To configure the Session Initiation Protocol (SIP) user agent (gateway) for SIP signaling messages on inbound calls through
the SIP TCP, Transport Layer Security (TLS) over TCP, or User Datagram Protocol (UDP) socket, use the transport command in SIP user agent configuration mode. To block reception of SIP signaling messages on a particular socket, use the
no form of this command.
transport
{
tcp
[
tls
[
v1.0
|
v1.1
|
v1.2
[minimum]
|
v1.3
]
]
|
udp
}
no
transport
{
tcp
[
tls
[
v1.0
|
v1.1
|
v1.2
[minimum]
|
v1.3
]
]
|
udp
}
default
transport
{
tcp
[tls ]
|
udp
}
Syntax Description
| tcp
|
SIP user agent receives SIP messages on TCP port 5060.
|
| tls
|
(Optional) SIP user agent receives SIP messages on TLS over TCP port 5061. You can configure TLS version 1.0, 1.1, 1.2, or
1.3.
Starting from Cisco IOS XE 26.1.1 release, insecure TLS versions and ciphers are not supported in default configurations. However, these insecure configurations
are supported in "system mode insecure" operation-mode.
|
| minimum
|
(Optional) Specifies minimum configured TLS version. The minimum keyword can be configured only with TLS version 1.2. This configuration enables TLS versions 1.2 and 1.3.
|
| udp
|
SIP user agent receives SIP messages on UDP port 5060.
|
Command Default
TCP, TLS over TCP, and UDP transport protocols are enabled.
Command Modes
SIP user-agent configuration (config-sip-ua)
Command History
|
Release
|
Modification
|
|
Cisco IOS XE 26.1.1
|
This command is modified with the removal of insecure TLS versions (1.0, 1.1) and associated ciphers from default configurations.
Support for insecure configurations in "system mode insecure" operation-mode.
|
|
Cisco IOS XE 17.18.2
|
Security warnings for usage of legacy TLS and associated weaker ciphers.
|
| Cisco IOS XE 17.14.1a |
This command is modified to include the TLS version 1.3 support. In addition, minimum keyword configuration support is introduced with TLS version 1.2.
Introduced support for the following YANG models:
|
| Cisco IOS XE Cupertino 17.7.1a |
Introduced support for YANG models.
|
|
15.6(1)T and 3.17S
|
This command was modified to include the TLS version 1.2.
|
|
12.4(6)T
|
The optional TLS keyword was added to the command.
|
|
12.2(11)T
|
Support was added for the Cisco AS5300, Cisco AS5350, Cisco AS5400, and Cisco AS5850 platforms in this release.
|
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T and implemented on Cisco 7200 series routers. Support for the
Cisco AS5300, Cisco AS5350, Cisco AS5400, and Cisco AS5850 platforms were not included in this release.
|
|
12.2(2)XB1
|
This command was implemented on Cisco AS5850 platforms.
|
|
12.2(2)XA
|
This command was implemented on Cisco AS5400 and Cisco AS5350 platforms.
|
|
12.1(3)T
|
This command was integrated into Cisco IOS Release 12.1(3)T.
|
|
12.1(1)T
|
This command was introduced on the Cisco 2600 series, Cisco 3600 series, and Cisco AS5300 platforms.
|
Usage Guidelines
This command controls whether messages reach the SIP service provider interface (SPI). Setting tcp , or tls over tcp, or udp as the protocol for the SIP user agents to listen on port 5060.
To block reception of SIP signaling messages on a specific socket, use the no form of this command.
To reset this command to the default value, use the default form of this command.

Note
|
In the Cisco IOS XE 17.18.2 release, a security warning message appears for configurations using TLS versions below 1.2 and associated weaker ciphers.
For secure configurations, we recommend configuring stronger ciphers with TLS version 1.2 or higher.
|

Note
|
Starting from Cisco IOS XE 26.1.1 release, the insecure TLS versions (1.0, 1.1) and associated ciphers are not supported in default configurations. However,
insecure configurations are allowed in "system mode insecure" operation-mode. The following are the insecure ciphers associated
with TLS versions (1.0, 1.1):
|
Examples
The following example sets the SIP user agent to allow the reception of SIP signaling messages on the UDP socket:
sip-ua
transport udp
Examples
The following example sets the SIP user agent to allow the reception of SIP signaling messages on the TCP socket:
sip-ua
transport tcp
Examples
The following example sets the SIP user agent to allow the reception of SIP signaling messages on the TLS over TCP socket:
sip-ua
transport tcp tls
v1.0 Enable TLS Version 1.0
v1.1 Enable TLS Version 1.1
v1.2 Enable TLS Version 1.2
v1.3 Enable TLS Version 1.3
Examples
The following example sets the SIP user agent to TLS version 1.2 as minimum, enabling both TLS versions 1.2 and 1.3:
sip-ua
transport tcp tls v1.2 minimum
Examples
The following example illustrates a security warning message display in Cisco IOS XE 17.18.2 release for configurations using TLS versions below 1.2:
Device(config-sip-ua)#transport tcp tls v1.0
SECURITY WARNING - Module: SIPUA, Command: transport tcp tls v1.0, Reason: Weak tls version,
Remediation: Use stronger tls version to enhance security
Device(config-sip-ua)#do sh run | sec sip-ua
sip-ua
no remote-party-id
timers connect 501
timers dns registrar-cache 60
transport tcp tls v1.0
registration spike 100
connection-reuse
crypto signaling remote-addr 10.10.10.70 255.255.255.255 trustpoint CUBE-TLS strict-cipher
alias exec tcp show sip-ua connections tcp tls detail
Examples
The following example illustrates weaker TLS versions (1.0, 1.1) configuration in insecure mode with warning message display,
starting from Cisco IOS XE 26.1.1 release:
Device# configure terminal
Device(config)# system mode insecure
Device(config)# sip-ua
Device(config-sip-ua)# transport tcp tls v1.1
SECURITY WARNING - Module: SIPUA, Command: transport tcp tls v1.0, Reason: Weak tls version,
Remediation: Use stronger tls version to enhance security
Examples
The following example illustrates weaker TLS versions (1.0, 1.1) configuration in secure mode with error message display,
starting from Cisco IOS XE 26.1.1 release:
Device(config-sip-ua)# transport tcp tls v1.1
%Error:Insecure configurations are not permitted in secure mode. To proceed, set the system mode to insecure
using the command system mode insecure, and then try again.
Module: SIPUA, Command: transport tcp tls v1.1 , Reason: Weak tls version, Remediation: Use stronger tls version
to enhance security
%ERROR: Security policy check failed, configuration can't be applied