BRKCOL-2120.Pdf

Cisco Webex Edge for Meetings Webex Edge Audio, Connect and Video Mesh

Richard Murphy

BRKCOL-2120

August 5, 2019 Cisco Webex Teams

Questions? Use Cisco Webex Teams to chat with the speaker after the session How 1 Find this session in the Cisco Events Mobile App 2 Click “Join the Discussion” 3 Install Webex Teams or go directly to the team space 4 Enter messages/questions in the team space

Cisco Webex is a constantly evolving cloud platform with innovation happening all the time such as the Webex Edge for Meetings service. What is it? If this question is something you are asking yourself, then this session is right for you. This session is designed to be an introductory session and will cover the three different services of Webex Edge Connect, Webex Edge Audio, and Webex Edge Video Mesh that make up the Webex Edge for Meetings service. The attendees will understand the differences of each service, the configuration requirements, and common deployment scenarios. A general knowledge of Cisco UC products such as Expressway and Cisco UCM is required. Cisco Expressways and Cisco UCM will not be discussed in detail except where they are relevant to the Webex Edge for Meetings service.

• Webex Edge Connect • Overview

• Webex Edge Audio • Design and Implementation

• Webex Edge Video Mesh • Design and Implementation

• Conclusion

Webex Edge for Meetings

1 Connect 2 Audio 3 Video Mesh

Direct Connection to the Webex Meeting Audio via the Meeting Resources on Webex Datacenter Internet or Edge Connect premises

Webex Edge Connect

• A direct peering at Equinix data centers • Bypasses the Internet by providing a direct connection1 to the Webex data center • All Webex media traffic traverses the dedicated link to the meeting. (VoIP, video, content sharing) • When used with Video Mesh provides a more secure end-to-end experience Webex Edge

• Private circuit (not over Internet)

• Deterministic network path

• Predictable and stable latency and jitter

• Guaranteed bandwidth

• Speed options: 500M, 1G, 5G,10G Available Services Enterprise Equinix Cloud Cisco Exchange • Webex Meetings (ECX) • Webex Teams Media *

• Video Device-Enabled Webex Meetings (CMR)

• Webex Edge Audio

* Webex Teams, Board, Cloud Registered Endpoints and Video Mesh require Internet access for signaling

• Enhanced Meeting Quality - Your day-day core business conducted over the internet does not interfere with meetings and vice-versa. This means you can be assured of a consistent, reliable, cost effective, and secure meeting experience for all

• Added Security - Webex Edge Connect direct peering insulates your meetings from the variability of the Internet and provides protection from the public Internet and the potential threats and attacks.

Customer Network Layer 1 (1G/10G)

Layer 2 Cust ASN (802.1q) AS13445 Layer 3 (BGP)

IMPORTANT ROLES AND RESPONSIBILITIES

1. Layer 1 – Physical Connectivity Equinix responsibility: ✓ Physical link provisioning (cross connects) 2. Layer 2 – Ethernet Connectivity ✓ Virtual circuit monitoring reports & support

3. Layer 3 – IP connectivity Cisco responsibility ✓ peering provisioning and support

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 HELSINKI STOCKHOLM MANCHESTER SEATTLE TORONTO AMSTERDAM DUBLIN CHICAGO OSAKA BOSTON TOKYO DENVER SILICON NEW YORK DÜSSELDORF VALLEY LONDON FRANKFURT WARSAW SHANGHAI DALLAS PHILADELPHIA MUNICH WASHINGTON ,D.C. PARIS LOS ANGELES ATLANTA CULPEPER, VA GENEVA HONG KONG HOUSTON MADRID MIAMI ZURICH MILAN SOFIA BARCELONA ISTANBUL

SEVILLE LISBON SINGAPORE BOGOTÁ JAKARTA

DUBAI ABU DHABI

Equinix Location BRISBANE PERTH SYDNEY ECX Fabric Location ADELAIDE MELBOURNE ECX Fabric Connectivity SÃO PAULO CANBERRA (routes subject to change) RIO DE JANEIRO Partner data centre Cisco Webex Locations

Customer Equinix ECX Facility

Customer to Customer Equipment to Equinix Webex Cross Connect Physical Circuit

Customer Cage Cisco Webex Cage

1 On-prem Enterprise 2 BGP Peering Link

Customer Equinix Facility A Equinix Backbone Equinix Facility B Customer to Equinix Equinix Backbone Physical Circuit Connected

Customer Cage Cisco Webex Cage

1 On-prem Enterprise 2 BGP Peering Link

Customer Equinix Co-Location Data Center

Service Provider Customer ECX Cisco Webex Cage Physical Cage Cage

SP Network

On-prem 1 Enterprise BGP Peering Link

When a customer has a cage within Equinix DC, the ECX virtual circuit will be considered ‘Local Port & Local Connection’ with lower monthly fee from Equinix.

Customer Equinix Co-Location Data Center

Service Provider VAR Partner ECX Cisco Webex Cage Cage Cage

SP Network

On-prem 1 Enterprise BGP Peering Link

In this option, VAR Partner has established a cage with Equinix and manages the equipment, ECX ports, and billing from Equinix. VAR Partner can manage virtual connections on customer’s behalf or assign ECX portal permissions for customer to manage virtual connections. The VAR partner is the Equinix customer of record with a local Cage thus Local Port pricing applies. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Option 4: Equinix Cloud Exchange Direct Peering via Network Edge

Customer Equinix Co-Location Data Center

Service Provider Customer ECX Cisco Webex Cage Virtual Router on Cage Equinix Network Edge

Cisco CSR 1000V

SP Network

1 On-prem Enterprise BGP Peering Link

When a customer does not have a cage in Equinix DC, they can consider the new Equinix ‘Network Edge’ option; however, the the ECX connection will be considered a ‘Remote Port’ with additional monthly fees from Equinix. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Customer Requirements - Core

• Equinix Cloud Exchange (ECX) Account and Rackspace in ECX

• BGP and Dot1Q Tagging Capable Router with L3 Connectivity to the Enterprise

• Physical port [1G/10G typical] available for connecting to ECX Fabric

• Public BGP Autonomous System Number (ASN)

• An IP space that is public and provider-independent • Edge Connect does not accept private IP advertisements like RFC1918

• An IT team knowledgeable of BGP and peering principles

• IP Addressing • Public IP - /30 or /31 supported Customer Equinix Cloud Cisco Webex • Max length prefix that Webex advertises is /24 Premises Exchange (ECX) • The maximum length prefix that Webex accepts is /29 • The maximum number of routes Webex accepts is 100 • We recommend that customers allow 50 routes from Webex on the BGP peering as the number of routes that Webex advertises may change over time • Bidirectional-Forwarding Detection (BFD) is supported and enabled with a default value of 300 ms x 3 on the Webex Edge routers • Customer owned IP Addresses

• Purchase link/space in Equinix Cloud Exchange (ECX)

• Cisco Commerce Workspace (CCW): Cisco Order # used in ECX Portal

• ECX Portal to Request Port Connection • VLAN ID (customer side locally significant for Equinix only) • Purchase Order (PO) Number (From CCW order) • Public IP Range (/30 or /31) for BGP Peering (BYoIP - Customer and Webex side) • Subnets to Advertise to Webex (max /29 – max 100 subnets) • Public AS + password (32 bit supported) • Tech contact (i.e. admin group alias + phone number) • Link speed to provision: 200mb, 500mb, 1gb, 5gb, 10gb or increments thereof!

• Peering Provisioning Completion Email • L3 should be up and running

Equinix Cloud Exchange Order Process

Layer 1 1. Order physical circuit (1G/10G) to ECX fabric

Layer 2 2. Provision virtual (802.1q) Customer AS13445 circuit to Cisco Webex using Equinix Network Layer 3 self-service portal (BGP) 3. Cisco enables BGP IMPORTANT ROLES AND RESPONSIBILITIES connection to the Enterprise to establish connectivity 1. Layer 1 – Physical Connectivity Equinix responsibility: ✓ Physical link provisioning (cross connects) 2. Layer 2 – Ethernet Connectivity ✓ Virtual circuit monitoring reports & support

3. Layer 3 – IP connectivity Cisco responsibility ✓ peering provisioning and support

BGP peering from the router in the BGP peering from the router in the Equinix Cage Enterprise

Cisco Webex Customer IP address is provided by customer • /30 or /31 IP subnet supported Gig interfaces: Webex network uses LAG bundles to support • Customer public IP block – Bring your own IP (BYOIP) 10 Gig

(IOS-XE) (IOS-XR) interface GigabitEthernet0/1/1 interface Bundle-Ether10000.2 ip address 192.0.2.2 255.255.255.252 ipv4 address 192.0.2.1/30 encapsulation dot1q 10 encapsulation dot1q 11 Cisco Recommends Customer Dual peering Network links for high availability

(IOS-XE) (IOS-XR) interface GigabitEthernet0/1/1 interface Bundle-Ether10000.2 ip address 192.0.2.6 255.255.255.252 ipv4 address 192.0.2.5/30 encapsulation dot1q 20 encapsulation dot1q 12

Note - VLAN assignment is locally significant due to ECX QinQ tagging and does not need to match on Webex & Customer sides

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Webex Routes AMER 64.68.96.0/19 64.68.104.0/21 Internet …. APAC 69.26.176.0/20 69.26.176.0/22 …. EMEA 62.109.192.0/18 …. Redistribute Equinix

OSPF BGP BGP

Advertise Customer

DNS Lookup Internet

64.68.96.55 DNS Server

Equinix

OSPF BGP BGP

Customer

DNS Lookup Internet

64.68.96.55 DNS Server

Equinix

OSPF BGP BGP

Customer

✓ Enterprises are responsible for their network architecture • Avoid asymmetric routing • Avoid suboptimal network paths Don’t have the networking expertise ✓ A connection to the Equinix Cloud Exchange internally? Consider enlisting a partner or Cisco Advanced Services to ensure a successful ✓ Knowledge of BGP Routing deployment.

✓ Public BGP Autonomous System Number

✓ Public provider independent IP block ✓ No RFC1918 addressing (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

• All global routes are advertised by Webex Edge Connect

• We recommend using IP prefix lists to manage route advertisements

• Filter ONLY on subnet groups by Theater: North America, EMEA, AsiaPac

• No static routing – Dynamic routing routing is required

• Route advertisements may change over time so customers should accept all Webex routes with prefix length that is less than or equal to /24

Traffic Engineering Communities

Multiple options to influence traffic flow Link Priority • None - Default (least desirable path) • 13445:200 - Local Preference 200 Option 1 – BGP Community local preference • 13445:300 - Local Preference 300 tagging • 13445:400 - Local Preference 400 • Highest level of control and routing influence • 13445:500 - Local Preference 500 • Advanced customer configuration • 13445:600 - Local Preference 600 • 13445:700 - Local Preference 700 • 13445:800 - Local Preference 800 Option 2 – AS-Path prepending • 13445:900 - Local Preference 900 (Most desirable path) • Simple Webex Prefix BGP Origin communities • 13445:10000 - AMER Option 3 – Unique NAT Pools per peering • 13445:10010 - EMEA session • 13445:10020 - APAC • Simple • Disruptive Fail-over Customer Prefix propagation scoping communities • None - Default permit global reachability • 13445:677 - Permit local theater reachability

RTR1 Example BGP Configuration

router bgp 64496 neighbor 192.0.2.2 remote-as 13445 ! The following diagram is an example of a typical address-family ipv4 neighbor 192.0.2.2 activate active/standby topology. Router 1 (RTR1) is the primary path neighbor 192.0.2.2 send-community both and Router 2 (RTR2) is the backup. neighbor 192.0.2.2 route-map PRIMARY-OUT out neighbor 192.0.2.2 route-map PRIMARY-IN in exit-address-family ! Enterprise Network ip prefix-list ADVERTISE-TO-WEBEX seq 5 permit 198.51.100.0/28 BGP community 13445:900 ! route-map PRIMARY-OUT permit 10 Local match ip address prefix-list ADVERTISE-TO-WEBEX Primary Local Preference set community 13445:900 Preference 900 ! RTR1 900 route-map PRIMARY-IN permit 10 192.0.2.1/30 192.0.2.2/30 set local-preference 900 198.51.100.0/28 NAT RTR2 Example BGP Configuration 192.0.2.5/30 192.0.2.6/30 RTR2 router bgp 64496 Local AS13445 neighbor 192.0.2.6 remote-as 13445 AS 64496 Local Preference ! Secondary address-family ipv4 Preference 800 neighbor 192.0.2.6 activate 800 BGP community 13445:800 neighbor 192.0.2.6 send-community both neighbor 192.0.2.6 route-map SECONDARY-OUT out neighbor 192.0.2.6 route-map SECONDARY-IN in exit-address-family Webex to Enterprise network path selection: ! ip prefix-list ADVERTISE-TO-WEBEX seq 5 permit 198.51.100.0/28 RTR1 applies the BGP community 13445:900 and RTR2 applies the community 13445:800 to the enterprise prefix ! 198.51.100.0/28. The Webex cloud selects the RTR1 path because it is advertising the most desirable link priority route-map SECONDARY-OUT permit 10 community. match ip address prefix-list ADVERTISE-TO-WEBEX set community 13445:800 Enterprise to Webex Network path selection: ! RTR1 applies a local preference of 900 and RTR2 applies a local preference of 800 to the Webex prefixes. The route-map SECONDARY-IN permit 10 best path to reach the Webex cloud is RTR1 because it has assigned the highest local preference. set local-preference 800

• 13445:10000 - AMER • 13445:10010 - EMEA • 13445:10020 - APAC

Customer Network

The following diagram is an example of a typical active/standby topology. Router 1 (RTR1) is the primary path and Router 2 (RTR2) is the backup. IOS XE

RTR2 Example BGP Configuration Enterprise Network router bgp 64496 neighbor 192.0.2.6 remote-as 13445 Primary ! address-family ipv4 1 AS-Hop 1 AS-Hop neighbor 192.0.2.6 activate neighbor 192.0.2.6 send-community both RTR1 neighbor 192.0.2.6 route-map SECONDARY-OUT out 192.0.2.1/30 192.0.2.2/30 neighbor 192.0.2.6 route-map SECONDARY-IN in exit-address-family 198.51.100.0/28 NAT ! ip prefix-list ADVERTISE-TO-WEBEX seq 5 permit 198.51.100.0/28 192.0.2.5/30 192.0.2.6/30 ! RTR2 AS13445 route-map SECONDARY-OUT permit 10 match ip address prefix-list ADVERTISE-TO-WEBEX AS 64496 2 AS-Hops 2 AS-hops set as-path prepend 64496 Secondary ! AS Path Prepending route-map SECONDARY-IN permit 10 set as-path prepend 13445 Webex to Enterprise network path selection: RTR2 applies AS path prepending 64496 to the enterprise prefix 198.51.100.0/28. The Webex cloud selects the RTR1 path because it is advertising the shortest AS Path.

Enterprise to Webex Network path selection: RTR2 applies AS path prepending 13445 to the Webex prefixes. The best path to reach the Webex cloud is RTR1 because it has the shortest AS Path.

RTR1 Example BGP Configuration

The following diagram is an example of a typical router bgp 64496 neighbor 192.0.2.2 remote-as 13445 active/standby topology. Router 1 (RTR1) is the primary path ! address-family ipv4 and Router 2 (RTR2) is the backup. neighbor 192.0.2.2 activate neighbor 192.0.2.2 send-community both neighbor 192.0.2.2 route-map PRIMARY-OUT out neighbor 192.0.2.2 route-map PRIMARY-IN in Enterprise Network exit-address-family ! Local ip prefix-list ADVERTISE-NAT1-TO-WEBEX seq 5 permit 198.51.100.0/28 Primary ! Preference route-map PRIMARY-OUT permit 10 200 match ip address prefix-list ADVERTISE-NAT1-TO-WEBEX RTR1 ! route-map PRIMARY-IN permit 10 198.51.100.0/28 NAT1 192.0.2.1/30 192.0.2.2/30 set local-preference 200

198.51.100.16/28 NAT2 192.0.2.5/30 192.0.2.6/30 RTR2 Example BGP Configuration RTR2 AS13445 Local router bgp 64496 AS 64496 neighbor 192.0.2.6 remote-as 13445 Preference Secondary ! 100 address-family ipv4 neighbor 192.0.2.6 activate neighbor 192.0.2.6 send-community both neighbor 192.0.2.6 route-map SECONDARY-OUT out Webex to Enterprise network path selection: neighbor 192.0.2.6 route-map SECONDARY-IN in RTR1 and RTR2 are advertising unique prefixes. The Webex network will respond to the exit-address-family ! router performing the NAT. ip prefix-list ADVERTISE-NAT2-TO-WEBEX seq 5 permit 198.51.100.16/28 ! Enterprise to Webex Network path selection: route-map SECONDARY-OUT permit 10 match ip address prefix-list ADVERTISE-NAT2-TO-WEBEX RTR1 applies a local preference of 200 to make it the most desirable path towards the Webex ! network. route-map SECONDARY-IN permit 10 set local-preference 100

Enterprise Network BGP Peering

RTR1 192.0.2.1/30 192.0.2.2/30

198.51.100.0/28 NAT

AS 64496 AS13445 Multi-link Single Router LAG Bundle Single BGP Support as single Port Peering

Enterprise Network

NAT

NAT X Internet as a backup • Internet is a valid fail-over path solution during Edge connect failures or maintenance events Internet • A brief meeting disruption is expected if the client IP address changes due to NAT pool change

Enterprise Network X

NAT

Avoid Disruptions • Limit edge router responsible to routing and Internet forwarding packets • BFD Fast failure detection ensures meeting traffic is redirected over alternative available links to prevents meeting disruptions • Perform NAT on a device inside network

Webex DC Webex DC Webex DC

Internet Internet

NAT NAT NAT Local Local Local NAT Pool NAT Pool NAT Pool

Enterprise Network Enterprises will need to limit route leaking across their WAN to ensure remote offices utilize local Internet paths

Internet NAT NAT NAT NAT

Enterprise WAN

Enterprise Network - West Enterprise Network - East

Internet

NAT NAT

Enterprise Network - West Enterprise Network - East

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 42 Edge Audio w/ Edge Connect using Internet as Backup DNS SRV: _sips._tcp.edge-us.example.com Priority determines list order Cisco Site 1 Webex Edge DNS SRV Records Unified CM Audio - _sips._tcp.edge-us.example.com. 60 IN SRV 10 5 5062 exp-us1.example.com Secondary _sips._tcp.edge-us.example.com. 60 IN SRV 20 5 5062 exp-us2.example.com 1:1 NAT

Internet

exp-us2.example.com Meeting Z Webex Edge Audio - Primary 1:1 NAT Laptop Client Call back made to On net IP phone exp-us1.example.com

• Expressway-E is configured in Webex for callback Customer • +1 is defined in Webex callback settings Primary Path Premises • SRV records along with DNS configuration will set Secondary Path Expressway cluster exp-us1 as Primary and exp-us2 as Secondary BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 43 What level of redundancy is desired?

Link Level Redundancy? • Cost vs other redundancy options • Expressway solution considerations • Seamless recovery Site to Site redundancy? • Can the MAN/WAN support the traffic load? • Changing NAT pools can cause service disruption Failover to Direct Internet Access (DIA)? • Use your DIA link as a redundant option • Changing NAT pools can cause service disruption

Signaling Edge Connect Peering Link Media

Webex Meetings App Signaling and Media Webex Meetings App Edge Connect

Webex Meetings Browser Integration ECX and Productivity Tools Z

Public Internet

Internet

Customer

Signaling Edge Connect Peering Link Media

Webex Meetings App Signaling and Media

Webex Teams, Board and Endpoint’s Media Edge Connect Webex Boards Webex Teams Z Cloud Registered Endpoints

ECX

Z Public Internet

Webex Teams, Board and Endpoint’s Signaling Internet

Customer

Signaling Edge Connect Peering Link Media

Webex Meetings App Signaling and Media

Webex Teams, Board and Endpoint’s Media Edge Connect Webex Boards Webex Teams Video Mesh Cascade Media Z Cloud Registered Z Endpoints Video Mesh ECX

Z Public Internet

Webex Teams, Board and Endpoint’s Signaling Internet Video Mesh Signaling Customer

Signaling Edge Connect Peering Link Media

Webex Meetings App Signaling and Media Unified CM Webex Teams, Board and Endpoint’s Media Cisco Video Edge Connect Unified Devices CM Z Video Mesh Cascade Media SIP Trunk

Video Mesh ECX

Z Public Internet

Webex Teams, Board and Endpoint’s Signaling Internet Video Mesh Signaling Customer

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 49 Webex Unified CM Integration – Video Device- Enablement Enabled Cisco Webex Meetings Z Signaling and Media Expressway Signaling C/E Edge Connect Peering Link Media

Webex Meetings App Signaling and Media Webex Video Webex Teams, Board and Endpoint’s Media Cisco Meetings Edge Connect Unified CM Z Video Mesh Cascade Media SIP Trunk

Expressway Signaling and Media Expressway C/E ECX

Z Public Internet Video Endpoints Webex Teams, Board and Endpoint’s Signaling Internet Video Mesh Signaling Customer

Expressway Signaling C/E Edge Connect Peering Link Media

Webex Meetings App Signaling and Media Webex Edge Webex Teams, Board and Endpoint’s Media Cisco Audio Edge Connect Unified CM Video Mesh Cascade Media SIP Trunk Z

Expressway Signaling and Media Expressway C/E ECX

Z Dials +1.844.621.3956 US Webex Access Number Public Internet IP Phone Webex Teams, Board and Endpoint’s Signaling Internet Video Mesh Signaling Customer

Signaling Z Media Video Endpoints REST/HTTPS Expressway Z Hybrid Calling C/E Edge Connect

Cisco SIP Trunk Unified CM ECX

Expressway C/E

Active Directory Directory Connector Z

Expressway-C Webex Connectors Communication Connector Host Management Connector Microsoft Exchange Calendar Connector Internet Call Connector Customer

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 52 Connect to DNS Webex Routes webex.com Server AMER 64.68.96.0/19 DNS Lookup 64.68.104.0/21 Internet …. APAC 69.26.176.0/20 69.26.176.0/22 …. 64.68.96.55 EMEA DNS 62.109.192.0/18 Signaling Server …. Media Equinix

OSPF BGP BGP

Customer

Network BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 53 Connect to DNS Webex Routes wbx2.com Server AMER 64.68.96.0/19 DNS Lookup 64.68.104.0/21 Internet …. APAC 69.26.176.0/20 69.26.176.0/22 13.59.223.20 …. EMEA 64.68.96.55 DNS 62.109.192.0/18 Signaling Server …. Media Equinix

OSPF BGP BGP

Customer

Network BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 54 Connecting to Webex through Enterprise Firewalls: Webex Teams Apps and Devices Firewalls : Whitelisting Ports and Destinations Signalling You will need to allow Webex Teams media and signaling traffic to pass UDP Media through your Enterprise Firewall – For white listing details refer to : Webex Teams Network Requirements doc : https://collaborationhelp.cisco.com/article/en-us/WBX000028782

Webex

Media Port Ranges : Source UDP Ports : Voice 52000 - 52099, Video 52100- 52299 Source TCP/ HTTPS Ports : Ephemeral (=> No DSCP re-marking) Destination UDP/ TCP Port : 5004 Destination HTTPS (TLS) Port : 443 Destination IP Addresses : Global IP subnets listed in doc above

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 55 Firewall rules continued Webex Teams, Board and Registered Video Endpoints Include all rules outlined in the following documents: Webex Meetings: https://collaborationhelp.cisco.com/article/en-us/WBX264 Webex Teams & Boards: https://collaborationhelp.cisco.com/article/en-us/WBX000028782

Note - Teams, Board and Registered Video Endpoints signaling service and messaging requires Internet access.

Source IP Destination IP Destination Port Protocol Description Devices using this rule HTTPS and WSS for signalling and messaging. If your firewall supports DNS resolution, or you Internet Your networks ANY 443 TLS are using a proxy; use these Webex Teams All URLs to white list access to Webex Teams access services. Video Mesh Node cascade signalling required Video Mesh Node ANY 444 TCP Cascade Signalling to Webex Cloud Video Mesh Node ANY 123 UDP Network Time Protocol Video Mesh Node NTP Video Mesh Node ANY 53 TCP/UDP Domain Name System Video Mesh Node DNS Secure audio, video. Content sharing on Your Networks Webex Collaboration Cloud 5004 (1) UDP SRTP All Webex Teams devices Used for secure content sharing on Webex Teams desktop and mobile apps. Your Networks Webex Collaboration Cloud 5004 TCP SRTP All except Webex Board Also serves as a fallback transport for audio and video if UDP cannot be used. Used as a fallback transport for audio, video TLS/HTTPS Webex Teams desktop and mobile Your Networks Webex Collaboration Cloud 443 and content sharing if UDP and TCP cannot be SRTP apps used. Secure audio, video & content sharing media Video Mesh Nodes in your Video Mesh Node Cascade Webex Collaboration Cloud 5004 UDP SRTP from Video Mesh Node to the Webex Cloud networks connections (TCP also supported, but not recommended) SIP calls to or from Webex Teams, Your Networks Webex Collaboration Cloud 33434-33598 UDP SRTP Secure audio, video & content sharing media including Hybrid Call Service © 2020 Cisco and/or its affiliates. All rightsConnect reserved. Cisco Public Marking for Webex Media Cisco Webex Teams Media Assigning Cisco Webex Teams Media Traffic To Queues

Cisco Webex Audio-only EF Audio traffic marked PHB Endpoints

EF PQ EF / DSCP 46 mapped to BW Assigned BW to Cisco Webex EF priority queue

Room / Board WRED AF41

AF41

Video LLQ Video traffic marked PHB Cisco Webex CBWFQ Applications AF41 Classes AF41 / DSCP 34 mapped

AF41 to a class-based other other queues weighted fair queue with DSCP-based WRED

PHB; DSCP 802.11 User Traffic Type Notes (decimal value) Priority (UP) Includes audio streams of voice-only calls, Audio EF; 46 6 audio streams of video calls, and related RTCP packets Includes video streams (main video and Prioritized video AF41; 34 5 presentations or content) and related RTCP packets Includes messaging, file transfer, Other traffic Best Effort; 0 0 configuration, call and meeting setup

Microsoft Windows does not allow applications to mark DSCP natively. Group Policy Objects (GPO) can be used to instruct the operating system to classify traffic from the application based on specific port ranges; however, we recommend following a network-based classification scheme.

Customer Edge ECX Enterprise LAN Metro link to Equinix Cage Equinix Facility Cage

Outbound Outbound Ingress Policy Ingress Policy Queue Queue

Hybrid PA for more guidance© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Media Signatures for Cisco Webex Teams and Cloud Registered Endpoints Client to Cloud (Reverse for Cloud to Client) Source IP Destination IP Source UDP Destination UDP Recommended Media Ports Ports DSCP Type Webex Teams Webex cloud and 52000 to 5004 EF Audio application or Video Mesh Media 52099 endpoint Services Webex Teams Webex cloud and 52100 to 5004 AF41 Video application or Video Mesh Media 52299 endpoint Services Video Mesh Node Webex Cloud 52500 to 5004 EF Audio Media Services 62999 Video Mesh Node Webex cloud 63000 to 5004 AF41 Video Media Services 65500 Video Mesh Node Video Mesh Node 52500 to 5004 EF Audio 62999 Video Mesh Node Video Mesh Node 63000 to 5004 AF41 Video

Source IP Destination IP Source UDP Destination UDP Recommended Media Ports Ports DSCP Type Cisco Webex Webex Cloud Ephemeral 9000 AF41 Audio / Meetings Application Video

Webex Meetings App webex-audio = Webex audio streaming webex-video = Webex video streaming webex-app-sharing = Webex app sharing traffic Z webex-meeting = Webex Signaling Traffic - (non- Webex Mtgs App media – not port based) NBAR2

Enterprise Network Internet

TCP TCP 443 UDP 52000-52099 Z TCP/ UDP Webex Teams UDP 5004 52100- 52299

Cisco Webex Teams Endpoints and Applications

Enterprise Network Internet

TCP TCP CS3 443 UDP EF 52000-52099 Z TCP/ UDP Webex Teams UDP AF41 5004 52100-

52299 AF41 NBAR2

Cisco Webex Teams Endpoints and Applications

Enterprise Network Internet

TCP TCP 80/443 Z Webex Mtgs App UDP TCP/ Ephemeral UDP 9000 Cisco Webex Teams Endpoints and Applications

Latest Webex Version Enterprise Network Internet

TCP TCP CS3 80/443 AF41 WebexZ Mtgs App STUN UDP EF TCP/ Ephemeral UDP

AF41 9000 NBAR2 Cisco Webex Teams Endpoints and Applications

Protocol Pack 39/41

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 66 Video Mesh Node – Ports • Webex Control Hub Services > Video Mesh Video Mesh Cluster • QoS (Enabled by Default) • Enables Cascade Port Ranges and Native Marking • Audio 52500-62999 (EF)* Video Mesh • Video 63000-65500 (AF41)* Node

* When disabled changes the source ports that are used for audio, video, and content

TCP TCP 443

UDP 52000-52099 AF41 TCP/ Video Mesh UDP UDP AF41 5004 Node TCP TCP 52100- 443,444 52299 AF41 UDP 52500-62999 EF TCP TCP/ 5000,5001 AF41 UDP Cisco Webex Teams UDP 5004 Endpoints and Clients 63000-

UDP 65500 62999

65500 AF41 - 5004 -

TCP

TCP (SIP)TCP 5060,5061

UDP 52500

UDP 63000

UDP

52500-62999

AF41

AF41 EF UDP 63000- Source ports configure on Video Mesh 65500 Unified CM Node SIP Endpoints © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 68 Video Mesh - Native Marking QoS Disabled Enterprise Network Internet

TCP TCP 443

UDP 52000-52099 AF41 TCP/ Video Mesh UDP UDP AF41 5004 Node TCP TCP 52100- 443,444 52299 AF41 UDP 34000 - AF41 34999 TCP TCP/ 5000,5001 AF41 UDP Cisco Webex Teams UDP 5004 Endpoints and Clients 34000 -

UDP 34999 62999

65500 AF41 - 5004 -

TCP

TCP (SIP)TCP 5060,5061

UDP 52500

UDP 63000

UDP

52500-62999

AF41

AF41 AF41

Cisco Expressway Core • System → Quality of Service (C) and Edge (E) • DSCP Signaling value 24 (Default) → CS3 • DSCP Audio value 46 (Default) → EF • DSCP Video value 34 (Default) → AF41 • DSCP XMPP value 24 (Default) → CS3

BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 70 ip access-list extended QOS_VOICE Webex Ingress QoS Policy permit udp any range 17000 17999 any dscp ef ip access-list extended QOS_PRIORITIZED_VIDEO permit udp any range 17000 17999 any dscp af41 ip access-list extended QOS_WEBEX_TEAMS_AUDIO permit udp any range 52000 52099 any any Z permit udp any eq 5004 any range 52000 52099 Webex Mtgs App ip access-list extended QOS_WEBEX_TEAMS_VIDEO permit udp any range 52100 52299 any any permit udp any eq 5004 any range 52100 52299

Update QoS class-map match-any VOICE configuration match protocolaccess-group WEBEX name-AUDIO QOS_VOICE

ip acces-list… match access-group name QOS_WEBEX_TEAMS_AUDIO permit udp… . . . class-map match-an… match access-g . . . class-map match-any PRIORITIZED_VIDEO Webex Meetings App match protocolaccess-group WEBEX name-VIDEO QOS_PRIORITIZED_VIDEO webex-audio = Webex audio streaming match protocolaccess-group WEBEX name-APP -QOS_WEBEX_TEAMS_VIDEOSHARING webex-video = Webex video streaming webex-app-sharing = Webex app sharing traffic webex-meeting = Webex Signaling Traffic - (non- media, not port based) NBAR2 BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 71 ip access-list extended QOS_VOICE Webex Ingress QoS Policy permit udp any range 17000 17999 any dscp ef ip access-list extended QOS_PRIORITIZED_VIDEO permit udp any range 17000 17999 any dscp af41 ip access-list extended QOS_WEBEX_TEAMS_AUDIO permit udp any range 52000 52099 any any Z Z Webex Cloud permit udp any eq 5004 any range 52000 52099 Registered Webex Teams ip access-list extended QOS_WEBEX_TEAMS_VIDEO Video permit udp any range 52100 52299 any any permit udp any eq 5004 any range 52100 52299

Update QoS class-map match-any VOICE configuration match protocolaccess-group cisco name-spark QOS_VOICE-audio

ip acces-list… match access-group name QOS_WEBEX_TEAMS_AUDIO permit udp… . . . class-map match-an… match access-g . . . Webex Teams class-map match-any PRIORITIZED_VIDEO cisco-spark-audio = Teams audio streaming match protocolaccess-group cisco name-spark QOS_PRIORITIZED_VIDEO-video cisco-spark-video = Teams video streaming match access-group name QOS_WEBEX_TEAMS_VIDEO cisco-spark-media = Outdated: Will match if Audio and Video are not matched cisco-spark = Teams Signaling (login, chat, keep-alive, etc…) NBAR2 BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 73 WAN Ingress QoS Ingress Policy 1 Marking Policy

! This section applies the policy-map to the Interface Ingress 1 Policy Router(config-if)# service-policy input INGRESS-MARKING ! Attaches service policy to interface 2

! This section configures the policy-map to set DSCP for Trusted and Untrusted Voice, Video and SIP Signaling on ingress ! This section configures the classes class-map match-any VOICE policy-map INGRESS-MARKING match webex-audio class VOICE match access-group QOS_WEBEX_TEAMS_AUDIO set dscp ef class-map match-any PRIORITIZED-VIDEO class PRIORITIZED-VIDEO match webex-video set dscp af41 match access-group QOS_WEBEX_TEAMS_VIDEO class OPPORTUNISTIC-VIDEO class-map match-any SIGNALING 3 set dscp af42 match webex-meeting class SIGNALING match cisco-spark set dscp cs3 match access-group QOS_SIGNALING class class-default© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public

Ingress Policy 1 WAN

Egress Policy 6

! This section configures the policy-map to set DSCP for Trusted and Untrusted Voice, Video and SIP Signaling on ingress ! This section configures the classes class-map match-any VOICE 4 policy-map INGRESS-MARKING match webex-audio class VOICE match access-group QOS_WEBEX_TEAMS_AUDIO set dscp ef class-map match-any PRIORITIZED-VIDEO class PRIORITIZED-VIDEO match webex-video set dscp af41 match access-group QOS_WEBEX_TEAMS_VIDEO class OPPORTUNISTIC-VIDEO class-map match-any SIGNALING 3 set dscp af42 match webex-meeting class SIGNALING match cisco-spark set dscp cs3 match access-group QOS_SIGNALING class class-default© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public ! This section configures the ACL’s ip access-list extended QOS_WEBEX_TEAMS_AUDIO Ingress Policy 1

permit udp any range 52000 to 52099 any 5004 WAN permit udp eq 5004 any range 52000 to 52099 ip access-list extended QOS_WEBEX_TEAMS_VIDEO 5 permit udp any range 52100 52299 any 5004 permit udp eq 5004 any range 52100 52299 Egress Policy 6

4 ! This section configures the policy-map to set DSCP for Trusted and Untrusted Voice, Video and SIP Signaling on ingress ! This section configures the classes class-map match-any VOICE policy-map INGRESS-MARKING match webex-audio class VOICE match access-group QOS_WEBEX_TEAMS_AUDIO set dscp ef class-map match-any PRIORITIZED-VIDEO class PRIORITIZED-VIDEO match webex-video set dscp af41 match access-group QOS_WEBEX_TEAMS_VIDEO class OPPORTUNISTIC-VIDEO class-map match-any SIGNALING 3 set dscp af42 match webex-meeting class SIGNALING match cisco-spark set dscp cs3 match access-group QOS_SIGNALING class class-default© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Egress Classification Egress Policy 6 and Queuing WAN

! This section applies the policy-map to the Interface 6.1 Router (config-if)# service-policy output EGRESS-QUEUING ! Attaches service policy to interface

! This section configures the bandwidth for all collab traffic policy-map EGRESS-QUEUING 6.2 class VOICE ! This section applies the policy-map priority percent 10 class-map match-all VOICE ! Provisions 10% LLQ to VOICE class match dscp ef class VIDEO class-map match-any VIDEO bandwidth percent 30 match dscp af41 ! Provisions 30% CBWFQ to VIDEO class match dscp af42 class SIGNALING class-map match-all SIGNALING bandwidth percent 2 6.3 match dscp cs3 ! Provisions 2% CBWFQ to SIGNALING class BRKCOL-2120 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 78 … QoS Marking and Traffic Queuing

Key Takeaways

• Simplified Ingress Remarking Policy

• Egress Queuing Policy (recommended)

• Single video queue for AF class traffic model is recommended

• All Webex media traffic can be differentiated and marked

• QoS should be set prior to arriving at Edge Connect

• Webex Edge Connect over Equinix does not modify the QoS marking applied but does not use it either. It will only be used for your outbound queueing (If configured)

• A QoS policy is required for traffic coming from Webex to remark it prior to entering the Enterprise.

Q: Does Edge Q: Will Edge Connect Q: Will Edge Connect Q: Does Edge Connect support support a private support private IP Connect support 4 IPv6 BGP AS Addressing byte ASN

A: Yes, contact A: No your account A: No A: Yes team to request

• ECX Portal Tutorials: https://ecxfabric-documentation.equinix.com/hc/en-us/articles/360013215672-Video- tutorials

• ECX Portal Edge Connect Ordering Tutorial: https://www.youtube.com/watch?v=WhRHgbUXGns

Cisco Webex Edge Connect Documentation

• https://collaborationhelp.cisco.com/article/en-us/n68tcpb

Equinix Cloud Exchange Portal

• https://cloudexchangeportal.equinix.com

Network requirements for Webex Services

• Webex Meetings: https://collaborationhelp.cisco.com/article/en-us/WBX264

• Teams & Boards: https://collaborationhelp.cisco.com/article/en-us/WBX000028782

Network connectivity test

• https://mediatest.webex.com

AS13445 Looking Glass

Webex Edge for Meetings

1 Connect 2 Audio 3 Video Mesh

Direct Connection to the Webex Meeting Audio via the Meeting Resources on Webex Datacenter Internet or Edge Connect premises

1. On-premises telephone or cell phone Call dials the Webex meeting number to Control/PBX get connected by audio into the Meeting meeting.

2. Signaling is routed via the on- premises call control device/PBX or by the cell phone network to Webex Meetings audio service. Webex Dials theIP Webex PSTN 3. Audio media (the sound) is meetingPhone number PSTN GW Dials the Webex connected via the Webex PSTN meeting number Customer connection between the Webex Signaling meeting and the on-premises phone Premises Media Path or cell phone.

1. Webex Edge On-premises telephone dials the Cisco Audio Webex meeting number or gets a call Unified CM back from the Webex meeting to get Meeting Z connected by audio into the meeting.

2. Signaling is routed via the on- Expressway C/E premises call control device (Unified CM) through the Expressway C and E to Webex Meetings audio service.

IP 3. Audio media (the sound) is routed Phone from the Webex meeting to the Customer Expressway E and C and then to the Signaling on-premises phone for callback and Premises Media Path the reverse for call in.

Webex Edge Cisco Audio Unified CM •Intelligent audio routing: integrating Webex with Z Unified CM Meeting • Creates end-to-end VoIP path for Unified CM Expressway C/E registered devices (callback and dial-in) • Uses company’s own PSTN for any other device (callback savings) • No SIP trunks or peering arrangements

IP required Phone •Geo-country code configurable Signaling Customer •Included in Collaboration Flex Plan – no extra Premises Media Path charge. No port charges on Expressway •Supports Webex Meetings, Events, Training No user training, no change in user behavior, easy for IT

Cisco UCM registered IP phones • Supporting G.711 or G.722 Webex Edge Audio Cisco Expressway support only Unified Meeting • X8.10 or later CM Z • Can use existing Expressway C/E deployment • Audio scale dependent on Expressway Expressway C/E deployment and services enabled.

Webex site • WBS 33.x or higher • Included in Flex, A-WBX and A-SPK SKU need IP the Webex Edge Audio package Phone • Not available on CCA-ENT or TSP sites. • Requires migration to Webex Audio Site Customer Signaling Premises Requires a signed certification from a Cisco trusted Media Path Certificate Authority (CA)

1. Make a new SIP trunk from CUCM to

Meeting Expressway – C, do not use an existing Webex Edge trunk. Cisco Audio 2. Create a new dedicated traversal zone Unified CM between Expressway C and E for Edge Z SIP Trunk Internet Audio only, do not use an existing zone.

Expressway C/E 3. MRA and Edge Audio can co-reside on the same Expressway C/E pair.

4. Dials +1.844.621.3956 Edge Audio is based on +E.164 US Webex Access Number numbers for dialing. IP Phone 5. Recommend a dedicated Expressway C & E pair for environments that require Customer Signaling high volume webex audio calling Premises Media Path support. USA

Expressway – C + E Single Expressway C + E pair 1 node cluster • Supports up to 1000 audio calls

• Size the Expressway clusters based on peak load and regional traffic

• Each Expressway cluster supports up to 4000 peak audio calls with full active- active redundancy

• Each Expressway 6 node cluster supports up to 16 calls per sec.

Expressway – C Expressway – E • Recommend dedicating Expressway C and 6 node cluster 6 node cluster E pairs for Edge audio only calls to Webex for large peak loads

Overview of Webex Edge Audio Webex Edge Configuration Steps: Cisco Audio Unified CM 1. Obtain dial-in numbers and Lua script Meeting Z from Control Hub

Expressway C/E 2. Configure Unified CM 3. Set Up Expressway-C

4. Set Up Expressway-E

IP 5. Phone Open Firewall ports 6. Apply Signed Certificate From Trusted Customer Signaling Certificate Authority Premises Media Path 7. Apply Edge Audio Callback Settings

Overview of Webex Edge Audio Webex Edge Configuration Steps: Cisco Audio Unified 1. Obtain dial-in numbers and Lua script CM Z from Control Hub

Expressway C/E 2. Configure Unified CM 3. Set Up Expressway-C

4. Set Up Expressway-E

IP Phone 5. Open Firewall ports 6. Apply Signed Certificate From Trusted Customer Signaling Premises Certificate Authority Media Path 7. Apply Edge Audio Callback Settings