Platform Study · Signal Path Reference · v1.0 — Aug 2026

Cisco Collaboration

Call control, meetings, messaging, edge traversal, voicemail, emergency services, and devices — the complete suite, how every component ties together, and how to lab it under DoD-grade compliance.

Signaling (SIP/TLS · XMPP · HTTPS) Media (RTP/SRTP) Untrust DMZ Trust

01Signal Path Map — Zones & Components

Solid copper traces are signaling; dashed cyan traces are media. Every inter-zone crossing is a firewall policy line — the traversal zone is the only DMZ→Trust path, and it is initiated outbound from Trust.

UNTRUST — INTERNET / PSTN DMZ — BORDER ELEMENTS TRUST — CORE UC ITSP / PSTN SIP trunk Remote users Webex App · 88xx · MRA B2B partners SIP / H.323 URI Webex Cloud Meetings · Msg · Control Hub CUBE (SBC) IOS-XE · HA pair Expressway-E cluster MRA edge · B2B · TURN Video Mesh node local media for Webex Expressway-C cluster traversal client · hybrid connectors CUCM CLUSTER — Pub · Subs · TFTP dial plan · registration · CAC · media resources · ILS/GDPR · CTI CMS + CMM meetings bridge Unity Conn. voicemail A/A IM&P pair XMPP presence CER pair E911 / ERL AD·DNS·NTP·CA tier-0 infra + SFTP/SSM Endpoints 78/88/98xx · Room · Jabber RTMT · SIEM CDR/CMR · syslog · DRS traversal zone — outbound TLS from C→E only

02Component Console

Every role in the suite, and the one sentence that tells you what it is for.

Call control

CUCM

The transmission: SIP registration, dial plan, class of control, CAC, media-resource orchestration. Pub + subscriber cluster.

  • Partitions / CSS / route patterns
  • ILS + GDPR multi-cluster
  • MLPP, EM, SNR, hunt + queuing
Call control

SME

A CUCM cluster used purely as a trunk core between leaf clusters, PBXs, and SBCs.

Cloud

Webex Calling

Cloud call control; Dedicated Instance = hosted single-tenant CUCM. PSTN via Cisco plans, CCP, or your own CUBE Local Gateway.

Messaging

IM&P + Jabber

On-prem XMPP presence and IM bound 1:1 to a CUCM cluster; persistent chat and MFT need external Postgres.

Messaging

Webex Messaging

Cloud spaces with HDS option — your on-prem KMS holds the keys, so the cloud can't read content.

Voicemail

Unity Connection

Voicemail, auto-attendant, single inbox with Exchange/O365. Active/active pair; VPIM/HTTPS networking.

Meetings

Cisco Meeting Server

Your own bridge: Call Bridge (mix), Web Bridge 3 (WebRTC), clustered Postgres, TURN via Expressway-E. CMM is its ops console.

Meetings

Webex Meetings + Video Mesh

Cloud meetings at scale; Video Mesh nodes keep media on your LAN and cascade to cloud on overflow.

Edge

Expressway C / E

The badge-checked skybridge: MRA without VPN, B2B federation, hybrid connectors, TURN for CMS web joins.

Edge

CUBE

The loading dock: the SBC where the carrier's SIP meets yours. Normalization, topology hiding, SRTP↔RTP, transcoding, SIPREC.

Safety

Emergency Responder

Tracks phone location, maps to ERLs, stamps the right ELIN so 911 finds the correct door. NG911 via RedSky/Intrado.

Survivability

SRST

Branch router answers registrations when the WAN dies; local FXO/PRI/SIP keeps dial tone alive.

Devices

Endpoints

7800/8800/9800 phones, Room/Desk/Board (RoomOS), ATAs, DECT, headsets — registered to CUCM, Webex, or both (Edge for Devices).

Ops

Control Hub · RTMT · DRS

Cloud pane for users/devices/analytics; RTMT for on-prem perfmon and traces; DRS backups to hardened SFTP.

Adjacent

Contact Center

UCCX (≤400 agents) · UCCE/PCCE (enterprise) · Webex CC (cloud). Finesse desktop, CUIC reporting, CVP IVR.

03Head-to-Head

DecisionOption AOption BRule of thumb
Call controlCUCM — deepest features, STIG/FIPS, air-gapWebex Calling — zero ops, cloud PSTNEnclave or complex dial plan → CUCM. Cloud-first commercial → Webex Calling.
Border roleExpressway — MRA, B2B, hybridCUBE — ITSP trunks, SBCNever cross the roles. ITSP on CUBE, people on Expressway.
MeetingsCMS — you own the bridgeWebex Meetings — global cloud scaleClassified/internal → CMS. Everything else → Webex; Video Mesh to localize media.
ClientJabber — fully on-premWebex App — strategic, cloud messagingAir-gapped → Jabber. Connected → Webex App with CUCM calling.
SurvivabilitySRST — CUCM branchesSurvivability node — Webex Calling branchesMatch to your call control plane.
Contact centerUCCX / UCCEWebex Contact CenterDepartmental → X, airline-scale → E, direction of travel → WxCC.

04Lab Build-Outs — 7 Tiers

All tiers use the three-zone model with default-deny firewalls between zones. VM counts are the whole build, infra included.

3 VMs

T1 · Bare minimum

CUCM Pub · Unity · infra services. Prove install, dial plan, voicemail.

trust ×3
13 VMs

T2 · Recommended

One VM per diagram role: Pub, Sub, IM&P, Unity, CER, CMS, CMM, Exp-C, Exp-E, CUBE, infra, SFTP/SSM, ITSP emulator.

untrust ×1dmz ×2trust ×10
16 VMs

T3 · Pragmatic HA (cheap lessons)

+Sub #2, +IM&P #2, +Unity Sub — every failover semantic that behaves differently, nothing duplicated for symmetry.

×1×2×13
24 VMs

T4 · Pragmatic HA (real learning)

Full mirror: Expressway clusters, CUBE box-to-box HA, CMS 3-node + DB quorum, CER sub, dual DC, optional SME pair. Quorum, split-brain, stateful SIP failover.

×1×4×19
3 VMs

OSS · Bare minimum

FreePBX (Asterisk) · RHEL IdM · OPNsense spanning the zones.

trust ×2fw spans
10 VMs

OSS · Recommended

Kamailio + FreeSWITCH split, Prosody/Matrix, Jitsi, Kamailio-edge + coturn, OpenSIPS SBC + RTPEngine, IdM, Keycloak, Homer/Grafana/Elastic, SIPp box.

×1×2×7
14 VMs

OSS · Pragmatic HA

+Kamailio #2, FreeSWITCH #2, RTPEngine #2, Galera/Patroni DB, keepalived VIPs — the raw VRRP/dispatcher/quorum mechanics Cisco hides behind CM groups.

×1×3×10

05HA Doctrine

CUCM

CM groups: Sub1→Sub2→Pub. Phones re-home <30s. Never stretch a cluster past the 80ms RTT ceiling.

CUBE

Box-to-box HA with media preservation — calls survive a chassis loss. Dual ITSP with dial-peer preference.

CMS

Call Bridge groups + odd-numbered DB cluster (3). Web Bridges behind SRV/F5.

Expressway

Clusters ≤6, equal-priority DNS SRV. Traversal zones fail over per peer.

Unity / IM&P / CER

Active/active ports · presence redundancy groups · warm standby respectively.

Site & data

SRST + local trunks per branch; DRS nightly to hardened SFTP; AXL config exports in git; AAR re-routes via PSTN when the WAN is full.

06Compliance Rack

Hardening baseline: STIG/SRG on every node, FIPS mode at install, CNSA 1.0 crypto (AES-256-GCM SRTP, P-384/RSA-3072, SHA-384), SIP OAuth + mutual TLS as the ZTA identity plane, SSM On-Prem for air-gapped licensing — then crosswalked to the Vanta 38-framework catalog.

DISA STIG/SRGDoD UC APLFIPS 140-3NSA CNSA 1.0ZTA 800-207 NIST 800-53NIST 800-171CMMC L2FedRAMP (Webex for Gov)SOC 2 ISO 27001ISO 27017ISO 27018ISO 27701CJIS HIPAAHITRUSTGDPRPCI DSSNIST CSF 2.0 DORANIS 2ISO 42001EU AI Act+14 more in catalog