개요

Webex Calling currently supports two versions of Local Gateway:

  • 로컬 게이트웨이

  • Local Gateway for Webex for Government

Key considerations

  • Before you begin, understand the premises-based Public Switched Telephone Network (PSTN) and Local Gateway (LGW) requirements for Webex Calling. 자세한 정보는 Webex Calling Cisco 선호하는 아키텍처를 참조하십시오.

  • 이 문서는 기존의 음성 구성이 없는 전용 로컬 게이트웨이 플랫폼이 위치하는 것으로 가정합니다. If you modify an existing PSTN gateway or CUBE Enterprise deployment to use as the Local Gateway function for Webex Calling, then pay careful attention to the configuration. Ensure that you don't interrupt the existing call flows and functionality because of the changes that you make.

The procedures contain links to command reference documentation where you can learn more about the individual command options. All command reference links go to the Webex Managed Gateways Command Reference unless stated otherwise (in which case, the command links go to Cisco IOS Voice Command Reference). You can access all these guides at Cisco Unified Border Element Command References.

For information on the supported third-party SBCs, refer to the respective product reference documentation.

Configure your Local Gateway

로컬 게이트웨이를 구성할 수 있는 두 가지 옵션이 Webex Calling 있습니다.

  • 등록 기반 트렁크

  • 인증서 기반 트렁크

Use the task flow either under the Registration-based Local Gateway or Certificate-based Local Gateway to configure Local Gateway for your Webex Calling trunk.

See Get started with Local Gateway for more information on different trunk types. CLI(Command Line Interface)를 사용하여 로컬 게이트웨이 자체에서 다음 단계를 실행합니다. We use Session Initiation Protocol (SIP) and Transport Layer Security (TLS) transport to secure the trunk and Secure Real Time Protocol (SRTP) to secure the media between the Local Gateway and Webex Calling.

Key considerations

Local Gateway for Webex for Government doesn’t support the following:

  • STUN/ICE-Lite for media path optimization

  • Fax (T.38)

Configure your Local Gateway for Webex for Government

To configure Local Gateway for your Webex Calling trunk in Webex for Government, use the following option:

  • 인증서 기반 트렁크

Use the task flow under the Certificate-based Local Gateway to configure the Local Gateway for your Webex Calling trunk. For more details on how to configure a certificate-based Local Gateway, see Configure Webex Calling certificate-based trunk.

It’s mandatory to configure FIPS-compliant GCM ciphers to support Local Gateway for Webex for Government. If not, the call setup fails. For configuration details, see Configure Webex Calling certificate-based trunk.

Webex for Government doesn’t support registration-based Local Gateway.

Design overview

This section describes how to configure a Cisco Unified Border Element (CUBE) as a Local Gateway for Webex Calling, using a registering SIP trunk. The first part of this document illustrates how to configure a simple PSTN gateway. In this case, all calls from the PSTN are routed to Webex Calling and all calls from Webex Calling are routed to the PSTN. The image below highlights this solution and the high-level call routing configuration that will be followed.

In this design, the following principal configurations are used:

  • voice class tenants: Used to create trunk specific configurations.

  • voice class uri: Used to classify SIP messages for the selection of an inbound dial-peer.

  • inbound dial-peer: Provides treatment for inbound SIP messages and determines the outbound route with a dial-peer group.

  • dial-peer group: Defines the outbound dial-peers used for onward call routing.

  • outbound dial-peer: Provides treatment for outbound SIP messages and routes them to the required target.

Call routing from/to PSTN to/from Webex Calling configuration solution

While IP and SIP have become the default protocols for PSTN trunks, TDM (Time Division Multiplexing) ISDN circuits are still widely used and are supported with Webex Calling trunks. To enable media optimization of IP paths for Local Gateways with TDM-IP call flows, it is currently necessary to use a two-leg call routing process. This approach modifies the call routing configuration shown above, by introducing a set of internal loop-back dial-peers between Webex Calling and PSTN trunks as illustrated in the image below.

When connecting an on-premises Cisco Unified Communications Manager solution with Webex Calling, you can use the simple PSTN gateway configuration as a baseline for building the solution illustrated in the following diagram. In this case, Unified Communications Manager provides centralized routing and treatment of all PSTN and Webex Calling calls.

Throughout this document, the host names, IP addresses, and interfaces illustrated in the following image are used.

Use the configuration guidance in the rest of this document to complete your Local Gateway configuration as follows:

  • 단계 1: Configure router baseline connectivity and security

  • 단계 2: Configure Webex Calling Trunk

    Depending on your required architecture, follow either:

  • 단계 3: Configure Local Gateway with SIP PSTN trunk

  • 단계 4: Configure Local Gateway with existing Unified CM environment

    또는:

  • 단계 3: Configure Local Gateway with TDM PSTN trunk

Configure connectivity and security

Baseline configuration

The first step in preparing your Cisco router as a Local Gateway for Webex Calling is to build a baseline configuration that secures your platform and establishes connectivity.

  • All registration-based Local Gateway deployments require Cisco IOS XE 17.6.1a or later versions. For the recommended versions, see the Cisco Software Research page. Search for the platform and select one of the suggested releases.

    • ISR4000 series routers must be configured with both Unified Communications and Security technology licenses.

    • Catalyst Edge 8000 series routers fitted with voice cards or DSPs require DNA Advantage licensing. Routers without voice cards or DSPs require a minimum of DNA Essentials licensing.

  • Build a baseline configuration for your platform that follows your business policies. In particular, configure the following and verify the working:

    • NTP

    • Acl

    • User authentication and remote access

    • DNS

    • IP 라우팅

    • IP addresses

  • The network toward Webex Calling must use an IPv4 address.

  • Upload the Cisco root CA bundle to the Local Gateway.

구성

1

Ensure that you assign valid and routable IP addresses to any Layer 3 interfaces, for example:

 interface GigabitEthernet0/0/0 description Interface facing PSTN and/or CUCM ip address 10.80.13.12 255.255.255.0 ! interface GigabitEthernet0/0/1 description Interface facing Webex Calling (Private address) ip address 192.51.100.1 255.255.255.240

2

Protect registration and STUN credentials on the router using symmetric encryption. Configure the primary encryption key and encryption type as follows:

 key config-key password-encrypt YourPassword password encryption aes

3

Create a placeholder PKI trustpoint.

Requires this trustpoint to configure TLS later. For registration-based trunks, this trustpoint doesn't require a certificate - as would be required for a certificate-based trunk.
 crypto pki trustpoint EmptyTP revocation-check none
4

Enable TLS1.2 exclusivity and specify the default trustpoint using the following configuration commands. Transport parameters should also be updated to ensure a reliable secure connection for registration:

The cn-san-validate server command ensures that the Local Gateway permits a connection if the host name configured in tenant 200 is included in either the CN or SAN fields of the certificate received from the outbound proxy.

  1. Set tcp-retry count to 1000 (5-msec multiples = 5 seconds).

  2. The timer connection establish command allows you to tune how long the LGW waits to set up a connection with a proxy before considering the next available option. The default for this timer is 20 seconds and the minimum 5 seconds. Start with a low value and increase if necessary to accommodate network conditions.

 sip-ua timers connection establish tls 5 transport tcp tls v1.2 crypto signaling default trustpoint EmptyTP cn-san-validate server tcp-retry 1000

5

Install the Cisco root CA bundle, which includes the DigiCert CA certificate used by Webex Calling. Use the crypto pki trustpool import clean url command to download the root CA bundle from the specified URL, and to clear the current CA trustpool, then install the new bundle of certificates:

If you need to use a proxy for access to the internet using HTTPS, add the following configuration before importing the CA bundle:

ip http client proxy-server yourproxy.com proxy-port 80
 ip http client source-interface GigabitEthernet0/0/1 crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b
Configure Webex Calling registration-based trunk
1

Create a registration based PSTN trunk for an existing location in Control Hub. Make a note of the trunk information that is provided once the trunk has been created. These details, as highlighted in the following illustration, will be used in the configuration steps in this guide. For more information, see Configure trunks, route groups, and dial plans for Webex Calling.

2

Enter the following commands to configure CUBE as a Webex Calling Local Gateway:

 voice service voip ip address trusted list ipv4 x.x.x.x y.y.y.y mode border-element media statistics media bulk-stats allow-connections sip to sip no supplementary-service sip refer stun stun flowdata agent-id 1 boot-count 4 stun flowdata shared-secret 0 Password123$ sip asymmetric payload full early-offer forced

구성에 대한 필드의 설명은 다음과 같습니다.

 ip address trusted list  ipv4 x.x.x.x y.y.y.y

  • To protect against toll fraud, the trusted address list defines a list of hosts and networks from which the Local Gateway expects legitimate VoIP calls.

  • By default, Local Gateway blocks all incoming VoIP messages from IP addresses not in its trusted list. Statically configured dial-peers with “session target IP” or server group IP addresses are trusted by default, so do not need to be added to the trusted list.

  • When configuring your Local Gateway, add the IP subnets of your regional Webex Calling data center to the list. 자세한 정보는 Webex Calling의 포트 참조 정보를 참조하십시오. Also, add address ranges for Unified Communications Manager servers (if used) and PSTN trunk gateways.

    If your LGW is behind a firewall with restricted cone NAT, you may prefer to disable the IP address trusted list on the Webex Calling facing interface. 방화벽은 이미 자발적인 인바운드 또는 인바운드로부터 VoIP. 비활성화 작업은 장기적인 구성 오버헤드를 줄입니다. 피어에 대한 Webex Calling 고정된 것으로 보장할 수 없습니다. 피어에 대해 방화벽을 구성해야 합니다.

mode border-element

Enables Cisco Unified Border Element (CUBE) features on the platform.

media statistics

로컬 게이트웨이에서 미디어 모니터링을 가능하게 합니다.

media bulk-stats

일괄 통화 통계에 대해 데이터가 저장되는 설문조사를 진행할 수 있습니다.

For more information on these commands, see Media.

allow-connections sip to sip

Enable CUBE basic SIP back-to-back user agent functionality. For more information, see Allow connections.

By default, T.38 fax transport is enabled. For more information, see fax protocol t38 (voice-service).

stun

Enables STUN (Session Traversal of UDP through NAT) globally.

  • Webex Calling 사용자에게 통화를 전달할 때(예: 전화하는 사용자 및 통화 사용자는 모두 Webex Calling 가입자, Webex Calling SBC에 미디어를 고정하는 경우), 핀홀이 열려 있지 않습니다. 미디어가 로컬 게이트웨이로 연결되지 않습니다.

  • The STUN bindings feature on the Local Gateway allows locally generated STUN requests to be sent over the negotiated media path. This helps to open the pinhole in the firewall.

For more information, see stun flowdata agent-id and stun flowdata shared-secret.

asymmetric payload full

Configures SIP asymmetric payload support for both DTMF and dynamic codec payloads. For more information on this command, see asymmetric payload.

early-offer forced

Forces the Local Gateway to send SDP information in the initial INVITE message instead of waiting for acknowledgment from the neighboring peer. For more information on this command, see early-offer.

3

Configure voice class codec 100 filter for the trunk. In this example, the same codec filter is used for all trunks. You can configure filters for each trunk for precise control.

 voice class codec 100 codec preference 1 opus codec preference 2 g711ulaw codec preference 3 g711alaw

구성에 대한 필드의 설명은 다음과 같습니다.

voice class codec 100

Used to only allow preferred codecs for calls through SIP trunks. For more information, see voice class codec.

Opus codec is supported only for SIP-based PSTN trunks. If the PSTN trunk uses a voice T1/E1 or analog FXO connection, exclude codec preference 1 opus from the voice class codec 100 configuration.

4

Configure voice class stun-usage 100 to enable ICE on the Webex Calling trunk.

 voice class stun-usage 100 stun usage firewall-traversal flowdata stun usage ice lite

구성에 대한 필드의 설명은 다음과 같습니다.

stun usage ice lite

Used to enable ICE-Lite for all Webex Calling facing dial-peers to allow media-optimization whenever possible. For more information, see voice class stun usage and stun usage ice lite.

You require stun usage of ICE-lite for call flows using media path optimization. To provide media-optimization for a SIP to TDM gateway, configure a loopback dial-peer with ICE-Lite enabled on the IP-IP leg. For further technical details, contact the Account or TAC teams

5

Configure the media encryption policy for Webex traffic.

 voice class srtp-crypto 100 crypto 1 AES_CM_128_HMAC_SHA1_80

구성에 대한 필드의 설명은 다음과 같습니다.

voice class srtp-crypto 100

Specifies SHA1_80 as the only SRTP cipher-suite CUBE offers in the SDP in offer and answer messages. Webex Calling only supports SHA1_80. For more information, see voice class srtp-crypto.

6

Configure a pattern to uniquely identify calls to a Local Gateway trunk based on its destination trunk parameter: 

 voice class uri 100 sip pattern dtg=Dallas1463285401_LGU

구성에 대한 필드의 설명은 다음과 같습니다.

voice class uri 100 sip

Defines a pattern to match an incoming SIP invite to an incoming trunk dial-peer. When entering this pattern, use dtg= followed by the Trunk OTG/DTG value provided in Control Hub when the trunk was created. For more information, see voice class uri.

7

Configure sip profile 100, which will be used to modify SIP messages before they are sent to Webex Calling.

 voice class sip-profiles 100 rule 10 request ANY sip-header SIP-Req-URI modify "sips:" "sip:" rule 20 request ANY sip-header To modify "<sips:" "<sip:" rule 30 request ANY sip-header From modify "<sips:" "<sip:" rule 40 request ANY sip-header Contact modify "<sips:(.*)>" "<sip:\1;transport=tls>" rule 50 response ANY sip-header To modify "<sips:" "<sip:" rule 60 response ANY sip-header From modify "<sips:" "<sip:" rule 70 response ANY sip-header Contact modify "<sips:" "<sip:" rule 80 request ANY sip-header From modify ">" ";otg=dallas1463285401_lgu>" rule 90 request ANY sip-header P-Asserted-Identity modify "sips:" "sip:"

구성에 대한 필드의 설명은 다음과 같습니다.

  • rule 10 to 70 and 90

    Ensures that SIP headers used for call signaling use the sip, rather than sips scheme, which is required by Webex proxies. Configuring CUBE to use sips ensures that secure registration is used.

  • rule 80

    Modifies the From header to include the trunk group OTG/DTG identifier from Control Hub to uniquely identify a Local Gateway site within an enterprise.

8

Configure Webex Calling trunk:

  1. Create voice class tenant 100 to define and group configurations required specifically for the Webex Calling trunk. In particular, the trunk registration details provided in Control Hub earlier will be used in this step as detailed below. Dial-peers associated with this tenant later will inherit these configurations.

    The following example uses the values illustrated in Step 1 for the purpose of this guide (shown in bold). Replace these with values for your trunk in your configuration.

     voice class tenant 100 registrar dns:98027369.us10.bcld.webex.com scheme sips expires 240 refresh-ratio 50 tcp tls credentials number Dallas1171197921_LGU username Dallas1463285401_LGU password 0 9Wt[M6ifY+ realm BroadWorks authentication username Dallas1463285401_LGU password 0 9Wt[M6ifY+ realm BroadWorks authentication username Dallas1463285401_LGU password 0 9Wt[M6ifY+ realm 98027369.us10.bcld.webex.com no remote-party-id sip-server dns:98027369.us10.bcld.webex.com connection-reuse srtp-crypto 100 session transport tcp tls url sips error-passthru asserted-id pai bind control source-interface GigabitEthernet0/0/1 bind media source-interface GigabitEthernet0/0/1 no pass-thru content custom-sdp sip-profiles 100 outbound-proxy dns:dfw04.sipconnect-us.bcld.webex.com privacy-policy passthru

    구성에 대한 필드의 설명은 다음과 같습니다.

    voice class tenant 100

    Defines a set of configuration parameters that will be used only for the Webex Calling trunk. For more information, see voice class tenant.

    registrar dns:98027369.us10.bcld.webex.com scheme sips expires 240 refresh-ratio 50 tcp tls

    등록이 설정된 로컬 게이트웨이에 대한 등록 서버는 매 2분마다 새로 고침됩니다(50%240초). For more information, see registrar.

    Ensure that you use the Register Domain value from Control Hub here.

    credentials number Dallas1171197921_LGU username Dallas1463285401_LGU password 0 9Wt[M6ifY+ realm BroadWorks

    트렁크 등록 챌린지용 자격 증명. For more information, see credentials (SIP UA).

    Ensure that you use the Line/Port host, Authentication Username and Authentication Password values respectively from Control Hub here.

    authentication username Dallas1171197921_LGU password 0 9Wt[M6ifY+ realm BroadWorks
    authentication username Dallas1171197921_LGU password 0 9Wt[M6ifY+ realm 98027369.us10.bcld.webex.com

    통화에 대한 인증 챌린지. For more information, see authentication (dial-peer).

    Ensure that you use the Authentication Username, Authentication Password and Registrar Domain values respectively from Control Hub here.

    no remote-party-id

    Disable SIP Remote-Party-ID (RPID) header as Webex Calling supports PAI, which is enabled using CIO asserted-id pai. For more information, see remote-party-id.

    sip-server dns:us25.sipconnect.bcld.webex.com

    Configures the target SIP server for the trunk. Use the edge proxy SRV address provided in Control Hub when you created your trunk.

    connection-reuse

    등록 및 통화 처리에 대해 동일한 지속적인 연결을 사용. For more information, see connection-reuse.

    srtp-crypto 100

    Configures the preferred cipher-suites for the SRTP call leg (connection) (specified in step 5). For more information, see voice class srtp-crypto.

    session transport tcp tls

    전송을 TLS로 설정합니다. For more information, see session-transport.

    url sips

    SRV 쿼리는 액세스 SBC에서 지원하는 SIP가 되어야 합니다. 기타 모든 메시지는 sip-프로필 200에 의해 SIP로 변경됩니다.

    error-passthru

    SIP 오류 응답 통과 기능을 지정합니다. For more information, see error-passthru.

    asserted-id pai

    로컬 게이트웨이에서 PAI 프로세싱을 켜 습니다. For more information, see asserted-id.

    bind control source-interface GigabitEthernet0/0/1

    Configures the source interface and associated IP address for messages sent to WebexCalling. For more information, see bind.

    bind media source-interface GigabitEthernet0/0/1

    Configures the source interface and associated IP address for media sent to WebexCalling. For more information, see bind.

    no pass-thru content custom-sdp

    테넌트 아래의 기본 명령어. For more information on this command, see pass-thru content.

    sip-profiles 100

    Changes SIPs to SIP and modify Line/Port for INVITE and REGISTER messages as defined in sip-profiles 100. For more information, see voice class sip-profiles.

    outbound-proxy dns:dfw04.sipconnect-us.bcld.webex.com

    Webex Calling SBC에 액세스합니다. Insert the Outbound Proxy Address provided in Control Hub when you created your trunk. For more information, see outbound-proxy.

    privacy-policy passthru

    Configures the privacy header policy options for the trunk to pass privacy values from the received message to the next call leg. For more information, see privacy-policy.

  2. Configure the Webex Calling trunk dial-peer. 

     dial-peer voice 100 voip description Inbound/Outbound Webex Calling max-conn 250 destination-pattern BAD.BAD session protocol sipv2 session target sip-server incoming uri request 100 voice-class codec 100 dtmf-relay rtp-nte voice-class stun-usage 100 no voice-class sip localhost voice-class sip tenant 100 srtp no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 100 voip  description Inbound/Outbound Webex Calling

    100 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다.

    max-conn 250

    Restricts the number of concurrent inbound and outbound calls between the LGW and Webex Calling. For registration trunks, the maximum value configured should be 250. Usea lower value if that would be more appropriate for your deployment. For more information on concurrent call limits for Local Gateway, refer to the Get started with Local Gateway document.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    다이얼-피어 100 이 SIP 통화 레그를 처리하게 지정합니다. For more information, see session protocol (dial-peer).

    session target sip-server

    Indicates that the SIP server defined in tenant 100 is inherited and used for the destination for calls from this dial peer.

    incoming uri request 100

    To specify the voice class used to match a VoIP dial peer to the uniform resource identifier (URI) of an incoming call. For more information, see incoming uri.

    voice-class codec 100

    Configures the dial-peer to use the common codec filter list 100. For more information, see voice-class codec.

    voice-class stun-usage 100

    Allows locally generated STUN requests on the Local Gateway to be sent over the negotiated media path. STUN helps to open a firewall pinhole for media traffic.

    no voice-class sip localhost

    발신 메시지의 보낸 곳, 통화-ID 및 원격-사용자-ID 헤더에 있는 물리적 IP 주소 대신 DNS 로컬 호스트 이름의 하위 기능을 비활성화합니다.

    voice-class sip tenant 100

    The dial-peer inherits all parameters configured globally and in tenant 100. Parameters may be overridden at the dial-peer level.

    srtp

    통화 레그에 대해 SRTP를 가능하게 합니다.

    no vad

    음성 활동 탐지를 비활성화합니다.

After you define tenant 100 and configure a SIP VoIP dial-peer, the gateway initiates a TLS connection toward Webex Calling. At this point the access SBC presents its certificate to the Local Gateway. The Local Gateway validates the Webex Calling access SBC certificate using the CA root bundle that was updated earlier. If the certificate is recognised, a persistent TLS session is established between the Local Gateway and Webex Calling access SBC. The Local Gateway is then able to use this secure connection to register with the Webex access SBC. When the registration is challenged for authentication:

  • The username, password, and realm parameters from the credentials configuration is used in the response.

  • The modification rules in sip profile 100 are used to convert SIPS URL back to SIP.

Registration is successful when a 200 OK is received from the access SBC.

Configure Local Gateway with a SIP PSTN trunk

Having built a trunk towards Webex Calling above, use the following configuration to create a non-encrypted trunk towards a SIP based PSTN provider:

If your Service Provider offers a secure PSTN trunk, you may follow a similar configuration as detailed above for the Webex Calling trunk. Secure to secure call routing is supported by CUBE.

If you are using a TDM / ISDN PSTN trunk, skip to next section Configure Local Gateway with TDM PSTN trunk.

To configure TDM interfaces for PSTN call legs on the Cisco TDM-SIP Gateways, see  Configuring ISDN PRI.

1

Configure the following voice class uri to identify inbound calls from the PSTN trunk:

 voice class uri 200 sip host ipv4:192.168.80.13

구성에 대한 필드의 설명은 다음과 같습니다.

voice class uri 200 sip

Defines a pattern to match an incoming SIP invite to an incoming trunk dial-peer. When entering this pattern, use the IP address of you IP PSTN gateway. For more information, see  voice class uri.

2

Configure the following IP PSTN dial-peer:

 dial-peer voice 200 voip description Inbound/Outbound IP PSTN trunk destination-pattern BAD.BAD session protocol sipv2 session target ipv4:192.168.80.13 incoming uri via 200 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 voice-class codec 100 dtmf-relay rtp-nte no vad

구성에 대한 필드의 설명은 다음과 같습니다.

 dial-peer voice 200 voip  description Inbound/Outbound IP PSTN trunk

200 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다. For more information, see dial-peer voice.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

session protocol sipv2

다이얼-피어 200 이 SIP 통화 레그를 처리하게 지정합니다. For more information, see session protocol (dial peer).

session target ipv4:192.168.80.13

통화 레그를 보낼 대상 IPv4 주소를 나타냅니다. 여기에 있는 세션 대상은 ITSP의 IP 주소입니다. For more information, see  session target (VoIP dial peer).

incoming uri via 200

IP 네트워크의 IP 주소로 VIA 헤더에 대한 PSTN 정의합니다. Matches all incoming IP PSTN call legs on the Local Gateway with dial-peer 200. For more information, see  incoming url.

bind control source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

bind media source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

voice-class codec 100

Configures the dial-peer to use the common codec filter list 100. For more information, see voice-class codec.

dtmf-relay rtp-nte

RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see DTMF Relay (Voice over IP).

no vad

음성 활동 탐지를 비활성화합니다. For more information, see vad (dial peer).

3

If you are configuring your Local Gateway to only route calls between Webex Calling and the PSTN, add the following call routing configuration. If you are configuring your Local Gateway with a Unified Communications Manager platform, skip to the next section.

  1. Create dial-peer groups to route calls towards Webex Calling or the PSTN. Define DPG 100 with outbound dial-peer 100 toward Webex Calling. DPG 100 is applied to the incoming dial-peer from the PSTN. Similarly, define DPG 200 with outbound dial-peer 200 toward the PSTN. DPG 200 is applied to the incoming dial-peer from Webex.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 200 description Route calls to PSTN dial-peer 200

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer 100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  2. Apply dial-peer groups to route calls from Webex to the PSTN and from the PSTN to Webex: 

     dial-peer voice 100 destination dpg 200 dial-peer voice 200 destination dpg 100

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 200

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

    This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features are configured.

Configure Local Gateway with a TDM PSTN trunk

Having built a trunk towards Webex Calling, use the following configuration to create a TDM trunk for your PSTN service with loop-back call routing to allow media optimization on the Webex call leg.

If you do not require IP media optimization, follow the configuration steps for a SIP PSTN trunk. Use a voice port and POTS dial-peer (as shown in Steps 2 and 3) instead of the PSTN VoIP dial-peer.
1

The loop-back dial-peer configuration uses dial-peer groups and call routing tags to ensure that calls pass correctly between Webex and the PSTN, without creating call routing loops. Configure the following translation rules that will be used to add and remove the call routing tags:

 voice translation-rule 100 rule 1 /^\+/ /A2A/ voice translation-profile 100 translate called 100 voice translation-rule 200 rule 1 /^/ /A1A/ voice translation-profile 200 translate called 200 voice translation-rule 11 rule 1 /^A1A/ // voice translation-profile 11 translate called 11 voice translation-rule 12 rule 1 /^A2A44/ /0/ rule 2/^A2A/ /00/ voice translation-profile 12 translate called 12

구성에 대한 필드의 설명은 다음과 같습니다.

voice translation-rule

Uses regular expressions defined in rules to add or remove call routing tags. Over-decadic digits (‘A’) are used to add clarity for troubleshooting.

In this configuration, the tag added by translation-profile 100 is used to guide calls from Webex Calling towards the PSTN via the loopback dial-peers. Similarly, the tag added by translation-profile 200 is used to guide calls from the PSTN towards Webex Calling. Translation-profiles 11 and 12 remove these tags before delivering calls to the Webex and PSTN trunks respectively.

This example assumes that called numbers from Webex Calling are presented in +E.164 format. Rule 100 removes the leading + to maintain a valid called number. Rule 12 then adds a national or international routing digit(s) when removing the tag. Use digits that suit your local ISDN national dial plan.

If Webex Calling presents numbers in national format, adjust rules 100 and 12 to simply add and remove the routing tag respectively.

For more information, see voice translation-profile and voice translation-rule.

2

Configure TDM voice interface ports as required by the trunk type and protocol used. For more information, see Configuring ISDN PRI. For example, the basic configuration of a Primary Rate ISDN interface installed in NIM slot 2 of a device might include the following:

 card type e1 0 2 isdn switch-type primary-net5 controller E1 0/2/0 pri-group timeslots 1-31
3

Configure the following TDM PSTN dial-peer:

 dial-peer voice 200 pots description Inbound/Outbound PRI PSTN trunk destination-pattern BAD.BAD translation-profile incoming 200 direct-inward-dial port 0/2/0:15

구성에 대한 필드의 설명은 다음과 같습니다. 

 dial-peer voice 200 pots  description Inbound/Outbound PRI PSTN trunk

200 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다. For more information, see dial-peer voice.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

translation-profile incoming 200

Assigns the translation profile that will add a call routing tag to the incoming called number.

direct-inward-dial

Routes the call without providing a secondary dial-tone. For more information, see direct-inward-dial.

port 0/2/0:15

The physical voice port associated with this dial-peer.

4

To enable media optimization of IP paths for Local Gateways with TDM-IP call flows, you can modify the call routing by introducing a set of internal loop-back dial-peers between Webex Calling and PSTN trunks. Configure the following loop-back dial-peers. In this case, all incoming calls will be routed initially to dial-peer 10 and from there to either dial-peer 11 or 12 based on the applied routing tag. After removal of the routing tag, calls will be routed to the outbound trunk using dial-peer groups.

 dial-peer voice 10 voip description Outbound loop-around leg destination-pattern BAD.BAD session protocol sipv2 session target ipv4:192.168.80.14 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad dial-peer voice 11 voip description Inbound loop-around leg towards Webex translation-profile incoming 11 session protocol sipv2 incoming called-number A1AT voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad dial-peer voice 12 voip description Inbound loop-around leg towards PSTN translation-profile incoming 12 session protocol sipv2 incoming called-number A2AT voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad

구성에 대한 필드의 설명은 다음과 같습니다. 

 dial-peer voice 10 pots  description Outbound loop-around leg

Defines a VoIP dial-peer and gives a meaningful description for ease of management and troubleshooting. For more information, see dial-peer voice.

translation-profile incoming 11

Applies the translation profile defined earlier to remove the call routing tag before passing to the outbound trunk.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

session protocol sipv2

Specifies that this dial-peer handles SIP call legs. For more information, see  session protocol (dial peer).

session target 192.168.80.14

Specifies the local router interface address as the call target to loop-back. For more information, see session target (voip dial peer).

bind control source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for messages sent through the loop-back. For more information, see  bind.

bind media source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for media sent through the loop-back. For more information, see  bind.

dtmf-relay rtp-nte

RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

codec g711alaw

Forces all PSTN calls to use G.711. Select a-law or u-law to match the companding method used by your ISDN service.

no vad

음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

5

Add the following call routing configuration:

  1. Create dial-peer groups to route calls between the PSTN and Webex trunks, via the loop-back.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 200 description Route calls to PSTN dial-peer 200 voice class dpg 10 description Route calls to Loopback dial-peer 10

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer 100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  2. Apply dial-peer groups to route calls.

     dial-peer voice 100 destination dpg 10 dial-peer voice 200 destination dpg 10 dial-peer voice 11 destination dpg 100 dial-peer voice 12 destination dpg 200

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 200

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features are configured.
기존의 Unified CM 환경에서 로컬 게이트웨이 구성

The PSTN-Webex Calling configuration in the previous sections may be modified to include additional trunks to a Cisco Unified Communications Manager (UCM) cluster. In this case, all calls are routed via Unified CM. Calls from UCM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling. The following incremental configurations may be added to include this calling scenario.

When creating the Webex Calling trunk in Unified CM, ensure that you configure the incoming port in the SIP Trunk Security Profile settings to 5065. This allows incoming messages on port 5065 and populate the VIA header with this value when sending messages to the Local Gateway.

1

다음 음성 클래스 URI를 구성합니다.

  1. Classifies Unified CM to Webex calls using SIP VIA port:

     voice class uri 300 sip
 pattern :5065

  2. Classifies Unified CM to PSTN calls using SIP via port:

     voice class uri 400 sip pattern 192\.168\.80\.6[0-5]:5060

    Classify incoming messages from the UCM towards the PSTN trunk using one or more patterns that describe the originating source addresses and port number. Regular expressions may be used to define matching patterns if required.

    In the example above, a regular expression is used to match any IP address in the range 192.168.80.60 to 65 and port number 5060.

2

Configure the following DNS records to specify SRV routing to Unified CM hosts:

IOS XE uses these records for locally determining target UCM hosts and ports. With this configuration, it is not required to configure records in your DNS system. If you prefer to use your DNS, then these local configurations are not required.

 ip host ucmpub.mydomain.com 192.168.80.60 ip host ucmsub1.mydomain.com 192.168.80.61 ip host ucmsub2.mydomain.com 192.168.80.62 ip host ucmsub3.mydomain.com 192.168.80.63 ip host ucmsub4.mydomain.com 192.168.80.64 ip host ucmsub5.mydomain.com 192.168.80.65 ip host _sip._udp.wxtocucm.io srv 0 1 5065 ucmpub.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub1.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub2.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub3.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub4.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub5.mydomain.com ip host _sip._udp.pstntocucm.io srv 0 1 5060 ucmpub.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub1.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub2.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub3.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub4.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub5.mydomain.com

구성에 대한 필드의 설명은 다음과 같습니다.

The following command creates a DNS SRV resource record. Create a record for each UCM host and trunk:

ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub5.mydomain.com

_sip._udp.pstntocucm.io: SRV resource record name

2: The SRV resource record priority

1: The SRV resource record weight

5060: The port number to use for the target host in this resource record

ucmsub5.mydomain.com: The resource record target host

To resolve the resource record target host names, create local DNS A records. 예:

ip host ucmsub5.mydomain.com 192.168.80.65

ip host: Creates a record in the local IOS XE database.

ucmsub5.mydomain.com: The A record host name.

192.168.80.65: The host IP address.

Create the SRV resource records and A records to reflect your UCM environment and preferred call distribution strategy.

3

Configure the following dial-peers:

  1. Dial-peer for calls between Unified CM and Webex Calling:

     dial-peer voice 300 voip description UCM-Webex Calling trunk destination-pattern BAD.BAD session protocol sipv2 session target dns:wxtocucm.io incoming uri via 300 voice-class codec 100 voice-class sip bind control source-interface GigabitEthernet 0/0/0 voice-class sip bind media source-interface GigabitEthernet 0/0/0 dtmf-relay rtp-nte no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 300 voip  description UCM-Webex Calling trunk

    Defines a VoIP dial-peer with a tag 300 and gives a meaningful description for ease of management and troubleshooting.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    Specifies that dial-peer 300 handles SIP call legs. For more information, see  session protocol (dial-peer).

    session target dns:wxtocucm.io

    Defines the session target of multiple Unified CM nodes through DNS SRV resolution. In this case, the locally defined SRV record wxtocucm.io is used to direct calls.

    incoming uri via 300

    Uses voice class URI 300 to direct all incoming traffic from Unified CM using source port 5065 to this dial-peer. For more information, see  incoming uri.

    voice-class codec 100

    Indicates codec filter list for calls to and from Unified CM. For more information, see  voice class codec.

    bind control source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

    bind media source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

    dtmf-relay rtp-nte

    RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

    no vad

    음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

  2. Dial-peer for calls between Unified CM and the PSTN:

     dial-peer voice 400 voip description UCM-PSTN trunk destination-pattern BAD.BAD session protocol sipv2 session target dns:pstntocucm.io incoming uri via 400 voice-class codec 100 voice-class sip bind control source-interface GigabitEthernet 0/0/0 voice-class sip bind media source-interface GigabitEthernet 0/0/0 dtmf-relay rtp-nte no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 400 voip  description UCM-PSTN trunk

    400 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    Specifies that dial-peer 400 handles SIP call legs. For more information, see  session protocol (dial-peer).

    session target dns:pstntocucm.io

    Defines the session target of multiple Unified CM nodes through DNS SRV resolution. In this case, the locally defined SRV record pstntocucm.io is used to direct calls.

    incoming uri via 400

    Uses voice class URI 400 to direct all incoming traffic from the specified Unified CM hosts using source port 5060 to this dial-peer. For more information, see  incoming uri.

    voice-class codec 100

    Indicates codec filter list for calls to and from Unified CM. For more information, see  voice class codec.

    bind control source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

    bind media source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

    dtmf-relay rtp-nte

    RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

    no vad

    음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

4

Add call routing using the following configurations:

  1. Create dial-peer groups to route calls between Unified CM and Webex Calling. Define DPG 100 with outbound dial-peer 100 towards Webex Calling. DPG 100 is applied to the associated incoming dial-peer from Unified CM. Similarly, define DPG 300 with outbound dial-peer 300 toward Unified CM. DPG 300 is applied to the incoming dial-peer from Webex.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 300 description Route calls to Unified CM Webex Calling trunk dial-peer 300

  2. Create a dial-peer groups to route calls between Unified CM and the PSTN. Define DPG 200 with outbound dial-peer 200 toward the PSTN. DPG 200 is applied to the associated incoming dial-peer from Unified CM. Similarly, define DPG 400 with outbound dial-peer 400 toward Unified CM. DPG 400 is applied to the incoming dial-peer from the PSTN.

     voice class dpg 200 description Route calls to PSTN dial-peer 200 voice class dpg 400 description Route calls to Unified CM PSTN trunk dial-peer 400

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer  100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  3. Apply dial-peer groups to route calls from Webex to Unified CM and from Unified CM to Webex: 

     dial-peer voice 100 destination dpg 300 dial-peer voice 300 destination dpg 100

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 300

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

  4. Apply dial-peer groups to route calls from the PSTN to Unified CM and from Unified CM to the PSTN:

     dial-peer voice 200 destination dpg 400 dial-peer voice 400 destination dpg 200

    This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features have been configured.

진단 서명을 사용하여 로컬 게이트웨이를 모니터하고 문제 해결하기

진단 서명(DS)은 IOS XE 기반 로컬 게이트웨이에서 일반적으로 관찰되는 문제를 사전적으로 탐지하고 이벤트의 이메일, 시스로그 또는 터미널 메시지 알림을 생성합니다. You can also install the DS to automate diagnostics data collection and transfer-collected data to the Cisco TAC case to accelerate resolution time.

진단 서명(DS)은 문제 발생에 대한 정보 및 문제를 알리고, 문제 해결 및 수정하기 위해 실행되는 작업에 대한 정보를 포함하는 XML 파일입니다. You can define the problem detection logic using syslog messages, SNMP events and through periodic monitoring of specific show command outputs.

작업 유형은 표시 명령어 출력 수집을 포함합니다. 다음:

  • 통합 로그 파일 생성

  • Uploading the file to a user-provided network location such as HTTPS, SCP, FTP server.

TAC 엔지니어는 DS 파일을 작성하고 디지털로 서명하여 완전성을 보호합니다. 각 DS 파일에는 시스템이 지정한 고유한 숫자 ID가 있습니다. Diagnostic Signatures Lookup Tool (DSLT) is a single source to find applicable signatures for monitoring and troubleshooting various problems.

시작하기 전에:

  • DSLT에서 다운로드한 DS 파일을 편집 하지 않습니다. 완전성 검사 오류로 인해 수정한 파일 설치에 실패합니다.

  • 로컬 게이트웨이가 이메일 알림을 발송하기 위해 필요한 간단한 메일 전송 프로토콜(SMTP) 서버입니다.

  • 이메일 통지에 대해 보안 SMTP 서버를 사용하고자 하는 경우, 로컬 게이트웨이가 IOS XE 17.6.1 이상을 실행하고 있도록 합니다.

전제 조건

Local Gateway running IOS XE 17.6.1a or higher

  1. 진단 서명은 기본적으로 활성화됩니다.

  2. Configure the secure email server to be used to send proactive notification if the device is running Cisco IOS XE 17.6.1a or higher.

    configure terminal call-home mail-server <username>:<pwd>@<email server> priority 1 secure tls end

  3. Configure the environment variable ds_email with the email address of the administrator to notify you. 

    configure terminal call-home diagnostic-signature environment ds_email <email address> end

The following shows an example configuration of a Local Gateway running on Cisco IOS XE 17.6.1a or higher to send the proactive notifications to tacfaststart@gmail.com using Gmail as the secure SMTP server:

We recommend you to use the Cisco IOS XE Bengaluru 17.6.x or later versions.

call-home mail-server tacfaststart:password@smtp.gmail.com priority 1 secure tls diagnostic-signature environment ds_email "tacfaststart@gmail.com"

Cisco IOS XE 소프트웨어에서 실행되는 로컬 게이트웨이는 OAuth를 지원하는 일반적인 웹 기반 Gmail 클라이언트가 아니기 때문에 특정 Gmail 계정 설정을 구성하고 장치에서 이메일을 올바르게 처리하려면 특정 권한을 제공해야 합니다.

  1. Go to Manage Google Account > Security and turn on the Less secure app access setting.

  2. Gmail에서 "Google이 아닌 앱을 사용하여 사용자의 계정에 로그인하는 것을 차단했습니다"라는 이메일을 수신하면 "예. 저도 그렇습니다"에 응답합니다.

사전 모니터링을 위해 진단 서명 설치

높은 CPU 이용 모니터링하기

This DS tracks CPU utilization for five seconds using the SNMP OID 1.3.6.1.4.1.9.2.1.56. 사용률이 75% 이상이면 모든 디버그를 비활성화하고 로컬 게이트웨이에 설치된 모든 진단 서명을 제거합니다. 서명을 설치하려면 아래 단계를 따르십시오.

  1. Use the show snmp command to enable SNMP. If you do not enable, then configure the snmp-server manager command.

    show snmp %SNMP agent not enabled config t snmp-server manager end show snmp Chassis: ABCDEFGHIGK 149655 SNMP packets input      0 Bad SNMP version errors      1 Unknown community name      0 Illegal operation for community name supplied      0 Encoding errors 37763 Number of requested variables      2 Number of altered variables 34560 Get-request PDUs 138 Get-next PDUs      2 Set-request PDUs      0 Input queue packet drops (Maximum queue size 1000) 158277 SNMP packets output      0 Too big errors (Maximum packet size 1500) 20 No such name errors      0 Bad values errors      0 General errors 7998 Response PDUs 10280 Trap PDUs Packets currently in SNMP process input queue: 0 
SNMP global trap: 활성화됨

  2. 다음과 같이 진단 서명 검색 도구에서 다음 드롭다운 옵션을 사용하여 DS 64224를 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR Series or Cisco CSR 1000V Series

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    성능

    문제 유형

    이메일 알림에서 높은 CPU 이용.

  3. DS XML 파일을 로컬 게이트웨이 플래시로 복사합니다.

    LocalGateway# copy ftp://username:password@<server name or ip>/DS_64224.xml bootflash:

    다음 예제는 FTP 서버에서 로컬 게이트웨이로 파일을 복사하는 방법을 보여줍니다. 

    copy ftp://user:pwd@192.0.2.12/DS_64224.xml bootflash:  Accessing ftp://*:*@ 192.0.2.12/DS_64224.xml...!  [OK - 3571/4096 bytes] 3571 bytes copied in 0.064 secs (55797 bytes/sec)

  4. 로컬 게이트웨이에서 DS XML 파일을 설치합니다.

    call-home diagnostic-signature load DS_64224.xml Load file DS_64224.xml success

  5. 통화- 홈 진단 서명 표시 명령어를 사용하여 서명이 성공적으로 설치 있는지 확인합니다. 상태 열에는 "등록됨" 값이 표시되어야 합니다. 

    show call-home diagnostic-signature Current diagnostic-signature settings:  Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: username@gmail.com

    DSes 다운로드:

    DS ID

    DS 이름

    개정

    상태

    마지막 업데이트(GMT+00:00)

    64224

    DS_LGW_CPU_MON75

    0.0.10

    등록됨

    2020-11-07 22:05:33

    트리거되면 이 서명은 서명 자체를 포함하여 실행 중인 모든 DS를 제거합니다. If necessary, reinstall DS 64224 to continue monitoring high CPU utilization on the Local Gateway.

SIP 트렁크 등록 모니터링하기

이 DS는 60초마다 SIP 트렁크 클라우드와 로컬 게이트웨이 Webex Calling 확인합니다. Once the unregistration event is detected, it generates an email and syslog notification and uninstalls itself after two unregistration occurrences. Use the steps below to install the signature:

  1. 다음과 같이 진단 서명 검색 도구에서 다음 드롭다운 옵션을 사용하여 DS 64117를 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR 시리즈 또는 Cisco CSR 1000V 시리즈

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    SIP-SIP

    문제 유형

    SIP 트렁크 알림에 대한 등록을 변경하지 않습니다.

  2. DS XML 파일을 로컬 게이트웨이로 복사합니다.

    copy ftp://username:password@<server name or ip>/DS_64117.xml bootflash:

  3. 로컬 게이트웨이에서 DS XML 파일을 설치합니다. 

    call-home diagnostic-signature load DS_64117.xml Load file DS_64117.xml success LocalGateway#

  4. 통화- 홈 진단 서명 표시 명령어를 사용하여 서명이 성공적으로 설치 있는지 확인합니다. 상태 열에는 "등록된" 값이 있어야 합니다.

비정상적인 통화 연결 끊기 모니터링 중

This DS uses SNMP polling every 10 minutes to detect abnormal call disconnect with SIP errors 403, 488 and 503.  If the error count increment is greater than or equal to 5 from the last poll, it generates a syslog and email notification. Please use the steps below to install the signature.

  1. Use the show snmp command to check whether SNMP is enabled. If it is not enabled, configure the snmp-server manager command. 

    show snmp %SNMP agent not enabled config t snmp-server manager end show snmp Chassis: ABCDEFGHIGK 149655 SNMP packets input      0 Bad SNMP version errors      1 Unknown community name      0 Illegal operation for community name supplied      0 Encoding errors 37763 Number of requested variables      2 Number of altered variables 34560 Get-request PDUs 138 Get-next PDUs      2 Set-request PDUs      0 Input queue packet drops (Maximum queue size 1000) 158277 SNMP packets output      0 Too big errors (Maximum packet size 1500) 20 No such name errors      0 Bad values errors      0 General errors 7998 Response PDUs 10280 Trap PDUs Packets currently in SNMP process input queue: 0 
SNMP global trap: 활성화됨

  2. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 65221을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR 시리즈 또는 Cisco CSR 1000V 시리즈

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    성능

    문제 유형

    이메일 및 시스로그 알림에서 SIP 비정상적인 통화 연결 끊기 탐지.

  3. DS XML 파일을 로컬 게이트웨이로 복사합니다. 

    copy ftp://username:password@<server name or ip>/DS_65221.xml bootflash:

  4. 로컬 게이트웨이에서 DS XML 파일을 설치합니다. 

    call-home diagnostic-signature load DS_65221.xml Load file DS_65221.xml success

  5. 통화- 홈 진단 서명 표시 명령어를 사용하여 서명이 성공적으로 설치 있는지 확인합니다. 상태 열에는 "등록된" 값이 있어야 합니다.

진단 서명을 설치하여 문제를 해결

진단 서명(DS)을 사용하여 빠르게 문제를 해결합니다. Cisco TAC 엔지니어는 주어진 문제를 해결하기 위해 필요한 디버그를 활성화하고, 문제점 발생 탐지, 진단 데이터의 올바른 집합을 수집, Cisco TAC 사례로 데이터를 자동으로 전송하는 다양한 서명을 생성했습니다. Diagnostic Signatures (DS) eliminate the need to manually check for the problem occurrence and makes troubleshooting of intermittent and transient issues a lot easier.

진단 서명 찾기 도구를 사용하여 해당하는 서명을 찾고 설치하여 주어진 문제를 자체 해결하거나, TAC 엔지니어가 지원 참여의 일부로 권장하는 서명을 설치할 수 있습니다.

다음 항목을 탐지하기 위해 DS를 찾고 설치하는 방법의 예제는 다음과 같습니다. “%VOICE_IEC-3-GW: CCAPI: 내부 오류 (통화 spike 임계값): IEC=1.1.181.1.29.0" 시스로그 및 다음 단계를 사용하여 진단 데이터 수집을 자동화합니다.

  1. Configure an additional DS environment variable ds_fsurl_prefix which is the Cisco TAC file server path (cxd.cisco.com) to which the collected diagnostics data are uploaded. The username in the file path is the case number and the password is the file upload token which can be retrieved from Support Case Manager in the following command. The file upload token can be generated in the Attachments section of the Support Case Manager, as needed. 

    configure terminal call-home diagnostic-signature LocalGateway(cfg-call-home-diag-sign)environment ds_fsurl_prefix "scp://<case number>:<file upload token>@cxd.cisco.com" end

    예: 

    call-home diagnostic-signature environment ds_fsurl_prefix " environment ds_fsurl_prefix "scp://612345678:abcdefghijklmnop@cxd.cisco.com"

  2. Ensure that SNMP is enabled using the show snmp command. If it is not enabled, configure the snmp-server manager command.

    show snmp %SNMP agent not enabled config t snmp-server manager end

  3. 높은 CPU 모니터링 DS 64224를 사전 대책으로 설치하여 높은 CPU 사용률 동안 모든 디버그 및 진단 서명을 비활성화합니다. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 64224을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR 시리즈 또는 Cisco CSR 1000V 시리즈

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    성능

    문제 유형

    이메일 알림에서 높은 CPU 이용.

  4. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 65095을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR 시리즈 또는 Cisco CSR 1000V 시리즈

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    시스로그

    문제 유형

    Syslog - %VOICE_IEC-3-GW: CCAPI: 내부 오류 (통화 spike 임계값): IEC=1.1.181.1.29.0

  5. DS XML 파일을 로컬 게이트웨이에 복사합니다.

    copy ftp://username:password@<server name or ip>/DS_64224.xml bootflash:  copy ftp://username:password@<server name or ip>/DS_65095.xml bootflash:

  6. 높은 CPU 모니터링 DS 64224를 설치한 후 로컬 게이트웨이에 DS 65095 XML 파일을 설치합니다. 

    call-home diagnostic-signature load DS_64224.xml Load file DS_64224.xml success call-home diagnostic-signature load DS_65095.xml Load file DS_65095.xml success

  7. Verify that the signature is successfully installed using the show call-home diagnostic-signature command. 상태 열에는 "등록된" 값이 있어야 합니다. 

    show call-home diagnostic-signature Current diagnostic-signature settings:  Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: username@gmail.com ds_fsurl_prefix: scp://612345678:abcdefghijklmnop@cxd.cisco.com

    다운로드된 DSes:

    DS ID

    DS 이름

    개정

    상태

    마지막 업데이트(GMT+00:00)

    64224

    00:07:45

    DS_LGW_CPU_MON75

    0.0.10

    등록됨

    2020-11-08

    65095

    00:12:53

    DS_LGW_IEC_Call_spike_threshold

    0.0.12

    등록됨

    2020-11-08

진단 서명 실행 확인

In the following command, the “Status” column of the show call-home diagnostic-signature command changes to “running” while the Local Gateway executes the action defined within the signature. 통화-홈 진단 서명 통계 표시의 출력은 진단 서명이 관심 있는 이벤트를 탐지하고 해당 작업을 실행하는지 확인하는 최선의 방법입니다. "트리거(Triggered/Max/Deinstall) 열은 부여된 서명이 이벤트를 트리거한 횟수, 이벤트를 탐지하기 위해 정의된 최대 횟수 및 최대 트리거된 이벤트의 수를 탐지한 후 서명이 자동으로 제거되는지 여부를 나타냅니다. 

show call-home diagnostic-signature Current diagnostic-signature settings:  Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: carunach@cisco.com ds_fsurl_prefix: scp://612345678:abcdefghijklmnop@cxd.cisco.com

다운로드된 DSes:

DS ID

DS 이름

개정

상태

마지막 업데이트(GMT+00:00)

64224

DS_LGW_CPU_MON75

0.0.10

등록됨

2020-11-08 00:07:45

65095

DS_LGW_IEC_Call_spike_threshold

0.0.12

실행 중

2020-11-08 00:12:53

통화 홈 진단 서명 통계 표시

DS ID

DS 이름

Triggered/Max/Deinstall

평균 실행 시간(초)

최대 실행 시간(초)

64224

DS_LGW_CPU_MON75

0/0/N

0.000

0.000

65095

DS_LGW_IEC_Call_spike_threshold

1/20/Y

23.053

23.053

진단 알림 이메일 실행 중에 발송되는 관리 장치에는 문제 유형, 장치 세부 사항, 소프트웨어 버전, 실행 중인 구성 및 해당 문제와 관련된 명령어 출력을 표시하는 등의 주요 정보가 포함되어 있습니다.

진단 서명 제거

문제 해결을 위해 진단 서명 사용은 일반적으로 일부 문제점을 탐지한 후에 제거하기로 정의됩니다. If you want to uninstall a signature manually, retrieve the DS ID from the output of the show call-home diagnostic-signature command and run the following command:

call-home diagnostic-signature deinstall <DS ID>

예:

call-home diagnostic-signature deinstall 64224

배포에서 일반적으로 관찰되는 문제에 기반하여 새로운 서명은 진단 서명 검색 도구에 주기적으로 추가됩니다. 현재 TAC는 새 사용자 정의 서명을 만드는 요청을 지원하지 않습니다.

Manage and validate Cisco IOS XE Gateways through Control Hub

For better management of Cisco IOS XE Gateways, we recommend that you enroll and manage the gateways through the Control Hub. It is an optional configuration. When enrolled, you can use the configuration validation option in the Control Hub to validate your Local Gateway configuration and identify any configuration issues. Currently, only registration-based trunks support this functionality.

For more information, refer the following:

Design overview

This section describes how to configure a Cisco Unified Border Element (CUBE) as a Local Gateway for Webex Calling, using certificate-based mutual TLS (mTLS) SIP trunk. The first part of this document illustrates how to configure a simple PSTN gateway. In this case, all calls from the PSTN are routed to Webex Calling and all calls from Webex Calling are routed to the PSTN. The following image highlights this solution and the high-level call routing configuration that will be followed.

In this design, the following principal configurations are used:

  • voice class tenants: Used to create trunk specific configurations.

  • voice class uri: Used to classify SIP messages for the selection of an inbound dial-peer.

  • inbound dial-peer: Provides treatment for inbound SIP messages and determines the outbound route with a dial-peer group.

  • dial-peer group: Defines the outbound dial-peers used for onward call routing.

  • outbound dial-peer: Provides treatment for outbound SIP messages and routes them to the required target.

Call routing from/to PSTN to/from Webex Calling configuration solution

While IP and SIP have become the default protocols for PSTN trunks, TDM (Time Division Multiplexing) ISDN circuits are still widely used and are supported with Webex Calling trunks. To enable media optimization of IP paths for Local Gateways with TDM-IP call flows, it is currently necessary to use a two-leg call routing process. This approach modifies the call routing configuration shown above, by introducing a set of internal loop-back dial-peers between Webex Calling and PSTN trunks as illustrated in the image below.

When connecting an on-premises Cisco Unified Communications Manager solution with Webex Calling, you can use the simple PSTN gateway configuration as a baseline for building the solution illustrated in the following diagram. In this case, Unified Communications Manager provides centralized routing and treatment of all PSTN and Webex Calling calls.

Throughout this document, the host names, IP addresses, and interfaces illustrated in the following image are used. Options are provided for public or private (behind NAT) addressing. SRV DNS records are optional, unless load balancing across multiple CUBE instances.

Use the configuration guidance in the rest of this document to complete your Local Gateway configuration as follows:

  • 단계 1: Configure router baseline connectivity and security

  • 단계 2: Configure Webex Calling Trunk

    Depending on your required architecture, follow either:

  • 단계 3: Configure Local Gateway with SIP PSTN trunk

  • 단계 4: Configure Local Gateway with existing Unified CM environment

    또는:

  • 단계 3: Configure Local Gateway with TDM PSTN trunk

Configure connectivity and security

Baseline configuration

The first step in preparing your Cisco router as a Local Gateway for Webex Calling is to build a baseline configuration that secures your platform and establishes connectivity.

  • All certificate-based Local Gateway deployments require Cisco IOS XE 17.9.1a or later versions. For the recommended versions, see the Cisco Software Research page. Search for the platform and select one of the suggested releases.

    • ISR4000 series routers must be configured with both Unified Communications and Security technology licenses.

    • Catalyst Edge 8000 series routers fitted with voice cards or DSPs require DNA Essentials licensing. Routers without voice cards or DSPs require a minimum of DNA Essentials licensing.

    • For high-capacity requirements, you may also require a High Security (HSEC) license and additional throughput entitlement.

      Refer to Authorization Codes for further details.

  • Build a baseline configuration for your platform that follows your business policies. In particular, configure the following and verify the working:

    • NTP

    • Acl

    • User authentication and remote access

    • DNS

    • IP 라우팅

    • IP addresses

  • The network toward Webex Calling must use a IPv4 address. Local Gateway Fully Qualified Domain Names (FQDN) or Service Record (SRV) addresses must resolve to a public IPv4 address on the internet.

  • All SIP and media ports on the Local Gateway interface facing Webex must be accessible from the internet, either directly or via static NAT. Ensure that you update your firewall accordingly.

  • Install a signed certificate on the Local Gateway (the following provides detailed configuration steps).

    • A public Certificate Authority (CA) as detailed in  What Root Certificate Authorities are Supported for Calls to Cisco Webex Audio and Video Platforms? must sign the device certificate.

    • The FQDN configured in the Control Hub when creating a trunk must be the Common Name (CN) or Subject Alternate Name (SAN) certificate of the router. 예:

      • If a configured trunk in the Control Hub of your organization has cube1.lgw.com:5061 as FQDN of the Local Gateway, then the CN or SAN in the router certificate must contain cube1.lgw.com. 

      • If a configured trunk in the Control Hub of your organization has lgws.lgw.com as the SRV address of the Local Gateway(s) reachable from the trunk, then the CN or SAN in the router certificate must contain lgws.lgw.com. SAN에서 SRV 주소(CNAME, A 레코드 또는 IP 주소)를 확인한 레코드는 선택 사항입니다.

      • Whether you use an FQDN or SRV for the trunk, the contact address for all new SIP dialogs from your Local Gateway uses the name configured in the Control Hub.

  • 인증서가 클라이언트 및 서버 사용에 대해 서명되지 않도록 합니다.

  • Upload the Cisco root CA bundle to the Local Gateway.

구성

1

Ensure that you assign valid and routable IP addresses to any Layer 3 interfaces, for example:

 interface GigabitEthernet0/0/0 description Interface facing PSTN and/or CUCM ip address 192.168.80.14 255.255.255.0 ! interface GigabitEthernet0/0/1 description Interface facing Webex Calling (Public address) ip address 198.51.100.1 255.255.255.240

2

Protect STUN credentials on the router using symmetric encryption. Configure the primary encryption key and encryption type as follows:

 key config-key password-encrypt YourPassword password encryption aes
3

Create an encryption trustpoint with a certificate signed by your preferred Certificate Authority (CA).

  1. Create an RSA key pair using the following exec command.

    crypto key generate rsa general-keys exportable label lgw-key modulus 4096

  2. When using cube1.lgw.com as the fqdn for the trunk, create a trustpoint for the signed certificate with the following configuration commands: 

     crypto pki trustpoint LGW_CERT enrollment terminal pem fqdn cube1.lgw.com subject-name cn=cube1.lgw.com subject-alt-name cube1.lgw.com revocation-check none rsakeypair lgw-key

  3. Generate Certificate Signing Request (CSR) with the following exec or configuration command and use it to request a signed certificate from a supported CA provider:

    crypto pki enroll LGW_CERT

4

Authenticate your new certificate using your intermediate (or root) CA certificate, then import the certificate (Step 4). Enter the following exec or configuration command:

 crypto pki authenticate LGW_CERT <paste Intermediate X.509 base 64 based certificate here>

5

Import a signed host certificate using the following exec or configuration command:

 crypto pki import LGW_CERT certificate <paste CUBE host X.509 base 64 certificate here>

6

Enable TLS1.2 exclusivity and specify the default trustpoint using the following configuration commands:

 sip-ua crypto signaling default trustpoint LGW_CERT transport tcp tls v1.2

7

Install the Cisco root CA bundle, which includes the DigiCert CA certificate used by Webex Calling. Use the crypto pki trustpool import clean url command to download the root CA bundle from the specified URL, and to clear the current CA trustpool, then install the new bundle of certificates:

If you need to use a proxy for access to the internet using HTTPS, add the following configuration before importing the CA bundle:

ip http client proxy-server yourproxy.com proxy-port 80
 ip http client source-interface GigabitEthernet0/0/1 crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b
Configure Webex Calling certificate-based trunk
1

Create a CUBE certificate-based PSTN trunk for an existing location in Control Hub. For more information, see Configure trunks, route groups, and dial plans for Webex Calling.

Make a note of the trunk information that is provided once the trunk is created. These details, as highlighted in the following illustration, will be used in the configuration steps in this guide.
2

Enter the following commands to configure CUBE as a Webex Calling Local Gateway:

 voice service voip ip address trusted list ipv4 x.x.x.x y.y.y.y mode border-element allow-connections sip to sip no supplementary-service sip refer stun stun flowdata agent-id 1 boot-count 4 stun flowdata shared-secret 0 Password123$ sip asymmetric payload full early-offer forced sip-profiles inbound

구성에 대한 필드의 설명은 다음과 같습니다.

 ip address trusted list  ipv4 x.x.x.x y.y.y.y

  • To protect against toll fraud, the trusted address list defines a list of hosts and networks entities from which the Local Gateway expects legitimate VoIP calls.

  • By default, Local Gateway blocks all incoming VoIP messages from IP addresses not in its trusted list. Statically configured dial-peers with “session target IP” or server group IP addresses are trusted by default so do not need to be added to the trusted list.

  • When configuring your Local Gateway, add the IP subnets for your regional Webex Calling data center to the list, see Port Reference Information for Webex Calling for more information. Also, add address ranges for Unified Communications Manager servers (if used) and PSTN trunk gateways.

  • For more information on how to use an IP address trusted list to prevent toll fraud, see IP address trusted.

mode border-element

Enables Cisco Unified Border Element (CUBE) features on the platform.

allow-connections sip to sip

Enable CUBE basic SIP back to back user agent functionality. For more information, see Allow connections.

By default, T.38 fax transport is enabled. For more information, see fax protocol t38 (voice-service).

stun

Enables STUN (Session Traversal of UDP through NAT) globally.

These global stun commands are only required when deploying your Local Gateway behind NAT.

  • Webex Calling 사용자에게 통화를 전달할 때(예: 전화하는 사용자 및 통화 사용자는 모두 Webex Calling 가입자, Webex Calling SBC에 미디어를 고정하는 경우), 핀홀이 열려 있지 않습니다. 미디어가 로컬 게이트웨이로 연결되지 않습니다.

  • The STUN bindings feature on the Local Gateway allows locally generated STUN requests to be sent over the negotiated media path. This helps to open the pinhole in the firewall.

For more information, see  stun flowdata agent-id and  stun flowdata shared-secret.

asymmetric payload full

Configures SIP asymmetric payload support for both DTMF and dynamic codec payloads. For more information on this command, see asymmetric payload.

early-offer forced

Forces the Local Gateway to send SDP information in the initial INVITE message instead of waiting for acknowledgment from the neighboring peer. For more information on this command, see early-offer.

sip-profiles inbound

Enables CUBE to use SIP profiles to modify messages as they are received. Profiles are applied via dial-peers or tenants.

3

Configure voice class codec 100 codec filter for the trunk. In this example, the same codec filter is used for all trunks. You can configure filters for each trunk for precise control.

 voice class codec 100 codec preference 1 opus codec preference 2 g711ulaw codec preference 3 g711alaw

구성에 대한 필드의 설명은 다음과 같습니다.

voice class codec 100

Used to only allow preferred codecs for calls through SIP trunks. For more information, see voice class codec.

Opus codec is supported only for SIP-based PSTN trunks. If the PSTN trunk uses a voice T1/E1 or analog FXO connection, exclude codec preference 1 opus from the voice class codec 100 configuration.

4

Configure voice class stun-usage 100 to enable ICE on the Webex Calling trunk. (This step is not applicable for Webex for Government)

 voice class stun-usage 100 stun usage firewall-traversal flowdata stun usage ice lite

구성에 대한 필드의 설명은 다음과 같습니다.

stun usage ice lite

Used to enable ICE-Lite for all Webex Calling facing dial-peers to allow media-optimization whenever possible. For more information, see voice class stun usage and stun usage ice lite.

The stun usage firewall-traversal flowdata command is only required when deploying your Local Gateway behind NAT.
You require stun usage of ICE-lite for call flows using media path optimization. To provide media-optimization for a SIP to TDM gateway, configure a loopback dial-peer with ICE-Lite enabled on the IP-IP leg. For further technical details, contact the Account or TAC teams.
5

Configure the media encryption policy for Webex traffic. (This step is not applicable for Webex for Government)

 voice class srtp-crypto 100 crypto 1 AES_CM_128_HMAC_SHA1_80

구성에 대한 필드의 설명은 다음과 같습니다.

voice class srtp-crypto 100

Specifies SHA1_80 as the only SRTP cipher-suite CUBE offers in the SDP in offer and answer messages. Webex Calling only supports SHA1_80. For more information, see voice class srtp-crypto.

6

Configure FIPS-compliant GCM ciphers (This step is applicable only for Webex for Government). 

 voice class srtp-crypto 100 crypto 1 AEAD_AES_256_GCM

구성에 대한 필드의 설명은 다음과 같습니다.

voice class srtp-crypto 100

Specifies GCM as the cipher-suite that CUBE offers. It is mandatory to configure GCM ciphers for Local Gateway for Webex for Government.

7

Configure a pattern to uniquely identify calls to a Local Gateway trunk based on its destination FQDN or SRV:

 voice class uri 100 sip pattern cube1.lgw.com

구성에 대한 필드의 설명은 다음과 같습니다.

voice class uri 100 sip

Defines a pattern to match an incoming SIP invite to an incoming trunk dial-peer. When entering this pattern, use LGW FQDN or SRV configured in Control Hub while creating a trunk.

8

Configure SIP message manipulation profiles. If your gateway is configured with a public IP address, configure a profile as follows or skip to the next step if you are using NAT. In this example, cube1.lgw.com is the FQDN configured for the Local Gateway and "198.51.100.1" is the public IP address of the Local Gateway interface facing Webex Calling:

 voice class sip-profiles 100 rule 10 request ANY sip-header Contact modify "@.*:" "@cube1.lgw.com:" rule 20 response ANY sip-header Contact modify "@.*:" "@cube1.lgw.com:"

구성에 대한 필드의 설명은 다음과 같습니다.

rules 10 and 20

To allow Webex to authenticate messages from your local gateway, the 'Contact' header in SIP request and responses messages must contain the value provisioned for the trunk in Control Hub. This will either be the FQDN of a single host, or the SRV domain name used for a cluster of devices.

Skip the next step if you have configured your Local Gateway with public IP addresses.

9

If your gateway is configured with a private IP address behind static NAT, configure inbound and outbound SIP profiles as follows. In this example, cube1.lgw.com is the FQDN configured for the Local Gateway, "10.80.13.12" is the interface IP address facing Webex Calling and "192.65.79.20" is the NAT public IP address.

SIP profiles for outbound messages to Webex Calling 
 voice class sip-profiles 100 rule 10 request ANY sip-header Contact modify "@.*:" "@cube1.lgw.com:" rule 20 response ANY sip-header Contact modify "@.*:" "@cube1.lgw.com:" rule 30 response ANY sdp-header Audio-Attribute modify "(a=candidate:1 1.*) 10.80.13.12" "\1 192.65.79.20" rule 31 response ANY sdp-header Audio-Attribute modify "(a=candidate:1 2.*) 10.80.13.12" "\1 192.65.79.20" rule 40 response ANY sdp-header Audio-Connection-Info modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 41 request ANY sdp-header Audio-Connection-Info modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 50 request ANY sdp-header Connection-Info modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 51 response ANY sdp-header Connection-Info modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 60 response ANY sdp-header Session-Owner modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 61 request ANY sdp-header Session-Owner modify "IN IP4 10.80.13.12" "IN IP4 192.65.79.20" rule 70 request ANY sdp-header Audio-Attribute modify "(a=rtcp:.*) 10.80.13.12" "\1 192.65.79.20" rule 71 response ANY sdp-header Audio-Attribute modify "(a=rtcp:.*) 10.80.13.12" "\1 192.65.79.20 rule 80 request ANY sdp-header Audio-Attribute modify "(a=candidate:1 1.*) 10.80.13.12" "\1 192.65.79.20" rule 81 request ANY sdp-header Audio-Attribute modify "(a=candidate:1 2.*) 10.80.13.12" "\1 192.65.79.20"

구성에 대한 필드의 설명은 다음과 같습니다.

rules 10 and 20

To allow Webex to authenticate messages from your local gateway, the 'Contact' header in SIP request and responses messages must contain the value provisioned for the trunk in Control Hub. This will either be the FQDN of a single host, or the SRV domain name used for a cluster of devices.

rules 30 to 81

Convert private address references to the external public address for the site, allowing Webex to correctly interpret and route subsequent messages.

SIP profile for inbound messages from Webex Calling 
 voice class sip-profiles 110 rule 10 response ANY sdp-header Video-Connection-Info modify "192.65.79.20" "10.80.13.12" rule 20 response ANY sip-header Contact modify "@.*:" "@cube1.lgw.com:" rule 30 response ANY sdp-header Connection-Info modify "192.65.79.20" "10.80.13.12" rule 40 response ANY sdp-header Audio-Connection-Info modify "192.65.79.20" "10.80.13.12" rule 50 response ANY sdp-header Session-Owner modify "192.65.79.20" "10.80.13.12" rule 60 response ANY sdp-header Audio-Attribute modify "(a=candidate:1 1.*) 192.65.79.20" "\1 10.80.13.12" rule 70 response ANY sdp-header Audio-Attribute modify "(a=candidate:1 2.*) 192.65.79.20" "\1 10.80.13.12" rule 80 response ANY sdp-header Audio-Attribute modify "(a=rtcp:.*) 192.65.79.20" "\1 10.80.13.12"

구성에 대한 필드의 설명은 다음과 같습니다.

rules 10 to 80

Convert public address references to the configured private address, allowing messages from Webex to be correctly processed by CUBE.

For more information, see voice class sip-profiles.

10

Configure a SIP Options keepalive with header modification profile.

 voice class sip-profiles 115 rule 10 request OPTIONS sip-header Contact modify "<sip:.*:" "<sip:cube1.lgw.com:" rule 30 request ANY sip-header Via modify "(SIP.*) 10.80.13.12" "\1 192.65.79.20" rule 40 response ANY sdp-header Connection-Info modify "10.80.13.12" "192.65.79.20" rule 50 response ANY sdp-header Audio-Connection-Info modify "10.80.13.12" "192.65.79.20" ! voice class sip-options-keepalive 100 description Keepalive for Webex Calling up-interval 5 transport tcp tls sip-profiles 115

구성에 대한 필드의 설명은 다음과 같습니다.

voice class sip-options-keepalive 100

Configures a keepalive profile and enters voice class configuration mode. You can configure the time (in seconds) at which an SIP Out of Dialog Options Ping is sent to the dial-target when the heartbeat connection to the endpoint is in UP or Down status.

This keepalive profile is triggered from the dial-peer configured towards Webex.

To ensure that the contact headers include the SBC fully qualified domain name, SIP profile 115 is used. Rules 30, 40, and 50 are required only when the SBC is configured behind static NAT.

In this example, cube1.lgw.com is the FQDN selected for the Local Gateway and if static NAT is used, "10.80.13.12" is the SBC interface IP address towards Webex Calling and "192.65.79.20" is the NAT public IP address.

11

Configure Webex Calling trunk:

  1. Create voice class tenant 100 to define and group configurations required specifically for the Webex Calling trunk. Dial-peers associated with this tenant later will inherit these configurations:

    The following example uses the values illustrated in Step 1 for the purpose of this guide (shown in bold). Replace these with values for your trunk in your configuration.

     voice class tenant 100 no remote-party-id sip-server dns:us25.sipconnect.bcld.webex.com srtp-crypto 100 localhost dns:cube1.lgw.com session transport tcp tls no session refresh error-passthru bind control source-interface GigabitEthernet0/0/1 bind media source-interface GigabitEthernet0/0/1 no pass-thru content custom-sdp sip-profiles 100 sip-profiles 110 inbound privacy-policy passthru !

    구성에 대한 필드의 설명은 다음과 같습니다.

    voice class tenant 100

    We recommend that you use tenants to configure trunks which have their own TLS certificate, and CN or SAN validation list. Here, the tls-profile associated with the tenant contains the trust point to be used to accept or create new connections, and has the CN or SAN list to validate the incoming connections. For more information, see voice class tenant.

    no remote-party-id

    Disable SIP Remote-Party-ID (RPID) header as Webex Calling supports PAI, which is enabled using CIO asserted-id pai. For more information, see remote-party-id.

    sip-server dns:us25.sipconnect.bcld.webex.com

    Configures the target SIP server for the trunk. Use the edge proxy SRV address provided in Control Hub when you created your trunk

    srtp-crypto 100

    Configures the preferred cipher-suites for the SRTP call leg (connection) (specified in Step 5). For more information, see voice class srtp-crypto.

    localhost dns: cube1.lgw.com

    Configures CUBE to replace the physical IP address in the From, Call-ID, and Remote-Party-ID headers in outgoing messages with the provided FQDN.

    session transport tcp tls

    Sets transport to TLS for associated dial-peers. For more information, see session-transport.

    no session refresh

    Disables SIP session refresh globally.

    error-passthru

    SIP 오류 응답 통과 기능을 지정합니다. For more information, see error-passthru.

    bind control source-interface GigabitEthernet0/0/1

    Configures the source interface and associated IP address for messages sent to Webex Calling. For more information, see bind.

    bind media source-interface GigabitEthernet0/0/1

    Configures the source interface and associated IP address for media sent to Webex Calling. For more information, see bind.

    voice-class sip profiles 100

    Applies the header modification profile (Public IP or NAT addressing) to use for outbound messages. For more information, see voice-class sip profiles.

    voice-class sip profiles 110 inbound

    Applies the header modification profile (NAT addressing only) to use for inbound messages. For more information, see voice-class sip profiles.

    privacy-policy passthru

    Configures the privacy header policy options for the trunk to pass privacy values from the received message to the next call leg. For more information, see privacy-policy.

  2. Configure the Webex Calling trunk dial-peer.

     dial-peer voice 100 voip description Inbound/Outbound Webex Calling destination-pattern BAD.BAD session protocol sipv2 session target sip-server incoming uri request 100 voice-class codec 100 voice-class stun-usage 100 voice-class sip rel1xx disable voice-class sip asserted-id pai voice-class sip tenant 100 voice-class sip options-keepalive profile 100 dtmf-relay rtp-nte srtp no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 100 voip  description Inbound/Outbound Webex Calling

    100 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다. For more information, see dial-peer voice.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    다이얼-피어 100 이 SIP 통화 레그를 처리하게 지정합니다. For more information, see session protocol (dial-peer).

    session target sip-server

    Indicates that the SIP server defined in tenant 100 is inherited and used for the destination for calls from this dial peer.

    incoming uri request 100

    To specify the voice class used to match a VoIP dial peer to the uniform resource identifier (URI) of an incoming call. For more information, see  incoming uri.

    voice-class codec 100

    Indicates codec filter list for calls to and from Webex Calling. For more information, see voice class codec.

    voice-class stun-usage 100

    Allows locally generated STUN requests on the Local Gateway to be sent over the negotiated media path. STUN help to open a firewall pinhole for media traffic.

    voice-class sip asserted-id pai

    Sets the outgoing calling information using the privacy asserted ID (PAI) header. For more information, see voice-class sip asserted-id.

    voice-class sip tenant 100

    The dial-peer inherits all parameters configured globally and in tenant 100. Parameters may overridden at the dial-peer level. For more information, see  voice-class sip tenant.

    voice-class sip options-keepalive profile 100

    This command is used to monitor the availability of a group of SIP servers or endpoints using a specific profile (100).

    srtp

    통화 레그에 대해 SRTP를 가능하게 합니다.

Configure Local Gateway with a SIP PSTN trunk

Having built a trunk towards Webex Calling above, use the following configuration to create a non-encrypted trunk towards a SIP based PSTN provider:

If your Service Provider offers a secure PSTN trunk, you may follow a similar configuration as detailed above for the Webex Calling trunk. Secure to secure call routing is supported by CUBE.

If you are using a TDM / ISDN PSTN trunk, skip to next section Configure Local Gateway with TDM PSTN trunk.

To configure TDM interfaces for PSTN call legs on the Cisco TDM-SIP Gateways, see  Configuring ISDN PRI.

1

Configure the following voice class uri to identify inbound calls from the PSTN trunk:

 voice class uri 200 sip host ipv4:192.168.80.13

구성에 대한 필드의 설명은 다음과 같습니다.

voice class uri 200 sip

Defines a pattern to match an incoming SIP invite to an incoming trunk dial-peer. When entering this pattern, use the IP address of you IP PSTN gateway. For more information, see  voice class uri.

2

Configure the following IP PSTN dial-peer:

 dial-peer voice 200 voip description Inbound/Outbound IP PSTN trunk destination-pattern BAD.BAD session protocol sipv2 session target ipv4:192.168.80.13 incoming uri via 200 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 voice-class codec 100 dtmf-relay rtp-nte no vad

구성에 대한 필드의 설명은 다음과 같습니다.

 dial-peer voice 200 voip  description Inbound/Outbound IP PSTN trunk

200 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다. For more information, see dial-peer voice.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

session protocol sipv2

다이얼-피어 200 이 SIP 통화 레그를 처리하게 지정합니다. For more information, see session protocol (dial peer).

session target ipv4:192.168.80.13

통화 레그를 보낼 대상 IPv4 주소를 나타냅니다. 여기에 있는 세션 대상은 ITSP의 IP 주소입니다. For more information, see  session target (VoIP dial peer).

incoming uri via 200

IP 네트워크의 IP 주소로 VIA 헤더에 대한 PSTN 정의합니다. Matches all incoming IP PSTN call legs on the Local Gateway with dial-peer 200. For more information, see  incoming url.

bind control source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

bind media source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

voice-class codec 100

Configures the dial-peer to use the common codec filter list 100. For more information, see voice-class codec.

dtmf-relay rtp-nte

RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see DTMF Relay (Voice over IP).

no vad

음성 활동 탐지를 비활성화합니다. For more information, see vad (dial peer).

3

If you are configuring your Local Gateway to only route calls between Webex Calling and the PSTN, add the following call routing configuration. If you are configuring your Local Gateway with a Unified Communications Manager platform, skip to the next section.

  1. Create dial-peer groups to route calls towards Webex Calling or the PSTN. Define DPG 100 with outbound dial-peer 100 toward Webex Calling. DPG 100 is applied to the incoming dial-peer from the PSTN. Similarly, define DPG 200 with outbound dial-peer 200 toward the PSTN. DPG 200 is applied to the incoming dial-peer from Webex.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 200 description Route calls to PSTN dial-peer 200

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer 100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  2. Apply dial-peer groups to route calls from Webex to the PSTN and from the PSTN to Webex: 

     dial-peer voice 100 destination dpg 200 dial-peer voice 200 destination dpg 100

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 200

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

    This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features are configured.

Configure Local Gateway with a TDM PSTN trunk

Having built a trunk towards Webex Calling, use the following configuration to create a TDM trunk for your PSTN service with loop-back call routing to allow media optimization on the Webex call leg.

If you do not require IP media optimization, follow the configuration steps for a SIP PSTN trunk. Use a voice port and POTS dial-peer (as shown in Steps 2 and 3) instead of the PSTN VoIP dial-peer.
1

The loop-back dial-peer configuration uses dial-peer groups and call routing tags to ensure that calls pass correctly between Webex and the PSTN, without creating call routing loops. Configure the following translation rules that will be used to add and remove the call routing tags:

 voice translation-rule 100 rule 1 /^\+/ /A2A/ voice translation-profile 100 translate called 100 voice translation-rule 200 rule 1 /^/ /A1A/ voice translation-profile 200 translate called 200 voice translation-rule 11 rule 1 /^A1A/ // voice translation-profile 11 translate called 11 voice translation-rule 12 rule 1 /^A2A44/ /0/ rule 2/^A2A/ /00/ voice translation-profile 12 translate called 12

구성에 대한 필드의 설명은 다음과 같습니다.

voice translation-rule

Uses regular expressions defined in rules to add or remove call routing tags. Over-decadic digits (‘A’) are used to add clarity for troubleshooting.

In this configuration, the tag added by translation-profile 100 is used to guide calls from Webex Calling towards the PSTN via the loopback dial-peers. Similarly, the tag added by translation-profile 200 is used to guide calls from the PSTN towards Webex Calling. Translation-profiles 11 and 12 remove these tags before delivering calls to the Webex and PSTN trunks respectively.

This example assumes that called numbers from Webex Calling are presented in +E.164 format. Rule 100 removes the leading + to maintain a valid called number. Rule 12 then adds a national or international routing digit(s) when removing the tag. Use digits that suit your local ISDN national dial plan.

If Webex Calling presents numbers in national format, adjust rules 100 and 12 to simply add and remove the routing tag respectively.

For more information, see voice translation-profile and voice translation-rule.

2

Configure TDM voice interface ports as required by the trunk type and protocol used. For more information, see Configuring ISDN PRI. For example, the basic configuration of a Primary Rate ISDN interface installed in NIM slot 2 of a device might include the following:

 card type e1 0 2 isdn switch-type primary-net5 controller E1 0/2/0 pri-group timeslots 1-31
3

Configure the following TDM PSTN dial-peer:

 dial-peer voice 200 pots description Inbound/Outbound PRI PSTN trunk destination-pattern BAD.BAD translation-profile incoming 200 direct-inward-dial port 0/2/0:15

구성에 대한 필드의 설명은 다음과 같습니다. 

 dial-peer voice 200 pots  description Inbound/Outbound PRI PSTN trunk

200 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다. For more information, see dial-peer voice.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

translation-profile incoming 200

Assigns the translation profile that will add a call routing tag to the incoming called number.

direct-inward-dial

Routes the call without providing a secondary dial-tone. For more information, see direct-inward-dial.

port 0/2/0:15

The physical voice port associated with this dial-peer.

4

To enable media optimization of IP paths for Local Gateways with TDM-IP call flows, you can modify the call routing by introducing a set of internal loop-back dial-peers between Webex Calling and PSTN trunks. Configure the following loop-back dial-peers. In this case, all incoming calls will be routed initially to dial-peer 10 and from there to either dial-peer 11 or 12 based on the applied routing tag. After removal of the routing tag, calls will be routed to the outbound trunk using dial-peer groups.

 dial-peer voice 10 voip description Outbound loop-around leg destination-pattern BAD.BAD session protocol sipv2 session target ipv4:192.168.80.14 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad dial-peer voice 11 voip description Inbound loop-around leg towards Webex translation-profile incoming 11 session protocol sipv2 incoming called-number A1AT voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad dial-peer voice 12 voip description Inbound loop-around leg towards PSTN translation-profile incoming 12 session protocol sipv2 incoming called-number A2AT voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte codec g711alaw no vad

구성에 대한 필드의 설명은 다음과 같습니다. 

 dial-peer voice 10 pots  description Outbound loop-around leg

Defines a VoIP dial-peer and gives a meaningful description for ease of management and troubleshooting. For more information, see dial-peer voice.

translation-profile incoming 11

Applies the translation profile defined earlier to remove the call routing tag before passing to the outbound trunk.

destination-pattern BAD.BAD

A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. For more information, see destination-pattern (interface).

session protocol sipv2

Specifies that this dial-peer handles SIP call legs. For more information, see  session protocol (dial peer).

session target 192.168.80.14

Specifies the local router interface address as the call target to loop-back. For more information, see session target (voip dial peer).

bind control source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for messages sent through the loop-back. For more information, see  bind.

bind media source-interface GigabitEthernet0/0/0

Configures the source interface and associated IP address for media sent through the loop-back. For more information, see  bind.

dtmf-relay rtp-nte

RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

codec g711alaw

Forces all PSTN calls to use G.711. Select a-law or u-law to match the companding method used by your ISDN service.

no vad

음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

5

Add the following call routing configuration:

  1. Create dial-peer groups to route calls between the PSTN and Webex trunks, via the loop-back.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 200 description Route calls to PSTN dial-peer 200 voice class dpg 10 description Route calls to Loopback dial-peer 10

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer 100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  2. Apply dial-peer groups to route calls.

     dial-peer voice 100 destination dpg 10 dial-peer voice 200 destination dpg 10 dial-peer voice 11 destination dpg 100 dial-peer voice 12 destination dpg 200

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 200

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features are configured.
기존의 Unified CM 환경에서 로컬 게이트웨이 구성

The PSTN-Webex Calling configuration in the previous sections may be modified to include additional trunks to a Cisco Unified Communications Manager (UCM) cluster. In this case, all calls are routed via Unified CM. Calls from UCM on port 5060 are routed to the PSTN and calls from port 5065 are routed to Webex Calling. The following incremental configurations may be added to include this calling scenario.

1

다음 음성 클래스 URI를 구성합니다.

  1. Classifies Unified CM to Webex calls using SIP VIA port:

     voice class uri 300 sip
 pattern :5065

  2. Classifies Unified CM to PSTN calls using SIP via port:

     voice class uri 400 sip pattern 192\.168\.80\.6[0-5]:5060

    Classify incoming messages from the UCM towards the PSTN trunk using one or more patterns that describe the originating source addresses and port number. Regular expressions may be used to define matching patterns if required.

    In the example above, a regular expression is used to match any IP address in the range 192.168.80.60 to 65 and port number 5060.

2

Configure the following DNS records to specify SRV routing to Unified CM hosts:

IOS XE uses these records for locally determining target UCM hosts and ports. With this configuration, it is not required to configure records in your DNS system. If you prefer to use your DNS, then these local configurations are not required.

 ip host ucmpub.mydomain.com 192.168.80.60 ip host ucmsub1.mydomain.com 192.168.80.61 ip host ucmsub2.mydomain.com 192.168.80.62 ip host ucmsub3.mydomain.com 192.168.80.63 ip host ucmsub4.mydomain.com 192.168.80.64 ip host ucmsub5.mydomain.com 192.168.80.65 ip host _sip._udp.wxtocucm.io srv 0 1 5065 ucmpub.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub1.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub2.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub3.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub4.mydomain.com ip host _sip._udp.wxtocucm.io srv 2 1 5065 ucmsub5.mydomain.com ip host _sip._udp.pstntocucm.io srv 0 1 5060 ucmpub.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub1.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub2.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub3.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub4.mydomain.com ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub5.mydomain.com

구성에 대한 필드의 설명은 다음과 같습니다.

The following command creates a DNS SRV resource record. Create a record for each UCM host and trunk:

ip host _sip._udp.pstntocucm.io srv 2 1 5060 ucmsub5.mydomain.com

_sip._udp.pstntocucm.io: SRV resource record name

2: The SRV resource record priority

1: The SRV resource record weight

5060: The port number to use for the target host in this resource record

ucmsub5.mydomain.com: The resource record target host

To resolve the resource record target host names, create local DNS A records. 예:

ip host ucmsub5.mydomain.com 192.168.80.65

ip host: Creates a record in the local IOS XE database.

ucmsub5.mydomain.com: The A record host name.

192.168.80.65: The host IP address.

Create the SRV resource records and A records to reflect your UCM environment and preferred call distribution strategy.

3

Configure the following dial-peers:

  1. Dial-peer for calls between Unified CM and Webex Calling:

     dial-peer voice 300 voip description UCM-Webex Calling trunk destination-pattern BAD.BAD session protocol sipv2 session target dns:wxtocucm.io incoming uri via 300 voice-class codec 100 voice-class sip bind control source-interface GigabitEthernet 0/0/0 voice-class sip bind media source-interface GigabitEthernet 0/0/0 dtmf-relay rtp-nte no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 300 voip  description UCM-Webex Calling trunk

    Defines a VoIP dial-peer with a tag 300 and gives a meaningful description for ease of management and troubleshooting.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    Specifies that dial-peer 300 handles SIP call legs. For more information, see  session protocol (dial-peer).

    session target dns:wxtocucm.io

    Defines the session target of multiple Unified CM nodes through DNS SRV resolution. In this case, the locally defined SRV record wxtocucm.io is used to direct calls.

    incoming uri via 300

    Uses voice class URI 300 to direct all incoming traffic from Unified CM using source port 5065 to this dial-peer. For more information, see  incoming uri.

    voice-class codec 100

    Indicates codec filter list for calls to and from Unified CM. For more information, see  voice class codec.

    bind control source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

    bind media source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

    dtmf-relay rtp-nte

    RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

    no vad

    음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

  2. Dial-peer for calls between Unified CM and the PSTN:

     dial-peer voice 400 voip description UCM-PSTN trunk destination-pattern BAD.BAD session protocol sipv2 session target dns:pstntocucm.io incoming uri via 400 voice-class codec 100 voice-class sip bind control source-interface GigabitEthernet 0/0/0 voice-class sip bind media source-interface GigabitEthernet 0/0/0 dtmf-relay rtp-nte no vad

    구성에 대한 필드의 설명은 다음과 같습니다.

     dial-peer voice 400 voip  description UCM-PSTN trunk

    400 의 VoIP 다이얼- 피어를 정의하고, 쉽게 관리하고 문제를 해결할 수 있도록 의미 있는 설명을 제공합니다.

    destination-pattern BAD.BAD

    A dummy destination pattern is required when routing outbound calls using an inbound dial-peer group. Any valid destination pattern may be used in this case.

    session protocol sipv2

    Specifies that dial-peer 400 handles SIP call legs. For more information, see  session protocol (dial-peer).

    session target dns:pstntocucm.io

    Defines the session target of multiple Unified CM nodes through DNS SRV resolution. In this case, the locally defined SRV record pstntocucm.io is used to direct calls.

    incoming uri via 400

    Uses voice class URI 400 to direct all incoming traffic from the specified Unified CM hosts using source port 5060 to this dial-peer. For more information, see  incoming uri.

    voice-class codec 100

    Indicates codec filter list for calls to and from Unified CM. For more information, see  voice class codec.

    bind control source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for messages sent to the PSTN. For more information, see  bind.

    bind media source-interface GigabitEthernet0/0/0

    Configures the source interface and associated IP address for media sent to PSTN. For more information, see  bind.

    dtmf-relay rtp-nte

    RTP-NTE(RFC2833)를 통화 레그에서 기대하는 DTMF 기능으로 정의합니다. For more information, see  DTMF Relay (Voice over IP).

    no vad

    음성 활동 탐지를 비활성화합니다. For more information, see  vad (dial peer).

4

Add call routing using the following configurations:

  1. Create dial-peer groups to route calls between Unified CM and Webex Calling. Define DPG 100 with outbound dial-peer 100 towards Webex Calling. DPG 100 is applied to the associated incoming dial-peer from Unified CM. Similarly, define DPG 300 with outbound dial-peer 300 toward Unified CM. DPG 300 is applied to the incoming dial-peer from Webex.

     voice class dpg 100 description Route calls to Webex Calling dial-peer 100 voice class dpg 300 description Route calls to Unified CM Webex Calling trunk dial-peer 300

  2. Create a dial-peer groups to route calls between Unified CM and the PSTN. Define DPG 200 with outbound dial-peer 200 toward the PSTN. DPG 200 is applied to the associated incoming dial-peer from Unified CM. Similarly, define DPG 400 with outbound dial-peer 400 toward Unified CM. DPG 400 is applied to the incoming dial-peer from the PSTN.

     voice class dpg 200 description Route calls to PSTN dial-peer 200 voice class dpg 400 description Route calls to Unified CM PSTN trunk dial-peer 400

    구성에 대한 필드의 설명은 다음과 같습니다.

    dial-peer  100

    Associates an outbound dial-peer with a dial-peer group. For more information, see  voice-class dpg.

  3. Apply dial-peer groups to route calls from Webex to Unified CM and from Unified CM to Webex: 

     dial-peer voice 100 destination dpg 300 dial-peer voice 300 destination dpg 100

    구성에 대한 필드의 설명은 다음과 같습니다.

    destination dpg 300

    Specifies which dial-peer group, and therefore dial-peer should be used for the outbound treatment for calls presented to this incoming dial-peer.

  4. Apply dial-peer groups to route calls from the PSTN to Unified CM and from Unified CM to the PSTN:

     dial-peer voice 200 destination dpg 400 dial-peer voice 400 destination dpg 200

    This concludes your Local Gateway configuration. Save the configuration and reload the platform if this is the first time CUBE features have been configured.

진단 서명을 사용하여 로컬 게이트웨이를 모니터하고 문제 해결하기

진단 서명(DS)은 Cisco IOS XE 기반 로컬 게이트웨이에서 일반적으로 관찰되는 문제를 사전적으로 탐지하고 이벤트의 이메일, 시스로그 또는 터미널 메시지 알림을 생성합니다. 또한, DS를 설치하여 진단 데이터 수집을 자동화하고 수집한 데이터를 Cisco TAC 사례로 전송하여 해결 시간을 가속화할 수 있습니다.

진단 서명(DS)은 문제 트리거 이벤트 및 문제를 알리고, 문제를 해결, 수정하기 위한 작업에 대한 정보를 포함하는 XML 파일입니다. 시스로그 메시지, SNMP 이벤트 및 특정 표시 명령어 출력의 주기적으로 모니터링을 통해 문제점 탐지 논리를 정의합니다. 작업 유형에는 다음이 포함됩니다.

  • 표시 명령 출력 수집 중

  • 통합 로그 파일 생성

  • HTTPS, SCP, FTP 서버 등 사용자가 제공한 네트워크 위치로 파일을 업로드하기

TAC 엔지니어는 DS 파일을 작성하고 디지털로 서명하여 완전성을 보호합니다. 각 DS 파일에는 시스템이 지정한 고유한 숫자 ID가 있습니다. Diagnostic Signatures Lookup Tool (DSLT) is a single source to find applicable signatures for monitoring and troubleshooting various problems.

시작하기 전에:

  • DSLT에서 다운로드한 DS 파일을 편집 하지 않습니다. 완전성 검사 오류로 인해 수정한 파일 설치에 실패합니다.

  • 로컬 게이트웨이가 이메일 알림을 발송하기 위해 필요한 간단한 메일 전송 프로토콜(SMTP) 서버입니다.

  • 이메일 통지에 대해 보안 SMTP 서버를 사용하고자 하는 경우, 로컬 게이트웨이가 IOS XE 17.6.1 이상을 실행하고 있도록 합니다.

전제 조건

IOS XE 17.6.1 이상을 실행하는 로컬 게이트웨이

  1. 진단 서명은 기본적으로 활성화됩니다.

  2. Configure the secure email server that you use to send proactive notification if the device is running IOS XE 17.6.1 or higher.

     configure terminal call-home mail-server <username>:<pwd>@<email server> priority 1 secure tls end

  3. 통지할 관리자 ds_email 의 이메일 주소로 환경 변수를 구성합니다.

     configure terminal call-home diagnostic-signature LocalGateway(cfg-call-home-diag-sign)environment ds_email <email address> end

사전 모니터링을 위해 진단 서명 설치

높은 CPU 이용 모니터링하기

이 DS는 SNMP OID 1.3.6.1.4.1.9.2.1.56을 사용하여 5초 CPU 이용을 추적합니다. 사용률이 75% 이상이면 모든 디버그를 비활성화하고 로컬 게이트웨이에 설치한 모든 진단 서명을 제거합니다. 서명을 설치하려면 아래 단계를 따르십시오.

  1. 명령어 show snmp를 사용하여 SNMP를 활성화하는지 확인합니다. If SNMP is not enabled, then configure the snmp-server manager command.

     show snmp %SNMP agent not enabled config t snmp-server manager end show snmp Chassis: ABCDEFGHIGK 149655 SNMP packets input      0 Bad SNMP version errors      1 Unknown community name      0 Illegal operation for community name supplied      0 Encoding errors 37763 Number of requested variables      2 Number of altered variables 34560 Get-request PDUs 138 Get-next PDUs      2 Set-request PDUs      0 Input queue packet drops (Maximum queue size 1000) 158277 SNMP packets output      0 Too big errors (Maximum packet size 1500) 20 No such name errors      0 Bad values errors      0 General errors 7998 Response PDUs 10280 Trap PDUs Packets currently in SNMP process input queue: 0 
SNMP global trap: 활성화됨

  2. 다음과 같이 진단 서명 검색 도구에서 다음 드롭다운 옵션을 사용하여 DS 64224를 다운로드합니다.

    copy ftp://username:password@<server name or ip>/DS_64224.xml bootflash:

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR Series, or Catalyst 8000V Edge Software

    제품

    CUBE Enterprise in Webex Calling solution

    문제 범위

    성능

    문제 유형

    이메일 알림을 통한 높은 CPU 사용률

  3. DS XML 파일을 로컬 게이트웨이 플래시로 복사합니다.

    copy ftp://username:password@<server name or ip>/DS_64224.xml bootflash:

    다음 예제는 FTP 서버에서 로컬 게이트웨이로 파일을 복사하는 방법을 보여줍니다.

    copy ftp://user:pwd@192.0.2.12/DS_64224.xml bootflash:  Accessing ftp://*:*@ 192.0.2.12/DS_64224.xml...!  [OK - 3571/4096 bytes] 3571 bytes copied in 0.064 secs (55797 bytes/sec)

  4. 로컬 게이트웨이에서 DS XML 파일을 설치합니다.

     call-home diagnostic-signature load DS_64224.xml Load file DS_64224.xml success

  5. 통화- 홈 진단 서명 표시 명령어를 사용하여 서명이 성공적으로 설치 있는지 확인합니다. 상태 열에는 "등록된" 값이 있어야 합니다. 

     show call-home diagnostic-signature Current diagnostic-signature settings:   Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: username@gmail.com

    DSes 다운로드:

    DS ID

    DS 이름

    개정

    상태

    마지막 업데이트(GMT+00:00)

    64224

    DS_LGW_CPU_MON75

    0.0.10

    등록됨

    2020-11-07 22:05:33

    트리거되면 이 서명은 서명 자체를 포함하여 실행 중인 모든 DS를 제거합니다. 필요한 경우, 로컬 게이트웨이에서 높은 CPU 이용률을 계속 모니터하기 위해 DS 64224를 다시 설치하십시오.

비정상적인 통화 연결 끊기 모니터링 중

This DS uses SNMP polling every 10 minutes to detect abnormal call disconnect with SIP errors 403, 488 and 503.  If the error count increment is greater than or equal to 5 from the last poll, it generates a syslog and email notification. Please use the steps below to install the signature.

  1. 명령어 show snmp를 사용하여 SNMP가 활성화되어 있도록 합니다. If SNMP is not enabled, configure the snmp-server manager command. 

    show snmp %SNMP agent not enabled config t snmp-server manager end show snmp Chassis: ABCDEFGHIGK 149655 SNMP packets input      0 Bad SNMP version errors      1 Unknown community name      0 Illegal operation for community name supplied      0 Encoding errors 37763 Number of requested variables      2 Number of altered variables 34560 Get-request PDUs 138 Get-next PDUs      2 Set-request PDUs      0 Input queue packet drops (Maximum queue size 1000) 158277 SNMP packets output      0 Too big errors (Maximum packet size 1500) 20 No such name errors      0 Bad values errors      0 General errors 7998 Response PDUs 10280 Trap PDUs Packets currently in SNMP process input queue: 0 
SNMP global trap: 활성화됨

  2. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 65221을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR Series, or Catalyst 8000V Edge Software

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    성능

    문제 유형

    이메일 및 시스로그 알림에서 SIP 비정상적인 통화 연결 끊기 탐지.

  3. DS XML 파일을 로컬 게이트웨이로 복사합니다.

    copy ftp://username:password@<server name or ip>/DS_65221.xml bootflash:

  4. 로컬 게이트웨이에서 DS XML 파일을 설치합니다. 

     call-home diagnostic-signature load DS_65221.xml Load file DS_65221.xml success

  5. Use the command show call-home diagnostic-signature to verify that the signature is successfully installed. 상태 열에는 "등록됨" 값이 표시되어야 합니다.

진단 서명을 설치하여 문제를 해결

진단 서명(DS)을 사용하여 빠르게 문제를 해결할 수도 있습니다. Cisco TAC 엔지니어는 주어진 문제를 해결하기 위해 필요한 디버그를 활성화하고, 문제점 발생 탐지, 진단 데이터의 올바른 집합을 수집, Cisco TAC 사례로 데이터를 자동으로 전송하는 다양한 서명을 생성했습니다. 따라서 문제 발생을 수동으로 확인하지 않아도 되고 간헐적 및 일시적인 문제를 보다 쉽게 해결할 수 있습니다.

진단 서명 찾기 도구를 사용하여 해당하는 서명을 찾고 해당 문제를 셀프 해결하기 위해 설치할 수 있습니다. 또는 TAC 엔지니어가 지원 참여의 일부로 권장하는 서명을 설치할 수 있습니다.

다음 항목을 탐지하기 위해 DS를 찾고 설치하는 방법의 예제는 다음과 같습니다. “%VOICE_IEC-3-GW: CCAPI: 내부 오류 (통화 spike 임계값): IEC=1.1.181.1.29.0" 시스로그 및 다음 단계를 사용하여 진단 데이터 수집을 자동화합니다.

  1. Configure another DS environment variable ds_fsurl_prefix as the Cisco TAC file server path (cxd.cisco.com) to upload the diagnostics data. The username in the file path is the case number and the password is the file upload token which can be retrieved from Support Case Manager as shown in the following. The file upload token can be generated in the Attachments section of the Support Case Manager, as required. 

     configure terminal call-home diagnostic-signature LocalGateway(cfg-call-home-diag-sign)environment ds_fsurl_prefix "scp://<case number>:<file upload token>@cxd.cisco.com" end

    예: 

     call-home diagnostic-signature environment ds_fsurl_prefix " environment ds_fsurl_prefix "scp://612345678:abcdefghijklmnop@cxd.cisco.com"

  2. 명령어 show snmp를 사용하여 SNMP가 활성화되어 있도록 합니다. If SNMP not enabled, configure the snmp-server manager command.

     show snmp %SNMP agent not enabled config t snmp-server manager end

  3. 높은 CPU 모니터링 DS 64224를 사전 대책으로 설치하여 높은 CPU 사용률 중에 모든 디버그 및 진단 서명을 비활성화할 것이 좋습니다. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 64224을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR Series, or Catalyst 8000V Edge Software

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    성능

    문제 유형

    이메일 알림에서 높은 CPU 이용.

  4. 진단 서명 검색 도구에서 다음 옵션을 사용하여 DS 65095을 다운로드합니다.

    필드명

    필드 값

    플랫폼

    Cisco 4300, 4400 ISR Series, or Catalyst 8000V Edge Software

    제품

    Webex Calling 솔루션의 CUBE Enterprise

    문제 범위

    시스로그

    문제 유형

    Syslog - %VOICE_IEC-3-GW: CCAPI: 내부 오류 (통화 spike 임계값): IEC=1.1.181.1.29.0

  5. DS XML 파일을 로컬 게이트웨이에 복사합니다.

     copy ftp://username:password@<server name or ip>/DS_64224.xml bootflash:  copy ftp://username:password@<server name or ip>/DS_65095.xml bootflash:

  6. Install the high CPU monitoring DS 64224 and then DS 65095 XML file in the Local Gateway. 

     call-home diagnostic-signature load DS_64224.xml Load file DS_64224.xml success call-home diagnostic-signature load DS_65095.xml Load file DS_65095.xml success

  7. show call-home diagnostic-signature를 사용하여 서명이 성공적으로 설치되었는지 확인합니다. 상태 열에는 "등록됨" 값이 표시되어야 합니다. 

     show call-home diagnostic-signature Current diagnostic-signature settings:   Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: username@gmail.com ds_fsurl_prefix: scp://612345678:abcdefghijklmnop@cxd.cisco.com

    다운로드된 DSes:

    DS ID

    DS 이름

    개정

    상태

    마지막 업데이트(GMT+00:00)

    64224

    00:07:45

    DS_LGW_CPU_MON75

    0.0.10

    등록됨

    2020-11-08:00:07:45

    65095

    00:12:53

    DS_LGW_IEC_Call_spike_threshold

    0.0.12

    등록됨

    2020-11-08:00:12:53

진단 서명 실행 확인

다음 명령어에서 명령어의 "상태" 열은 콜-홈 진단 서명 이 "실행 중"으로 변경되는 반면, 로컬 게이트웨이는 서명 내에 정의된 작업을 실행합니다. 통화-홈 진단 서명 통계 표시의 출력은 진단 서명이 관심 있는 이벤트를 탐지하고 해당 작업을 실행하는지 확인하는 최선의 방법입니다. "트리거(Triggered/Max/Deinstall) 열은 부여된 서명이 이벤트를 트리거한 횟수, 이벤트를 탐지하기 위해 정의된 최대 횟수 및 최대 트리거된 이벤트의 수를 탐지한 후 서명이 자동으로 제거되는지 여부를 나타냅니다. 

show call-home diagnostic-signature Current diagnostic-signature settings:   Diagnostic-signature: enabled 
 Profile: CiscoTAC-1 (status: ACTIVE) 
 Downloading  URL(s):  https://tools.cisco.com/its/service/oddce/services/DDCEService Environment variable: ds_email: carunach@cisco.com ds_fsurl_prefix: scp://612345678:abcdefghijklmnop@cxd.cisco.com

다운로드된 DSes:

DS ID

DS 이름

개정

상태

마지막 업데이트(GMT+00:00)
64224

DS_LGW_CPU_MON75

0.0.10

등록됨

2020-11-08 00:07:45

65095

DS_LGW_IEC_Call_spike_threshold

0.0.12

실행 중

2020-11-08 00:12:53

통화 홈 진단 서명 통계 표시

DS ID

DS 이름

Triggered/Max/Deinstall

평균 실행 시간(초)

최대 실행 시간(초)
64224

DS_LGW_CPU_MON75

0/0/N

0.000

0.000

65095

DS_LGW_IEC_Call_spike_threshold

1/20/Y

23.053

23.053

진단 알림 이메일 실행 중에 발송되는 도구에는 문제 유형, 장치 세부 사항, 소프트웨어 버전, 구성 실행 및 해당 문제와 관련된 명령어 출력을 표시하는 등의 주요 정보가 포함되어 있습니다.

진단 서명 제거

문제를 해결하기 위해 진단 서명을 사용하면 일반적으로 일부 문제점을 탐지한 후에 제거하기로 정의됩니다. 수동으로 서명을 제거하려면 통화 홈 진단 서명 표시의 출력에서 DS ID 를 검색하고 다음 명령어를 실행합니다.

call-home diagnostic-signature deinstall <DS ID>

예:

call-home diagnostic-signature deinstall 64224

배포에서 관찰된 문제에 따라 새로운 서명은 진단 서명 검색 도구에 주기적으로 추가됩니다. 현재 TAC는 새 사용자 정의 서명을 만드는 요청을 지원하지 않습니다.