Site Survivability for Webex Calling

Overview

By default, Webex Calling endpoints operate in Active mode, connecting to the Webex cloud for SIP registration and call control. However, if the network connection to Webex breaks, endpoints switch automatically to Survivability mode, and registrations fall back to the Survivability Gateway within the local network. While endpoints are in Survivability mode, the Survivability Gateway provides a basic backup calling service for those endpoints. After the network connection to Webex resumes, call control and registrations revert to the Webex cloud.

While endpoints are in Survivability mode, you can make the following calls:

Internal calling (intrasite) between supported Webex Calling endpoints

External calling (incoming and outgoing) using a local PSTN circuit or SIP trunk to external numbers and E911 providers

The following image shows a network failure scenario where the connection to Webex is broken, and endpoints at the Webex site are operating in Survivability mode. In the image, the Survivability Gateway routes an internal call between two on-site endpoints without requiring a connection to Webex. In this case, the Survivability Gateway is configured with a local PSTN connection. As a result, on-site endpoints in Survivability mode can use the PSTN for incoming and outgoing calls to external numbers and E911 providers.

To use this feature, administrators must configure a Cisco IOS XE router in the local network as a Survivability Gateway. The Survivability Gateway syncs calling information daily from the Webex cloud for endpoints at that location. If the endpoints switch to Survivability mode, the gateway can use this information to take over SIP registrations and provide basic calling services.

The following conditions apply to the Survivability Gateway:

• The Webex cloud includes the Survivability Gateway IP address, hostname, and port in the device configuration file. As a result, endpoints are able to reach out to the Survivability Gateway for registration if the connection to Webex breaks.
• The daily call data sync between the Webex cloud and the Survivability Gateway includes authentication information for registered users. As a result, endpoints can maintain secure registrations, even while operating in Survivability mode. The sync also includes routing information for those users.
• The Survivability Gateway can route internal calls automatically using the routing information that Webex provides. Add a PSTN trunk configuration to the Survivability Gateway to provide external calling.
• Each site that deploys Site Survivability requires a Survivability Gateway within the local network.
• Registrations and call control revert to the Webex cloud once the Webex network connection resumes for at least 30 seconds.

Feature Support

The following table provides information on supported features.

When the feature is configured, Site Survivability is available for the following supported endpoints.

The following table provides details on Cisco IOS XE routers that can be configured as a Survivability Gateway. The table also provides information on the maximum number of endpoints that each platform supports and the minimum IOS XE version.

Colocation

Colocation with Unified SRST

The Survivability Gateway supports the collocation of a Webex Survivability configuration and a Unified SRST configuration on the same gateway. The gateway can support survivability for both Webex Calling endpoints and for endpoints that register to Unified Communications Manager.

To configure colocation:

• Configure Unified SRST support for endpoints that register to Unified Communications Manager.
• On the same gateway, follow the Site Survivability Configuration Task Flow in this article to configure the gateway with Site Survivability for Webex Calling endpoints.

Call routing considerations for colocation

Consider the following when configuring call routing for colocation scenarios:

• The Survivability Gateway routes internal calls automatically provided that both endpoints in the call are registered to the Survivability Gateway. Internal calls are automatically routed between any registered clients (SRST or Webex Calling).
• It's possible to have a situation where the connection to one call control system goes down while the connection to the other call control system remains up. As a result, one set of endpoints registers to the Survivability Gateway while another set of endpoints at the same site registers to primary call control. In this case, you may need to route calls between the two sets of endpoints to a SIP trunk or PSTN circuit.
• External calls and E911 calls can be routed to a SIP trunk or PSTN circuit.

Limitations and Restrictions

• You cannot deploy a Survivability Gateway and a Local Gateway in the same router.
• Public Switched Telephone Network (PSTN) service availability depends on the SIP trunks or PSTN circuits available during a network outage.
• Devices with 4G and 5G connectivity (for example, Webex App for mobile or tablet) could still be able to register to Webex Calling during outages. As a result, they could be unable to call other numbers from the same site location during an outage.
• Dialing patterns could work differently in Survivability mode than in Active mode.
• This feature doesn't support call preservation during a fallback to the Survivability Gateway. However, calls are preserved when connectivity to the cloud service is re-established..
• When an outage occurs, it could take a few minutes for the devices to register successfully to the Survivability Gateway.
• The Survivability Gateway must use an IPv4 address. IPv6 isn't supported.
• An on-demand sync status update in Control Hub could take up to 30 minutes.
• Cisco Webex multi-call window is not supported in Release 43.2. If you are using a multi-call window, disable it in survivability mode, and use the main application to make or receive calls.
• If you exit and relaunch a Cisco Webex App that is in Survivability mode, it does not re-register with the Survivability Gateway.

While in Survivability mode:

• MPP Softkeys such as Park, Unpark, Barge, Pickup, Group Pickup, and Call Pull buttons are not supported for Site Survivability. However, they do not appear disabled.
• Calls made to shared lines can ring on all devices. However, other shared line functionalities such as Remote Line State Monitoring, Hold, Resume, Synchronized DND, and Call Forwarding settings are not available.
• Conferencing or Three-way Calling is not available.
• Local call history of placed, received, and missed calls is not available for MPP Phones.

Configuration

Assign Survivability Service to a Gateway

Use this procedure in Control Hub to assign an existing gateway as a Survivability Gateway.

Please Note: You can’t assign the same gateway to be a Local Gateway and a Survivability Gateway.
Before you begin. If the gateway doesn't exist in Control Hub, see Enroll Cisco IOS Gateways to Webex Calling  to add a new gateway instance.

1. Sign in to Control Hub.
2. Under Services, click Calling and then click the Managed Gateways tab.
3. The Managed Gateways view displays the list of gateways you manage through Control Hub. The Service column displays the current service assignment.
4. For the gateway that you want to assign as a Survivability Gateway, choose one of the following based on the value of the Service field:
• Unassigned (empty value)—Click Assign Service and go to the next step.
• Survivability Gateway—If you want to edit existing gateway IP settings, go to Edit Survivability Gateway properties. Otherwise, go to the next procedure in the flow.

5. From the service type drop-down, select Survivability Gateway and complete the following fields:
• Location—From the drop-down, select a location.
• Host Name—Enter the Fully Qualified Domain Name (FQDN) used when creating the certificate for the gateway. It could be a name that is included in the certificate Subject Alternate Name field (SAN). The FQDN and the IP address are only used for establishing a secure connection with the gateway. Hence, it is not mandatory to populate it in DNS.
• IP Address—In IPv4 format, enter the IP address of the Survivability Gateway. Devices register to this address while operating in Survivability mode.

6. Click Assign.

(Optional) Unassign the Survivability Service—If you want to remove the Survivability Gateway from a gateway, go to Unassign the Services of a Managed Gateway.

Download Configuration Template

Download the configuration template from Control Hub. You'll need the template when you configure the gateway command line.

• Sign in to Control Hub. 
• Under Services, click Calling and then click the Managed Gateways tab.          
• Click on the applicable Survivability Gateway. 
• Click Download Config Template and download the template to your desktop or laptop.

Configure Licensing

Configure licenses using the commands that are appropriate to your platform.
Please Note: You must have the appropriate platform licenses for your gateway.

1. Enter global configuration mode on the router:

enable
 configure terminal

2. Configure licenses using the commands that apply only to your specific platform.

• For Cisco ISR 4000 series:

license boot level uck9
 license boot level securityk9

• For Cisco Catalyst 8300 and 8200 Series Edge Platforms, use the DNA Network Advantage feature license, or better, and enter the required throughput level. The following example uses 25Mbps bidirectional crypto throughput. Select the appropriate level for the number of calls that you anticipate.

license boot level network-essentials addon dna-essentials
 platform hardware throughput crypto 25M

• For Cisco Catalyst 8000V Edge Software, use the DNA Network Essentials feature license, or better, and enter the required throughput level. The following example uses 1Gbps throughput. Select the appropriate level for the number of calls that you anticipate.

license boot level network-essentials addon dna-essentials
 platform hardware throughput level MB 1000

           
Please Note: When configuring throughput higher than 250Mbp, you require an HSEC platform license.

Configure Certificates

Complete the following steps to request and create certificates for the Survivability Gateway. You must use certificates signed by a trusted Certificate Authority.

You can run the commands from the sample code to complete the steps.

1. Enter global configuration mode by running the following commands:

enable
 configure terminal

2. Generate the RSA private key by running the following command. The private key modulus must be at least 2048 bits.

crypto key generate rsa general-keys label webex-sgw exportable modulus 2048

3. Configure a trustpoint to hold the Survivability Gateway certificate. The gateway fully qualified domain name (fqdn) must use the same value you used when assigning the survivability service to the gateway.

crypto pki trustpoint webex-sgw
 enrollment terminal
 fqdn <gateway_fqdn>
 subject-name cn=<gateway_fqdn>
 subject-alt-name <gateway_fqdn>
 revocation-check crl
 rsakeypair webex-sgw

4. Generate a Certificate Signing Request by running the crypto pki enroll webex-sgw command.

When prompted, enter yes.

After the CSR displays on screen, use Notepad to copy the certificate to a file that you can send to a supported certificate authority (CA).

Please Note: If your certificate signing provider requires a CSR in PEM (Privacy Enhanced Mail) format, add a header and footer before submitting. For example:

-----BEGIN CERTIFICATE REQUEST-----
 <Insert CSR here>
 -----END CERTIFICATE REQUEST-----

5. After the CA issues you a certificate, run the crypto pki authenticate webex-sgw command to authenticate the certificate. You can run this command from either exec or config mode.
   When prompted, paste the base 64 CER/PEM issuing CA certificate contents (not the device certificate) into the terminal.

6. Import the signed host certificate to the trustpoint using the crypto pki import webex-sgwcertificate command. When prompted, paste the base 64 CER/PEM certificate into the terminal.

7. Check that the root CA certificate is available:

• Find the root CA common name by running show crypto pki certificates webex-sgw | begin CA Cert. Look for the issuer cn= <value>.
• Run the show crypto pki trustpool | include cn= command and check whether this root CA certificate is installed with the Cisco CA bundle. If you see your CA, skip to step 9.
• If you don't see your certificate, run the following command to install the extended IOS CA bundle.
    crypto pki trustpool import url
  http://www.cisco.com/security/pki/trs/ios_union.p7b
• Repeat these substeps to determine if the root CA certificate is now available. After you repeat the substeps:
  If the certificate is not available, go to step 8. If the certificate is available, go to step 9.

8. If your root CA certificate isn’t included in the bundle, acquire the certificate and import this to a new trustpoint.

crypto pki trustpoint <CA name>
 enrollment terminal
 revocation-check crl
 crypto pki authenticate <CA name>

When prompted, paste the base 64 CER/PEM certificate contents into the terminal.

9. Using configuration mode, specify the default trust point, TLS version and SIP-UA defaults with the following commands.

sip-ua
 no remote-party-id
 retry invite 2
 transport tcp tls v1.2
 crypto signaling default trustpoint webex-sgw
 Handle-replaces

Configure Gateway as a Survivability Gateway

Use the configuration template you downloaded earlier as a guide to configuring the gateway command line. Complete all of the mandatory configurations that are in the template.

The following steps contain sample commands along with an explanation of the commands. Edit the settings to fit your deployment. The angled brackets (for example, <settings>) identify settings where you should enter values that apply to your deployment. The various <tag> settings use numerical values to identify and assign sets of configurations.

• Unless stated otherwise, this solution requires that you complete all the configurations in this procedure.
• When applying settings from the template, replace %tokens% with your preferred values before you copy to the gateway.
• Use this guide unless the command description refers you to a different document.

1. Enter into global configuration mode.

enable
 configure terminal

where:

1. enable—Enables privileged EXEC mode.
2. configure terminal—Enables global configuration mode.

2. Perform the voice service configurations:

voice service voip
 ip address trusted list
    ipv4 <ip_address> <subnet_mask>
    ipv4 <ip_address> <subnet_mask>
  allow-connections sip to sip
  supplementary-service media-renegotiate
  no supplementary-service sip refer
  trace
  sip
   asymmetric payload full
   registrar server
 
Explanation of commands:

• ip address trusted list—Defines a list of non-registering addresses that the Survivability Gateway must accept SIP messages from. For example, a SIP trunk peer address.
• <ip_address> and <subnet_mask> represent trusted address ranges. You don't need to enter directly connected subnets as the Survivability Gateway trusts them automatically.
• allow-connections sip to sip—Allows SIP to SIP connections in a VoIP network.
• no supplementary-service sip refer—Disable REFER method for call forward and call transfer supplementary services. Webex Calling doesn’t use these methods.
• sip—Enters service SIP configuration mode.
• registrar server—Enable the SIP registrar to allow Webex Calling clients to register to the gateway.
• asymmetric payload full—Enables video calling in survivability mode.

3. Enable Survivability on the router:

voice register global
 mode webex-sgw
 max-dn 50
 max-pool 50
exit

Explanation of commands:

1. voice register global—Enters global voice registration mode.
2. mode webex-sgw—Enables Webex Calling Survivability mode and Survivable Remote Site Telephony for Unified Communications Manager endpoints.
3. max-dn—Limits the number of directory numbers that the router can handle. For this solution, always configure the maximum value available for your platform.
4. max-pool—Sets the maximum number of devices that can register to the gateway. Set this value to the maximum that your platform allows, as described in Table 3.

4. Configure NTP servers:

ntp server <ip_address_of_primary_NTP_server>
 ntp server <ip_address_of_secondary_NTP_server>       

5. (Optional). Configure general Class of Restriction call permissions:

dial-peer cor custom
 name Wx_calling_Internal
 name Wx_calling_Toll-free
 name Wx_calling_National
 name Wx_calling_International
 name Wx_calling_Operator_Assistance
 name Wx_calling_Chargeable_Directory_Assistance
 name Wx_calling_Special_Services1
 name Wx_calling_Special_Services2
 name Wx_calling_Premium_Services1
name Wx_calling_Premium_Services2

The preceding example creates a set of custom classes of restriction-named categories (for example, Wx_calling_International).

6. Configure a list of preferred codecs. For example, the following list specifies g711ulaw as the preferred codec, followed by g711alaw.

voice class codec 1
 codec preference 1 g711ulaw
 codec preference 2 g711alaw

Explanation of commands:

• voice class codec —1 Enters voice-class configuration mode for the codec group 1.
• codec preference— Identifies the preferred codecs for this codec group.

7. Configure default voice register pools per location:

voice register pool 1
 id network 0.0.0.0 mask 0.0.0.0
 dtmf-relay rtp-nte
 voice-class codec 1

Explanation of commands:

• voice register pool 1—Enters voice register pool configuration mode for SIP devices in this pool.
• id network and mask identify a SIP device or set of network devices that use this pool. Use the addresses and masks that apply to your deployment. Note that 0.0.0.0 allows devices from anywhere to register (if the device addresses are in the permit list).
• id extension-number—The pool applies to the Webex Calling user at extension 1234 specifically. Use the appropriate extensions for your network.
• dtmf-relay specifies the rtp-nte method for sending DTMF digits. In this example, Real-Time Transport (RTP) with Named phone event (NTE) payload type.
• voice-class codec 1—Assigns codec group 1 to this pool.

8. Configure emergency calling:

voice emergency response location 1
elin 1 <number>
subnet 1 <ip-group> <subnet-mask>

voice emergency response location 2
elin 1 <number>
subnet 1 <ip-group> <subnet-mask>

voice emergency response zone 1
location 1
location 2

voice class e164-pattern-map 301
voice class e164-pattern-map 351

Explanation of commands:

• voice emergency response location 1—Creates emergency response location group 1 for the enhanced 911 service. A subsequent command creates emergency response location group 2.
• elin 1 <number>—Assigns an elin to the emergency response location. For this elin, the <number> portion defines a PSTN number to replace the extension of the 911 caller (for example, 14085550100).
• subnet 1 <ip-group> <subnet-mask>—Defines a subnet group along with a specific subnet address for this emergency response location. Use this command to identify the caller network via an IP address and subnet mask. For example, subnet 1 192.168.100.0 /26.
• voice emergency response zone 1—Defines an emergency response zone.
• location 1 (and 2)—Assigns emergency response locations 1 and 2 to this emergency response zone.
• voice class e164-pattern-map 301 (and 351)—Identifies e164 pattern maps 301 and 351 for this voice class. You can use the map to define dial plans and emergency location identifiers.

           
Please Note: If the WiFi overlay doesn't match to IP subnets accurately, then emergency calling for nomadic devices may not have the correct ELIN mapping.

9. Configure dial peers for the PSTN.

10. Optional. Enable Music on Hold for the router. You must store a music file in the router flash memory in G.711 format. The file can be in .au or .wav file format, but the file format must contain 8-bit 8-kHz data (for example, ITU-T A-law or mu-law data format).

call-manager-fallback
 moh enable-g711 "bootflash:<MOH_filename>"

Explanation of commands:

• call-manager-fallback—Enters SRST configuration mode.
• moh enable-g711 "bootflash:<MOH_filename>"—Enables unicast Music on Hold using G.711. Also provides the directory and audio filename (for example, bootflash:music-on-hold.au). Note that the filename can’t exceed 128 characters.

Complete On-Demand Sync

Complete this procedure only if you want to complete an immediate on-demand sync.
Please Note: This procedure is optional. Webex cloud syncs call data to the Survivability Gateway once per day automatically.

1. Sign in to Control Hub.
2. Under Services, click Calling. Select the Managed Gateways tab.
3. Click on the applicable Survivability Gateway to open the Survivability Service view for that gateway.
4. Click the Sync button.
5. Click Submit.
   It may take up to 10 minutes to complete the sync.

Edit Survivability Gateway Properties

1. Sign in to Control Hub.
2. Under Services, click Calling. Select the Managed Gateways tab.
3. Click on the applicable Survivability Gateway to open the Survivability Service view for that gateway.
4. Click the Edit button and update settings for the following.

• Host Name—Use the hostname or Fully Qualified Domain Name of the certificate to establish the TLS connection with clients and IP Address.
• IP Address—In IPv4 format, enter the IP address of the gateway to which devices register while operating in Survivability mode.

5. Click Submit.

If you want to delete a Survivability Gateway from Control Hub, unassign the Survivability Gateway service first.