Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. We recommend that you choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

• Verify that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.

• Verify that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Update the DNS server as follows. There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you cannot use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, we recommend that you place the Internet Reverse Proxy in a subnet that is separate from the internal (Admin or Media) virtual machines. See Port Access When All the Virtual Machines Are in the Internal Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.

• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin, Media and Web, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. We recommend that you choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

• Verify that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.

• Verify that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Update the DNS server as follows. There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you cannot use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, we recommend that you place the Internet Reverse Proxy in a subnet that is separate from the internal (Admin or Media) virtual machines. See Port Access When All the Virtual Machines Are in the Internal Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.

• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin, Media and Web, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. We recommend that you choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

Verify that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.

Required IP Addresses

DNS Configuration

Update the DNS server as follows. There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you cannot use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

Network Routing Configuration

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

Make the following changes to your firewalls.

Network Routing Configuration

Make the following changes to your network routing.

WebEx Site URL

Users access the WebEx site URL to schedule, host, or attend meetings. This URL resolves to either the private VIP address or the public VIP address, depending on whether or not you are using a split-horizon DNS.

• Resolves to the public VIP address for all users, when you do not have split-horizon DNS.

• Resolves to the public VIP address for external users when you have split-horizon DNS.

• Resolves to the private VIP address for internal users when you have split-horizon DNS.

Note	Ports 80 and 443 must be open for the WebEx site URL.

WebEx Administration URL

Administrators access the WebEx Administration URL to configure, manage, and monitor the system. This URL resolves to the private VIP address.

Note	Ports 80 and 443 must be open for the WebEx Administration URL.

Names for the WebEx Site and WebEx Administration URLs

You may choose almost any names for these URLs, comprising all lowercase characters. However, you cannot use the following as the hostname in the URLs:

This section describes the port access required in the external firewall when all the system virtual machines (Admin, and if applicable, Media, Web, and Internet Reverse Proxy) are in the internal network. This is the Internal Internet Reverse Proxy network topology.

Ensure that the firewall or any load balancing solution redirects requests to the ports listed below to ensure end users can host and join meetings successfully.

• TCP Port 80 to the public virtual IP (VIP) address

• TCP Port 443 to the public virtual IP (VIP) address

Note

The Web node and Admin node send SMTP requests to the configured Email server. If there is a firewall between the internal Web and Admin virtual machines and the Email server, SMTP traffic might be blocked. To ensure Email server configuration and Email notification work properly, port 25 or 465 (secure SMTP port number) must be open between the Email server and the Web and the Admin virtual machines.

This section describes the port access required in the internal and external firewalls when you have internal virtual machines (Admin, and if applicable, Media and Web) in the internal network, and the Internet Reverse Proxy (IRP) in the DMZ network.

Configure access control lists (ACLs) on the switch that permits traffic to the ESXi hosts for the system's virtual machines.

Ports Open for Deployment

These are some of the ports that are used during the deployment of a Single-data Center (SDC) Cisco WebEx Meetings Server (CWMS). Once the deployment completes, you can close any ports that were opened solely for the deployment.

TCP Port 443 should be open, in both directions, between vCenter and the Admin virtual machine for secure https management during an automatic system deployment. The Admin virtual machine uses this port to provide vCenter credentials to deploy the virtual machines automatically in vCenter.

The ports listed below are used for communication between the ESXi host and vCenter. If the ESXi host and vCenter are connected to a separate management network, you may not need to open these ports through the firewall. For a complete list of ports used by vCenter and the ESXi host, see your VMware documentation.

• UDP/TCP Port 902 in both directions between vCenter and the ESXi hosts for vCenter management

• (Optional) TCP Port 22 from the vSphere client to the ESXi hosts for SSH management

• UDP Port 514 from the ESXi hosts for your system to the internal syslog

• TCP Port 5989 in both directions between vCenter and the ESXi hosts for XML management

The default UDP port used for external clients for audio and video data transmission is SSL (port 443).

Ports Open to Support Multi-data Center

These ports are used for communication between Cisco WebEx Meeting Center and Cisco WebEx Meetings Server.

• The UDP ports used for internal clients for audio and video data transmission between UDP and SSL include:

  • For 50 user systems, use UDP port 9000

  • For 250 user systems, use UDP ports 9000, 9001, 9002, 9003

  • For 800 user systems, use UDP ports 9000, 9001, 9002, 9003, 9004, 9005, 9006, 9007, 9008, 9009

  • For 2000 user systems, use UDP ports 9000, 9001, 9002, 9003, 9004, 9005, 9006, 9007

• With the appropriate network settings, internal media servers allow connections through any port used by Meeting Center.

• The Internet Reverse Proxy only accepts connections from Meeting Center through TCP ports 80 and 443.

• AXL traffic from Web Node to CUCM is passed through port 8443.

Cisco supports Network Address Translation (NAT) traversal with this product for virtual machine IP addresses and for the virtual IP addresses (Public and Private VIPs) that are used in your system.

The following schematic diagram illustrates a typical NAT traversal for a 50 user system without High Availability (HA). By using NAT, you can reduce the number of public IP addresses required for the product to just one IP address, instead of two (or three if you deploy HA). You can also deploy similar NAT deployments as long as these meet the overall system requirements.

In the diagram, an external user accesses the WebEx site to join or host a meeting. Following a DNS lookup, the IP address for the WebEx site is the NAT public IP address (Eth0). This NAT public IP address is for the external NAT firewall router (Firewall and NAT router 1), between the external network and the DMZ network.

The firewall router receives this request from the external user, and internally routes the request to the NAT private IP address for the router (Eth1, exposed to the DMZ network). Eth1 then sends the request to the public VIP address (also a NAT IP address in the private networking segment for the WebEx site).

You can use NAT IP addresses for the public VIP address, and the Internet Reverse Proxy IP addresses. The only NAT public IP address is the Eth0 IP address for the NAT firewall router.

Note	To ensure this NAT firewall router (between the Internet and DMZ network) routes the incoming packet correctly, set port mapping configuration on the NAT device, or apply other similar mechanisms to ensure the packet is routed correctly to the public VIP address and the Internet Reverse Proxy.

There is usually a second internal NAT firewall router between the DMZ network and the internal network. Similar to the external NAT firewall router, Eth0 is a DMZ NAT private IP address and is an interface to the DMZ network. Eth1 is also a NAT private IP address that is an interface to the internal network.

You can use NAT IP addresses for the private VIP address and the Administration virtual machine IP addresses.

For more information about NAT, see http:/​/​www.cisco.com/​c/​en/​us/​tech/​ip/​ip-addressing-services/​tech-tech-notes-list.html.