Aug 27, 2020 | view(s) | people thought this was helpful
Configure Local Gateway on IOS-XE for Webex Calling
After you configure Webex Calling for your organization, you must then configure local gateways using their respective CLI interfaces. The trunk between the local gateway and the Webex cloud is always secured using SIP TLS transport and SRTP for media between Local gateway and the Webex Calling Access SBC.
Use this task flow to configure local gateways for your Webex Calling deployment. The steps that follow are performed on the CLI interface itself. The trunk between the local gateway and Webex Calling is always secured using SIP TLS transport and SRTP for media between Local gateway and the Webex Calling Access SBC.
Before you begin
Meet the local gateway requirements for Webex Calling.
Create a local gateway in Control Hub.
The configuration guidelines provided in this document assume that a dedicated local gateway platform is in place with no
existing voice configuration. If an existing PSTN gateway or CUBE enterprise deployment is being modified to also use the
local gateway function for Webex Calling, pay careful attention to the configuration applied and make sure existing call flows and functionality are not interrupted
as a result of changes that you make.
Implement these steps as a common global configuration for the local gateway. The configuration includes baseline platform
configuration and a trust pool update.
Call Routing on the local gateway is based on the Webex Calling deployment option that you chose. This section assumes that IP PSTN termination is on the same platform as the local gateway.
The configuration that follows is for one of these options on the local gateway:
The local gateway deployment option without an on-premises IP PBX. The local gateway and IP PSTN CUBE are coresident.
The local gateway deployment option within an existing Unified CM environment. The local gateway and IP PSTN CUBE are coresident.
Ensure that baseline platform configuration such as NTPs, ACLs, enable passwords, master password (IOS-XE 16.11.1 and later),
IP routing, IP Addresses, and so on are configured according to your organization's policies and procedures.
IOS-XE 16.9.3 and later or 16.11.1 and later is required for local gateway deployments. IOS-XE releases16.10.x is not supported.
1
Ensure that any layer 3 interfaces have valid and routable IP addresses assigned:
If you're using IOS-XE 16.11.1 or later, you must preconfigure a master key for the password using the commands shown below
before it can be used in the credentials and shared secrets. Type 6 passwords are encrypted using AES cypher and user-defined
master key.
LocalGateway#conf t
LocalGateway(config)#key config-key password-encrypt Password123
LocalGateway(config)#password encryption aes
3
Configure IP Name Server to enable DNS lookup and ensure it is reachable by pinging it:
LocalGateway#conf t
Enter configuration commands, one per line. End with CNTL/Z.
LocalGateway(config)#ip name-server 8.8.8.8
LocalGateway(config)#end
4
Enable TLS 1.2 Exclusivity and a default Dummy Trustpoint:
Create a dummy PKI Trustpoint and call it dummyTp
Assign the trustpoint as the default signaling trustpoint under sip-ua
cn-san-validate server is needed to ensure that the local gateway establishes the connection only if the outbound proxy configured on the tenant 200 (described later) matches with CN-SAN list received from the server.
The crypto trustpoint is needed for TLS to work even though a local client certificate (for example, mTLS) is not required
for the connection to be set up.
Disable TLS v1.0 and v1.1 by enabling v1.2 exclusivity.
LocalGateway#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
LocalGateway(config)#
LocalGateway(config)#crypto pki trustpoint dummyTp
LocalGateway(ca-trustpoint)# revocation-check crl
LocalGateway(ca-trustpoint)#exit
LocalGateway(config)#sip-ua
LocalGateway(config-sip-ua)# crypto signaling default trustpoint dummyTp cn-san-validate server
LocalGateway(config-sip-ua)# transport tcp tls v1.2
LocalGateway(config-sip-ua)#end
5
Update Local Gateway Trustpool:
The default trustpool bundle does not include the “DigiCert Root CA” certificate needed for validating the server side certificate
during TLS connection establishment to Webex Calling.
The trustpool bundle must be updated by downloading the latest “Cisco Trusted Core Root Bundle” from http://www.cisco.com/security/pki/.
Check if the DigiCert Room CA certificate exists:
LocalGateway#show crypto pki trustpool | include DigiCert
If it doesn't exist, update as follows:
LocalGateway#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
LocalGateway(config)#crypto pki trustpool import clean url
http://www.cisco.com/security/pki/trs/ios_core.p7b
Reading file from http://www.cisco.com/security/pki/trs/ios_core.p7b
Loading http://www.cisco.com/security/pki/trs/ios_core.p7b
% PEM files import succeeded.
LocalGateway(config)#end
Verify:
LocalGateway#show crypto pki trustpool | include DigiCert
cn=DigiCert Global Root CA
o=DigiCert Inc
cn=DigiCert Global Root CA
o=DigiCert Inc
Ensure that you completed the steps in Control Hub to create a location and add a local gateway. In the example local gateway
shown here, the information was obtained from Control Hub.
1
Enter these commands to turn on the local gateway application:
Device(config)# voice service voip
Device(config-voi-serv)# ip address trusted list
Device(cfg-iptrust-list)# ipv4 199.59.70.0 255.255.255.128
Device(cfg-iptrust-list)# ipv4 199.59.71.0 255.255.255.128
Explicitly enables the source IP addresses of entities from which the local gateway expects legitimate VoIP calls, such as
Webex Calling peers, Unified CM nodes, IP PSTN.
By default, LGW blocks all incoming VoIP call setups from IP addresses not in its trusted list. IP Addresses from dial-peers
with “session target ip” or Server Group are trusted by default and need not be populated here.
IP addresses in this list need to match the IP subnets according to the regional Webex Calling data center the customer is connected to. For more information, see Port Reference Information for Webex Calling.
If your LGW is behind a firewall with restricted cone NAT, you may prefer to disable the IP address trusted list on the Webex Calling-facing interface. This is because the firewall already protects you from unsolicited inbound VoIP. This action would reduce
your longer term configuration overhead, because we cannot guarantee that the addresses of the Webex Calling peers will remain fixed, and you would need to configure your firewall for the peers in any case.
Other IP addresses may need to be configured on other interfaces; for example, your Unified CM addresses may need to be added
to the inward-facing interfaces.
IP addresses must match the IP of hosts the outbound-proxy resolves to in tenant 200
voice service voip
media statistics
media bulk-stats
media-address range 192.168.43.197 192.168.43.197 port-range 8000 48000
Media Statistics enables media monitoring on the local gateway.
Media bulk-stats enables the control plane to poll the data plane for bulk call statistics.
Media-address range <LGW IP Address Range> port-range configuration decides which RTP source ports to use for this media address range. This is being configured for Gig0/0/1 interface
facing Webex Calling.
SIP-to-SIP Basic Functionality
allow-connections sip to sip
Allow SIP-to-SIP connections.
By default, IOS/IOS-XE voice devices do not allow an incoming VoIP leg to go out as VoIP.
When a call is forwarded back to a Webex Calling user (for example, both the called and calling parties are Webex Calling subscribers and have the media anchored at the Webex Calling SBC), the media cannot flow to the local gateway as the pinhole isn't open.
The STUN bindings feature on the local gateway allows locally generated STUN requests to be sent over the negotiated media
path. This helps in opening up the pinhole in the firewall.
STUN password is a prerequisite for the local gateway to send STUN messages out. IOS/IOS-XE based firewalls can be configured
to check for this password and open pinholes dynamically (for example, without explicit in-out rules). But for the local gateway
deployment case, the firewall is statically configured to open pinholes in and out based on the Webex Calling SBC sub nets. As such, the firewall should just treat this as any inbound UDP packet which will trigger the pinhole opening
without explicitly looking at the packet contents.
G729
sip
g729 annexb-all
Allows all variants of G729.
SIP
early-offer forced
Forces the local gateway to send the SDP information in the initial INVITE message instead of waiting for acknowledgement
from the neighboring peer.
2
Configure “SIP Profile 200”.
LocalGateway(config)# voice class sip-profiles 200
LocalGateway (config-class)# rule 9 request ANY sip-header SIP-Req-URI modify "sips:(.*)" "sip:\1"
LocalGateway (config-class)# rule 10 request ANY sip-header To modify "<sips:(.*)" "<sip:\1"
LocalGateway (config-class)# rule 11 request ANY sip-header From modify "<sips:(.*)" "<sip:\1"
LocalGateway (config-class)# rule 12 request ANY sip-header Contact modify "<sips:(.*)>" "<sip:\1;transport=tls>"
LocalGateway (config-class)# rule 13 response ANY sip-header To modify "<sips:(.*)" "<sip:\1"
LocalGateway (config-class)# rule 14 response ANY sip-header From modify "<sips:(.*)" "<sip:\1"
LocalGateway (config-class)# rule 15 response ANY sip-header Contact modify "<sips:(.*)" "<sip:\1"
LocalGateway (config-class)# rule 20 request ANY sip-header From modify ">" ";otg=hussain2572_lgu>"
LocalGateway (config-class)# rule 30 request ANY sip-header P-Asserted-Identity modify "sips:(.*)" "sip:\1"
These rules are
Explanation of commands:
rule 9 ensures the header is listed as “SIP-Req-URI” and not “SIP-Req-URL”
This converts between SIP URIs and SIP URLs, because Webex Calling doesn't support SIP URIs in the request/response messages, but needs them for SRV queries, e.g. _sips._tcp.<outbound-proxy>.
rule 20 modifies the From header to include the Trunk Group OTG/DTG parameter from Control Hub to uniquely identify a LGW site within
an enterprise.
This SIP Profile will be applied to voice class tenant 200 (discussed later) for all traffic facing Webex Calling.
3
Configure Codec Profile, STUN definition, and SRTP Crypto suite.
Voice class codec 99: Allows both g729 and g711 (mu and a-law) codecs for sessions. Is applied to all the dial-peers.
Voice class srtp-crypto 200: Specifies SHA1_80 as the only SRTP cipher-suite that's offered by local gateway in the SDP in offer and answer. Webex Calling only supports SHA1_80.
Will be applied to voice class tenant 200 (discussed later) facing Webex Calling.
Voice class stun-usage 200: Defines STUN usage. Is applied to all Webex Calling-facing (2XX tag) dial-peers to avoid no way audio when a Unified CM phone forwards the call to another Webex Calling phone.
In cases where media is anchored at the ITSP SBC and the Local Gateway is behind a NAT and waiting for the inbound media stream
from ITSP, this command may be applied on ITSP facing dial-peers.
4
Map Control Hub parameters to local gateway configuration:
Webex Calling is added as a tenant within the local gateway. The configuration required to register the local gateway is defined under
voice class tenant 200. You must obtain the elements of that configuration from the local gateway admin page within the Control Hub as shown in
this screenshot. This is an example to display what fields map to the respective local gateway CLI.
Tenant 200 is then applied to all the Webex Calling facing dial-peers (2xx tag) within the local gateway configuration. The voice class tenant feature allows for grouping and configuring of SIP trunk
parameters otherwise done under voice service voip and sip-ua. When a tenant is configured and applied under a dial-peer,
the IOS-XE configurations are applied in the following order of preference:
Dial-peer configuration
Tenant configuration
Global configuration (voice service voip / sip-ua)
5
Configure voice class tenant 200 to Trunk Registration from LGW to Webex Calling:
LocalGateway(config)#voice class tenant 200
registrar dns:40462196.cisco-bcld.com scheme sips expires 240 refresh-ratio 50 tcp tls
credentials number Hussain6346_LGU username Hussain2572_LGU password 0 meX7]~)VmF realm BroadWorks
authentication username Hussain2572_LGU password 0 meX7]~)VmF realm BroadWorks
authentication username Hussain2572_LGU password 0 meX7]~)VmF realm 40462196.cisco-bcld.com
no remote-party-id
sip-server dns:40462196.cisco-bcld.com
connection-reuse
srtp-crypto 200
session transport tcp tls
url sips
error-passthru
asserted-id pai
bind control source-interface GigabitEthernet0/0/1
bind media source-interface GigabitEthernet0/0/1
no pass-thru content custom-sdp
sip-profiles 200
outbound-proxy dns:1a01.sipconnect-us10.cisco-bcld.com
privacy-policy passthru
Explanation of commands:
voice class tenant 200
A local gateway's multitenant feature enables specific global configurations for multiple tenants on SIP trunks that allow
differentiated services for tenants.
Transparently pass across privacy header values from incoming to the outgoing leg.
After tenant 200 is defined within the local gateway and a SIP VoIP dial-peer is configured, the gateway then initiates a
TLS connection towards Webex Calling, at which point the Access SBC presents its certificate to the local gateway. The local gateway validates the Webex Calling Access SBC certificate using the CA root bundle updated earlier. A persistent TLS session is established between the local
gateway and Webex Calling Access SBC. The Local gateway then sends a REGISTER to the Access SBC which is challenged. Registration AOR is number@domain.
The number is taken from credentials “number” parameter and domain from the “registrar dns:<fqdn>”. When the Registration
is challenged, the username, password and realm parameters from credentials are used to build the header and sip-profile 200 converts SIPS URL back to SIP. Registration is successful once 200 OK is
received from the Access SBC.
The following configuration on the local gateway is required for this deployment option:
Voice class tenants—First we will create additional tenants for dial-peers facing ITSP similar to tenant 200 that we created for Webex Calling facing dial-peers.
Voice class URIs—Patterns defining host IP addresses/ports for various trunks terminating on Local Gateway: Webex Calling to LGW; and PSTN SIP trunk termination on LGW.
Outbound dial-peers—To route outbound call legs from LGW to ITSP SIP trunk and Webex Calling.
Voice class DPG—Target outbound dial-peers invoked from an inbound dial-peer.
Inbound dial-peers—To accept inbound call legs from ITSP and Webex Calling.
Configuration in this section can be used for either partner-hosted local gateway setup, as shown below, or local customer
site gateway.
1
Configure the following voice class tenants:
Voice class tenant 100 is applied on all OUTBOUND dial-peers facing IP PSTN.
voice class tenant 100
session transport udp
url sip
error-passthru
bind control source-interface GigabitEthernet0/0/0
bind media source-interface GigabitEthernet0/0/0
no pass-thru content custom-sdp
Voice class tenant 300 is applied on all INBOUND dial-peers from IP PSTN.
voice class tenant 300
bind control source-interface GigabitEthernet0/0/0
bind media source-interface GigabitEthernet0/0/0
no pass-thru content custom-sdp
2
Configure the following voice class URI:
Define ITSP’s host IP address:
voice class uri 100 sip
host ipv4:192.168.80.13
Define pattern to uniquely identify a local gateway site within an Enterprise based on Control Hub's TrunkGroup OTG/DTG parameter:
voice class uri 200 sip
pattern dtg=hussain2572.lgu
Local gateway doesn't currently support underscore "_" in the match pattern. As a workaround, we use dot "." (match any) to
match the "_".
Received
INVITE sip:+16785550123@198.18.1.226:5061;transport=tls;dtg=hussain2572_lgu SIP/2.0
Via: SIP/2.0/TLS 199.59.70.30:8934;branch=z9hG4bK2hokad30fg14d0358060.1
pattern :8934
3
Configure the following outbound dial peers:
Outbound dial-peer toward IP PSTN:
dial-peer voice 101 voip
description Outgoing dial-peer to IP PSTN
destination-pattern BAD.BAD
session protocol sipv2
session target ipv4:192.168.80.13
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
Explanation of Commands:
dial-peer voice 101 voip
description Outgoing dial-peer to PSTN
Defines a VOIP dial-peer with a tag of 101 and a meaningful description is given for ease of management and troubleshooting.
destination-pattern BAD.BAD
Digit pattern that allows selection of this dial-peer. However, we will invoke this outgoing dial-peer directly from the inbound
dial-peer using DPG statements and that bypasses the digit pattern match criteria. As a result, we're using an arbitrary pattern
based on alphanumeric digits allowed by the destination-pattern CLI.
session protocol sipv2
Specifies that this dial-peer will be handling SIP call legs.
session target ipv4:192.168.80.13
Indicates the destination’s target IPv4 address where this call leg will be sent. In this case, ITSP’s IP address.
voice-class codec 99
Indicates codec preference list 99 to be used for this dial-peer.
dtmf-relay rtp-nte
Defines RTP-NTE (RFC2833) as the DTMF capability expected on this call leg.
voice-class sip tenant 100
The dial-peer will inherit all the parameters from Tenant 100 unless that same parameter is defined under the dial-peer itself.
no vad
Disables voice activity detection.
Outbound dial-peer towards Webex Calling
dial-peer voice 201 voip
description Outgoing dial-peer to Webex Calling
destination-pattern BAD.BAD
session protocol sipv2
session target sip-server
voice-class codec 99
dtmf-relay rtp-nte
voice-class stun-usage 200
no voice-class sip localhost
voice-class sip tenant 200
srtp
no vad
Explanation of commands:
dial-peer voice 201 voip
description Outgoing dial-peer to Webex Calling
Defines a VOIP dial-peer with a tag of 201 and a meaningful description is given for ease of management and troubleshooting
session target sip-server
Indicates that the global SIP server is the destination for calls from this dial peer. Webex Calling server defined in tenant 200 is inherited for this dial-peer.
voice-class stun-usage 200
The STUN bindings feature on the local gateway allows locally generated STUN requests to be sent over the negotiated media
path. This helps in opening up the pinhole in the firewall.
no voice-class sip localhost
Disables substitution of the DNS localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID
headers of outgoing messages.
voice-class sip tenant 200
The dial-peer inherits all the parameters from Tenant 200 (LGW <--> Webex Calling Trunk) unless that same parameter is defined under the dial-peer itself.
srtp
SRTP is enabled for this call leg.
no vad
Disables voice activity detection.
4
Configure the following dial-peer groups (DPG):
Defines dial-peer group 100. Outbound dial-peer 101 is the target for any incoming dial-peer invoking dial-peer group 100. We will apply DPG 100 to incoming dial-peer 200 defined later for Webex Calling --> LGW --> PSTN path.
voice class dpg 100
description Incoming IP PSTN(DP100) to Webex Calling(DP201)
dial-peer 101 preference 1
Define dial-peer group 200 with outbound dial-peer 201 as the target for CUCM --> LGW --> Webex Calling path. DPG 200 will be applied to incoming dial-peer 100 defined later.
voice class dpg 200
description Incoming IP PSTN(DP100) to Webex Calling(DP201)
dial-peer 201 preference 1
5
Configure the following Inbound dial-peers:
Inbound dial-peer for incoming IP PSTN call legs:
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
session protocol sipv2
destination dpg 200
incoming uri via 100
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 300
no vad
Explanation of Commands
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
Defines a VOIP dial-peer with a tag of 100 and a meaningful description is given for ease of management and troubleshooting.
session protocol sipv2
Specifies that this dial-peer will be handling SIP call legs.
incoming uri via 100
All incoming traffic from IP PSTN to LocalGW is matched on the incoming VIA header’s host IP address defined in voice class
URI 100 SIP to match based on source IP (ITSP’s) address.
destination dpg 200
With the destination dpg 200, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination Dial-peer group 200, which is dial-peer 201.
voice-class sip tenant 300
The dial-peer will inherit all the parameters from Tenant 300 unless that same parameter is defined under the dial-peer itself.
no vad
Disables voice activity detection.
Inbound dial-peer for incoming Webex Calling call legs:
dial-peer voice 200 voip
description Incoming dial-peer from Webex Calling
session protocol sipv2
destination dpg 100
incoming uri request 200
voice-class codec 99
voice-class stun-usage 200
voice-class sip tenant 200
srtp
no vad
Explanation of Commands
dial-peer voice 200 voip
description Incoming dial-peer from Webex Calling
Defines a VOIP dial-peer with a tag of 200 and a meaningful description is given for ease of management and troubleshooting.
incoming uri request 200
All incoming traffic from Webex Calling to LGW can be matched on the unique dtg pattern in the request URI, uniquely identifying the local gateway site within an
Enterprise and in the Webex Calling ecosystem.
destination dpg 100
With the destination dpg 100, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination Dial-peer group 300, which is dial-peer 101.
voice-class stun-usage 200
The STUN bindings feature on the local gateway allows locally generated STUN requests to be sent over the negotiated media
path. This helps in opening up the pinhole in the firewall.
voice-class sip tenant 200
The dial-peer will inherit all the parameters from Tenant 200 unless that same parameter is defined under the dial-peer itself.
srtp
Enables SRTP for this call leg.
no vad
Disables voice activity detection.
PSTN to Webex Calling
All incoming IP PSTN call legs on the local gateway are matched on dial-peer 100 as it defines a match criteria for the VIA
header with the IP PSTN’s IP address. Outbound dial-peer selection is dictated by DPG 200 that directly invokes outgoing dial-peer
201, which has the Webex Calling server listed as the target destination.
Webex Calling to PSTN
All incoming Webex Calling call legs on the local gateway are matched on dial-peer 200 as it meets a match criteria for the REQUEST URI header pattern
with the TrunkGroup OTG/DTG parameter, unique to this local gateway deployment. Outbound dial-peer selection is dictated by
DPG 100 that directly invokes outgoing dial-peer 101, which has the IP PSTN IP address listed as the target destination.
For this deployment option, the following configuration on the local gateway is required:
Voice class tenants—You must create additional tenants for dial-peers facing Unified CM and ITSP, similar to tenant 200 that we created for Webex Calling facing dial-peers.
Voice class URIs—Patterns defining host IP addresses/ports for various trunks terminating on the LGW: from Unified CM to LGW for PSTN destinations;
Unified CM to LGW for Webex Calling destinations; Webex Calling to LGW; and PSTN SIP trunk termination on LGW.
Voice class server-group—Target IP addresses/ports for outbound trunks from LGW to Unified CM, LGW to Webex Calling, and LGW to PSTN SIP trunk.
Outbound dial-peers—To route outbound call legs from LGW to Unified CM, ITSP SIP trunk, and/or Webex Calling.
Voice class DPG—Target outbound dial-peer(s) invoked from an inbound dial-peer.
Inbound dial-peers —To accept inbound call legs from Unified CM, ITSP, and/or Webex Calling.
1
Configure the following voice class tenants:
Voice class tenant 100 is applied on all outbound dial-peers facing Unified CM and IP PSTN:
voice class tenant 100
session transport udp
url sip
error-passthru
bind control source-interface GigabitEthernet0/0/0
bind media source-interface GigabitEthernet0/0/0
no pass-thru content custom-sdp
Voice class tenant 300 will be applied on all inbound dial-peers from Unified CM and IP PSTN:
voice class tenant 300
bind control source-interface GigabitEthernet0/0/0
bind media source-interface GigabitEthernet0/0/0
no pass-thru content custom-sdp
2
Configure the following voice class URIs:
Defines ITSP’s host IP address:
voice class uri 100 sip
host ipv4:192.168.80.13
Define pattern to uniquely identify a local gateway site within an Enterprise based on Control Hub's TrunkGroup OTG/DTG parameter:
voice class uri 200 sip
pattern dtg=hussain2572.lgu
The local gateway doesn't currently support underscore "_" in the match pattern. As a workaround, we use dot "." (match any)
to match the "_".
Received
INVITE sip:+16785550123@198.18.1.226:5061;transport=tls;dtg=hussain2572_lgu SIP/2.0
Via: SIP/2.0/TLS 199.59.70.30:8934;branch=z9hG4bK2hokad30fg14d0358060.1
pattern :8934
Defines Unified CM signaling VIA port for the Webex Calling trunk:
voice class uri 300 sip
pattern :5065
Defines CUCM source signaling IP and VIA port for PSTN trunk:
voice class uri 302 sip
pattern 192.168.80.60:5060
3
Configure the following voice class server-groups:
Defines Unified CM trunk’s target host IP address and port number for Unified CM Group 1 (5 nodes). Unified CM uses port 5065
for inbound traffic on the Webex Calling trunk (Webex Calling <-> LGW --> Unified CM).
voice class server-group 301
ipv4 192.168.80.60 port 5065
Defines Unified CM trunk’s target host IP address and port number for Unified CM Group 2 if applicable:
voice class server-group 303
ipv4 192.168.80.60 port 5065
Defines Unified CM trunk’s target host IP address for Unified CM Group 1 (5 nodes). Unified CM uses default port 5060 for
inbound traffic on the PSTN trunk. With no port number specified, default 5060 is used. (PSTN <-> LGW --> Unified CM)
voice class server-group 305
ipv4 192.168.80.60
Defines Unified CM trunk’s target host IP address for Unified CM Group 2, if applicable.
voice class server-group 307
ipv4 192.168.80.60
4
Configure the following outbound dial-peers:
Outbound dial-peer towards IP PSTN:
dial-peer voice 101 voip
description Outgoing dial-peer to IP PSTN
destination-pattern BAD.BAD
session protocol sipv2
session target ipv4:192.168.80.13
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
Explanation of commands
dial-peer voice 101 voip
description Outgoing dial-peer to PSTN
Defines a VOIP dial-peer with a tag of 101 and a meaningful description is given for ease of management and troubleshooting.
destination-pattern BAD.BAD
Digit pattern that will allow selection of this dial-peer. However, we will invoke this outgoing dial-peer directly from the
inbound dial-peer using DPG statements and that bypasses the digit pattern match criteria. As a result, we're using an arbitrary
pattern based on alphanumeric digits allowed by the destination-pattern CLI.
session protocol sipv2
Specifies that this dial-peer will be handling SIP call legs.
session target ipv4:192.168.80.13
Indicates the destination’s target IPv4 address where this call leg will be send. (In this case, ITSP’s IP address.)
voice-class codec 99
Indicates codec preference list 99 to be used for this dial-peer.
voice-class sip tenant 100
The dial-peer will inherit all the parameters from Tenant 100 unless that same parameter is defined under the dial-peer itself.
Outbound dial-peer towards Webex Calling:
dial-peer voice 201 voip
description Outgoing dial-peer to Webex Calling
destination-pattern BAD.BAD
session protocol sipv2
session target sip-server
voice-class codec 99
dtmf-relay rtp-nte
voice-class stun-usage 200
no voice-class sip localhost
voice-class sip tenant 200
srtp
no vad
Explanation of commands
dial-peer voice 201 voip
description Outgoing dial-peer to Webex Calling
Defines a VOIP dial-peer with a tag of 201 and a meaningful description is given for ease of management and troubleshooting.
session target sip-server
Indicates that the global SIP server is the destination for calls from this dial peer. Webex Calling server defined in tenant 200 will be inherited for this dial-peer.
voice-class stun-usage 200
The STUN bindings feature on the LGW allows locally generated STUN requests to be sent over the negotiated media path. This
helps in opening up the pinhole in the firewall.
no voice-class sip localhost
Disables subsititution of the DNS localhost name in place of the physical IP address in the From, Call-ID, and Remote-Party-ID
headers of outgoing messages.
voice-class sip tenant 200
The dial-peer inherits all the parameters from Tenant 200 (LGW <--> Webex Calling Trunk) unless that same parameter is defined under the dial-peer itself.
dial-peer voice 301 voip
description Outgoing dial-peer to CUCM-Group-1 for
inbound from Webex Calling - Nodes 1 to 5
destination-pattern BAD.BAD
session protocol sipv2
session server-group 301
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
Explanation of Commands
dial-peer voice 301 voip
description Outgoing dial-peer to CUCM-Group-1 for
inbound from Webex Calling – Nodes 1 to 5
Defines a VOIP dial-peer with a tag of 301 and a meaningful description is given for ease of management and troubleshooting.
session server-group 301
Instead of session target IP in the dial-peer, we are pointing to a Destination Server Group (server-group 301 for dial-peer 301) to define multiple target UCM nodes though the example only shows a single node.
Server Group in Outbound Dial Peer
With multiple dial-peers in the DPG and multiple servers in the dial-peer server group, we can achieve random distribution
of calls over all Unified CM call processing subscribers or hunt based on a defined preference. Each server group can have
up to five servers (IPv4/v6 with or without port). A second dial-peer and second server group is only required if more than
five call processing subscribers are used.
dial-peer voice 305 voip
description Outgoing dial-peer to CUCM-Group-1
for inbound from PSTN - Nodes 1 to 5
destination-pattern BAD.BAD
session protocol sipv2
session server-group 305
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
Second outbound dial-peer toward Unified CM’s PSTN Trunk if you have more than 5 Unified CM nodes:
dial-peer voice 307 voip
description Outgoing dial-peer to CUCM-Group-2
for inbound from PSTN - Nodes 6 to 10
destination-pattern BAD.BAD
session protocol sipv2
session server-group 307
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 100
no vad
5
Configure the following DPG:
Defines DPG 100. Outbound dial-peer 101 is the target for any incoming dial-peer invoking dial-peer group 100. We will apply DPG 100 to incoming dial-peer 302 defined later for the Unified CM --> LGW --> PSTN path:
voice class dpg 100
dial-peer 101 preference 1
Define DPG 200 with outbound dial-peer 201 as the target for Unified CM --> LGW --> Webex Calling path:
voice class dpg 200
dial-peer 201 preference 1
Define DPG 300 for outbound dial-peers 301 or 303 for the Webex Calling --> LGW --> Unified CM path:
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
session protocol sipv2
destination dpg 302
incoming uri via 100
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 300
no vad
Explanation of Commands
dial-peer voice 100 voip
description Incoming dial-peer from PSTN
Defines a VOIP dial-peer with a tag of 100 and a meaningful description is given for ease of management and troubleshooting.
session protocol sipv2
Specifies that this dial-peer will be handling SIP call legs.
incoming uri via 100
All incoming traffic from IP PSTN to LGW is matched on the incoming VIA header’s host IP address defined in voice class URI
100 SIP to match based on source IP (ITSP’s) address.
destination dpg 302
With the destination DPG 302, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination DPG 302, which can be either dial-peer 305 or dial-peer
307.
voice-class sip tenant 300
The dial-peer will inherit all the parameters from Tenant 300 unless that same parameter is defined under the dial-peer itself.
Inbound dial-peer for incoming Webex Calling call legs:
dial-peer voice 200 voip
description Incoming dial-peer from Webex Calling
session protocol sipv2
destination dpg 300
incoming uri via 200
incoming uri request 200
voice-class codec 99
dtmf-relay rtp-nte
voice-class stun-usage 200
voice-class sip tenant 200
srtp
no vad
Explanation of Commands
dial-peer voice 200 voip
description Incoming dial-peer from Webex Calling
Defines a VOIP dial-peer with a tag of 200 and a meaningful description is given for ease of management and troubleshooting.
incoming uri request 200
All incoming traffic from Webex Calling to LGW can be matched on the unique dtg pattern in the request URI, uniquely identifying a local gateway site within an Enterprise
and in the Webex Calling ecosystem.
destination dpg 300
With the destination DPG 300, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination DPG 300, which can be either dial-peer 301 or dial-peer
303.
voice-class stun-usage 200
The STUN bindings feature on the LGW allows locally generated STUN requests to be sent over the negotiated media path. This
helps in opening up the pinhole in the firewall.
voice-class sip tenant 200
The dial-peer inherits all the parameters from Tenant 200 unless that same parameter is defined under the dial-peer itself.
srtp
Enables SRTP for this call leg.
Inbound dial-peer for incoming Unified CM call legs with Webex Calling as the destination:
dial-peer voice 300 voip
description Incoming dial-peer from CUCM for Webex Calling
session protocol sipv2
destination dpg 200
incoming uri via 300
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 300
no vad
Explanation of Commands
dial-peer voice 300 voip
description Incoming dial-peer from CUCM for Webex Calling
Defines a VOIP dial-peer with a tag of 300 and a meaningful description is given for ease of management and troubleshooting.
incoming uri via 300
All incoming traffic from Unified CM to LGW is matched on the via source port (5065), defined in voice class URI 300 SIP.
destination dpg 200
With the destination DPG 200, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination DPG 200, which will be dial-peer 201.
voice-class sip tenant 300
The dial-peer will inherit all the parameters from Tenant 300 unless that same parameter is defined under the dial-peer itself.
Inbound dial-peer for incoming Unified CM call legs with PSTN as the destination:
dial-peer voice 302 voip
description Incoming dial-peer from CUCM for PSTN
session protocol sipv2
destination dpg 100
incoming uri via 302
voice-class codec 99
dtmf-relay rtp-nte
voice-class sip tenant 300
no vad
Explanation of Commands
dial-peer voice 302 voip
description Incoming dial-peer from CUCM for PSTN
Defines a VOIP dial-peer with a tag of 302 and a meaningful description is given for ease of management and troubleshooting.
incoming uri via 302
All incoming traffic from Unified CM to LGW for a PSTN destination is matched on the Unified CM source signaling IP address
and VIA port defined in voice class URI 302 SIP. Standard SIP port 5060 is used.
destination dpg 100
With the destination DPG 100, IOS-XE by passes the classic outbound dial-peer matching criteria and straight away proceeds
to setup the outgoing call leg using dial-peers defined within destination DPG 100, which will be dial-peer 101.
voice-class sip tenant 300
The dial-peer will inherit all the parameters from Tenant 300 unless that same parameter is defined under the dial-peer itself.
IP PSTN to Unified CM PSTN Trunk
Webex Calling Platform to Unified CM Webex Calling Trunk
Unified CM PSTN Trunk to IP PSTN
Unified CM Webex Calling Trunk to Webex Calling Platform
Product:Webex Calling
Activities:Administration, Calls
Operating System:Web Browser
Was this article helpful?
What was great?
Where did we go wrong?
Check out Webex Community, where experts and other members help answer questions every day. You can see if others have the same question, or make a new post about your specific issue.
Join the conversation
