<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Lelio,<div><br></div><div>From the sounds of it looks like you already have MRA expressways and want to enable B2B on the same for VC/SIP end points registered to CUCM - you will need -</div><div><br></div><div>1) If both the MRA and B2B go to same CUCM then the ports for neighbour zone (between Exp-C and CUCM need to be different from MRA, you can set these up at exp-c and CUCM SIP trunk)</div><div><br></div><div>2) There has to be a separate traversal zone between exp-c and exp-e as well for B2B, using a different port. If existing MRA is using 7001, use 7002 for B2B. </div><div><br></div><div>3) For outbound calls to Webex setup is fairly simple, As long as you have opened the required firewall ports, (which you can find in the admin guide)</div><div>You don’t need any SRV records for outbound only sip route patterns/trunk on CUCM and expressway zones/search rules. </div><div><br></div><div>4) For inbound calls from WebEx you will need to publish theSRV records for your domain. (Only needed if you have enabled or require call me or call my video system from Webex)</div><div><br></div><div>5) As others have mentioned, CMR calls to webex don’t require RMS license. </div><div><br></div><div>6) Also be mindful of the internet bandwidth; depending on your usage. </div><div><br></div><div>7) Regards to Security; you can setup ACL at your routers, switches (l2 vacls, acls - normally comes up to your organisations network policy on what you have already in place), obviously firewalls. The complete list of ports is in the admin guide. </div><div><br></div><div>-Terry<br><br><div id="AppleMailSignature">Sent from my iPhone</div><div><br>On 3 Aug 2018, at 6:44 am, Brian Meade <<a href="mailto:bmeade90@vt.edu">bmeade90@vt.edu</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">It's always up to the caller and what SRV records they check and in which order. Webex always prefers the TLS SRV records first though.</div><br><div class="gmail_quote"><div dir="ltr">On Thu, Aug 2, 2018 at 12:10 PM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_5936953658442087667WordSection1">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks Brian. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I meant to write: _<i>without</i>_ the need for licenses – but good to be corrected, since it does firm up my assumptions.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ll take a look at the document. We’re working with a partner, so I’m hoping not to have to be to versed with he deployment details too much, but the options available will be good to review.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Will all B2B calls try 5061? If so, then that breaks my theory / thought about using ACLs, since MRA needs those ports.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">---<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">Lelio Fulgenzi, B.A.</span></b><span style="font-family:"Arial",sans-serif"> | Senior Analyst<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#333333">Computing and Communications Services</span><span style="font-family:"Arial",sans-serif"> | University of Guelph<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">519-824-4120 Ext. 56354 |
<a href="mailto:lelio@uoguelph.ca" target="_blank"><span style="color:#0563c1">lelio@uoguelph.ca</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><a href="http://www.uoguelph.ca/ccs" target="_blank"><span style="font-family:"Arial",sans-serif">www.uoguelph.ca/ccs</span></a><span style="font-family:"Arial",sans-serif;color:#1f497d"> | @UofGCCS on Instagram, Twitter and Facebook<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><img border="0" width="187" height="100" style="width:1.9479in;height:1.0416in" id="m_5936953658442087667Picture_x0020_1" src="cid:image001.png@01D42A59.AF939E10" alt="University of Guelph Cornerstone with Improve Life tagline"><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>> <br>
<b>Sent:</b> Wednesday, August 1, 2018 9:16 AM<br>
<b>To:</b> Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>><br>
<b>Cc:</b> cisco-voip voyp list <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> Re: [cisco-voip] Enabling CUCM/WebEx/B2B - firewall’ing thoughts?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Lelio,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">You don't need RMS licenses for Webex calls. You need to use the exact settings mentioned in the<a href="https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Deployment_Guide_WBS31_WBS32.pdf">https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Dep</a>Webex CMR Guide though- <a href="https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Deployment_Guide_WBS31_WBS32.pdf" target="_blank">https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Dep</a><a href="https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Deployment_Guide_WBS31_WBS32.pdf">https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Deployment_Guide_WBS31_WBS32.pdf</a><a href="https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/WebEx_Meeting_Center_Video_Conferencing_Enterprise_Deployment_Guide_WBS31_WBS32.pdf" target="_blank">loyment_Guide_WBS31_WBS32.pdf</a></p></div></div></div></div></blockquote></div></div></blockquote><blockquote type="cite"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_5936953658442087667WordSection1"><div><div><p class="MsoNormal"><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Also Webex will typically try TLS inbound so I would just go with the _sips SRV record and just open inbound 5061 along with the audio ports. You can disable TCP/UDP 5060 from the Expressway as well.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">You can also setup mutual TLS with Webex for even more security. That way Expressway is only trusting Webex certificates for inbound calls. Most of that documentation is in the Hybrid Services Call Service Connect documentation.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Wed, Aug 1, 2018 at 9:09 AM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We’re finally taking a turn (not to be confused with TURN - hahaha) at getting CUCM talking to WebEx. Im guessing this is simply a B2B setup with the need for licenses. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The question I have is whether or not I should be activating ACLs anywhere along the path to avoid the expressways from getting hammered and clogging up the logs. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We’ll be enabling this on the MRA expressway pairs for the time being. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">From my understanding, MRA uses 5061, 8443, 5222 inbound and B2B uses 5060. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Would it be advisable, to build ACLs only allowing certain address (space) to connect?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This would be on top of any rules/zones we build into the ExpE and CUCM (css). <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We’re trying to avoid the obvious impact of scanning Ip addresses/uri’s for sip connectivity. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">What are people doing?<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div id="m_5936953658442087667m_6078027502892570623AppleMailSignature">
<p class="MsoNormal"><i>-sent from mobile device-</i><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>Lelio Fulgenzi, B.A.</b> | Senior Analyst<u></u><u></u></p>
<p class="MsoNormal">Computing and Communications Services | University of Guelph<u></u><u></u></p>
<p class="MsoNormal">Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"><a href="tel:519-824-4120;56354" target="_blank">519-824-4120 Ext. 56354</a> | <a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a></span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"><a href="http://www.uoguelph.ca/ccs" target="_blank">www.uoguelph.ca/ccs</a> | @UofGCCS on Instagram, Twitter and Facebook</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote></div>
</blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>cisco-voip mailing list</span><br><span><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a></span><br><span><a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span><br></div></blockquote></div></body></html>