CUBE configuration with CUCM Call Manager

[sarwarm123]

Our company recently decided to have a SIP trunk in our Cisco VOIP environment. I have not configured CUBE router before so I have read number of documents related to CUBE configuration with CUCM. However I still have confusion so I need your help. Please see proposed network diagram below.

My Question is, do we connect one gig port to company LAN where CUCM is connected and second gig interface will connect to SIP Provider customer end router? For example

interface GigabitEthernet0/0

description Connection to LAN

ip address 172.102.243.10 255.255.255.0

duplex auto

speed auto

!

interface GigabitEthernet0/1

description connection to SIP Provider

ip address 99.102.153.24 255.255.255.0

duplex auto

speed auto

I have seen some other sample configurations where people configured only one gig port for example (I have also attached full sample configuration)

interface GigabitEthernet0/0

description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$

no ip address

shutdown

duplex auto

speed auto

service-policy output VOIP-Policy

!

interface GigabitEthernet0/1

description $ES_LAN$

ip address 146.191.201.41 255.255.255.0

duplex auto

speed auto

h323-gateway voip interface

h323-gateway voip bind srcaddr 146.191.201.41

service-policy output VOIP-Policy

[Ayodeji Okanlawon · Accepted solution]

Atif,

Both solutions are correct. You can use a single interface or use two different interfaces..here is what you need to know

1. When you are using a single gig/fast thernet interface..You must ensure that your ITSP can route traffic to that internal IP address. Most people dont do this unless you can create a secure tunnel between this IP and your ITSP

2. Once you ensure your ITSP can reach this IP, you then bind your SIP signalling and  media traffic to this interface

3. If you are using a different IP to connect to your ITSP than your local LAN interface, then bind your sip traffic to the IP address facing your ITSP.

4. If you have multiple ITSP for redundancy purposes or load balancing, then you should configure your bind traffic under the dial-peer facing each provider.Example shown below

interface loopback1
ip address 10.10.10.1 255.255.255.0---------------------------------Service provider 1 IP

interface loopback2
ip address 20.20.20.1 255.255.255.0------------------------SP 2 IP

dial-peer voice 10 voip
description “Primary path to SIP SP-1”
destination-pattern 91[2-9]..[2-9]......
session protocol sipv2
session target ipv4:10.10.10.2
voice-class sip options-keepalive
voice-class sip bind control source-interface loopback1
voice-class sip bind media source-interface loopback1

dial-peer voice 20 voip
description “Secondary path to SIP SP-2”
destination-pattern 91[2-9]..[2-9]......
session protocol sipv2
session target ipv4:20.20.20.2
preference 2
voice-class sip options-keepalive
voice-class sip bind control source-interface loopback2
voice-class sip bind media source-interface loopback2

Please rate all useful posts

"opportunity is a haughty goddess who waste no time with those who are unprepared"

[sarwarm123]

Hi Aokanlawon,

Thanks mate to clear my concept much appreciate. As you know our company going to have SIP trunk, will you give my any tip or suggest best practices related to CUBE configuration with CUCM 8.6

Thanks,

[Ayodeji Okanlawon · Accepted solution]

Muhammad,

Here are some thoughts for you

1. Configure CUBE for media flow through. In this Mode CUBE acts as a true B2BUA. Advantages you get include address hiding and security becaue CUBE terminates and re-originate both signalling and Media. In this mode CUBE becomes a point of demarcation from th external world.

2. Configure CUCM to use Delayed Offer and CUBE to convert delayed offer to ealry offer...This prevents the need for you to use MTP to send Early offer on CUCM

voice service voip

early-offer forced

3. Configure DTMF signalling method on sip trunk to "No preference" This setting allows Unified CM to make an optimal decision for DTMF and to minimize MTP allocation.

4. Configure your CUBE to meet the requirements of your ITSP. Ask if they have configuration templates or any specific configuration they like you to use. This will save you time troubleshooting. Most of them dont use the default port 5060 because of security, confirm with your proivider what ports they use.

voice service voip

allow-connections sip to sip

sip

early-offer forced

header-passing

error-passthru

5. Use SIP to SIP...Use end to end sip. CUCM---sip---CUBE--sip----ITSP

6. Create a Trusted list of IP addresses on your CUBE is your CUBE IOS is 15.1 .2(T) and above.

voice service voip

ip address trusted list

  ipv4 203.0.113.100 255.255.255.255

  ipv4 192.0.2.0 255.255.255.0

This is imprtant because sometimes your ITSP will send you a single ip address for signalling and will then send media on a different IP adress. So get all the IP address your ITSP is using and add them to the trust list as shown above

7. Configure your inbound and outbound dial-peer approriately

Inbound Dial-Peer for calls from CUCM to CUBE (CUCM sending 9 +all digits dialled to CUBE)

dial-peer voice 100 voip
description *** Inbound LAN side dial-peer ***
incoming called-number 9T
session protocol sipv2
codec g711ulaw
dtmf-relay rtp-nte

Outbound Dial-Peer for calls from CUBE to CUCM (SP will be sending 10 digits inbound)

dial-peer voice 200 voip
description *** Outbound LAN side dial-peer ***
destination-pattern [2-9].........
session protocol sipv2
session target ipv4:
codec g711ulaw
dtmf-relay rtp-nte

Note: If more than 1 CUCM cluster exists, you will have to create multiple such LAN dial-peers with “preference CLI” for CUCM redundancy/load balancing

Inbound Dial-Peer for calls from SP to CUBE

dial-peer voice 100 voip
description *** Inbound WAN side dial-peer ***------------------(catch-all for all inbound PSTN calls)
incoming called-number [2-9].........
session protocol sipv2
codec g711ulaw
dtmf-relay rtp-nte

Outbound Dial-Peer for calls from CUBE to SP

dial-peer voice 200 voip
description *** Outbound WAN side dial-peer ***
translation-profile outgoing Digitstrip
destination-pattern 9[2-9].........
session protocol sipv2
voice-class sip bind control source gig0/1
voice-class sip bind media source gig0/1
session target ipv4::XXXX (where XXXX is the port number your provider is using if different from 5060)
codec g711ulaw
dtmf-relay rtp-nte

8. SIP Normalization:

You may need to configure sip normnalization to modify sip headers, CLI etc. A good example is during call forwarding. You may need to change your diversion headers to  match the CLI your provider is expecting.. if your call forwarding is failing during testing this may be the reason..We can help you with this.

9. Media Resources

Plan your solution properly. Consider if you will need Xcoders, MTP, Conference bridge etc. You may avoid the need for xcoders if you confure your regions properly and use voice class codecs on your sip profiles. It is important to know if there are any endpoints in your network that do not support dtmf relay rtp-nte. You can avoid the use of MTP if you configure your dial-peers to have multiple dtmf types for thos phones that do not support rtp-nte

e.g

dial-peer voice 1 voip

session protocol sipv2

dtmf-relay rtp-nte digit-drop sip-kpml (if your phones support kpml..then this will be used)

If in your environment you will need to do xcoding or CFB then ensure you have PVDMS

.10.FAX

If you have FAX in your network, determine what fax protocol your sip provider supports. Dont assume. Ask them and confirm in writing  what they support. I have seen legal cases because of fax failures over sip trunks

Configure your FAX devices in seperate device pools and use porefix to route calls using G711 only. Even if you are using T38, ensure your fax use G711 to establish the voice calls

Finally

11. Have a detailed and carefully planned TEST Plan. Test the FF:

• Inbound and outbound Local, Long distance, International calls for G711 & G729 codecs (if supported by provider)
  
• Outbound calls to information and emergency services
  
• Caller ID and Calling Name Presentation
  
• Supplementary services like Call Hold, Resume, Call Forward & Transfer
  
• DTMF Tests
  
• Fax calls – T.38, modem pass-through--whichever one you decide to use
  

Please rate all useful posts

"opportunity is a haughty goddess who waste no time with those who are unprepared"

[sarwarm123]

Aokanlawon you are a star mate, these guidelines will be extremely helpful for me. I probably need your help for SIP Normalization script when I get to that stage. Once again thank you very much

[sarwarm123]

Hi Aokanlawon,

I just received following network details from the ITSP. Please see my config below. Also, I have couple of questions related to the information I received from ITSP

• sip-server ip address would be CUBE WAN (CUBE WAN/PBX IP 10.160.134.98) address or ITSP Gateway IP (10.160.134.97)?
  
• Shall I route ip any to CUBE LAN or ITSP Gateway IP?
  

**********************************************************************

Details received from ITSP
**********************************************************************

Gateway IP: 10.160.134.97
PBX IP: 10.160.134.98
Signalling Address: 10.123.0.1
Media Access: 10.123.0.2

##################################################

CUBE LAN: 10.116.143.2
CUBE WAN: PBX IP = 10.160.134.98
CUCM: 10.206.143.12
##################################################

voice service voip
ip address trusted list
ipv4 10.160.134.96/29
ipv4 10.123.0.1 255.255.255.255
ipv4 10.123.0.2 255.255.255.255

ip route 0.0.0.0 0.0.0.0 10.116.143.1 //CUBE LAN network Default Gateway//

sip-ua
sip-server ipv4:10.160.134.97:5060 //ITSP Gateway IP address//

Message was edited by: Muhammad Atif Sarwar

[Ayodeji Okanlawon · Accepted solution]

Muhammad,

Your sip-server config has to point to the signalling address of your ITSP

sip-ua

sip-server ipv4:10.123.0.1 ( you dont need to speficy the port if they are using default 5060)

Then you will need to configure a static route to both signalling and media ip address via the ITSP gateway

ip route 10.123.0.1 255.255.255.255 10.160.134.97

ip route 10.123.0.2 255.255.255.255 10.160.134.97

Your sip trunk from CUCM should point to the LAN onterface on the CUBE, however if your CUCM can reach the WAN interface on the CUBE, then use this ip address on your sip trunk, then configure your sip signalling and media bind on this interface... This will give you the advantage of having your sip signalling and RTP flowing on one Interface of the CUBE

If you are going to use the LAN interface of CUBE for the SIP trunk from CUCM then I suggest you either dont configure any bind statements or bind on the WAN interface facing the ITSP

Please rate all useful posts

"opportunity is a haughty goddess who waste no time with those who are unprepared"

[sarwarm123]

Many thanks Aokanlawon for your reply, so that means signalling address of the ITSP will also be used here

session target ipv4:

CUCM cannot reach the WAN interface of the CUBE because that ip addresses are given by ITSP.

Gateway IP: 10.160.134.97   //ITSP LAN interface of their Router//

PBX IP: 10.160.134.98         //CUBE WAN interface//

As you said if our SIP trunk from CUCM point to the LAN inferface on the CUBE then dont configure any bind statements so in that case I dont need to use bind statements the below dial-peer

dial-peer voice 200 voip

description *** Outbound WAN side dial-peer ***

translation-profile outgoing Digitstrip

destination-pattern 9[2-9].........

session protocol sipv2

voice-class sip bind control source gig0/1

voice-class sip bind media source gig0/1

session target ipv4:<10.123.0.1>:XXXX (where XXXX is the port number your provider is using if different from 5060)

codec g711ulaw

dtmf-relay rtp-nte dial-peer voice 200 voip
description *** Outbound WAN side dial-peer ***
translation-profile outgoing Digitstrip
destination-pattern 9[2-9].........
session protocol sipv2
voice-class sip bind control source gig0/1
voice-class sip bind media source gig0/1
session target ipv4::XXXX (where XXXX is the port number your provider is using if different from 5060)
codec g711ulaw
dtmf-relay rtp-nte

[Ayodeji Okanlawon]

I think you may have a translation profile that is prefixing the 9..

Send me your updated config

Please rate all useful posts

"opportunity is a haughty goddess who waste no time with those who are unprepared"

[Ayodeji Okanlawon]

You need to apply sip profile 1 and not 2. You have configured profile 1, but applied 2 on the dial peer

[sarwarm123]

Hi Aok,

I think it was writting mistake but just for the safe side I remvoed the sip profile from the dial-peer and added SIP PROFILE 1. But error is exactly same.

However I noticed in ccsip debug,

CLI works when VOIP number shows@10.60.34.98

From: <44043>10.60.34.98>;tag=BABD0F4-13B0

CLI does not work when VOIP number points@10.116.143.151

From: <44043>10.116.143.151>;tag=BAE0164-774

Please see attached both debugs

voice class sip-profiles 1

request INVITE sip-header P-Asserted-Identity modify "<44043>" "<02476012665>"

!

dial-peer voice 2 voip

description *** Outbound calls to ITSP ***

destination-pattern 0[1-8].........

session protocol sipv2

session target sip-server

voice-class codec 1

voice-class sip profiles 1

dtmf-relay rtp-nte

[sarwarm123]

Hi Aok,

Issue has been resolved by modifled sip invite 44043 to 10.60.34.98 instead of 10.116.143.151. Can you please guide whats a syntax for range of numbers instead one fixed number. I mean not 44043 could be 44000 to 44150.

voice class sip-profiles 1

request INVITE sip-header P-Asserted-Identity modify "<44043>" "<44043>"

Also If you could guide me what translation rule would be for this senario

DDI 024760126XX changes to 5 digit VOIP number 526XX

Just like we do in num-exp

num-exp  0247601.... 526..

Currernt Rule is 02476012665 is translated to 44043

rule 1 /^02476012665/ /44043/

[Ayodeji Okanlawon]

Your session target will point to sip-server unless you want to use IP address, then yes it will be the signalling address.

Yes no need for bind statements on the dial-peer.


Sent from Cisco Technical Support Android App

[sarwarm123]

Hi Aokanlawon,

Many thanks for your great help. I have ready sample  configuration for the CUBE router as per your guidelines. It would be  extremely helpful if you could have a quick look. I haven’t add  outgoing/incoming translation rules which I will add later.

I have also created SIP trunk from CUCM to CUBE, device pool, route pattern etc

I have two more questions

• Can you please provide me SIP normalization sample code as ITSP expecting CLI all digits
• To make SIP calls from cisco phones 7942/7965 do I need to convert it from SCCP to SIP by upgrading SIP firmware.

Current configuration : 5885 bytes

!

version 15.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname CDC-CUBE

!

boot-start-marker

boot-end-marker

!

!

logging queue-limit 10000

logging buffered 20000000

logging persistent filesize 20000000

logging rate-limit 10000

no logging console

!

no aaa new-model

!

!

crypto pki trustpoint TP-self-signed-1280150379

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-1280150379

revocation-check none

rsakeypair TP-self-signed-1280150379

!

!

crypto pki certificate chain TP-self-signed-1280150379

certificate self-signed 01

  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030

  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

  69666963 6174652D 31323830 31353033 3739301E 170D3133 30323034 30383138

  34395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32383031

  35303337 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

  8100C4A2 10C7A212 340E3076 D97FA3BD E66D091F D5926342 BE07DDA7 C3CE96D6

  5441E4E9 9F673426 09A4E71C 1C653F3E E582DB0D D7DFB19C 2C9D4FB9 2563F32F

  F4E87C2A D1504B65 5B751DF3 1432F665 DF6A96C0 72916968 E039D009 D63E957B

  650374B5 5202DCC3 1D152F55 062DE7A1 8EF30730 33CABCA9 D64850F5 988BAC7A

  EE4B0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603

  551D2304 18301680 1456B52D 8E122C64 3BCBBA4A E67BAA04 F4DD76F7 A5301D06

  03551D0E 04160414 56B52D8E 122C643B CBBA4AE6 7BAA04F4 DD76F7A5 300D0609

  2A864886 F70D0101 05050003 818100C0 968CA8CD 5458E81D 93761550 23EF0AC1

  E97EE575 B9F5E8EF F69F39D4 CF3D688F EBB9DD9A 490F5109 5EE1A207 1EE73280

  AB89D93B 3FEA6FCA 3EC7B8E8 DF48B748 5998502B D6A7B6DB C4D33AF8 871953FB

  13387DDB 782C6695 DB5DC72D EC954FFB 96D86E78 B3997BF4 88E7C6D7 2134D8DD

  583C667F 6B67E1C4 8DD2DB1B E58A0E

        quit

ip cef

!

!

!

!

!

!

ip domain name cwss.nhs.uk

no ipv6 cef

!

multilink bundle-name authenticated

!

!

!

!

!

voice-card 0

!

!

!

voice service voip

ip address trusted list

  ipv4 10.116.143.2 255.255.255.255

  ipv4 10.206.143.0 255.255.255.128

  ipv4 10.160.134.96 255.255.255.248

  ipv4 10.123.0.1 255.255.255.255

  ipv4 10.123.0.2 255.255.255.255

address-hiding

mode border-element

allow-connections sip to sip

redirect ip2ip

fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none

sip

  header-passing

  error-passthru

  asserted-id pai

  early-offer forced

  midcall-signaling passthru

  privacy-policy passthru

!

!

!

!

!

!

license udi pid CISCO2951/K9 sn FGL1706105K

hw-module pvdm 0/0

!

!

!

username admin privilege 15 secret 5 $1$yF52$HweSxAz.i8CWNbTjhXLgb.

!

redundancy

!

!

!

!

!

csdb tcp synwait-time 30

csdb tcp idle-time 3600

csdb tcp finwait-time 5

csdb tcp reassembly max-memory 1024

csdb tcp reassembly max-queue-length 16

csdb udp idle-time 30

csdb icmp idle-time 10

csdb session max-session 65535

!

!

!

!

!

!

!

!

!

interface Embedded-Service-Engine0/0

no ip address

shutdown

!

interface GigabitEthernet0/0

description CUBE WAN interface

ip address 10.160.134.98 255.255.255.248

duplex auto

speed auto

!

interface GigabitEthernet0/1

description CUBE LAN interface

ip address 10.116.143.2 255.255.255.192

duplex auto

speed auto

!

interface GigabitEthernet0/2

no ip address

shutdown

duplex auto

speed auto

!

ip forward-protocol nd

!

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip route 0.0.0.0 0.0.0.0 10.116.143.1

ip route 10.123.0.1 255.255.255.255 10.160.134.98

ip route 10.123.0.2 255.255.255.255 10.160.134.98

!

!

nls resp-timeout 1

cpd cr-id 1

!

!

control-plane

!

!

!

!

!

!

!

mgcp profile default

!

!

dial-peer voice 101 voip

description *** Inbound LAN side dial-peer ***

session protocol sipv2

incoming called-number 9T

dtmf-relay rtp-nte

codec g711ulaw

!

dial-peer voice 20 voip

description *** Outbound LAN side dial-peer ***

destination-pattern [2-9].........

session protocol sipv2

session target ipv4:10.206.143.13

dtmf-relay rtp-nte

codec g711ulaw

!

dial-peer voice 21 voip

description *** Outbound LAN side dial-peer ***

destination-pattern [2-9].........

session protocol sipv2

session target ipv4:10.206.143.12

dtmf-relay rtp-nte

codec g711ulaw

!

dial-peer voice 1 voip

description *** Inbound WAN side dial-peer ***

session protocol sipv2

incoming called-number [2-9].........

dtmf-relay rtp-nte

codec g711ulaw

!

dial-peer voice 2 voip

description *** Outbound WAN side dial-peer ***

translation-profile outgoing Digitstrip

destination-pattern 9[2-9].........

session protocol sipv2

session target ipv4:10.123.0.1

dtmf-relay rtp-nte

codec g711ulaw

!

!

sip-ua

no remote-party-id

disable-early-media 180

retry invite 2

!

!

!

gatekeeper

shutdown

!

!

!

line con 0

exec-timeout 30 0

privilege level 15

login local

line aux 0

line 2

no activation-character

no exec

transport preferred none

transport input all

transport output pad telnet rlogin lapb-ta mop udptn v120 ssh

stopbits 1

line vty 0 4

access-class 23 in

exec-timeout 15 0

privilege level 15

logging synchronous

login local

transport input telnet ssh

line vty 5 15

access-class 23 in

exec-timeout 30 0

privilege level 15

login local

transport input telnet ssh

!

scheduler allocate 20000 1000

ntp server 194.172.9.137

ntp server 194.172.9.142 prefer

!

end

CDC-CUBE#

[Ayodeji Okanlawon]

It looks good. You might want to change the description on your dialpeers to reflect what they actually do..

eg

dial-peer voice 101 voip

description ***Inbound calls from CUCM****

dial-peer voice 20 voip

description **** Outbound calls to Primary CUCM ***

dial-peer voice 21 voip

description *** Outbound Calls to Backup CUCM***

dial-peer voice 1 voip

description *** Inbound Calls from ITSP ***

dial-peer voice 2 voip

description *** Outbound calls to ITSP ***

This description helps especially when you are troubleshooting..

I can certainly help you with sip normalization but I need to know what you want normalized.

ex

This sip profile modifies the remote party id of any number begining with 1234 to 441756789000

request INVITE sip-header Remote-Party-ID modify "<1234>" "<441756789000>

No, you dont need to ocnvert SCCP phones to SIP. SCCP phones can still send calls over the sip trunk.

I observed that in your sip-ua config you have "no remote-party id" is there any reason for this?

Please rate all useful posts

"opportunity is a haughty goddess who waste no time with those who are unprepared"