Cisco CUBE (ISR) guide for secure transcoding to SIP-Encrypt

What’s a CUBE?

A Cisco CUBE or “Cisco Unity Border Element” is the name given to a IP router that is running voice features. Specifically the Cisco IOS software is configured to route VoIP calls.

The Cisco Call Manager IP-PBX makes use of ISR routers as a platform for services that require treatment by Digital Signal Processors. Example of which are media termination points, audio transcoding, conferencing, bridging to ISDN and so on.  A CUBE is configured when a VoIP call enters and leaves the device where both call legs are VoIP calls. A licence from Cisco may be needed. A CUBE supports both H323 and SIP, and has extensive interoperability with other vendor systems, so can be used to protect many non Cisco solutions.

There is also a software only version of the CUBE that runs as a Virtual Machine.

To convert from unencrypted VoIP calls to encrypted VoIP calls, an ISR CUBE is first configured to host a secure transcoder. This uses DSP resources and DSP resources are provided withing a CUBE with a PVDM module. A PDVM sizing tool called DSP Calculator is available on cisco.com under support / other tools.

The CUBE is configured to accept an incoming call from an IP-PBX and to onward route the call to somewhere else. The call routing logic is normally dealt with using inbound and outbound dial-peer configuration. If the call routing requires a shift from non-secure to secure, or vice versa then the secure transcoder is invoked to enable the audio conversion.

Prerequisites for CUBE secure transcoding

Obtain the following information from Firstcom before you start

1. TLS Certificate (mandatory)
2. Assigned Session Border Controller
3. IP address space used by Firstcom in your territory
4. SIP username and password
5. Number format scheme format for CLI. This is self-configured on the selfcare portal.
6. Number format scheme format for Request URI. This is self-configures on the selfcare portal.

For the purposes of this document we will assume the following

1. We have the certificate
2. The SBC cluster assigned is perry.voip.co.uk
3. The IPV4 space is 193.203.210.0/23
4. The CLI will be provided in {e164} (other possible options are {national} and {custom})
5. The RURU will be in {e.164}

Configuration Steps

1. Ensure a Certificate is installed on the ISR
2. Install the Firstcom TLS certificate. This ensures your ISR trusts Firstcom’s network
3. Configure a Secure Transcoder
4. Configure the ISR router to accept a call from a PBX
5. Configure the ISR router to send the call to Firstcom
6. Configure the ISR router to receive an inbound call from Fistcom
7. Configure the ISR router to send the call to IP-PBX