Cisco Connect Montreal provided information on Cisco's Webex Hybrid Services which allow for integration between on-premises and cloud collaboration solutions. The key services discussed included Hybrid Directory Service for user synchronization, Hybrid Calendar Service for calendaring integration, Hybrid Call Service for calling capabilities, Hybrid Message Service for messaging interoperability, and the new Cisco Webex Edge service for enhanced audio, video mesh, and media experiences.

1. Cisco Connect Montreal
Canada • November 20th 2018
Global vision.
Local knowledge.

2. Yves Daigneault - TSA
Jeff Corcoran - TSA
20 novembre 2018
Meeting you wherever you are along your journey to the cloud
Webex Hybrid Services

3. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
Agenda
• Cloud Collaboration
• Hybrid Cloud Collaboration
• Hybrid Directory Service
• Hybrid Calendar Service
• Hybrid Call Service
• Hybrid Message Service
• Cisco Webex Edge Service
• Webex Teams Cloud Security
and Hybrid Data Security

4. Cloud Collaboration

5. Common Management
Messaging Meeting Calling
Application Integration
APIs
Device registrations
Cisco Webex Hybrid
Services
Cloud + On-Premises
Cisco Webex – The Platform
BRKCOL-2607 5

6. Anywhere, Any Device, Any Time
Cisco Webex
Cisco Webex
Room DeviceCisco Webex
Desk Phone
Cisco Video
Endpoints
3rd
Party endpoints
& service
integrations
Webex Teams
Mobile App
Webex Teams
Desktop App
WebEx
App
Cisco Webex – Meetings
BRKCOL-2607 6

7. NEW
Spark Board 70
Room 70D G2Room 70S G2Room 55DRoom 55
NEW NEW NEW
Room Kit PlusRoom KitRoom Kit Mini
NEW NEW
Room Kit Pro
NEW NEW NEW
NEW
Soon
Board 55 Board 70 Board 85
2019
DX80
Share
Soon

8. Hybrid Cloud
Collaboration

9. Creating unique value by
connecting on-premises and
cloud services
Hybrid Calendar Service
Cisco Webex platform
Messaging | Meetings | Calling
Existing Services
Hybrid Call Service
• Call Service Aware
• Call Service Connect
Hybrid Directory Service
Hybrid Media Service
Hybrid Data Security
Cisco Webex Hybrid Services: AND, not OR
9BRKCOL-2607
Hybrid Message Service

10. Expressway
Windows
*Includes Business Edition or HCS
Webex
Messenger
Integrating On-Premises and Cloud
10
Directory Calendar Media KMS
Microsoft AD Exchange Media Node
Data
Security
Call Message
IM&PCisco UCM*
?
Platform
BRKCOL-2607

11. SIPTrunk
XMPP
Expressway
C
DMZ
Collaboration Cloud Infrastructure
Collaboration Cloud Services
Media/TranscodingNotification/Alerts
Messaging Interop Content Sharing
Call Control RoomsIdentity/SSO
File
Storage
Metadata
Storage
Metrics &
Reporting
Billing &
Provisioning
Management Calendar Future
DC
Serviceability
Connector
Management
Connector
Common Connector Framework
Message
Connector
Calendar
Connector
Management Connector
Directory
Connector
Call
Connector
FutureService
Connector
BRKCOL-2607 11

12. Webex Admin Control Hub
12Presentation ID

13. Hybrid Service Expressway-C Registration Complete
BRKCOL-2607 13

14. Hybrid Directory Service
and SSO
Hybrid Directory Service
and SSO

15. Admin Portal DirSync User Configuration
BRKCOL-2607 15

16. Provisioning via Directory Connector
• Infrastructure for premises directory synchronization to the Identity cloud services
• Directory connector integrates with AD to retrieve user information to sync with the
identity service, and specifies the Active Directory synchronization agreement and
attribute mappings
• Customer installs Directory Connector in its network on a Windows Domain server
(Windows Server 2003, 2008 R2, 2012, 2012 R2, 2016) with administrative user privilege
• Directory Connector supports Single Forest, Multi-Domain and Multi-Forest, Multi-Domain
Directory
Connector
Active
Directory
Cisco Webex Cloud
Identity/SSO
HTTPS
BRKCOL-2607 16

17. Windows
WebEx
Messenger
17
On-Premises Directory Synchronization
Directory
Microsoft AD
BRKCOL-2607

18. Hybrid Calendar Service

19. Calendaring Scheduling Integration with @webex or @meet
@webex will backfill the users personal room
information into the calendar invite (seen here)
@meet will utilize the Cisco Webex Teams
space information when populating a calendar
invite, or create a new space (next page).
BRKCOL-2607 19

20. Calendaring Scheduling Integration with @webex
20Presentation ID

21. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Calendaring Scheduling Integration with @meet
21Presentation ID

22. Calendaring Scheduling Integration with @meet
22Presentation ID

23. 23
OBTP User Meeting Scheduling Experience
Cloud Registered
Room Device
Bookable Resource
BRKCOL-2607

24. 24
OBTP User Meeting Join Experience
Before Meeting
During Meeting
Cloud Registered Room Device
BRKCOL-2607

25. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Set Out-of-Office from Outlook
25Presentation ID

26. Edge
Exchange /
Office 365
Calendar
WebEx
Messenger
26
Calendar Service Hybrid Exchange Calendaring
BRKCOL-2607

27. Edge
Calendar
WebEx
Messenger
27
Calendar Service Hybrid Exchange Calendaring
BRKCOL-2607
Cloud Calendar Connector uses the same
system architecture; however, the connector
resides in the Cisco Collaboration Cloud (i.e.
requires no premises infrastructure)

28. Hybrid Call Services

29. Webex Hybrid Call Service at a Glance
Call Service Aware
Provides the Webex Teams application an awareness of calls placed between the on
premise devices of two Aware enabled users. This means a one-to-one space will be
created for the users and they will be offered the ability to share their screen with one click.
Call Service Connect
Provides Webex Teams users the ability to make and receive calls on their Webex Room
Devices or Webex Teams application by leveraging the on premise infrastructure’s dialing
capabilities
29

30. Call Connect for Webex Teams
30Presentation ID
Calling my mobile from Teams
Calling my Cisco phone number
from my mobile

31. Hybrid Call Service for Cisco Webex Devices Architecture
31Presentation ID

32. Edge
WebEx
Messenger
32
Call Service Integration for CUCM
BRKCOL-2607
*Includes Business Edition or HCS
Call
Cisco UCM *

33. Call Service Aware/Connect Architecture
Expressway-E Expressway-C
Expressway-C
(Connectors)
Communications
Manager
SIP
AXL/SOAP/RIS
CTIQBE
REST/HTTPS
*.ciscospark.com example.com

34. Hybrid Message Service

35. Expressway
Hybrid Message Service Integration
35
Message
IM&P
?
BRKCOL-2607

36. SIPTrunk
XMPP
Expressway
C
DMZ
Collaboration Cloud Infrastructure
Collaboration Cloud Services
Media/TranscodingNotification/Alerts
Content Sharing
Call Control RoomsIdentity/SSO
File
Storage
Metadata
Storage
Metrics &
Reporting
Billing &
Provisioning
Management Calendar Future
Messaging Interop
Serviceability
Connector
FutureService
Connector
Management
Connector
Common Connector Framework
Message
Connector
Calendar
Connector
Message Service
Directory
Connector
DC
Call
Connector
RESTful https
BRKCOL-2607 36
AXL / XMPP

37. Cisco Webex Teams / Jabber Interoperability - Presence
37
• When user is running Jabber, the user’s Presence on
Jabber shall be based on existing Jabber logic
• Available / Busy / Presenting / In meeting, etc.
• When user is not running Jabber, the user’s Presence
on Jabber shall be based on WebEx Teams activity
• “Available On WebEx Teams” when the user has
been active on WebEx Teams within the last 24
hours
• “Offline” when the user has not been active on
WebEx Teams for over 24 hours
Note: Webex Teams Presence is not impacted due to user’s Jabber activity
BRKCOL-2607

38. Cisco Webex Teams / Jabber Interoperability - Message
38
• Cisco Webex Teams Interop will allow 1:1 message only between
Jabber and Webex Teams users.
• Users must be configured and enabled on both IM&P and Webex
Teams
• Message Connector will map Jabber and the Webex Teams ID using
a common email address
• Notifications include is Typing, Message Read, Deletes, or Missed
• File transfer is not supported.
o When a Webex Teams user posts a file, Cisco Jabber will receive a notification to
get access to the file in the Webex Teams web client
BRKCOL-2607

39. Cisco Webex Edge
Service

40. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Cisco Webex Edge service
Webex Edge service
Enhanced
Quality
Consistent
Experience
No Change in
User Behavior
Cost
Savings
Purpose-built for collaboration and
real-time media
Customer Premises
Leverage existing investments
Reshaping the edge to maximize the power of the Webex cloud
Version 1.1

41. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Capabilities of Webex Edge
Intelligent Audio + Direct Connection + Industry-Leading Media Experiences
Audio Connect Video Mesh
Webex Edge
New New
Version 1.1

42. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Multiple deployment options
1
3
2
Webex Edge Connect provides peering connection to Webex datacenters for media.
• Can be used with Webex Edge Audio.
• Can be used with Video Mesh.
• Not required for either service to operate but recommended for Edge Audio.
Webex Edge Audio provides dial in and call back for Webex meeting audio to customer premises.
• Does not require Edge Connect, but is strongly recommended to be used with Edge Audio.
• Does not require Video Mesh, functions independently from this service.
Webex Edge Video Mesh provides on premises meeting resources for devices and Teams app.
• Does not require Edge Connect, but can utilize the direct peering link.
• Does not require Edge Audio, functions independently from this service.
Version 1.1
Audio Connect Video Mesh
Webex Edge
New New

43. Webex Edge Audio

44. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Webex Edge Audio
Intelligent audio routing
•Intelligent audio routing: integrating Webex with
Unified CM
• Creates end-to-end VoIP path for Unified CM
registered devices (callback and dial-in)
• Uses company’s own PSTN for any other device
(callback savings)
• No SIP trunks or peering arrangements required
•Geo-country code configurable
•Included in Collaboration Flex Plan – no extra
charge. No port charges on Expressway
•Supports Webex Meetings, Events, Training
•Enhanced audio quality when G.722 is enabled
No user training, no change in user behavior, easy for IT
IP
Phone
Cisco
Unified CM
Customer
Premises
Media Path
Z
Expressway
C/E
Webex Edge
Audio
Signaling
Meeting
Version 1.1

45. Unified CM support only
• 10.5 or later
Cisco UCM registered IP phones
• Supporting G.711 or G.722
Expressway support only
• X8.10 or later
• Can use existing Expressway C/E deployment
• Audio scale dependent on Expressway deployment
and services enabled.
Webex site
• WBS 33.x or higher
• Included in Flex, A-WBX and A-SPK SKU need the
Webex Edge Audio package
• Not available on CCA-SP, CCA-ENT or TSP sites.
• Requires migration to Webex Audio Site
Requires a signed certification from a Cisco trusted
Certificate Authority (CA)
Cisco Webex Edge Audio
Architecture requirements
IP
Phone
Cisco
Unified
CM
Customer
Premises
Media Path
Z
Expressway C/E
Webex Edge
Audio
Signaling
Meetin
g
Version 1.1

46. Webex Edge Audio Configuration Steps:
1. Obtain dial-in numbers and Lua script
from Site Administration
2. Configure DNS SRV records (5062)
3. Configure Unified CM
4. Set Up Expressway-C
5. Set Up Expressway-E
5. Open Firewall ports
6. Apply Signed Certificate From Trusted
Certificate Authority
7. Apply Edge Audio Callback Settings
Cisco Webex Edge Audio
Architecture configuration
IP
Phone
Cisco
Unified
CM
Customer
Premises
Media Path
Z
Expressway C/E
Webex Edge
Audio
Signaling
Meetin
g
Version 1.1

47. 1. Endpoint dials Webex Audio access number.
2. Cisco UCM matches the number and routes
as +E.164 through SIP trunk to Expressway-
C.
3. LUA script on SIP trunk to Expressway-C
applies transformations required for correct
routing to Webex
4. Expressway-C sends request to
Expressway-E.
5. Expressway-E routes call to the Webex
cloud.
6. Meeting resources are setup.
Cisco Webex Edge Audio
Dial in Signaling Call Flow
IP
Phone
Cisco
Unified
CM
Customer
Premises
Media Path
Z
Expressway C/E
Webex Edge
Audio
Signaling
Meetin
g
Dials Webex Access Number
SIP Trunk
1
2 3 4
5
Version 1.1

48. 1. The IP phone sends media to Expressway-C
2. The Expressway-C sends media to
Expressway-E via the traversal zone
3. The Expressway-E sends media to the
Webex cloud.
4. IP phone’s audio is mixed into the meeting
and it hears the other participants.
Cisco Webex Edge Audio
Dial in Media Call Flow
IP
Phone
Cisco
Unified
CM
Customer
Premises
Media Path
Z
Expressway C/E
Webex Edge
Audio
Signaling
1
2 3
4
Meetin
g
Version 1.1

49. Webex Edge Audio Callback Set Up Steps:
1. Apply Webex Edge Audio Callback Settings
• Define country callback parameters in Site Admin
• Ensure proper SRV record configuration for
Expressway
• Ensure connectivity checks are successful.
• Cisco UCM routes the +E.164 audio call to the IP
phones or local PSTN
Cisco Webex Edge Audio
Architecture configuration
IP
Phone
Cisco
Unified
CM
Customer
Premises
Media Path
Z
Expressway C/E
Webex Edge
Audio
Signaling
Meetin
g
PSTN
Version 1.1

50. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Single Country Call Back – Multiple Expressways
Customer
Premises
Z
Webex Edge
Audio
Meetin
g
USA
Intern
et
• Expressway-E is configured in Webex for callback
• +1 is defined in Webex callback settings
• SRV records along with DNS configuration will determine
cluster routing or load balancing
Site 1Cisco
Unified CM
DNS SRV:
_sips._tcp.edge-amer.example.com
DNS SRV Records
_sips._tcp.edge-amer.example.com. 60 IN SRV 0 5 5062 exp-amer1.example.com.
_sips._tcp.edge-amer.example.com. 60 IN SRV 0 5 5062 exp-amer2.example.com.Z
Webex Edge
Audio
Site 2
Cisco
Unified CM
Call back made to
On net IP phone
Laptop
Client
exp-amer1.example.com
exp-amer2.example.com
WAN
Signaling
Media Path
Version 1.1

51. Caveats

52. • CCA- SP, CCA-ENT, TSP customers can not use their present
configuration with Edge Audio.
• If a call fails, user needs to dial into the call or callback.
• Dial-in through customer owned E.164 or VOIP numbers is not
supported.
• Reroute call back to Webex PSTN resources if rejected by UCM is
not available
• Unable to define Class of Service for call back
• OPUS codec not supported
Webex Audio Caveats
Initial release
Version 1.1

53. Webex Edge Connect

54. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Webex Edge Connect
Brings the power of the Webex backbone directly to your data center
Webex Edge Connect
• A direct peering at Equinix data centers
• Bypasses the Internet by providing a direct connection1
to the Webex data center
• All Webex media traffic traverses the dedicated link providing
end-to-end QoS. (VoIP, video, content sharing)
• When used with Video Mesh provides a more secure
end-to-end experience
1 via a peering agreement with Equinix
Webex Edge
Version 1.1

55. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Customer Requirements
1. A cage and router in place at Equinix
2. A paid connection to the Equinix Cloud Exchange
3. Knowledge of BGP Routing
4. Public BGP Autonomous System Number
5. Public provider independent IP block
• No RFC1918 addressing (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Customer may rent a /29 IP block from Equinix
6. Paid service to Cisco Webex
Customer
Premises
Equinix Cloud
Exchange
(ECX)
Cisco Webex
Version 1.1

56. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Connectivity - Components
Layer 2
(802.1q)
Equinix
Cloud Exchange
Layer 3
(BGP)
Layer 1
(1G/10G)
AS13445
Customer
Network
1. Layer 1 – Physical Connectivity
2. Layer 2 – Ethernet Connectivity
3. Layer 3 – IP connectivity
Network Details
1. Customer orders physical circuit
to ECX fabric
2. Customer provisions virtual
circuit to Cisco WebEx using
Equinix self-service portal
3. Customer completes WebEx
BGP network questionnaire
4. Cisco enables BGP connection
to the Customer to establish
connectivity
Equinix responsibility:
ü Physical link provisioning (cross connects)
ü Virtual circuit monitoring reports & support
Roles and Responsibilities
Cisco responsibility:
ü Peering provisioning and support
Version 1.1

57. • A customer sets up dual connections to
Equinix for redundancy
• Cisco Webex has redundant connection to
Equinix at all colocations across the globe
• BGP routing is used to route traffic across
the peering connection.
• Customers that have a global presence
can choose which regions to peer.
• Customer’s Internet connection is used as
fallback
Architecture
Equinix
PRI SEC
Customer Premises
PRI SEC
ORD10-WXBB-CRT01
Cisco Webex
ORD10-WXBB-CRT02
ORD10-WXBB-PE02ORD10-WXBB-PE01
Intern
et
Version 1.1

58. Z
• Media flows via Equinix peering
connection.
• Webex Meetings app signaling
and media use the peering
connection
• Signaling for cloud registered
devices and Webex Teams uses
the public Internet
• Third party services accessed via
the Internet
Signaling and Media Flow
Customer
Signaling only
Internet
Media Path
Signaling
Webex AS13445
Webex IP blocks:
https://collaborationhel
p.cisco.com/article/en-
us/WBX000028782
Version 1.1

59. Webex Edge Video
Mesh

60. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Webex Edge Video Mesh
On-premises video quality and bandwidth savings
Webex Edge Video Mesh
• Automatic overflow if local capacity is full / unavailable
• Software extends cloud to the premises
- media stays local for on-premises attendees
• Cloud simple: managed by & registered to Webex cloud local media
kept local
Video Mesh
Node
local media
kept local
Video Mesh
Node
local media
kept local
Video Mesh
Node
Version 1.1

61. • Video Mesh is part of the Webex Edge solution
• Video Mesh functionality is the same, handling
the Main Video, Speaker’s Audio and Content
being shared by the video devices in the
meeting that can utilize Video Mesh
• Video Mesh communicates directly to Webex
cloud and terminates the media for cloud
registered device and SIP video endpoints for
dialing into Webex meetings.
• Webex Teams, Webex registered devices and
Cisco UCM registered SIP video endpoints use
Video Mesh. Webex Meeting app or Webex
Teams browser does not use Video Mesh.
Cisco Webex Edge Video Mesh
Architecture
SIP
Video
Endpoint
Cisco
Unified
CM
Customer
Premises
Media Path
ZExpressway C/E
Webex Edge
Audio
Signaling
Video
Mesh
Cloud
Registered
Video
Endpoint
Meeting
Version 1.1
SIP
Trunk
© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Video Mesh is part of the Webex Edge solution
• Video Mesh functionality is the same, handling
the Main Video, Speaker’s Audio and Content
being shared by the video devices in the
meeting that can utilize Video Mesh
• Video Mesh communicates directly to Webex
cloud and terminates the media for cloud
registered device and SIP video endpoints for
dialing into Webex meetings.
• Webex Teams, Webex registered devices and
Cisco UCM registered SIP video endpoints use
Video Mesh. Webex Meeting app or Webex
Teams browser does not use Video Mesh.
Cisco Webex Edge Video Mesh
Architecture
SIP
Video
Endpoint
Cisco
Unified
CM
Customer
Premises
Media Path
ZExpressway C/E
Webex Edge
Audio
Signaling
Video
Mesh
Cloud
Registered
Video
Endpoint
Meeting
Version 1.1
SIP Trunk

62. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
CASCADE CASCADE
Architecture
MEDIA
NODE
MEDIA
NODE
00:50
MEDIA
NODE
• Cloud and Premises nodes
• Hub and Spoke design
• Cascades initiated from premise to cloud
• Inside à Cloud only

63. Uses the Node
1. Any Webex registered device
Ø SX, MX, RK series, Webex Board
2. Webex Teams app
3. CUCM registered devices
Ø Calling a Webex scheduled, Webex
PMR, or space meeting including the IX.
4. VCS/Exp registered devices
Ø Calling a Webex scheduled Webex
PMR, or space meeting
Ø SIP or H.323 (requires Interworking)
5. Webex dial back to Webex
registered endpoints
Can NOT Use the Node
1. Webex Teams browser client
Ø web.ciscospark.com
2. Webex Call registered phones
Ø 88xx and 78xx (Spark Call) IP
Phones
3. Webex dialing back to SIP registered
endpoints
4. Webex Meetings app
What devices and scenario can the media node
be used?

64. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Capacity on Multiparty Media 410v and Cisco
Meeting Server 1000
Server (version) Max simultaneous calls per server
Cisco Spark only
(720p | 1080p)
Standard based SIP endpoints and
Cisco Spark app/devices
(720p | 1080p)
MM410v (Full version) 100 | 75 65 | 48
CMS 1000 (Full version) 100 | 75 80 | 60
Demo version 10 | 5 10 | 5
Note: If all the meetings hosted on a given Hybrid Media Node have only Cisco Spark apps and devices,
then the server can scale up to 100 participants at 720p. If all meetings have a mix of Cisco Spark and SIP
participants, then the scale goes up to 80 participants for the CMS 1000 server and 65 participants for the
MM410v server.

65. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Webex Video Mesh Requirements
Component purpose Minimum supported version
On-Premises call control Cisco Unified Communications Manager, Release 10.5(2) SU5 or
later
Cisco Expressway-C or E, Release X8.9.2 or later
Meeting infrastructure Cisco Webex Meetings WBS31.11.1, WBS31.12.1, WBS31.20, or
WBS32.0.2 and above, enabled with video platform version 2.0

66. Webex Edge
Audio, Video Mesh and
Connect

67. • Video Mesh and Edge Audio work
independently but are part of an overall
solution when connecting to a Webex meeting.
• IP phones dialing in or call back to the Webex
meeting use +E.164 numbers and utilize the
Expressway to connect to the Webex meeting.
(Webex Edge Audio)
• Cisco UCM registered SIP video endpoints,
Webex registered devices and Webex Teams
app dial SIP URIs to the Webex meeting and
use Video Mesh for local media processing.
• Webex Meeting app goes directly to the
Webex Cloud.
Cisco Webex Edge Audio + Video Mesh
Signaling and Media
Version 1.1
SIP
Video
Endpoint
Cisco
Unified
CM
Customer
Premises
Media Path
ZExpressway C/E
Webex Edge
Audio
Signaling
Video
Mesh
Cloud
Registered
Video
Endpoint
IP
Phone
SIP Trunk
Meetin
g
SIP
Trunk

68. • Webex Connect is a peering connection
to Cisco Webex.
• Both Video Mesh and Webex Edge Audio
can use the Webex Edge Connect peering
service to connect media to the Webex
Meeting, but it is not a requirement.
• Webex Teams signaling goes via the
Internet link and all media goes via Webex
Connect.
• Webex Meetings app sends signaling and
media via Webex Connect.
• If the peering connection is not available
all signaling and media traffic will flow via
the Internet.
Cisco Webex Edge Audio + Video Mesh +
Connect
Architecture
SIP Video
Endpoint
IP
Phone
Laptop
Client
Cisco
Unified
CM
Customer
Premises Media Path
ZExpresswa
y
Webex Edge
Video Mesh
Signaling
Connect
InternetLaptop
Client
Meeting
Version 1.1

69. Webex Teams Cloud
Security and Hybrid
Data Security

70. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Security mechanisms
• Realms of separation
• Identity Obfuscation
• SSO authentication using SAML based IdP
• OAuth access and refresh token based authorization
• Key Management Service for managing encryption keys
• End to end encryption of content (one key per space)
• Data encrypted in transit
• Data encrypted at rest
• Application layer database content encryption
• Hash key based secure index and search (one key per space)
• Secure compliance reporting service based on hashed index
Security Option for On-Premise Control
Webex Teams Security

71. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Secure Data Center
Content Server
Key Mgmt Service eDiscovery ServiceIndexing Service
Hybrid Data Security
Hybrid Data Security
=
On-Premises
Key Management Service
Indexing Service
eDiscovery Service
Requires
Pro Pack
Add-onHybrid Data Security (HDS)

72. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Secure Data Center
Content Server Key Mgmt Server
The Hybrid Key Management
Service performs the same
functions as the cloud based
Key Management Service
Customer now owns and
manages all of the keys for
messages and content
BUT
Key Management Service
Key Mgmt Service
Requires
Pro Pack
Add-onHDS – Key Management

73. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Secure Data Center
Content Server
Hybrid Data Security
Hybrid Data Security
Multiple servers can be provisioned
for Scalability & Load Sharing
Hybrid Data Security instances are
managed and upgraded from the
cloud
Customers can access usage
information for the HDS services via
the Cisco Webex Control Hub
Requires
Pro Pack
Add-on
Hybrid Data Security
Key Mgmt Server
HDS - Scalability

74. HDS Install Prerequisites
HDS Deployment Guide https://www.cisco.com/go/hybrid-data-security
X.509 Certificate, Intermediates and Private Key
PKI is used for KMS to KMS federation (Public Key Infrastructure)
Common Name signed by member of Mozzila Trusted Root Store
No SHA1 signatures, PKCS12 format
2 ESXi Virtualized Hosts: Min 2 to support upgrades, 3 recommended, 5 max
Minimum 4 vCPUs, 8-GB main memory, 50-GB local hard disk space per server
1 Microsoft SQL or Postgres 9.6.1 Database Instance (Key datastore)
8 vCPU, 16 GB RAM, 2 TB Disk. User created with createuser. Assigned GRANT ALL PRIVILEGES ON database.
1 Syslog Host
Hostname and port required to centralize syslog output from HDS instances and management containers
A secure backup
The HDS system requires organization administrators to securely backup :
1) A configuration ISO file generated during the install process
2) The MS SQL/ Postgres database.
Failure to maintain backups will result in loss of customer data.
See Standby Data Center for Disaster Recovery section of the HDS Deployment Guide
Network
Outbound HTTPS on TCP port 443 from HDS host
Bi-directional WSS on TCP port 443 from HDS host
TCP connectivity from HDS host to Postgres database host, syslog host and statsd host
HTTPS proxies not supported today
75© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

75. • Hybrid services connect premises resources to cloud
• Each hybrid service can be deployed independently
• Benefits
• Leverage premises investments
• Enhance user experience
• Increase security
• Ease management
• Transition to cloud at desired pace
Key Points

76. #CLUS