Jaroslav Martan video:

Product Naming & Positioning Solution Overview Deployment Considerations Setup Security Considerations Platform Choices & Scale Licensing & Migration 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 2

Collaboration Edge Architecture: umbrella term describing Cisco s entire collaboration architecture for edge... features and services that help bridge islands to enable any to any collaboration collaborate with anyone anywhere, on any device. Collaboration Edge Architecture Core Products include Cisco CUBE TDM & Analog Gateways SRST Is Jabber VPN-less access Collab Edge? the Collaboration Edge architecture includes VPN-less access for Jabber this capability is enabled by the Cisco product specifically labeled remote and mobile access at the feature level delivered in the X8.1 software release 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 4

Device Service Category Type of Service Service Delivery Product Position Jabber TelePresence Remote and Mobile Remote Fixed Line: Audio, Video, Directory Search, Visual Voicemail, Content Share Line: Audio, Video, Directory Search, Content Share Internet or Private Internet or Private Remote Fixed Line: Audio HCS CUBE (X8.1) (X8.1) 69XX, 7XXX, 89XX, 99XX IPSec or TLS Proxy VPN Phone, CVO, CUBE PSTN Trunk: Audio Private SIP Trunk CUBE SIP Trunk Video Trunk: Video, Conferencing Private SIP Trunk or CUBE DX 650 Remote Fixed Line: Audio, Video, Directory Search, CTI/QBE Internet or Private AnyConnect (today) (CY14 roadmap) 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 5

X8.1 VCS New Offering VCS Control No Change VCS No Change C Or Core E Or Edge Specialized video applications for video-only customer base (GK, interworking, traversal) For customers requiring endpoints to register to VCS B2B Video and Audio for UC customers Gateway 3 rd party UC solutions (Lync, Polycom) Remote & mobile access for Jabber and fixed endpoints Solution designed for and sold exclusively with UCM 9.1 and above Remote and mobile access for Jabber and fixed endpoints B2B Video and Audio for UC customers Jabber Guest Gateway 3 rd party UC solutions (Lync, Polycom) 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 6

Business to Business Consumer to Business Secure communications with partners, customers & suppliers over the internet Open, DNS-based URI dialing Integrated customer relationships re-imagined Jabber Guest Remote and Mobile Worker Access Cloud Services Enterprise flexibility and scalability WebEx and TelePresence Together, Service Provider Offerings Legacy & 3rd Party Interoperability Consistent user experience outside the corporate network Jabber Mobile, Desktop & TelePresence Endpoints Investment Protection and return on investment IP4 to IP6, H.323-SIP, Standards-based 3rd Party Video Cisco Unified Communications Manager Seamless User Experiences 2013 Cisco and/or its affiliates. All rights reserved. Simple, Secure Access No One Left Behind Connect Club 7

Enterprise Network DMZ Outside Network UCM Internet C Firewall E Firewall Signaling Media 1. E is the traversal server installed in DMZ. C is the traversal client installed inside the enterprise network. 2. C initiates traversal connections outbound through the firewall to specific ports on E with secure login credentials. 3. Once the connection has been established, C sends keep-alive packets to E to maintain the connection 4. When E receives an incoming call, it issues an incoming call request to C. 5. C then routes the call to UCM to reach the called user or endpoint 6. The call is established and media traverses the firewall securely over an existing traversal connection 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 9

The X8.1 release delivers 3 key capabilities enabling the Remote and Mobile Access Feature XCP Router for XMPP traffic HTTPS Reverse proxy Proxy SIP registrations to UCM (details on new firewall port requirements covered later) 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 10

Unified CM & applications AnyConnect VPN Firewall Traversal Layer 3 VPN Solution Secures the entire device and it s contents AnyConnect allows users access to any permitted applications & data New Offering Session-based firewall traversal Allows access to collaboration applications ONLY Personal data not routed through enterprise network 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 12

Access visual voicemail Inside firewall (Intranet) DMZ Outside firewall (Public Internet) Collaboration Services Internet Instant Message and Presence Unified CM C E Make voice and video calls Launch a web conference Share content Search corporate directory 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 13

Inside firewall (Intranet) DMZ Outside firewall (Public Internet) Protocol Security Service Collaboration Services Internet SIP TLS Session Establishment Register, Invite, etc. via UCM Unified CM C E Media SRTP Audio, Video, Content Share, Advanced Control (RTP/SRTP, BFCP, ix/xccp) Unified CM IM&P Conference Resources HTTPS TLS Logon, Provisioning/ Configuration, Contact Search, Visual Voicemail XMPP TLS Instant Messaging, Presence Other UC Infrastructure & Resources 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 14

Inside firewall (Intranet) DMZ Outside firewall (Public Internet) DNS SRV lookup _cisco-uds._tcp.example.com Not Found Collaboration Services Public DNS DNS SRV lookup _collab-edge._tls.example.com UCM C E expwynyc.example.com TLS Handshake, trusted certificate verification HTTPS: get_edge_config? service_name=_ciscouds&service_name=_cuplogin 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 15

Media Traversal UCM provides call control for both mobile and on-premise endpoints Inside firewall (Intranet) DMZ Outside firewall B C calls A on-premise solution provides firewall traversal for media C de-multiplexes media and forwards toward A Media Relay Collaboration Services Internet C C calls B off-premise Media is relayed via C UCM C E Optimized Media (roadmap ICE support) B calls D off-premise A SIGNALING MEDIA D Both B and D are ICE-enabled STUN binding success Media flows are optimized between endpoints 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 16

Cisco X8.1 Cisco Unified CM 9.1 Cisco Jabber 9.6 Cisco TelePresence TC 7.0 No support for Cisco Unified CM 8.6 ICE (STUN/TURN) support not included in Cisco Unified CM 10.0, on roadmap for 10.5 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 17

_sip._tcp IN SRV 0 0 5060 vcs.abc.com. vcs IN A 201.1.2.4 DNS UC Manager (ABC.COM) 192.168.1.4 Internet sip:meeting-room@xyz.com Generic SIP B2BUA (XYZ.COM) sip:joe@abc.com 201.1.2.4 port 5060 DNS _sip._tcp IN SRV 5 0 5060 edge.xyz.com. edge IN A 198.10.2.4 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 19

Jabber Guest connects consumers and other non- Cisco telephony users with Cisco enterprise registered users via simple browser & mobile voice and video Guest/Public User Enterprise User 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 21

Home Internet DMZ Enterprise Edge Core Reverse Proxy integrated for X8.1 Jabber Guest CUCM HTTP- based call control (ROAP) SIP RTP/SRTP STUN/TURN Jabber Guest Serves up Javascript call control based on URL For mobile, Cisco app from app store or integrated into 3 rd -party app For laptop browsers, initiates H.264 plugin install as needed for Cisco or 3 rd -party Web app Converts HTTP call request to SIP INVITE * X8.1 or later required 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 22

Add _collab-edge SRV to Public DNS Collaboration Services Deploy Jabber Guest Update _sip, _sips, _h323 SRV records to resolve to E Trunk MCU to UCM or C B2B Video SIP & H.323 (inbound & outbound) Cisco Movi and 3 rd Party Registration Cisco TelePresence Endpoints (TC) Registration WebEx Enabled TelePresence (outbound) UCM VCS-C VCS-E C E Cisco Jabber Registration Cisco TelePresence Endpoints (TC) Registration Jabber Guest (inbound) B2B Video SIP & H.323 (inbound & outbound) WebEx Enabled TelePresence (outbound) 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 25

Jabber allows for multiple contact source integrations Collaboration Services Unified CM Inside firewall (Intranet) C DMZ E Outside firewall (Public Internet) Internet UDS LDAP Directory sync provides corporate directory to UCM User Data Services (UDS) is a UCM RESTful API allowing for contact search, among other things All Jabber clients connecting via will use UDS for contact search Jabber clients deployed on-premise will use LDAP for directory search EDI/BDI Jabber clients will automatically use UDS for directory search when connecting via LDAP The entire corporate directory needs to be sync d on every UCM cluster for best contact search experience 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 26

Cluster s for scale and redundancy Clusters support up to 6 peers E and C node types cannot be mixed in the same cluster Deploy equal number of peers in C and E clusters Deploy same OVA sizes throughout cluster remote access is limited to one customer domain per cluster However customers can deploy multiple clusters for the same customer domain 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 27

Collaboration Services Unified CM Inside firewall (Intranet) C DMZ E Cluster A Outside firewall (Public Internet) Internet This model is still supported for traditional VCS deployments But this is not supported for the new remote and mobile access functionality introduced in X8.1 X8.1remote access requires a C cluster for each E cluster Only one Remote & Mobile Access enabled Traversal zone per cluster E Cluster B 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 28

Collaboration Services Inside firewall (Intranet) DMZ B DMZ A Outside firewall (Public Internet) Internet This deployment model is often used in environments with heightened security policies This model is still supported for traditional VCS deployments, or deployments do not require the remote and mobile access feature Unified CM C C/E E But this is not supported for the new remote and mobile access functionality introduced in X8.1 Traversal Client Traversal Server & Traversal Client Traversal Server Only one Remote & Mobile Access enabled Traversal zone per cluster 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 29

No inbound ports required to be opened on the internal firewall Important!!!!! Internal firewall needs to allow the following outbound connections from C to E SIP: TCP 7001 Traversal Media: UDP 36000 to 36011 XMPP: TCP 7400 HTTPS (tunneled over SSH between C and E): TCP 2222 VCS only: 1719 (UDP) (GK RAS Service) External firewall needs to allow the following inbound connections to SIP: TCP 5061 HTTPS: TCP 8443 XMPP: TCP 5222 TURN server control and media: UDP 3478 / 60000-61799 Media: UDP 36012 to 59999 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 31

X8 scalability improvements require a media port range expansion X8 default media Port Range is now UDP 36000 59999 VCS systems upgraded from X7 to X8 will need to manually update port range, Configuration > Local Zone > Traversal Subzone 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 32

Important change for existing VCS customers to understand X7 release included the ability to configure the Media demultiplexing RTP port and RTCP port Configuration Removed in X8 Upon upgrading to X8 the traversal media ports are automatically migrated to the first 2 ports in the current media port range (details on previous slide) Customers will need to coordinate X8 upgrade with firewall port change New X8 installs on the Large OVA (or new appliance) will use UDP 36000 36011, the expanded port range is required to support scalability improvements 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 33

E Server Certificates will need to be signed by 3 rd party Public CA Public CA signed certificates allow Jabber clients and endpoints to validate the server certificate without a CTL Note: Jabber clients with a CTL will not use the CTL to validate certificate C server certificates can be signed by 3 rd party Public CA or Enterprise CA C server certificates need to include an extension allowing for client authentication No support for wildcard certificates No requirement to include certs in UCM s CTL 2011 Cisco and/or its affiliates. All rights reserved. Connect Club 34

Certificate Type C E Comments Public CA cert chain used to sign E certificate Public or Enterprise CA cert chain used to sign C certificate þ þ þ þ UCM Tomcat certificates or CA chain þ ý UCM CallManager certificates or CA chain þ ý UCM IM&P Tomcat certificates or CA chain þ ý UCM CAPF certificate(s) ý þ Required to establish Traversal Zone connection Required to establish Traversal Zone connection Only required when C configured to use TLS Verify mode on Unified CM discovery Only required when UCM is in mixed mode for end to end TLS Only required when C configured to use TLS Verify mode on IM&P discovery Only required when remote endpoints authenticate with LSC certificate 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 35

Remote access provided by is, for the most part, transparent to UCM Think SIP line integration, versus SIP trunk No requirement to build a SIP trunk on UCM to VCS Control or Remote Jabber clients or TelePresence Endpoints registering to UCM through will appear to UCM as -C IP address No remote access policy mechanism to limit edge access to certain Jabber users or devices There will be a COP file made available for UCM 9.1 customers deploying remote and mobile access in production environments, shouldn t be required for labs or POCs 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 37

Collaboration Services SIP Video Endpoints Unified CM SIP Trunk can interfere with remote registrations Inside firewall (Intranet) VCS Control H.323 Video Endpoints DMZ VCS Outside firewall (Public Internet) Internet SIP trunk is not required between VCS and UCM for Remote Access deployment However, if UCM has an existing SIP trunk configured for VCS-C, UCM will reject any SIP registration attempts from remote Jabber or TP endpoints, as the register method is not accepted on UCM SIP trunk interface Update UCM SIP trunk security profile to listen on ports other than TCP 5060 or 5061 (you could use 5560, 5561, etc.) Port change allows for SIP trunk integration + remote access 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 38

Specs Based Virtual Machine Support OVA Size vcpu Reserved RAM Small 2 x 1.8 GHz Medium 2 x 2.4 GHz Large 8 x 3.3 GHz Disk Space vnic(s) 4GB 132GB 1Gb 6GB 132GB 1Gb 8GB 132GB 10Gb Appliance Support Existing VCS Appliance CE 500 CE 1000 New Offerings New appliances based on UCS C220 M3 Bare metal no hypervisor Fixed configurations for high and low end deployment Solution for customers with security policies that do not allow VMware in the DMZ CE500 Single components, 1Gbps interfaces CE1000 Redundant components, 1 or 10Gbps interfaces Target FCS Q1 CY2014 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 40

Server Cluster Platform Proxied Registrations Video Calls Audio Only Calls Proxied Registrations Video Calls Audio Only Calls Large OVA / CE1000 5,000 500 1,000 20,000 2,000 4,000 Medium OVA 2,500 100 200 10,000 400 800 Small OVA (BE6K) Current VCS Appliance 2,500 100 200 N/A N/A N/A 2,500 100 200 10,000 400 800 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 41

Call license optimization Preview Feature ü Each traversal call license allows either 1 video call or 4 audio-only SIP calls ü 100 traversal call license would allow For example, 90 video and 40 SIP audio-only simultaneous calls. 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 43

Time-limited (Demo) option keys ü The VCS now supports time-limited option keys ü The options keys page displays the validity period of each key ü All pre-existing option keys have an Unlimited validity period 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 44

ISDN No Additional Cost for Virtual Edition UCM 9.1 C E Internet Fixed and Mobile Users at no additional cost Mobile and Fixed Endpoint registrakon IM & Presence Video and Audio Media Sessions No Cost with UCM 9.x and above C as Lync Gateway Lync 2013 Separate C Server required for Lync Gateway 3rd Party Video and Audio Media Sessions (Rich Media Sessions) Business to Business Concurrent Sessions Business to Business Video and Audio Media Sessions Rich Media Session Interoperability Concurrent Sessions MSFT Interoperability OpKon Key Required Rich Media Session 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 45

Cisco is the evolution of VCS, specifically targeting UCM (9.1+) customers Cisco provides secure internet access for UCM, delivering VPN-less access for Jabber B2B Video Jabber Guest WebEx Enabled TelePresence The two biggest deployment challenges will likely be DNS and certificates understand the solution requirements and begin working through these sooner than later with your customers Remote and Mobile access for multiple UCM clusters is supported but introduces additional UCM configuration 2013 Cisco and/or its affiliates. All rights reserved. Connect Club 46

Thank you.