This discussion is locked

ASK THE EXPERTS: Cisco Unified Border Element for PSTN SIP trunks

Unanswered Question
Jul 25th, 2011

Read the bioWith Randy Wu

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn best practices on how to configure and troubleshoot Cisco Unified Border Element (UBE) for the public switched telephone network (PSTN) Session Initiation Protocol (SIP) trunks with  Cisco subject matter expert Randy Wu. Randy Wu is a senior customer support engineer in the Multiservice Voice team at Cisco in Sydney. He has vast experience and knowledge configuring, troubleshooting, and designing Cisco UBE, gateways, and gatekeepers, working with H323, MGCP, and SIP protocols. He joined Cisco as a systems engineer in 1999. He holds CCIE certification (#8550) in Service Provider, Routing, and Switching and Voice.

Remember to use the rating system to let Randy know if you have received an adequate response.  

Randy might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the IP Telephony discussion forum shortly after the event. This event lasts through August 5, 2011. Visit this forum often to view responses to your questions and the questions of other community members.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.3 (3 ratings)
JustForVoice_2 Mon, 07/25/2011 - 15:18


Thank you Cisco moderator for this nice topic. and thanks to Randy for his time and help.

I have one question regarding the new platforms 2900 and 3900 routers. there is CUBE license. when I have to order this license and when I do not. Is it required in our case PSTN SIP Trunk?

And how I can know if the router contains this license or not if I already have a router?

yuanwu Tue, 07/26/2011 - 02:18


thanks for your questions.  Regarding to the CUBE license for 2900,3900 routers,

1.   Your router comes with the evaluation license, also known as a temporary  license, for most packages and features supported on your router. If  you want to try a new software package or feature, activate the  evaluation license for that package or feature.

     If you want to permanently activate a CUBE function on your router, you must get a software license, so it is required for your PSTN SIP trunk function. it might come with the router platform depending on your order.

Please follow the URL for more details about the CUBE license ordering,

2.  You can determine the licenses activated on your system by issuing the

       show license feature   command on the router command-line interface (CLI)


Marwan ALshawi Tue, 07/26/2011 - 02:47

Hi Randy

what the difference between the UC lic and CUBE lic

because if i have UC lic i can still configure my IPtoIP dial-peers, xcoding ot MTP and other VOIP services



yuanwu Tue, 07/26/2011 - 17:40

Hi, Marwan

Thanks for your question.

The UC lic is for Unified Communication software package, the CUBE license is specially for CUBE function and sessions it will support.

You can order the Cisco Unified Border Element in two ways:

• Start with a base router and add the software and licenses individually to the order.

•  Start with a bundle that includes some (or all) of what is necessary  for the order and offers optional upgrade options. Some bundles are  defined specifically for Cisco Unified Border Element deployments.

Depending on your purchase order, the CUBE function might be already included, in addtional there is temp license available in every ISR G2 router, you can try the UC feature and CUBE feature, if you need the permanent feature, you have to buy the relevant license.

please check the following URL for more details,


mike-greene Tue, 07/26/2011 - 06:08


In the past I've done a couple of CUBE configs on gateways that connect to a SIP provider.  These providers have always sent me a single IP address to point the dialpeer to for the sip session target.

I have a new turnup for another customer and the provider is giving me two IP' for media and one for signaling.  I've been looking online and at the

interoperability portal for an example but I can't seem to find a clear answer.  Which IP do I set as the session target and do I need to put the second IP into the config somewhere? 

I appologize if this is a basic question but I'm alittle confused on which IP goes where.

Thanks in advance for your help,


yuanwu Tue, 07/26/2011 - 17:49

Hi, Mike

thanks for you question.

The ip address configured on the CUBE will be the signaling ip address pointing to the provider, you will not worry about the media address from the provider, usually it will be different than the signaling ip address, once in the SDP message the provider sends the media address, the CUBE will send the media to that ip address.


tonyng Tue, 07/26/2011 - 10:39

I have a questions about faxing over SIP using G711 pass-through.

Understanding that faxing over SIP can have reliability issues, what about using G711 pass-through?  My customer's SIP provider, Verizon, is claiming they have ONE customer that is using this and is working with Rightfax, but are also saying that Rightfax isn’t a certified solution on their end and will not guarantee its success and are advising us to do a POC.

Thanks in advance for your help!



yuanwu Tue, 07/26/2011 - 17:58

Hi, Tony

thanks for your question.

Since either fax using T.38 or pass-through via CUBE, it will be via IP network, and fax is more sensitive to packet drop, jitter than the voice or data traffic, you have to make sure the network design and provider SLA will satisfy the requirement.

In addition, you can have redundancy option for both T.38 or pass-through to compensate the network environment, but might get the trade-off for longer transmission.

Rgds/Randy Tue, 07/26/2011 - 12:39

Great Topic! I am going to be deploying CUBE gateways soon to interoperate with current H323 gatekeepers for international trunks. Do you have some quick information as far as recommended best practices for security and configuration examples?



yuanwu Tue, 07/26/2011 - 18:14

Hi, Mike

thanks for your question.

For CUBE security configuration with H323 protocol, you can follow the criteria for the SIP protocol in the following URL,

the considerations will be followed,

• Access Lists (ACLs) to Allow/Deny Explicit Sources of Calls:  Permit traffic only from the service provider SBC on the outside, and  only the valid call agent(s) on the inside of the network. No other  endpoint or source should be able to make or receive calls to Cisco UBE.

• CAC to Limit Call Arrival Rates and Max Active Calls: Deploy total call limits, per dial-peer call limits, call spike detection and CPU protection against potential DOS attacks.

• Toll Fraud Lock-Down: Ensure that only legitimate endpoints can make authorized toll calls via Cisco UBE.

    as  of 15.1.2T Cisco IOS no longer allows connections from "unknown"  sources to connect by default. Only sources on the IP Trust List are  allowed (by default) and all other calls are rejected.

    IP  addresses defined in the "session target ipv4:" commands on dial-peers  are automatically included in the IP Trust List. Additional valid source  IP addresses can be added manually to the Trust List if needed by using  the following CLI:

voice service voip

ip address trusted list

ipv4 xx.xx.xx.xx


mrmhar1408 Wed, 07/27/2011 - 01:16


My Question: Is there any limitations on CUBE to use fax T.38 with SIP Trunks from SP and send the fax over unity call handler to fax server? as it is working fine with TDM trunks but not with SIP trunks

yuanwu Wed, 07/27/2011 - 04:17

Hi, Mrmhar1408

Thanks for your question.

The Cisco CUBE supports T.38 fax relay if you have SIP trunk from SP, and SIP trunk to the CUCM.

Please provide more details about how the fax will be handled in the Unity Call handler to fax server.

If it is T.37 store and forward fax for that part , then it will not be supported.

We need to have a TDM call leg to support T.37 store and forward fax.


mrmhar1408 Wed, 07/27/2011 - 06:58

Thanks for your reply, actually the fax call going as the following:

Sending Fax ----PSTN SIP --> CUBE ----SIP Trunk----> CUCM 8.0 ----->Unity call handler ---Caller dial fax extension ---> CUCM ----Route pattern----> Fax Server.

there is no T.37 here only T.38

yuanwu Wed, 07/27/2011 - 17:14

Hi, Mrmhar1408

thanks for your response.

If it is all the way T.38 fax relay, it will work.

Please open a TAC service request, we will look after it, thanks.


ingpatricklouis Wed, 07/27/2011 - 06:33

Hi ,i get a problem with my phone ,each time i tried to get it registed ,it returned me this message  registration state failed 403 ,please someone around here help me to resolve this problem .

yuanwu Wed, 07/27/2011 - 17:16

Hi, Patrick

thanks for your question.

Please provide more details of your call flow with the Cisco platform you are using.

Based on that, CUBE configuration and some debug commands will be needed for the further trouble-shooting.


aemcomcco Thu, 07/28/2011 - 12:13

Hi, I've an issue with Clear-Channel codec.

I've a SIP Trunk between an AS5400 HPX and a Cisco 1760.

I can't establish a clear channel flow because SDP rtpmaps are different:

m=audio 16542 RTP/AVP 125 101 100
a=rtpmap:125 G.nX64/8000

m=audio 16542 RTP/AVP 125 101 100
a=rtpmap:125 X-CCD/8000

The call fails with 488 Not Acceptable Media.

Can I use a CUBE (AS5400 --- CUBE --- C1760) in the middle of the connection to normalize SDP rtpmap?


yuanwu Fri, 07/29/2011 - 04:07

Hi, Aemcomcco

thanks for your question.

Since the normalization can't change the codec encapsulation,

For this issue, you better use the following feature and change the C1760's legacy clear channel code encapsulation  to be RFC4040 compatible.

This command was integrated into Cisco IOS Release 15.1(1)T.

voice-class sip encap clear-channel

To enable RFC 4040-based clear-channel codec negotiation for Session  Initiation Protocol (SIP) calls on an individual dial peer, overriding  the global setting on a Cisco IOS voice gateway or Cisco Unified Border  Element (Cisco UBE), use the voice-class sip encap clear-channel command in dial peer voice configuration mode. To disable  RFC 4040-based clear-channel codec negotiation on an individual dial  peer for SIP calls on a Cisco IOS voice gateway or Cisco UBE, use the no form of this command.

voice-class sip encap clear-channel [standard | system]

no voice-class sip encap clear-channel standard

for example,

Router(config)# dial-peer voice 1 voip

Router(config-dial-peer)# voice-class sip encap clear-channel standard


amity_393936 Fri, 07/29/2011 - 02:41

Hi I am beginer in Networking

I am trying to understand channelization STM1...

and configuring routers....

I need documents to study, please can u tell from where I can get....



sarathn Mon, 08/01/2011 - 16:24

Hi Randy,

I have two problems I haven’t been able to find solutions for,

1. I am trying to enable authentication of incoming calls to CUBE(Version 15.1(4)M) from the service provider by adding command "authentication username xxxx password yyyy realm zzzz challenge" to the incoming dial peer. But CUBE still accepts INVITEs without challenging them. Is anything more required to make this work?

2. Is there a way to send SDP in the 180 Ringing response to an incoming INVITE?

Thanks in advance for your help.



yuanwu Mon, 08/01/2011 - 17:06

Hi, Sarath

thanks for your questions.

1.  the command of authentication you mentioned in the CUBE only applies to registeration, it is not a function of CUBE to authenticate the INVITE message. please check the following feature for peer to peer mode of

Registration Pass-Through Modes

2.  I am afraid there is no way to send SDP in 180 message so far from the CUBE, we can check what the real issue is and might work out the solution from other point of view.


ja.moreno Tue, 08/02/2011 - 07:54

Hi Randy,

In CUCM implementation, we can 'decouple' user services (call forward, transfer, etc.) from network side (SIP trunk). We can easily do this using a MTP resource controlled by CUCM.

In other hand, we can have a scenario with a third-party PBX that connects towards the service provider with a SIP trunk using a CUBE as a border element. In this scenario, for us it would be really interesting if CUBE is capable of a similar behaviour as what CUCM does: To use a MTP software -inside the same router-, so we can decouple both call legs in CUBE. In this way, CUBE would anchor media and the possible RE-INVITE or other similar messages would be stopped at CUBE level, remaining the trunk towards the service provider as a simple basic call.

We asked for this kind of feature to our Cisco SE, who told us it isn't possible. But in your Webex session from last week, some of your colleagues in chat room told me that CUBE could control a MTP resource. Can you confirm if that's possible? If it is, then point me out to some config guide and confirm if it would cover the previous scenario.

Best regards,

Jose Antonio

yuanwu Tue, 08/02/2011 - 17:49

Hi, Jose

thanks for your question again.

1. For CUBE supporting MTP, we might extend the MTP concept to transcoder, HW, SW MTP, since CUBE has the capability to do transcoding for different codec and in-band voice DTMF to RFC2833 etc

2. The CUBE as the B2BUA has the function to seperate the call legs between enterprise network and service provider trunk.

2. for your requirement of "decouple" service for supplementary services like call forward, call transfer, there were some other features in the CUBE which can satisfy your requirement ,such as  "no supplementary-service sip moved-temporarily", "no supplementary-service sip refer" to terminate it locally.

3. Since the CUBE and CUCM is defined for different function, sometimes we better understand the requirement, then we can come up with the right solution with CUBE and CUCM functioning respectively.


ja.moreno Wed, 08/03/2011 - 00:59

Hi Randy,

Thanks for your answer.

I understand that you say that we can configure SW MTP the same way that you configure transcoder registering it under telephony-service, right?

Anyway, coming back to the scenario: If the IP-PBX implement supplementary services using 3xx or REFER messages, we can limit these messages to CUBE boundary and it'll manage these calls as you point out. In other hand, if the IP-PBX sends a RE-INVITE for a call hold, is there a way to not send it towards the service provider using CUBE?

The goal in this case is to have a very basic trunk towards the service provider, so the interoperability tests are quite simple and limited. In this way, the chances to find problems in the interconnection lower. In CUCM architecture, we can achieve this using a MTP function, so that's why I was wondering if we can achieve something similar using CUBE for third-party PBX.

Best regards,

Jose Antonio

yuanwu Wed, 08/03/2011 - 03:24

Hi, Jose

thanks for your questions.

1. your understanding of the MTP configuration under telephony-service is correct.

2. for the RE-INVITE during hold, there is a new feature coming up with CUBE 8.8 version (IOS 15.2.1T), in which it can be blocked and only will be passed through when the media changed.

    the example command will be like this:

     voice service voip  

        midcall-signaling block

        midcall-signaling passthru media-change

3. for the REFER message, there is also new enhanced  feature coming up with CUBE 8.8 version (15.2.1T) as well, in which  will enables CUBE to handle REFER messages more efficiently, called REFER consumption, or REFER pass-through.

   the example command will be like this:

REFER Consumption

Based on “Refer-To” header, CUBE does outbound dial-peer match and sends out an INVITE message

voice service voip

   no supplementary-service sip refer

   supplementary-service media-renegotiate

REFER Pass-through

CUBE will pass across the Refer message “as-is” without any modification

voice service voip

  supplementary-service sip refer




ja.moreno Wed, 08/03/2011 - 08:35

Hi Randy,

Really interesting these new features.

Just a couple of clarifications referring to your points:

1. For transcoding resources I can understand when CUBE will use them. But, regarding MTP if -as usual- it's not mandatory for the call, then how do you force to use it?

2. - What is the expected timeframe for CUBE 8.8?

    - When you are talking about media change, I suppose you are referring to changes in codec (passing from g.729 to t.38 for instance) and not in media ports, right?

    - For this feature to work, will you need to use MTP resources or not?

Best regards,

José Antonio

yuanwu Wed, 08/03/2011 - 18:49

Hi, Jose

thanks for your questions.

1. There is no way to force CUBE to use the media resource, CUBE will insert it when necessary.

2. CUBE version 8.8 was with IOS 15.2.1T which was published on the CCO already.

3. your understanding about media change for g.729 to T.38 is correct, for media ports change please give more details for example call flow you want to achieve.

4. MTP resource will not be required for this feature, by default CUBE will be in flow through mode and the meda will be terminated, if needed the CUBE can insert transcoding resource even during mid-call event.


ja.moreno Thu, 08/04/2011 - 01:11

Hi Randy,

I didn't notice it was already available. I've seen it is published for ISR-G2 + 1800. Is it planned also for 28xx?

Regarding the call flow, I mean for instance a call hold scenario where a CUCM without MTP will negotiate first with c= and then will change it again to the IP address from the MoH server:

CUCM:     -> INVITE (c=        CUBE: Will it be blocked with the 'midcall-signaling' commands?

               <- 200 OK (SDP)

               -> ACK

               -> INVITE

               <- 200 OK (SDP)

               -> ACK (c=MoH server)

Thanks a lot for your interest.


José Antonio

yuanwu Thu, 08/04/2011 - 03:31

Hi, Jose

thanks for the information.

1. the 15.2.1T IOS for other platform will be there soon.

2. this feature was designed to improve the inter-op issue with CUCM when hold and resume, the message for hold and resume will be handled locally at CUBE without passing through to the provider.


JULIUS KINSLER Tue, 08/02/2011 - 13:51

I understand you need to purchase licenses for your concurrent sessions. This may be a basic questions but I came across this discussion as I was looking for the answer. How can you verify how many concurrent sessions you have installed on a SIP gateway? I am working with a 3900 ISR G2 If it makes a difference. Also, Is there a command I can issue to view how many concurrent calls are being used?



yuanwu Tue, 08/02/2011 - 17:16

Hi, Julius

thanks for your question.

The session license is not enforced in the software control yet, it is based on your network scale and design, then you need to purchase the accordingly number of the sessions which will be used, also you can buy the bundle option which includes the maximum sessions support in the platform you bought.

please check the following URL for more details,

From the ISR G2, you can use "show call active voice brief", "show call active voice compact" to have an idea of concurrent calls being made.


jonathan.akins@... Thu, 08/04/2011 - 12:55

Randy - We are evaluating using the CUBE as the PSTN SIP provider SBC for MS Lync and also a gateway for terminating analog lines (fax machine) in small offices.  Have you seen this configuration before and if so, any problems?  Thanks.

yuanwu Thu, 08/04/2011 - 17:26

Hi, Jonathan

thanks for your question.

The CUBE is running on ISR like 28/3800, ISR G2 29/3900 etc platform,which can be TDM GW with CUBE function at the same time,  you can have the FXS/FXO modules in the same box for the analog fax or phone connection.


Lin Zhu Fri, 08/05/2011 - 11:15


nice to meet you. I am studying voice now, I got a confused question , that is : I can not understand the relationship of many different users in call manager, such as relationship of Phone, DN, enduser, application user, etc.

do you have some documations regarding this topic?



This Discussion

Related Content