Allow extra time to prepare these items:

• Determine your certificate trust method. You can use manual or automatic upload; see Supported Certificate Authorities for Cisco Webex for more information.
• Verify your identity by registering all the domains that are used to form your users' directory URIs and email addresses. Ensure that the subject alternative names (SANs) belong to the domains that are registered on your Cisco Webex organization.

  See Why the Cloud Checks Domain Ownership to understand why domain checks are an important security measure.

• Install or upgrade to a supported version of Cisco Unified Communications Manager, as described in Requirements for Hybrid Call Service

• Prepare your Expressway-Es (default SIP Destination and cluster-specific SIP destinations for each location) for the secure mutual TLS connection between Cisco Webex and your call control environment:

  • An SRV record (multiple Expressway-Es for redundancy) is recommended for large deployments:

    • You cannot reuse an existing SRV; allow the time to request a dedicated SRV for Hybrid Call Service and use port 5062. The SRV record resolves into Expressway-E A-records; the hostname is the A-record for Expressway-E.

    • Request that port 5062 be open on the enterprise firewall. This port is required to establish a mutual TLS connection between the premises and cloud.

    • Make sure that the port is open to and from the Internet.

    • Verify that the mutual TLS port is reachable by using a ping utility—for example, telnet [domainname or ip] [port] in a command prompt.

    In a global Hybrid Call Service, scenario, you'll need one SRV record for each location (see Recommendations for Global Hybrid Call Service Deployments for deployment options and accompanying diagrams). Note these guidelines for the SIP destinations.

  • If you don't have time to request a dedicated SRV domain or have a small deployment, you can use FQDN:port or IP address:port to avoid blocking the rest of setup. Later, you can change to an SRV-based SIP destination if you prefer.

  See TCP Port 5062 on the Internet Firewall for more information.

• Follow these Expressway pair requirements:

  • If you don't have an existing Expressway pair that is deployed, read the following documents (Release X8.11.4 and later) to design your new Expressway pair to work together:

    • Cisco Expressway Installation Guides

    • Cisco Expressway Basic Configuration Deployment Guide

    • Cisco Expressway and CUCM via SIP Trunk Deployment Guide

    • Cisco Expressway IP Port Usage for Firewall Traversal Deployment Guide

  • Install or upgrade your Expressway pair that handles SIP traffic to a supported version, as described in Requirements for Hybrid Call Service. Use the recommended version for all Expressways that are handling SIP calls to take full advantage of Hybrid Call Service.

  • For a global Hybrid Call Service deployment, you must deploy one Expressway pair per location. See Recommendations for Global Hybrid Call Service Deployments for deployment options and accompanying diagrams.

  The Call Connector can run on a standalone or shared Expressway-C connector host, not the C or E in the Expressway pair. See Expressway Connector Host Support for Hybrid Services for the minimum supported version and User Capacity Limits for Expressway-based Hybrid Services for capacity planning guidelines.

  You can use an Expressway pair that's already configured for B2B or MRA deployments. You cannot use a Jabber Guest Expressway pair to handle Hybrid Call Service calls.

Follow these Cisco Unified Communications Manager requirements:

• Install or upgrade your Cisco Unified Communications Manager to the minimum version that supports Cisco Spark-RD, as described in Requirements for Hybrid Call Service.
• Prepare your licensing. (See Cisco Spark Remote Device Overview and License Requirements)
• On the Unified CM, configure Directory URIs in one or both of the following ways, depending on your deployment:

  • Intracluster routing for intracluster routing in single cluster and multicluster deployments.

  • Intercluster lookup service (ILS) routing for multicluster and business-to-business deployments.

• Check your codec configuration.
  Cisco Webex supports the following codecs:

  • Audio—G.711, G.722, AAC-LD

  • Video—H.264

  Note	We support G.729 when users join a Webex meeting, Personal Room meeting, or Cisco Webex meeting from a SIP device. We do not support G.729 when a user dials 1:1 from Cisco Webex to a SIP device or bridge.

• Configure the following settings to be used for Cisco Spark-RD creation:

  • Device pools

  • Locations

  • Calling search spaces

    Note	The calling search space must be able to route to partition of the PSTN gateway or trunk, and any other destinations that you want Cisco Webex Teams users to be able to reach (conference bridges, enterprise-to-enterprise trunks, and so on).

  • Note these values. You will use them when you create eachCisco Spark-RD.

Provide port access (for media traversal between phones, Expressways, and the Cisco Webex cloud), as covered in the Network Requirements.

For all existing SIP trunks between Cisco Unified Communications Manager clusters, go to Device > Trunk, open the trunk settings, and set the Calling and Connected Party Info Format to Deliver URI and DN in connected party.

Enable the AXL Web Service on at least one node in the cluster (the bootstrap server, which can be the publisher or subscriber node of a cluster).

Ensure that Cisco CallManager Serviceability is enabled on at least one node in the cluster. This service is enabled by default and is used to discover nodes where the AXL Web Service is enabled.

(Optional) Download the latest Cisco Directory Connector software from Cisco Webex Control Hub (https://admin.webex.com) and use it to import user attributes from your Active Directory:

• Enterprise work phone numbers
• Email addresses—These values must match the user's Cisco Webex Teams user email address.

Obtain full organization administrator rights before you register any Expressways, and use these credentials when you access the customer view in Cisco Webex Control Hub (https://admin.webex.com).

Plan your connector capacity by referring to User Capacity Limits for Expressway-based Hybrid Services.

Deploy the Expressway-C connector host in a cluster to account for redundancy. Follow the supported Expressway scalability recommendations:

• For Hybrid Call Service on a dedicated Expressway-C:

  • Call Connector supports multiple Expressway-C clusters with no specific upper limit.

  • Each cluster supports up to 6 Expressway-C nodes for active/active redundancy.

Follow these requirements for the Expressway-C connector host.

• Install the minimum supported Expressway software version. See the version support statement for more information.
• Install the virtual Expressway OVA file according to the Cisco Expressway Virtual Machine Installation Guide, after which you can access the user interface by browsing to its IP address. You can find the document in the list of Cisco Expressway Install and Upgrade Guides on cisco.com.

  Note

  The serial number of a virtual Expressway is based on the virtual machine's MAC address. The serial number is used to validate Expressway licenses and to identify Expressways that are registered to the Cisco Webex cloud. Do not change the MAC address of the Expressway virtual machine when using VMware tools, or you risk losing service.

• You do not require a release key, or an Expressway series key, to use the virtual Expressway-C for Cisco Webex Hybrid Services. You may see an alarm about the release key. You can acknowledge it to remove it from the interface.
• Use the Expressway web interface in a supported browser. (See the Cisco Expressway Administrator Guide.) The interface may or may not work in unsupported browsers. You must enable JavaScript and cookies to use the Expressway web interface.

If this is your first time running Expressway, you get a first-time setup wizard to help you configure it for Cisco Webex Hybrid Services.

Check that the following requirements are met for the Expressway-C connector host. You would normally do this during installation. See the Cisco Expressway Basic Configuration Deployment Guide, in the list of Cisco Expressway Configuration Guides on cisco.com, for details.

• Basic IP configuration (System > Network interfaces > IP)
• System name (System > Administration settings)
• DNS settings (System > DNS)
• NTP settings (System > Time)
• New password for admin account (Users > Administrator accounts, click Admin user then Change password link)
• New password for root account (Log on to CLI as root and run the passwd command)

Configure the Expressway-C as a "cluster of one":

• We recommend that you configure the Expressway as a primary peer before you register it, even if you do not currently intend to install an extra peer.

  Caution

  When you change clustering settings on X8.11 and later, be aware that removing all peer addresses from the System > Clustering page signals to the Expressway that you want to remove it from the cluster. This causes the Expressway to factory reset itself on its next restart. If you want to remove all peers but keep configuration on the remaining Expressway, leave its address on the clustering page and make it the primary in a "cluster of one".

• Here are the minimum clustering settings required, but the Cisco Expressway Cluster Creation and Maintenance Deployment Guide has more detail:

  • Enable H.323 protocol. On Configuration > Protocols > H.323 page, set H.323 Mode to On.

    H.323 mode is required for clustering, even if the Expressway does not process H.323 calls.

    Note	You may not see the H.323 menu item if you used the Service Select wizard to configure the Expressway for Hybrid Services. You can work around this problem by signing in to the Expressway console and issuing the command xconfig H323 Mode: "On".

  • System > Clustering > Cluster name should be an FQDN.

    Typically this FQDN is mapped by an SRV record in DNS that resolves to A/AAAA records for the cluster peers.

  • System > Clustering > Configuration primary should be 1.

  • System > Clustering > TLS verification mode should be Permissive, at least until you add a second peer.

    Select Enforce if you want cluster peers to validate each others' certificates before allowing intercluster communications.

  • System > Clustering > Cluster IP version should match the type of IP address of this Expressway-C.

  • System > Clustering > Peer 1 address should be the IP address or FQDN of this Expressway

    Each peer FQDN must match that Expressway's certificate if you are enforcing TLS verification.

If you have not already done so, open required ports on your firewall.

• All traffic between Expressway-C and the Cisco Webex cloud is HTTPS or secure web sockets.
• TCP port 443 must be open outbound from the Expressway-C. See https://collaborationhelp.cisco.com/article/WBX000028782 for details of the cloud domains that are requested by the Expressway-C.

Get the details of your HTTP proxy (address, port) if your organization uses one to access the internet. You'll also need a username and password for the proxy if it requires basic authentication. The Expressway cannot use other methods to authenticate with the proxy.

• We tested and verified Squid 3.1.19 on Ubuntu 12.04.5.
• We have not tested auth-based proxies.

Review these points about certificate trust. You can choose the type of secure connection when you begin the main setup steps.