Cisco CUCM SIP Trunk Configuration: Complete Step-by-Step Guide

Introduction

SIP trunks are the backbone of modern Cisco Unified Communications Manager (CUCM) deployments. They connect your CUCM cluster to SIP-based ITSP (Internet Telephony Service Providers), Session Border Controllers (SBCs), CUBE (Cisco Unified Border Element), voice gateways, and other call control platforms like CUE, Unity Connection, or third-party PBXs.

This step-by-step guide walks you through the complete process of configuring a SIP trunk on CUCM, from SIP security profiles and SIP trunk security to route patterns and codec negotiation. Whether you are connecting to an ITSP for PSTN access or building an intercluster trunk between CUCM systems, this guide covers what you need.

Prerequisites

CUCM Version: 12.x, 14.x, or 15.x (this guide uses CUCM 14.x screenshots and terminology, but the process is similar across versions)
Admin access: CUCM Administration web interface (https://cucm-pub/ccmadmin)
Network connectivity: IP reachability between CUCM and the remote SIP endpoint (CUBE, ITSP, etc.)
SIP endpoint details: IP address or FQDN of the far end, port number (typically 5060 for TCP/UDP or 5061 for TLS), supported codecs, and any ITSP-specific requirements
Dial plan: Know which number patterns should route over this trunk (e.g., +1NXXNXXXXXX for North American PSTN)

Step 1: Configure the SIP Trunk Security Profile

The SIP Trunk Security Profile defines the security and transport settings for the trunk. Every SIP trunk requires one.

Navigate to System > Security > SIP Trunk Security Profile
Click Add New
Configure the following fields:

Field	Value	Notes
Name	`SIP-Trunk-CUBE-NonSecure`	Descriptive name for the profile
Device Security Mode	Non Secure	Use “Encrypted” for TLS trunks
Incoming Transport Type	TCP+UDP	Match what the far end sends
Outgoing Transport Type	TCP	TCP is more reliable for SIP than UDP
Incoming Port	5060	Standard SIP port
Enable Digest Authentication	Unchecked	Check if ITSP requires auth

Click Save. If your ITSP or CUBE requires TLS, set the Device Security Mode to “Encrypted” and configure the appropriate certificates under System > Security > Certificate Management.

Step 2: Configure the SIP Profile

The SIP Profile controls the SIP signaling behavior, timers, and features used by the trunk. CUCM ships with a default “Standard SIP Profile” but creating a custom one gives you more control.

Navigate to Device > Device Settings > SIP Profile
Find and copy the Standard SIP Profile For Trunks (click it, then use “Copy”)
Name the copy descriptively: SIP-Profile-CUBE-Trunk
Key settings to review and adjust:

Setting	Recommended Value	Why
Early Offer Support	Best Effort (no MTP inserted)	Sends SDP in the INVITE for faster call setup and codec negotiation
DTMF Signaling Method	RFC 2833	Industry standard for DTMF over SIP (required for IVR interaction)
Enable OPTIONS Ping	Checked	Monitors trunk status — CUCM marks the trunk as down if OPTIONS pings fail
SIP Rel1XX Options	Send PRACK if Remote Side Supports	Enables reliable provisional responses
SIP Session Refresh Method	Invite	Keeps long-duration calls alive
Timer Invite Expires (seconds)	180	How long to wait for a call answer before timing out
Timer Register Delta (seconds)	5	Registration renewal window

Early Offer is critical for ITSP trunks. Without it, CUCM sends a Delayed Offer (INVITE without SDP), which many ITSPs reject. Set it to “Best Effort (no MTP inserted)” for most deployments.

Step 3: Create the SIP Trunk

Now create the actual SIP trunk device.

Navigate to Device > Trunk
Click Add New
Select:
- Trunk Type: SIP Trunk
- Device Protocol: SIP
Click Next

Device Information Section

Field	Value	Notes
Device Name	`SIP-Trunk-CUBE-PSTN`	Unique identifier for the trunk
Description	SIP Trunk to CUBE for PSTN access	Clear description
Device Pool	Default (or your custom device pool)	Determines which CUCM node handles the trunk
Common Device Configuration	Leave default	–
Media Termination Point Required	Unchecked	Only check if you need MTP for specific codec/DTMF scenarios
Run On All Active Unified CM Nodes	Checked	Provides redundancy across the cluster

SIP Information Section

Field	Value	Notes
Destination Address	`10.1.1.200`	IP address or FQDN of the CUBE/ITSP endpoint
Destination Port	5060	5061 for TLS
SIP Trunk Security Profile	`SIP-Trunk-CUBE-NonSecure`	The profile from Step 1
SIP Profile	`SIP-Profile-CUBE-Trunk`	The profile from Step 2
Normalization Script	None (or as required by ITSP)	SIP normalization can manipulate SIP headers for interop

Click Save and then Reset when prompted. The trunk will attempt to initialize and send an OPTIONS ping to the destination address.

Step 4: Configure the Route Pattern

Route patterns determine which dialed numbers are sent to the SIP trunk. This is the equivalent of a dial plan — it tells CUCM which calls should go out this trunk.

Navigate to Call Routing > Route/Hunt > Route Pattern
Click Add New
Configure:

Field	Value	Notes
Route Pattern	`9.1[2-9]XX[2-9]XXXXXX`	North American 10-digit dialing with 9 for outside line
Gateway/Route List	`SIP-Trunk-CUBE-PSTN`	Point directly to the trunk (or use a Route List for redundancy)
Route Option	Route this pattern	–
Discard Digits	PreDot	Strips the “9.” access code before sending to the trunk
Called Party Transformations	Prefix: +1	Adds +1 country code for E.164 format (ITSP requirement)

Common Route Patterns

Pattern                     Purpose                          Discard Digits  Prefix
----------------------------------------------------------------------------------
9.911                       Emergency (US)                   PreDot          +1
9.1[2-9]XX[2-9]XXXXXX     Long distance (10-digit)         PreDot          +1
9.[2-9]XX[2-9]XXXXXX      Local (10-digit)                 PreDot          +1
9.011!                      International                    PreDot          +
9.1800XXXXXXX              Toll-free                        PreDot          +1
9.1900XXXXXXX              Block (use route pattern         -               -
                            with "Block this pattern")

Tip: For modern deployments, consider using a single \+! route pattern with calling search spaces and partitions for call control, rather than maintaining many individual route patterns. This is known as the “globalized dial plan” approach and is the recommended best practice for CUCM 12.x and later.

Step 5: Configure Codec Preferences (Region)

Codec configuration in CUCM is handled through Regions. The region assigned to the trunk’s device pool determines which codecs are offered and in what order.

Navigate to System > Region Information > Region
Either modify an existing region or create a new one (e.g., Region-WAN-Codecs)
In the Region Relationships section, set the codec preference between the trunk’s region and your phone regions:

Codec Preference	Use Case	Bandwidth
G.711 u-law	LAN calls, high quality	80 kbps per call
G.711 a-law	International (Europe, most of the world)	80 kbps per call
G.729	WAN calls, bandwidth conservation	24 kbps per call
iLBC	Internet calls, packet loss resilience	15-38 kbps per call
Opus	Modern wideband (CUCM 14+)	Variable

For ITSP trunks, confirm which codecs your provider supports. Most North American ITSPs require G.711 u-law as the primary codec. Some support G.729 as a secondary option for bandwidth savings.

Step 6: Route List and Route Group (Redundancy)

For production deployments, never point route patterns directly to a single SIP trunk. Instead, use Route Groups and Route Lists for redundancy and load balancing.

Create a Route Group

Navigate to Call Routing > Route/Hunt > Route Group
Click Add New
Name: RG-PSTN-Primary
Add the SIP trunk to the route group
Set Distribution Algorithm: Top Down (for failover) or Circular (for load balancing)

Create a Route List

Navigate to Call Routing > Route/Hunt > Route List
Click Add New
Name: RL-PSTN-Outbound
Add route groups in order of preference:
- Group 1: RG-PSTN-Primary
- Group 2: RG-PSTN-Secondary (backup ITSP or analog fallback)

Then update your route patterns to point to the Route List instead of the SIP trunk directly. This way, if the primary trunk goes down (detected via OPTIONS pings), calls automatically failover to the secondary route group.

Step 7: Calling Search Space and Partition Setup

Calling Search Spaces (CSS) and Partitions control which users can make which types of calls. This is CUCM’s equivalent of a class of restriction (CoR) on traditional PBXs.

Create Partitions

Navigate to Call Routing > Class of Control > Partition and create partitions for each call type:

Partition Name           Description
-----------------------------------------------
PT-Internal              Internal extensions only
PT-Local                 Local PSTN calls
PT-LongDistance           Long distance calls
PT-International          International calls
PT-Emergency             911/Emergency calls

Assign Partitions to Route Patterns

Go back to your route patterns and assign each one to the appropriate partition. For example, your international route pattern 9.011! goes in the PT-International partition.

Create Calling Search Spaces

CSS Name                  Includes Partitions              Assigned To
--------------------------------------------------------------------------
CSS-Internal-Only        PT-Internal, PT-Emergency          Lobby phones, common areas
CSS-Local-LD             PT-Internal, PT-Emergency,         Standard employees
                          PT-Local, PT-LongDistance
CSS-Full-Access           PT-Internal, PT-Emergency,         Executives, managers
                          PT-Local, PT-LongDistance,
                          PT-International

Assign the CSS to each phone’s line or device in the Directory Number configuration. A phone can only route calls to partitions included in its CSS.

Step 8: Verify the SIP Trunk

Check Trunk Status in CUCM

Navigate to Device > Trunk
Find your SIP trunk and check the Status column — it should show “Full Service” (green)
If it shows “Partial Service” or “Out of Service,” there is a connectivity or configuration issue

RTMT Monitoring

Open the Real-Time Monitoring Tool (RTMT) and check:

CallManager > SIP Activity: Shows active SIP trunk connections, call counts, and error rates
CallManager > Call Activity: Total active calls, calls attempted, calls completed
System > Performance > SIP: Detailed SIP message statistics (INVITEs sent/received, 4xx/5xx errors)

SIP Trunk Debug Commands

If using CUBE as the SIP trunk endpoint, these IOS debug commands help troubleshoot signaling issues:

! On the CUBE router:

! Show active SIP calls
show sip-ua calls

! Show SIP trunk status
show sip-ua status

! Enable SIP message debugging (verbose — use sparingly)
debug ccsip messages

! Show dial peer matching
debug voip ccapi inout

! Show media (RTP) stream info
show voip rtp connections

! Check for codec mismatch issues
debug ccsip error

Troubleshooting Common SIP Trunk Issues

Trunk Shows “Out of Service”

Verify IP connectivity: Can you ping the destination address from the CUCM publisher?
Check that the SIP port (5060 or 5061) is not blocked by a firewall
Confirm the SIP Trunk Security Profile transport type matches what the far end expects
Check if OPTIONS ping is enabled — if the far end does not respond to OPTIONS, disable it or configure the far end to respond
Review CUCM alarms: System > RTMT > Alert Central for SIP-related alerts

One-Way Audio or No Audio

NAT issue: If CUCM is behind a NAT, the SDP (Session Description Protocol) contains the internal IP address. The far end cannot route RTP back to a private address. Solution: Configure SIP normalization or use CUBE to handle NAT traversal
Codec mismatch: If the two sides cannot agree on a codec, the call connects (signaling works) but there is no audio (media fails). Check the CUCM region configuration and the far-end codec list
Firewall blocking RTP: SIP signaling uses port 5060, but RTP (audio) uses a dynamic range (typically 16384-32767). Ensure your firewall allows UDP traffic in this range between CUCM and the far end
MTP issues: If “Media Termination Point Required” is checked and no MTP resources are available, calls may connect without audio. Uncheck this unless specifically needed

Calls Drop After 30-60 Seconds

This is typically a SIP session timer issue. The SIP session refresh (re-INVITE or UPDATE) is being blocked by a firewall or the far end does not support it
Adjust the “SIP Session Refresh Method” in the SIP Profile
Check that your firewall has SIP ALG disabled or properly configured (SIP ALG often causes more problems than it solves)

DTMF Not Working (IVR Cannot Hear Button Presses)

Confirm both sides are using the same DTMF method (RFC 2833 is the standard)
In the SIP Profile, verify “DTMF Signaling Method” is set to RFC 2833
On CUBE, ensure the dial peer has dtmf-relay rtp-nte configured
Check that the RTP payload type for telephone-event matches on both sides (default is 101)

SIP Trunk Checklist

Item	Status
SIP Trunk Security Profile created	[ ]
SIP Profile created (with Early Offer enabled)	[ ]
SIP Trunk created with correct destination IP/port	[ ]
Route Group created	[ ]
Route List created with Route Group(s)	[ ]
Route Patterns configured with correct digit manipulation	[ ]
Partitions and CSS configured for call restrictions	[ ]
Codec region configured	[ ]
Firewall allows SIP (5060/5061) and RTP (16384-32767)	[ ]
Trunk status shows “Full Service”	[ ]
Test call: internal to PSTN (both directions)	[ ]
Test call: verify audio (both directions)	[ ]
Test DTMF: dial into IVR and press buttons	[ ]
Test failover: disable primary trunk, verify secondary	[ ]

Related Resources on UnifiedGuru

Conclusion

Configuring a SIP trunk on CUCM involves multiple components — security profiles, SIP profiles, the trunk itself, route patterns, route groups, route lists, and calling search spaces. Each piece plays a role in ensuring calls are securely signaled, properly routed, and correctly restricted. By following this guide and using the checklist, you can deploy a production-ready SIP trunk with confidence.

Have SIP trunk questions or running into interoperability issues? Post in our CUCM forum and our community can help troubleshoot.