Call control, meetings, messaging, edge traversal, voicemail, emergency services, and devices — the complete suite, how every component ties together, and how to lab it under DoD-grade compliance.
Solid copper traces are signaling; dashed cyan traces are media. Every inter-zone crossing is a firewall policy line — the traversal zone is the only DMZ→Trust path, and it is initiated outbound from Trust.
Every role in the suite, and the one sentence that tells you what it is for.
The transmission: SIP registration, dial plan, class of control, CAC, media-resource orchestration. Pub + subscriber cluster.
A CUCM cluster used purely as a trunk core between leaf clusters, PBXs, and SBCs.
Cloud call control; Dedicated Instance = hosted single-tenant CUCM. PSTN via Cisco plans, CCP, or your own CUBE Local Gateway.
On-prem XMPP presence and IM bound 1:1 to a CUCM cluster; persistent chat and MFT need external Postgres.
Cloud spaces with HDS option — your on-prem KMS holds the keys, so the cloud can't read content.
Voicemail, auto-attendant, single inbox with Exchange/O365. Active/active pair; VPIM/HTTPS networking.
Your own bridge: Call Bridge (mix), Web Bridge 3 (WebRTC), clustered Postgres, TURN via Expressway-E. CMM is its ops console.
Cloud meetings at scale; Video Mesh nodes keep media on your LAN and cascade to cloud on overflow.
The badge-checked skybridge: MRA without VPN, B2B federation, hybrid connectors, TURN for CMS web joins.
The loading dock: the SBC where the carrier's SIP meets yours. Normalization, topology hiding, SRTP↔RTP, transcoding, SIPREC.
Tracks phone location, maps to ERLs, stamps the right ELIN so 911 finds the correct door. NG911 via RedSky/Intrado.
Branch router answers registrations when the WAN dies; local FXO/PRI/SIP keeps dial tone alive.
7800/8800/9800 phones, Room/Desk/Board (RoomOS), ATAs, DECT, headsets — registered to CUCM, Webex, or both (Edge for Devices).
Cloud pane for users/devices/analytics; RTMT for on-prem perfmon and traces; DRS backups to hardened SFTP.
UCCX (≤400 agents) · UCCE/PCCE (enterprise) · Webex CC (cloud). Finesse desktop, CUIC reporting, CVP IVR.
| Decision | Option A | Option B | Rule of thumb |
|---|---|---|---|
| Call control | CUCM — deepest features, STIG/FIPS, air-gap | Webex Calling — zero ops, cloud PSTN | Enclave or complex dial plan → CUCM. Cloud-first commercial → Webex Calling. |
| Border role | Expressway — MRA, B2B, hybrid | CUBE — ITSP trunks, SBC | Never cross the roles. ITSP on CUBE, people on Expressway. |
| Meetings | CMS — you own the bridge | Webex Meetings — global cloud scale | Classified/internal → CMS. Everything else → Webex; Video Mesh to localize media. |
| Client | Jabber — fully on-prem | Webex App — strategic, cloud messaging | Air-gapped → Jabber. Connected → Webex App with CUCM calling. |
| Survivability | SRST — CUCM branches | Survivability node — Webex Calling branches | Match to your call control plane. |
| Contact center | UCCX / UCCE | Webex Contact Center | Departmental → X, airline-scale → E, direction of travel → WxCC. |
All tiers use the three-zone model with default-deny firewalls between zones. VM counts are the whole build, infra included.
CUCM Pub · Unity · infra services. Prove install, dial plan, voicemail.
trust ×3One VM per diagram role: Pub, Sub, IM&P, Unity, CER, CMS, CMM, Exp-C, Exp-E, CUBE, infra, SFTP/SSM, ITSP emulator.
untrust ×1dmz ×2trust ×10+Sub #2, +IM&P #2, +Unity Sub — every failover semantic that behaves differently, nothing duplicated for symmetry.
×1×2×13Full mirror: Expressway clusters, CUBE box-to-box HA, CMS 3-node + DB quorum, CER sub, dual DC, optional SME pair. Quorum, split-brain, stateful SIP failover.
×1×4×19FreePBX (Asterisk) · RHEL IdM · OPNsense spanning the zones.
trust ×2fw spansKamailio + FreeSWITCH split, Prosody/Matrix, Jitsi, Kamailio-edge + coturn, OpenSIPS SBC + RTPEngine, IdM, Keycloak, Homer/Grafana/Elastic, SIPp box.
×1×2×7+Kamailio #2, FreeSWITCH #2, RTPEngine #2, Galera/Patroni DB, keepalived VIPs — the raw VRRP/dispatcher/quorum mechanics Cisco hides behind CM groups.
×1×3×10CM groups: Sub1→Sub2→Pub. Phones re-home <30s. Never stretch a cluster past the 80ms RTT ceiling.
Box-to-box HA with media preservation — calls survive a chassis loss. Dual ITSP with dial-peer preference.
Call Bridge groups + odd-numbered DB cluster (3). Web Bridges behind SRV/F5.
Clusters ≤6, equal-priority DNS SRV. Traversal zones fail over per peer.
Active/active ports · presence redundancy groups · warm standby respectively.
SRST + local trunks per branch; DRS nightly to hardened SFTP; AXL config exports in git; AAR re-routes via PSTN when the WAN is full.
Hardening baseline: STIG/SRG on every node, FIPS mode at install, CNSA 1.0 crypto (AES-256-GCM SRTP, P-384/RSA-3072, SHA-384), SIP OAuth + mutual TLS as the ZTA identity plane, SSM On-Prem for air-gapped licensing — then crosswalked to the Vanta 38-framework catalog.