requests are for a shorter expiration time than what is set with this command, the SIP Register message expiration time is used.

                      This command is mandatory for Cisco Unified SIP SRST or Cisco Unified CME and must be entered before any voice register pool or voice register global commands are configured.

                      If the WAN is down and you reboot your Cisco Unified CME or Cisco Unified SIP SRST router, when the router reloads it will have no database of SIP phone registrations. The SIP phones will have to register again, which could take several minutes, because SIP phones do not use a keepalive functionality. To shorten the time before the phones re-register, the registration expiry can be adjusted with this command. The default expiry is 3600 seconds; an expiry of 600 seconds is recommended.

                      Example: The following partial sample output from the show running-config command shows that SIP registrar functionality is set:

                      
                       voice service voip 
                       allow-connections sip-to-sip 
                       sip 
                       registrar server expires max 1200 min 300 

                      Command

                      Description

                      sip

                      Enters SIP configuration mode from voice service VoIP configuration mode.

                      voice register global

                      Enters voice register global configuration mode in order to set global parameters for all supported Cisco SIP phones in a Cisco Unified CME or Cisco Unified SIP SRST environment.

                      voice register pool

                      Enters voice register pool configuration mode for SIP phones.

                      To enable all Session Initiation Protocol (SIP) provisional responses (other than 100 Trying) to be sent reliably to the remote SIP endpoint, use the rel1xx command in SIP configuration mode or voice class tenant configuration mode. To reset to the default, use the no form of this command.

                      rel1xx {supported value | require value | disable | system }

                      no rel1xx

                      supported value

                      Supports reliable provisional responses. The value argument may have any value, as long as both the user-agent client (UAC) and user-agent server (UAS) configure it the same. This keyword, with value of 100rel, is the default.

                      required value

                      Requires reliable provisional responses. The value argument may have any value, as long as both the UAC and UAS configure it the same.

                      disable

                      Disables the use of reliable provisional responses.

                      system

                      Use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: supported with the 100rel value.

                      Command Mode: SIP configuration mode (conf-voi-serv)

                      Voice class tenant configuration (config-class)

                      Dial-peer configuration mode

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The use of resource reservation with SIP requires that the reliable provisional feature for SIP be enabled either at the VoIP dial-peer level or globally on the router.

                      There are two ways to configure reliable provisional responses:

                      • Dial-peer configuration mode. Use the voice-class sip rel1xx command to configure reliable provisional responses for the specific dial peer only.

                      • SIP configuration mode. Use the rel1xx command to configure reliable provisional responses globally.

                      The voice-class sip rel1xx command in dial-peer configuration mode takes precedence over the rel1xx command in global configuration mode with one exception: If the voice-class sip rel1xx command is used with the system keyword, the gateway uses what was configured under the rel1xx command in global configuration mode. Enter SIP configuration mode from voice-service VoIP configuration mode as shown in the following examples.

                      Example: The following example shows use of the rel1xx command with the value 100rel:

                      
                      Router(config)# voice service voip 
                      Router(config-voi-srv)# sip 
                      Router(conf-serv-sip)# rel1xx supported 100rel 

                      The following example shows use of the rel1xx command in the voice class tenant configuration mode:

                      Router(config-class)# rel1xx system

                      Related Commands:

                      CommandDescription
                      sip

                      Enters SIP configuration mode from voice-service VoIP configuration mode.

                      voice-class sip rel1xx

                      Provides provisional responses for calls on a dial peer basis.

                      To enable translation of the SIP header Remote-Party-ID, use the remote-party-id command in SIP UA configuration mode or voice class tenant configuration mode. To disable Remote-Party-ID translation, use the no form of this command.

                      remote-party-id system

                      no remote-party-id system

                      system

                      Specifies that the SIP header Remote-Party-ID use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      Command Default: Remote-Party-ID translation is enabled.

                      Command Modes:

                      SIP UA configuration

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: When the remote-party-id command is enabled, one of the following calling information treatments occurs:

                      • If a Remote-Party-ID header is present in the incoming INVITE message, the calling name and number that is extracted from the Remote-Party-ID header are sent as the calling name and number in the outgoing Setup message. This is the default behavior. Use the remote-party-id command to enable this option.

                      • When no Remote-Party-ID header is available, no translation occurs so the calling name and number are extracted from the From header and are sent as the calling name and number in the outgoing Setup message. This treatment also occurs when the feature is disabled.

                      Example: The following example shows the Remote-Party-ID translation being enabled:

                      
                      Router(config-sip-ua)# remote-party-id
                      

                      The following example shows the Remote-Party-ID translation being enabled in the voice class tenant configuration mode:

                      Router(config-class)# remote-party-id system

                      Command

                      Description

                      debug ccsip events

                      Enables tracing of SIP SPI events.

                      debug ccsip messages

                      Enables SIP SPI message tracing.

                      debug voice ccapi in out

                      Enables tracing the execution path through the call control API.

                      To configure the number of times that a Session Initiation Protocol (SIP) INVITE request is retransmitted to the other user agent, use the retry invite command in SIP UA configuration mode or voice class tenant configuration mode. To reset to the default, use the no form of this command.

                      retry invite number system

                      no retry invite number system

                      system

                      Specifies the INVITE requests use the global sip-ua value. This keyword is available only for the tenant mode to allow it to fallback to the global configurations.

                      number

                      Specifies the number of INVITE retries. Range is from 1 to 10. Default is 6.

                      Command Default: Six retries

                      Command Mode:

                      SIP UA configuration (config-sip-ua)

                      Voice class tenant configuration (config-class)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: To reset this command to the default value, you can also use the default command.

                      Example: The following example sets the number of invite retries to 2:

                      
                      sip-ua 
                       no remote-party-id 
                       retry invite 2 

                      The following example sets the number of invite retries to 2 for tenant 1 in the voice class tenant configuration mode:

                      Device> enable 
                      Device# configure terminal
                      Device(config)# voice class tenant 1
                      Device(config-class)# retry invite 2
                      

                      To check the revocation status of a certificate, use the revocation-check command in ca-trustpoint configuration mode.

                      revocation-check method1 [ method2 method3 ]

                      no revocation-check method1 [ method2 method3 ]

                      method1 [method2 method3]

                      Specifies the method (OCSP, CRL, or skip the revocation check) used to ensure that the certificate of a peer has not been revoked.

                      Checks the revocation status of a certificate:

                      • crl—Certificate checking is performed by a CRL. This is the default option.

                      • none—Certificate checking is ignored.

                      • ocsp—Certificate checking is performed by an OCSP server.

                      Command Default: CRL checking is mandatory for current trustpoint policy usage.

                      After a trustpoint is enabled, the default is set to revocation-check crl, which means that CRL checking is mandatory.

                      Command Mode: ca-trustpoint configuration (ca-trustpoint)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the revocation-check command to specify at least one method (OCSP, CRL, or skip the revocation check) that is to be used to ensure that the certificate of a peer has not been revoked. For multiple methods, the order in which the methods are applied is determined by the order specified via this command.

                      If your router does not have the applicable CRL and is unable to obtain one or if the OCSP server returns an error, your router will reject the peer’s certificate--unless you include the none keyword in your configuration. If the none keyword is configured, a revocation check will not be performed and the certificate will always be accepted.

                      Example: The following example shows to configure the router to download the CRL:

                      
                      configure terminal
                      Enter configuration commands, one per line.  End with CNTL/Z.
                       crypto pki trustpoint sampleTP
                        revocation-check crl
                      exit

                      To specify the Rivest, Shamir, and Adelman (RSA) key pair to associate with the certificate, use the rsakeypair command in certificate trustpoint configuration mode. To disassociate the key pair, use the no form of this command.

                      rsakeypair key-label [ key-size [ encryption-key-size ] ]

                      no rsakeypair key-label [ key-size [ encryption-key-size ] ]

                      key-label

                      Specifies the name of the key pair, which is generated during enrollment if it does not already exist or if the auto-enroll regenerate command is configured.

                      The keypair name cannot start from zero (‘0’).

                      key-size

                      (Optional) Specifies the size of the RSA key pair. If the size is not specified, the existing key size is used. The recommended key size is 2048 bits.

                      encryption-key-size

                      (Optional) Specifies the size of the second key, which is used to request separate encryption, signature keys, and certificates.

                      Command Default: By default, the fully qualified domain name (FQDN) key is used.

                      Command Mode: Certificate trustpoint configuration (ca-trustpoint)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Certificate renewal with regenerate option does not work with key label starting from zero ('0'), (for example, '0test'). CLI allows configuring such name under trustpoint, and allows hostname starting from zero. When configuring rsakeypair name under a trustpoint, do not configure the name starting from zero. When keypair name is not configured and the default keypair is used, make sure the router hostname does not start from zero. If it does so, configure "rsakeypair name explicitly under the trustpoint with a different name.

                      When you regenerate a key pair, you are responsible for reenrolling the identities associated with the key pair. Use the rsakeypair command to refer back to the named key pair.

                      Example: The following example shows how to create a trustpoint to hold a CA-signed certificate:

                      
                      crypto pki trustpoint CUBE_CA_CERT
                       enrollment terminal pem
                       serial-number none
                       subject-name CN=my-cube.domain.com (This has to match the DNS hostname through which this router is reachable)
                       revocation-check none
                       rsakeypair TestRSAkey !(this has to match the RSA key you just created)

                      The following example is a sample trustpoint configuration that specifies the RSA key pair “exampleCAkeys”:

                      
                      crypto ca trustpoint exampleCAkeys
                       enroll url http://exampleCAkeys/certsrv/mscep/mscep.dll
                       rsakeypair exampleCAkeys 1024 1024

                      Command

                      Description

                      auto-enroll

                      Enables autoenrollment.

                      crl

                      Generates RSA key pairs.

                      crypto ca trustpoint

                      Declares the CA that your router should use.

                      To identify the payload type of a Real-Time Transport Protocol (RTP) packet, use the rtp payload-type command in dial peer voice configuration mode. To remove the RTP payload type, use the no form of this command.

                      rtp payload-type comfort-noise [13 | 19 ]

                      no rtp payload-type comfort-noise [13 | 19]

                      comfort-noise {13 | 19}

                      (Optional) RTP payload type of comfort noise. The RTP Payload for Comfort Noise, from the IETF (IETF) Audio or Video Transport (AVT) working group, designates 13 as the payload type for comfort noise. If you are connecting to a gateway that complies with the RTP Payload for Comfort Noise draft, use 13. Use 19 only if you are connecting to older Cisco gateways that use DSPware before version 3.4.32.

                      Command Default: No RTP payload type is configured.

                      Command Mode: Dial peer voice configuration (config-dial-peer)

                      Release

                      Modification

                      Survivability Gateway

                      Cisco IOS XE Cupertino 17.9.3a

                      This command was introduced.

                      Usage Guidelines: Use the rtp payload-type command to identify the payload type of an RTP. Use this command after the dtmf-relay command is used to choose the NTE method of DTMF relay for a Session Initiation Protocol (SIP) call.

                      Configured payload types of NSE and NTE exclude certain values that have been previously hardcoded with Cisco proprietary meanings. Do not use the 96, 97, 100, 117, 121–123, and 125–127 numbers, which have preassigned values.

                      Example: The following example shows how to configure the RTP payload type:

                      
                      dial-peer voice 300 voip 
                       description outbound to PSTN 
                       destination-pattern +1[2-9]..[2-9]......$ 
                       translation-profile outgoing 300
                       rtp payload-type comfort-noise 13

                      Command

                      Description

                      dtmf-relay

                      Specifies how SIP gateway relays DTMF tones between telephony interfaces and an IP network.

                      To define a translation rule, use the rule command in voice translation-rule configuration mode. To delete the translation rule, use the no form of this command.

                      Match and Replace Rule

                      rule precedence { match-pattern | replace-pattern | [ type match-type replace-type [ plan match-type replace-type ] ] }

                      no rule precedence

                      Reject Rule

                      rule precedence reject { match-pattern | type match-type [ plan match-type ] }

                      no rule precedence

                      precedence

                      Priority of the translation rule. Range is from 1 to 15.

                      match-pattern

                      Stream editor (SED) expression used to match incoming call information. The slash ‘/’ is a delimiter in the pattern.

                      replace-pattern

                      SED expression used to replace the match pattern in the call information. The slash ‘/’ is a delimiter in the pattern.

                      type match-type replace-type

                      (Optional) Number type of the call. Valid values for the match-type argument are as follows:

                      • abbreviated—Abbreviated representation of the complete number as supported by this network.

                      • any—Any type of called number.

                      • international—Number called to reach a subscriber in another country.

                      • national—Number called to reach a subscriber in the same country, but outside the local network.

                      • network—Administrative or service number specific to the serving network.

                      • reserved—Reserved for extension.

                      • subscriber—Number called to reach a subscriber in the same local network.

                      • unknown—Number of a type that is unknown by the network.

                      Valid values for the replace-type argument are as follows:

                      • abbreviated—A—bbreviated representation of the complete number as supported by this network.

                      • international—Number called to reach a subscriber in another country.

                      • national—Number called to reach a subscriber in the same country, but outside the local network.

                      • network—Administrative or service number specific to the serving network.

                      • reserved—Reserved for extension.

                      • subscriber—Number called to reach a subscriber in the same local network.

                      • unknown—Number of a type that is unknown by the network.

                      plan match-type replace-type

                      (Optional) Numbering plan of the call. Valid values for the match-type argument are as follows:

                      • any—Any type of dialed number.

                      • data

                      • ermes

                      • isdn

                      • national—Number called to reach a subscriber in the same country, but outside the local network.

                      • private

                      • reserved—Reserved for extension.

                      • telex

                      • unknown—Number of a type that is unknown by the network.

                      Valid values for the replace-type argument are as follows:

                      • data

                      • ermes

                      • isdn

                      • national—Number called to reach a subscriber in the same country, but outside the local network.

                      • private

                      • reserved—Reserved for extension.

                      • telex

                      • unknown—Number of a type that is unknown by the network.

                      reject

                      The match pattern of a translation rule is used for call-reject purposes.

                      Command Default: No default behavior or values

                      Command Mode: Voice translation-rule configuration

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: A translation rule applies to a calling party number (automatic number identification [ANI]) or a called party number (dialed number identification service [DNIS]) for incoming, outgoing, and redirected calls within Cisco H.323 voice-enabled gateways.

                      Use this command in conjunction after the voice translation-rule command. An earlier version of this command uses the same name but is used after the translation-rule command and has a slightly different command syntax. In the older version, you cannot use the square brackets when you are entering command syntax. They appear in the syntax only to indicate optional parameters, but are not accepted as delimiters in actual command entries. In the newer version, you can use the square brackets as delimiters. Going forward, we recommend that you use this newer version to define rules for call matching. Eventually, the translation-rule command will not be supported.

                      Number translation occurs several times during the call routing process. In both the originating and terminating gateways, the incoming call is translated before an inbound dial peer is matched, before an outbound dial peer is matched, and before a call request is set up. Your dial plan should account for these translation steps when translation rules are defined.

                      The table below shows examples of match patterns, input strings, and result strings for the rule (voice translation-rule) command.

                      Table 1. Match Patterns, Input Strings and Result Strings

                      Match Pattern

                      Replacement Pattern

                      Input String

                      Result String

                      Description

                      /^.*///4085550100Any string to null string.
                      ////40855501004085550100Match any string but no replacement. Use this to manipulate the call plan or call type.
                      /\(^...\)456\(...\)//\1555\2/40845601774085550177Match from the middle of the input string.
                      /\(.*\)0120//\10155/40811101204081110155Match from the end of the input string.
                      /^1#\(.*\)//\1/1#23452345Replace match string with null string.
                      /^408...\(8333\)//555\1/40877701005550100Match multiple patterns.
                      /1234//00&00/555010055500010000Match the substring.
                      /1234//00\000/555010055500010000Match the substring (same as &).

                      The software verifies that a replacement pattern is in a valid E.164 format that can include the permitted special characters. If the format is not valid, the expression is treated as an unrecognized command.

                      The number type and calling plan are optional parameters for matching a call. If either parameter is defined, the call is checked against the match pattern and the selected type or plan value. If the call matches all the conditions, the call is accepted for additional processing, such as number translation.

                      Several rules may be grouped together into a translation rule, which gives a name to the rule set. A translation rule may contain up to 15 rules. All calls that refer to this translation rule are translated against this set of criteria.

                      The precedence value of each rule may be used in a different order than that in which they were typed into the set. Each rule’s precedence value specifies the priority order in which the rules are to be used. For example, rule 3 may be entered before rule 1, but the software uses rule 1 before rule 3.

                      The software supports up to 128 translation rules. A translation profile collects and identifies a set of these translation rules for translating called, calling, and redirected numbers. A translation profile is referenced by trunk groups, source IP groups, voice ports, dial peers, and interfaces for handling call translation.

                      Example: The following example applies a translation rule. If a called number starts with 5550105 or 70105, translation rule 21 uses the rule command to forward the number to 14085550105 instead.

                      Router(config)# voice translation-rule 21
                       Router(cfg-translation-rule)# rule 1 /^5550105/ /14085550105/
                       Router(cfg-translation-rule)# rule 2 /^70105/ /14085550105/

                      In the next example, if a called number is either 14085550105 or 014085550105, after the execution of translation rule 345, the forwarding digits are 50105. If the match type is configured and the type is not "unknown," dial-peer matching is required to match the input string numbering type.

                      Router(config)# voice translation-rule 345
                       Router(cfg-translation-rule)# rule 1 /^14085550105/ /50105/ plan any national
                       Router(cfg-translation-rule)# rule 2 /^014085550105/ /50105/ plan any national

                      Command

                      Description

                      show voice translation-rule

                      Displays the parameters of a translation rule.

                      voice translation-rule

                      Initiates the voice translation-rule definition.

                      Commands S

                      To specify whether the router serial number should be included in the certificate request, use the serial-number command in ca-trustpoint configuration mode. To restore the default behavior, use the no form of this command.

                      serial-number [none]

                      no serial-number

                      none

                      (Optional) Specifies that a serial number will not be included in the certificate request.

                      Command Default: Not configured. You will be prompted for the serial number during certificate enrollment.

                      Command Mode: ca-trustpoint configuration

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Before you can issue the serial-number command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.

                      Use this command to specify the router serial number in the certificate request, or use the none keyword to specify that a serial number should not be included in the certificate request.

                      Example: The following example shows how to omit a serial number from the certificate request:

                      
                      crypto pki trustpoint CUBE_CA_CERT
                       enrollment terminal pem
                       serial-number none
                       subject-name CN=my-cube.domain.com (This has to match the DNS hostname through which this router is reachable)
                        revocation-check none
                        rsakeypair TestRSAkey !(this has to match the RSA key you just created)

                      Command

                      Description

                      crypto ca trustpoint

                      Declares the CA that your router should use.

                      To specify a session protocol for calls between local and remote routers using the packet network, use the session protocol command in dial-peer configuration mode. To reset to the default, use the no form of this command.

                      session protocol {cisco | sipv2}

                      no session protocol

                      cisco

                      Dial peer uses the proprietary Cisco VoIP session protocol.

                      sipv2

                      Dial peer uses the Internet Engineering Task Force (IETF) Session Initiation Protocol (SIP). Use this keyword with the SIP option.

                      Command Default: No default behaviors or values

                      Command Mode: Dial-peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: The cisco keyword is applicable only to VoIP on the Cisco 1750, Cisco 1751, Cisco 3600 series, and Cisco 7200 series routers.

                      Examples: The following example shows that Cisco session protocol has been configured as the session protocol:

                      
                      dial-peer voice 20 voip
                       session protocol cisco
                      

                      The following example shows that a VoIP dial peer for SIP has been configured as the session protocol for VoIP call signaling:

                      
                      dial-peer voice 102 voip
                       session protocol sipv2

                      Command

                      Description

                      dial-peer voice

                      Enters dial-peer configuration mode and specifies the method of voice-related encapsulation.

                      session target (VoIP)

                      Configures a network-specific address for a dial peer.

                      To enable SIP session refresh globally, use the session refresh command in SIP configuration mode. To disable the session refresh, use the no form of this command.

                      session refresh

                      no session refresh

                      This command has no arguments or keywords.

                      Command Default: No session refresh

                      Command Mode: SIP configuration (conf-serv-sip)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: Use the SIP session refresh command to send the session refresh request.

                      Example: The following example sets the session refresh under SIP configuration mode:

                      
                      Device(conf-serv-sip)# session refresh
                      

                      Command

                      Description

                      voice-class sip session refresh

                      Enables session refresh at dial-peer level.

                      To configure the server groups in outbound dial peers, use the session server-group command in SIP dial peer configuration mode. To disable the capability, use the no form of this command.

                      session server-group server-group-id

                      no session server-group server-group-id

                      server-group-id

                      Configures specified server group as the destination of the dial peer.

                      Command Default: No default behavior or values.

                      Command Mode: sip dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway

                      Cisco IOS XE Gibraltar 16.12.2

                      This command was introduced.

                      Usage Guidelines: If the specified server group is in shutdown mode, the dial peer is not selected to route outgoing calls.

                      Example: The following example shows how to configure the specified server group as the destination of the dial peer:

                      Device(config-dial-peer)# session server-group 171

                      To designate a network-specific address to receive calls from a VoIP or VoIPv6 dial peer, use the session target command in dial peer configuration mode. To reset to the default, use the no form of this command.

                      session target {dhcp | ipv4: destination-address | ipv6: [destination-address] | dns: [$s$. | $d$. | $e$. | $u$.] hostname | enum: table-num | loopback:rtp | ras | settlement provider-number | sip-server | registrar} [: port]

                      no session target

                      dhcp

                      Configures the router to obtain the session target via DHCP.

                      The dhcp option can be made available only if the Session Initiation Protocol (SIP) is used as the session protocol. To enable SIP, use the session protocol (dial peer) command.

                      ipv4: destination -address

                      Configures the IP address of the dial peer to receive calls. The colon is required.

                      ipv6: [destination-address]

                      Configures the IPv6 address of the dial peer to receive calls. Square brackets must be entered around the IPv6 address. The colon is required.

                      dns:[$s$] hostname

                      Configures the host device housing the domain name system (DNS) server that resolves the name of the dial peer to receive calls. The colon is required.

                      Use one of the following macros with this keyword when defining the session target for VoIP peers:

                      • $s$. --(Optional) Source destination pattern is used as part of the domain name.

                      • $d$. --(Optional) Destination number is used as part of the domain name.

                      • $e$. --(Optional) Digits in the called number are reversed and periods are added between the digits of the called number. The resulting string is used as part of the domain name.

                      • $u$. --(Optional) Unmatched portion of the destination pattern (such as a defined extension number) is used as part of the domain name.

                      • hostname --String that contains the complete hostname to be associated with the target address; for example, serverA.example1.com.

                      enum: table -num

                      Configures ENUM search table number. Range is from 1 to 15. The colon is required.

                      loopback:rtp

                      Configures all voice data to loop back to the source. The colon is required.

                      ras

                      Configures the registration, admission, and status (RAS) signaling function protocol. A gatekeeper is consulted to translate the E.164 address into an IP address.

                      sip -server

                      Configures the global SIP server is the destination for calls from the dial peer.

                      : port

                      (Optional) Port number for the dial-peer address. The colon is required.

                      settlement provider -number

                      Configures the settlement server as the target to resolve the terminating gateway address.

                      • The provider-number argument specifies the provider IP address.

                      registrar

                      Specifies to route the call to the registrar end point.

                      • The registrar keyword is available only for SIP dial peers.

                      Command Default: No IP address or domain name is defined.

                      Command Mode: Dial peer configuration (config-dial-peer)

                      Release

                      Modification

                      Local Gateway