• Multicast MOH for SIP is not supported on the Cisco 4000 Series Integrated Services Routers.

• Transcoding is not supported on the Unified SRST.

• Voice VRF is not supported for SCCP SRST on Cisco Integrated Services Router Generation 2 (ISR G2).

• Shared lines and Mixed shared lines are not supported on the Unified SRST (supported on the Unified E-SRST).

• Privacy (on hold) is not supported on the Unified SRST (supported on the Unified E-SRST).

• SNMP/MIB support is restricted to fetching information on mode and number of registered phones.

• The CLI command max-redirect is not supported for SIP on Unified SRST.

• Unified SRST supports only the basic voice hunt group features. To configure advanced voice hunt group features, you must deploy the Cisco Unified Enhanced Survivable Remote Site Telephony.

• Video Calling is not supported on Unified SIP SRST.

Unified SRST 12.8 (Cisco IOS XE Amsterdam 17.2.1r) and later releases support the following Cisco Jabber clients:

• Cisco Jabber for Windows,12.9

• Cisco Jabber for Mac, 12.9

When installing Cisco Unified Communications Manager, consider the following:

• See the installation instructions for your version in the Cisco Unified Communications Manager Install and Upgrade Guides.

• Integrate Cisco Unified SRST with Cisco Unified Communications Manager. Integration is performed from Cisco Unified Communications Manager. See the

Unified SRST is supported with SIP trunks. Also, Unified SIP SRST supports the following trunk types:

• FXO/FXS

• Basic Rate ISDN

• Primary Rate ISDN (T1 or E1)

For information on language support, see Localization Matrix.

Unified SRST supports all PRI and BRI switches including the following:

• basic-1tr6

• basic-5ess

• basic-dms100

• basic-net3

• basic-ni

• basic-ntt NTT switch type for Japan

• basic-ts013

• primary-4ess Lucent 4ESS switch type for the United States

• primary-5ess Lucent 5ESS switch type for the United States

• primary-dms100 Northern Telecom DMS-100 switch type for the United States

• primary-net5 NET5 switch type for the United Kingdom, Europe, Asia, and Australia

• primary-ni National ISDN switch type for the United States

• primary-ntt NTT switch type for Japan

• primary-qsig QSIG switch type

primary-ts014 TS014 switch type for Australia (obsolete)

Cisco Smart Licensing is a software licensing model that provides visibility of ownership and usage through the Cisco Smart Software Manager (CSSM) portal. CSSM is a central license repository that manages licenses across all Cisco products that you own, including Unified SRST. Devices send license usage to CSSM either directly or use an on-premises satellite. Your Smart Account Administrator controls your access to CSSM. Use your Cisco credentials to access the CSSM portal using http://software.cisco.com.

Smart Licensing applies to all platform technology (UCK9, Security) and Unified SRST feature licenses that the router uses. Unified SRST requires one license entitlement (SRST_EP) for each configured SIP or SCCP phone.

CSSM shows license usage across all devices that are registered to a virtual account. A Virtual Account License Inventory displays the quantity of licenses that are purchased, those licenses in use, and a balance. An Insufficient Licenses alert is displayed if the license balance is below 0.

For example, consider a smart account in CSSM with 50 SRST_EP licenses. If you have a single registered Unified SRST router with 20 phones configured, the CSSM licenses page shows Purchased as 50, In Use as 20 and Balance as 30.

For more information on Smart Software Manager, see the Cisco Smart Software Manager User Guide.

Note

The SRST_EP license count reflects the total phone count for both the ephones and voice register pools that are configured in the Unified SRST irrespective of whether the phones are registered or not. To avoid unnecessary reporting while Unified SRST is being configured, license usage is reported three minutes after the last configuration change.

Note	Unified SRST Smart Licenses also provide RTU entitlement for routers that are not configured for Smart Licensing.

Cisco 4000 Series Integrated Services Routers support Smart Licensing as an alternative to Cisco Software RTU Licensing. Use the license smart enable command to enable Smart Licensing. To disable Smart Licensing, use the no form of the command and re-accept the EULA using the license accept end user agreement command.

The Cisco RTU Licensing and the CLI license smart enable command are deprecated. Smart Licensing is mandatory from this release.

Routers configured to use Smart Licensing offer a 90-day evaluation period, during which you can use all the features without registering to CSSM. A Unified SRST device is associated with CSSM using a registration token. You can obtain the registration token from the virtual CSSM account or from an on-premises satellite. Once registered, the evaluation period pauses and you can use the balance license later. You cannot renew the evaluation period on its expiry.

Warning

Unified SRST shuts down when the router is unregistered and allowed to pass in to the Evaluation Expired state.

To register the Unified SRST router with CSSM, use license smart register idtoken command. For information on registering the device with CSSM, see Software Activation Configuration Guide.

Upon successful registration, the device sends an authorization request to CSSM for the licenses in use. For each license type requested, if the Smart Account has sufficient licenses, CSSM responds with Authorized . If the Smart Account does not have sufficient licenses, CSSM responds with Out of Compliance .

Post successful authorization of the request, licenses are bound to the requesting device until the next authorization request submission. An authorization request is sent every 30 days or when there is any change in license consumption, to maintain the registration with CSSM. The authorization expires if you do not update the license request for the router within 90 days. The certificate issued to identify the router at the time of registration is valid for one year and renewed every six months. The router displays the License authorization as follows:

Router# show license summary
Smart Licensing is ENABLED
Registration:
Status: REGISTERED
Smart Account: ABC
Virtual Account: XYZ
Export-Controlled Functionality: Not Allowed
Last Renewal Attempt: None
Next Renewal Attempt: Jun 07 12:08:10 2017 UTC
License Authorization:
Status: AUTHORIZED
Last Communication Attempt: SUCCESS
Next Communication Attempt: Apr 13 07:11:48 2017 UTC
License Usage:
License                  Entitlement tag            Count Status
-----------------------------------------------------------------------------
ISR_4351_UnifiedCommun.. (ISR_4351_UnifiedCommun..) 1     AUTHORIZED
SRST v12 Endpoint Li...  (SRST_EP)                  4     AUTHORIZED

Specific License Reservation (SLR) is supported on Cisco 4000 Series Integrated Services Routers. SLR allows reservation and utilization of Cisco Smart Licenses without communicating the license information to CSSM. To reserve specific licenses for a device, generate request code from the device. Enter the request code in CSSM along with the required licenses and their quantity, and generate authorization code. Enter the authorization code on the device to map the license to the Unique Device identifier (UDI).

Note	If upgrading to IOS XE Amsterdam 17.3.1a with a license reservation in place, update the reservation to include version 14, rather than version 12 SRST licenses. The reservation may be updated before or after the software upgrade.

This release introduces a new paradigm for tracking license usage across your business. In earlier releases, license authorization was forward looking, binding licenses to a device until the next authorization request. Actual license usage during the proceeding reporting period is now sent to CSSM, allowing you to plan ongoing license requirements based on historical usage data. Initial device registration is no longer required to use most platform functionality and the evaluation period is deprecated.

License usage reports are submitted periodically according to a minimum reporting policy set for your account. Typically, this period could be once per year. However, you can generate reports more frequently if the use of licensed features varies over time. CSSM acknowledges each Resource Utilization Monitoring (RUM) report to ensure that the usage is recorded reliably. If the router does not receive an acknowledgment within the minimum reporting period, call processing is disabled. Call processing is resumed when a valid acknowledgment is received.

Reports can be submitted to CSSM directly or through a satellite. Cisco Smart Licensing Utility (CSLU) applications can also receive usage reports, providing you with more flexibility in managing your license usage. Also, when a device is not able to communicate directly with a licensing server, a signed usage report can be generated and manually uploaded to CSSM. The acknowledgment generated by CSSM must be uploaded to the device within the license reporting policy period to ensure continued use.

As license reporting is now based on historical usage, the registration process used previously has been replaced with a trust association that also defines the reporting policy set in your account. Establishing trust with CSSM or Cisco Smart Software Manager Satellite uses an identity token similar to earlier registrations. Use the license smart trust idtoken token command to establish the trust relationship within the initial reporting period set for the device. The CLI license smart register command is deprecated from this release.

Current license usage for Unified SRST is displayed using the show license summary command:

Note	Smart License Reservation (SLR) for SRST licenses is not compatible with IOS XE Amsterdam 17.3.2 and later releases. Even if a reservation is in place when upgrading to one of these releases, license use reporting will still be required in accordance with the device policy.

Router#show license summary
License Usage:
License                  Entitlement tag              Count   Status
-----------------------------------------------------------------------------
appxk9...................(ISR_4400_Application) ......1...... IN USE
uck9.................... (ISR_4400_UnifiedCommun..)...1.......IN USE
securityk9.............. (ISR_4400_Security)......... 1.......IN USE
SRST_E_EP............... (SRST_E_EP)..................2.......IN USE
SRST_EP..................(SRST_EP)...................18...... IN USE

Configure the passwords relevant to Unified SRST, Unified E-SRST, and Unified Secure SRST using the CLI commands as follows:

• call-manager-fallback configuration mode

• xml user username password [0|6]password privilege-level

Note	The 0 in the parameter [0|6] mentioned in the CLI command represents plain, unencrypted text and 6 represents level 6 password encryption.

• Apart from the parameter configurations ([0|6]) at the command level, configure the Unified SRST router to support encryption.

• Configure the CLI command encrypt password under call-manager-fallback configuration mode to support type 6 encryption on the Unified SRST router.

• Also, it is mandatory to configure key config-key password-encrypt[Master key]password encryption aes to support encryption on the Unified SRST router.

• If the key used to encrypt the password is replaced with a new key (replace key or re-key), then the password is re-encrypted with the new key.

• You must adhere to SRST Password Policy for both type 0 and type 6 parameters that you configure on Unified SRST.

• Configure no encrypt password for type 0 password on the Unified SRST router. A type 0 password is displayed as unencrypted plain text.

• If you are performing a downgrade from Unified SRST 12.6 to an earlier version, then you must execute the CLI command no encrypt password . If the CLI command no encrypt password is configured, the password is presented as plain text.

Router(config)#key config-key password-encrypt <cisco123>
Router(config)#password encryption aes
Router(config)#call-manager-fallback
Router(config-cm-fallback)encrypt password

From Unified SRST Release 12.6 onwards, the following CLI commands that are configured under call-manager-fallback configuration mode are deprecated to enhance product security:

• log passwordpassword-string

• xmltest

• xmlschemaschema-url

• xmlthread number

From Unified SRST Release 12.6 onwards, passwords and sRTP keys are not printed to logs to enhance security of Unified SRST. The information about keys is available only in the show commands from Unified SRST 12.6 release onwards. The CLI command show ephone offhook for SCCP and show sip-ua calls for SIP are enhanced to display the keys that are in use per media stream, along with the sRTP Ciphers.

The following is a sample output for the show command, show sip-ua calls . The lines that are added to the show command output as part of the Unified SRST 12.6 enhancement are the local crypto key and the remote crypto key:

SIP UAC CALL INFO
Number of SIP User Agent Client(UAC) calls: 0
SIP UAS CALL INFO
Call 1
SIP Call ID : 007278df-12e00376-6ed02377-6ffbaca9@8.55.0.195
State of the call : STATE_ACTIVE (7)
Substate of the call : SUBSTATE_NONE (0)
Calling Number : 1001
Called Number : 6901%23
Called URI : sip:6901%23@8.39.25.11;user=phone
Bit Flags : 0x10C0401C 0x10000100 0x4
CC Call ID : 196
Local UUID : 61488a9100105000a000007278df12e0
Remote UUID : c4b7f9475629538096ef61699b96746f
Source IP Address (Sig ): 8.39.25.11
Destn SIP Req Addr:Port : [8.55.0.195]:52704
Destn SIP Resp Addr:Port: [8.55.0.195]:52704
Destination Name : 8.55.0.195
Number of Media Streams : 1
Number of Active Streams: 1
RTP Fork Object : 0x0
Media Mode : flow-through
Media Stream 1
State of the stream : STREAM_ACTIVE
Stream Call ID : 196
Stream Type : voice+dtmf (1)
Stream Media Addr Type : 1
Negotiated Codec : g711ulaw (160 bytes)
Codec Payload Type : 0
Negotiated Dtmf-relay : rtp-nte
Dtmf-relay Payload Type : 101
QoS ID : -1
Local QoS Strength : BestEffort
Negotiated QoS Strength : BestEffort
Negotiated QoS Direction : None
Local QoS Status : None
Media Source IP Addr:Port: [8.39.25.11]:8080
Media Dest IP Addr:Port : [8.55.0.195]:23022
Local Crypto Suite : AEAD_AES_256_GCM
Remote Crypto Suite : AEAD_AES_256_GCM (
AEAD_AES_256_GCM
AEAD_AES_128_GCM
AES_CM_128_HMAC_SHA1_80
AES_CM_128_HMAC_SHA1_32 )
Local Crypto Key : 3taqc13ClF6BBpvd65WTMPrad/i0uyQ6iNouh+jYHxbf48d4TFmsOGyh4Vs=
Remote Crypto Key : 2/TNTV+Rc1Nh/wbGj0MGwIsLrJ4l+N2jKWGczolEnf7sgsA0Q9AEIz0a4eg=
Mid-Call Re-Assocation Count: 0
SRTP-RTP Re-Assocation DSP Query Count: 0

The following is a sample output for the show command, show ephone offhook . The lines that are added to the show command output as part of the Unified SRST 12.6 enhancement are local key and remote key.

ephone-1[0] Mac:549A.EBB5.8000 TCP socket:[1] activeLine:1 whisperLine:0 REGISTERED in
SCCP
ver 21/17 max_streams=1 + Authentication + Encryption with TLS connection
mediaActive:1 whisper_mediaActive:0 startMedia:1 offhook:1 ringing:0 reset:0 reset_sent:0
paging 0 debug:0 caps:8
IP:8.44.22.63 * 17872 SCCP Gateway (AN) keepalive 28 max_line 1 available_line 1
port 0/0/0
button 1: cw:1 ccw:(0 0)
dn 1 number 6901 CM Fallback CH1 CONNECTED CH2 IDLE
Preferred Codec: g711ulaw
Lpcor Type: none Active Secure Call on DN 1 chan 1 :6901 8.44.22.63 18116
to 8.39.25.11 8066 via 8.39.0.1
G711Ulaw64k 160 bytes no vad
SRTP cipher: AES_CM_128_HMAC_SHA1_32
local key: 0OPV0yxvcnRLPMzHfmYbwgHfdxcuS1uPbp5j/Tjk
remote key: e8DQl3Kvk7LjZlipaCoMg9TMreBmiPsFmNiVHwIA
Tx Pkts 0 bytes 0 Rx Pkts 0 bytes 0 Lost 0
Jitter 0 Latency 0 callingDn -1 calledDn -1

Unified SRST 12.6 enforces security and toll fraud prevention for SIP line side on Unified SRST. The ip address trusted authentication configuration blocks unauthorized calls from the line side. Hence, the toll fraud prevention feature secures Unified SRST 12.6 and later from unauthorized users on the line side.

The IP addresses of SRST endpoints are available before registration with Unified SRST, as they are configured (under voice register pool ) for fallback from Unified CM. Hence, it is not mandatory that the endpoints are registered to Unified SRST for configuring toll fraud prevention.

The IP trust list for Unified SRST is populated based on the IP address information available under voice register pool configuration mode. You can find the IP address of the SIP endpoints on Unified SRST under the following commands in voice register pool configuration mode:

• id ip (For example, id ip192.168.0.0 )

• id network (For example, id network192.168.25.0mask255.255.255.0 )

Sometimes, IP addresses of endpoints are not available to Unified SRST before registration. Consider a scenario where id device-id is the CLI command configured under voice register pool configuration mode to define the device name. Then, the IP address of the device or endpoint is available to Unified SRST only during registration.

The following are the configurations of Toll Fraud Prevention in Unified SRST, 12.6:

• The CLI command ip address trusted authentication is enabled by default in Unified SRST. The command ip address trusted authentication ensures that security is enabled on the Unified SRST system.

• You can manually configure your Unified SRST endpoints as trusted by entering the IP address or subnet of the trusted phone under theiptrust-list configuration mode, as follows:

Router#config t
Router(config)#voice service voip
Router(conf-voi-serv)#ip address trusted list
Router(cfg-iptrust-list)#ipv4 192.168.10.0 /16
OR
Router(cfg-iptrust-list)#ipv4 192.168.12.0 255.255.255.0

• You can verify the manually added IP address of the Unified SRST endpoint, as follows:

Router#show running-config | section voice service voip
voice service voip
ip address trusted list
ipv4 192.168.10.1
ipv4 192.168.10.2 255.255.0.0
ipv4 192.168.10.3 255.255.0.0
ipv4 192.168.10.4 255.255.255.0

• The CLI command ip address trusted list under voice service voip configuration mode supports manual configuration of trusted IP addresses.

• The CLI command show ip address trusted check provides information on whether a particular IP address is trusted or not.

• The CLI command silent-discard untrustedsip in configuration mode silently discards SIP requests from untrusted sources. This command is enabled by default on Unified SRST.

• The show ip address trusted list CLI command displays a list of trusted IP addresses. The trusted IP addresses are displayed under the following lists:

• Dial Peer (only applicable for trunk side): Provides details on the IP address of the trunk that is configured under the dial-peer configuration mode.

• Configured IP Address Trusted List: Provides details on the manually configured IP addresses that are trusted.

• Dynamic IP Address Trusted List: Provides details on the IP address of all the phones that are configured for fallback from Unified CM. This list is introduced in Unified CME 12.6 Release.

• Server Group: Provides details on the IP address of the phones that are configured under server-groups configuration mode.

Router>enable
Router#show ip address trusted list
IP Address Trusted Authentication
Administration State: UP
Operation State: UP
IP Address Trusted Call Block Cause: call-reject (21)
VoIP Dial-peer IPv4 and IPv6 Session Targets:
Peer Tag Oper State Session Target
-------- ---------- --------------
4         UP        ipv4:10.65.125.155
Configured IP Address Trusted List:
ipv4 192.168.20.1
ipv4 192.168.20.2 255.255.0.0
ipv4 192.168.20.3 255.255.0.0
ipv4 192.168.20.4 255.255.255.0
Dynamic IP Address Trusted List:
IP Address                                   Subnet Mask     Count Reason
-------------------------------------------- --------------- ----- ----------------
ipv4:8.55.0.0                                255.255.0.0         1 Pool Configured
ipv4:192.168.0.1                             255.255.0.0         2 Pool Configured
ipv6:2001:420:54FF:13::312:0                 119                 1 Pool Configured
ipv4:8.55.22.15                                                  1 Phone Registered

Note	The column Count in Dynamic IP Address Trusted List displays the number of directory numbers (DNs) sharing the same IP address. For example, ipv4 192.168.0.1 with count 2 represents two DNs sharing the IP address 192.168.0.1.

Note	The output of show ip address trusted list command displays the entry in column Type as ‘Phone Registered’ if id device-id is configured.

Typically, service providers use a VRF between Provider Edge (PE) and Customer Edge (CE) routers to provide VPN support for customers. VRF is also used to segment data and voice traffic for improved traffic management. VRF can be configured on an interface to process incoming packets according to the assigned VRF.

By configuring VRF-awareness on voice gateways, you can specify a VRF for the voice traffic that is generated from within the gateway. Voice VRF is added to the VoIP service provider interface (SPI) of the gateway to send and receive signaling and media packets in the configured VRF. The SPI can send and receive signaling and media packets only in the configured VRF.

Note	We recommend that you configure voice vrf for Unified SRST. For more information, see see Design Recommendations for VRF, page 62.

• SIP endpoints supported by Unified SRST, including Cisco IP Phone 7800 Series, Cisco IP Phone 8800 Series, and Cisco Jabber support VRF for Unified SRST.

• VRF support is offered for both secure and nonsecure deployments of Unified SRST.

• Configuring SRST to use a VRF is compatible with both SIP and TDM trunk configurations.

• If Global Bind and voice vrf are configured on the Unified SRST, then preference is given to the Global Bind.

• We recommend that

  • For SRST line side, configure VRF using voice vrf command.

  • For SIP trunk side, configure VRF using bind command configured under voice class tenant configuration mode and attach the tenant to the required SIP trunk dial-peer.

• VRF Preference Order—The following is the binding preference order for call processing on the trunk side and line side for SRST:

The following basic features are supported for a IPv6 WAN down scenario:

• Basic SIP Line (IPv4 or IPv6) to SIP Line calls (IPv4 or IPv6) when Unified SRST is in dual-stack no anat mode.

The following supplementary services are supported as part of IPv6 in Unified SRST IP Phones:

• Hold/Resume

• Call Forward

• Call Transfer

• Three-way Conference (with BIB conferencing only)

• Line to T1/E1 Trunk and Trunk to Line with Supplementary Service Features

• Fax to and from PSTN (IPv4 ATA to ISDN T1/E1) for both T.38 Fax Relay and Fax Passthrough