Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Deployment Guide for Cisco Webex Hybrid Call Service

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Deployment Guide for Cisco Webex Hybrid Call Service

Chapter Title

Deploy Hybrid Call Service for Webex Teams Users

Results

Updated:
July 22, 2019

Chapter: Deploy Hybrid Call Service for Webex Teams Users

Deploy Hybrid Call Service for Webex Teams Users

Hybrid Call Service Deployment Task Flow

With Hybrid Call Service deployed in your organization and enabled for your Webex Teams users, you get the following feature set:

Before you begin

Complete the Prerequisites for Hybrid Call Service


Note

After you've verified the prerequisites are met, you must perform all of the required configuration in this chapter, including Aware and Connect activation for users. Connect is the required activation state and Aware no longer supports any user features. These features may still work between Connect and Aware users, but are not supported and may stop working without advanced notice.

Procedure

  Command or Action Purpose
Step 1

Add and Verify Domains

Domain verification is essential to the security and integrity of your organization. Verification proves to us that you own a particular domain and is required for this service to work.

If your company has multiple domains, add each domain one at a time. For example, if you have users in sales.example.com and in support.example.com, you must add both domains.

If your organization enforces email addresses, you are presented with warnings about possible user lockout. You are forced to verify and remove domains in a particular order to prevent administrator lockout. When adding domains, for example, you must add the administrator domain first, followed by all other domains.

Step 2

Register Expressway-C Connector Hosts to the Cisco Webex Cloud

Cisco Webex Hybrid Services use software connectors to securely connect the Cisco Webex service to your organization's environment. Use Cisco Webex Control Hub to register your Expressway-C to the cloud. After you complete the registration steps, the connector software is automatically deployed on your on-premises Expressway-C (the software connector host).

Step 3

Configure an Application Account for Call Connector

Configure an administrator account with the required AXL access permissions. Call Connector uses this account to communicate with Cisco Unified Communications Manager, monitor any user's phone, and validate user configuration.

Step 4

Configure the Connection to Cisco Unified Communications Manager

Before you can enable Hybrid Call Service, you must link Call Connector to your Cisco Unified Communications Manager environment by entering server information for a single node. This step provides a secure bridge between Cisco Unified Communications Manager and the Cisco Webex cloud, with the connector acting as the broker between the two.

Step 5

Start the Call Connector

Manually enable the Call Connector after you register your Expressway-C for Cisco Webex Hybrid Services.

Step 6

Verify the Connector Status

Ensure that you correctly installed the Call Connector by viewing the status on the Expressway.

Step 7

Configure Cisco Unified Communications Manager Settings for Hybrid Call Service

Configure Cisco Unified Communications Manager to receive calls directly from Expressway-E. This configuration enables URI routing between the cloud and the on-premises enterprise. You'll create a cluster FQDN, which is the enterprise parameter that is used in SIP routing decisions and that helps identify multiple clusters so calls can occur between them.

Step 8

Perform one of the following tasks:

Configure Unified CM users so that their corresponding Cisco Webex Teams accounts in the cloud are activated with the correct call settings. Call Connector creates the remote destination on the user's Cisco Spark Remote Device after all the Unified CM settings are properly configured.

Step 9

Perform one of the following tasks:

Every Hybrid Call Service user requires a virtual device called a Cisco Spark Remote Device (Cisco Spark-RD). This virtual device is attached to a user's work number and links the user's Cisco Webex Teams account SIP identity to the enterprise SIP identity so that calls anchor on the Unified CM side or fork to the Cisco Webex cloud side. From a technical standpoint, the Cisco Spark-RD masks outbound calls from Cisco Webex and displays the user's work number for calls from the Cisco Webex Teams app. Incoming calls also ring both the user's Cisco Webex Teams app and desk phone.

To automate your configuration, on the Expressway-C connector host you can create Cisco Spark-RD for all your users in one step. The connector shows the remote device field values from your Cisco Unified Communications Manager, and then you can choose the values specific to your deployment. After the connector creates Cisco Spark-RDs, they are automatically moved to the users' control lists and their Cisco Webex SIP addresses are automatically created as remote destinations.

Step 10

Activate Hybrid Call Service for Your Organization

Use this procedure to begin the initial setup for Hybrid Call Service Connect in Cisco Webex Control Hub. These settings ensure that Hybrid Call Service Connect is first enabled for your organization before you do further configuration. You specify the desired subdomain for your company, and that setting creates Cisco Webex SIP addresses to identify users in the Cisco Webex cloud. Then, you toggle on Hybrid Call Service Connect for your organization. Last, you enter the SIP destination address which resolves to your Expressway-E in the call traversal pair. This entry is typically a DNS-SRV record which can resolve to multiple Expressway-Es.

Step 11

Add SIP Destinations to Hybrid Call Expressway Clusters

After you add a default SIP destination for Hybrid Call Service Connect, you can add more SIP destinations to specific hybrid call resources in Cisco Webex Control Hub. A single SIP destination means that all of the hybrid call traffic goes through a single Expressway-E or DNS SRV entry. You may want to add more SIP destinations and override the default entry so that you have more control over where the hybrid call traffic is routed.

Step 12

Configure the Expressway-E for Hybrid Call Service by following these tasks:

Enterprise calls are securely routed over the Expressway pair. If you want to reuse an existing pair, some of the required traversal configuration for Hybrid Call Service may already be in place. However, read the procedures that follow to ensure that Expressway-E and Expressway-C are correctly configured.

Step 13

Configure the Expressway-C for Hybrid Call Service by following these tasks:

Enterprise calls are securely routed over the Expressway pair. If you want to reuse an existing pair, some of the required traversal configuration for Hybrid Call Service may already be in place. However, read the procedures that follow to ensure that Expressway-E and Expressway-C are correctly configured.

Step 14

Enable Hybrid Call Service for Cisco Webex Teams Users

Enable Hybrid Call Service Connect for your users in Cisco Webex Control Hub—you can enable the service for individual users or in bulk.

Step 15

Restart the Call Connector from the Expressway-C

Disable and reenable the Call Connector, so that the connector captures Unified CM user and device configuration changes that you made while deploying Hybrid Call Service. During this restart cycle, the connector creates a remote destination with the Cisco Webex SIP address on the Cisco Spark Remote Device. This address is associated with end user accounts and the corresponding Webex Teams accounts. Toggle this setting as a troubleshooting step if you experience any issues, too.

Step 16

Test the Softphone Functionality for Hybrid Call Service

Use this procedure to test Hybrid Call Service call scenarios. These steps verify whether you correctly configured Hybrid Call Service and can help isolate any potential issues.

Register Expressway-C Connector Hosts to the Cisco Webex Cloud

Cisco Webex Hybrid Services use software connectors hosted on Expressway-C to securely connect Cisco Webex to your organization's environment. Use this procedure to register Expressway-C resources to the cloud.

After you complete the registration steps, the connector software is automatically deployed on your on-premises Expressway-C.

Before you begin

  • Make sure your Expressway-C is running on a version that's supported for hybrid services. See the Supported Versions of Expressway for Cisco Webex Hybrid Services Connectors documentation (https://collaborationhelp.cisco.com/article/ruyceab) for more information about which versions are supported for new and existing registrations to the cloud.

  • Sign out of any open connections to the Expressway-C interface that are open in other browser tabs.

  • If your on-premises environment proxies the outbound traffic, you must first enter the details of the proxy server on Applications > Hybrid Services > Connector Proxy before you complete this procedure. Doing so is necessary for successful registration.

    If you enter proxy information for call connector, the call connector automatically detects this configuration.

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Services, and then choose one:

  • If this is the first connector host you're registering, click Set up on the card for the hybrid service you're deploying, and then click Next.
  • If you've already registered one or more connector hosts, click View all on the card for the hybrid service you're deploying, and then click Add Resource.

The Cisco Webex cloud rejects any attempt at registration from the Expressway web interface. You must first register your Expressway through Cisco Webex Control Hub, because the Control Hub needs to hand out a token to the Expressway to establish trust between premises and cloud, and complete the secure registration.

Step 2

Choose a method to register the Expressway-C:

  • New Expressways—choose Register a new Expressway with its Fully Qualified Domain Name (FQDN), enter your Expressway-C IP address or fully qualified domain name (FQDN) so that Cisco Webex creates a record of that Expressway-C and establishes trust, and then click Next. You can also enter a display name to identify the resource in Cisco Webex Control Hub.
    Caution 

    To ensure a successful registration to the cloud, use only lowercase characters in the hostname that you set for the Expressway-C. Capitalization is not supported at this time.

  • Existing Expressways—choose Select an existing Expressway cluster to add resources to this service, and then choose the node or cluster from the drop-down that you previously registered. You can use it to run more than one hybrid service.
Tip 

If you're registering a cluster, register the primary peer. You don't need to register any other peers, because they register automatically when the primary registers. If you start with one node set up as a primary, subsequent additions do not require a system reboot.

Step 3

Click Next, and for new registrations, click the link to open your Expressway-C. You can then sign in to load the Connector Management window.

Step 4

Decide how you want to update the Expressway-C trust list:

A check box on the welcome page determines whether you will manually append the required CA certificates to the Expressway-C trust list, or whether you allow Cisco Webex to add those certificates for you.

Choose one of the following options:

  • Check the box if you want Cisco Webex to add the required CA certificates to the Expressway-C trust list.

    When you register, the root certificates for the authorities that signed the Cisco Webex cloud certificates are installed automatically on the Expressway-C. This means that the Expressway-C should automatically trust the certificates and be able to set up the secure connection.

    Note 

    If you change your mind, you can use the Connector Management window to remove the Cisco Webex cloud CA root certificates and manually install root certificates.

  • Uncheck the box if you want to manually update the Expressway-C trust list. See the Expressway-C online help for the procedure.
    Caution 

    When you register, you will get certificate trust errors if the trust list does not currently have the correct CA certificates. See Certificate Authorities for Hybrid Services.

Step 5

Click Register. After you're redirected to Cisco Webex Control Hub, read the on-screen text to confirm that Cisco Webex identified the correct Expressway-C.

Step 6

After you verify the information, click Allow to register the Expressway-C for Cisco Webex Hybrid Services.

  • Registration can take up to 5 minutes depending on the configuration of the Expressway and whether it's a first-time registration.

  • After the Expressway-C registers successfully, the Cisco Webex Hybrid Services window on the Expressway-C shows the connectors downloading and installing. The management connector automatically upgrades itself if there is a newer version available, and then installs any other connectors that you selected for the Expressway-C connector host.

  • Each connector installs the interface pages that you need to configure and activate that connector.

    This process can take a few minutes. When the connectors are installed, you can see new menu items on the Applications > Hybrid Services menu on your Expressway-C connector host.

Troubleshooting Tips

If registration fails and your on-premises environment proxies the outbound traffic, review the Before You Begin section of this procedure. If the registration process times out or fails (for example, you must fix certificate errors or enter proxy details), you can restart registration in Cisco Webex Control Hub.

What to do next

If you want to add resources for specific geographies, return to View all > Add Resource from the Hybrid Call card and repeat the above steps to register more Expressway resources to the Cisco Webex cloud.

Certificate Authorities for Hybrid Services

The table lists the Certificate Authorities that your on-premises or existing environment must trust when using Cisco Webex Hybrid Services.

If you opted to have Cisco Webex manage the required certificates, then you do not need to manually append CA certificates to the Expressway-C trust list.


Note

The issuers used to sign the Cisco Webex host certificates may change in future, and the table below may then be inaccurate. If you are manually managing the CA certificates, you must append the CA certificates of the issuing authorities that signed the currently valid certificates for the hosts listed below (and remove expired/revoked CA certificates).

Cloud hosts signed by this CA

Issuing CA

Must be trusted by

For this purpose

CDN

 O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root

Expressway-C

To ensure Expressway downloads connectors from a trusted host

Common identity service

O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority

Windows Server 2003 or Windows Server 2008 hosting the Cisco Directory Connector

Expressway-C

To synchronize users from your Active Directory with Cisco Webex and to authenticate Cisco Webex Hybrid Services users

Cisco Webex

O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority

Expressway-C

Configure an Application Account for Call Connector

Configure an administrator account with the required AXL access permissions. Call Connector uses this account to communicate with Cisco Unified Communications Manager, monitor any user's phone, and validate user configuration.

Procedure

Step 1

From Cisco Unified CM Administration, go to User Management > Application User, and then choose one:

  • Click Find and, from the list, choose the administrator account that the connector will use to communicate with Cisco Unified Communications Manager.
  • Click Add New to create a new application user account.
Step 2

Configure the account with the Standard AXL API Access role.

Step 3

Click Save.

What to do next

Start the Call Connector

Configure the Connection to Cisco Unified Communications Manager

To enable Hybrid Call Service, you must link Call Connector to your Cisco Unified Communications Manager environment by entering server information for a single node. This step provides secure bridge between Cisco Unified Communications Manager and the Cisco Webex cloud, with the connector acting as the broker between the two.

Before you begin

  • Configure an Application Account for Call Connector

  • For each cluster in your call environment, you must only enter server information in the connector for a single Cisco Unified Communications Manager node. The node doesn't have to be primary, but enter one that is enabled for AXL Web Service and Cisco CallManager Serviceability.

  • The connector on Expressway maintains a resilient connection between your cluster and the cloud. The connector is aware of all the server nodes in your cluster, so you only need to add 1 node to the Expressway-C connector host. If a specific node goes down in the cluster, the connector will move to another server.

Procedure

Step 1

From Expressway-C, go to Applications > Hybrid Services > Call Service > Unified CM Servers, and then click New.

Step 2

Enter the hostname or IP address of a single Cisco Unified Communications Manager node on which Cisco AXL Web Service and Cisco CallManager Serviceability are enabled.

Step 3

Enter the credentials of the Call Connector account that you configured for Call Connector to connect to Cisco Unified Communications Manager.

Enter a single node per cluster. The connector will automatically discover the other nodes in a cluster environment and identify those that can service AXL requests.

Step 4

Click Verify Credentials to test the connection and authentication for the provided credentials.

After the page refreshes, a new Hybrid Call Service Connect Configuration section appears.
Step 5

After the connection test is successful, click Add to store the connector configuration on the Expressway-C.

What to do next

Start the Call Connector

Start the Call Connector

Manually enable the Call Connector after you register your Expressway-C for Cisco Webex Hybrid Services.

Before you begin

Configure the Connection to Cisco Unified Communications Manager

Procedure

Step 1

From Expressway-C, go to Applications > Hybrid Services > Connector Management, and then click Call Connector.

Step 2

Choose Enabled from the Active drop-down list.

Step 3

Click Save.

The connector starts and the status changes to Running on the Connector Management window.

Verify the Connector Status

Before you enable your users for Hybrid Call Service, ensure that you correctly installed the Call Connector.

Procedure

From Expressway-C, go to Applications > Hybrid Services > Call Service > Call Connector Status, and then verify the configuration items in the Status column.

Configure Cisco Unified Communications Manager Settings for Hybrid Call Service

Configure Cisco Unified Communications Manager to receive calls directly from Expressway-E. This configuration enables URI routing between the cloud and the on-premises enterprise. You'll create a cluster FQDN, which is the enterprise parameter that is used in SIP routing decisions and that helps identify multiple clusters so calls can occur between them.

Before you begin

Procedure

Step 1

From Cisco Unified CM Administration on your publisher node, go to System > Enterprise Parameters, scroll to Clusterwide Domain Configuration, and then check the value for the Cluster Fully Qualified Domain Name field.

Step 2

If the field is empty or the field contains domain entries with wildcards, enter a new value that is specific to Hybrid Call Service that follows these guidelines:

FQDN Guideline

Description and Example

Multiple clusters

The entry must be unique for each cluster—For example, cluster1.example.com, cluster2.example.com, and so on.

No wildcards

Do not use entries with wildcards, such as *.example.com or example*.com.

First FQDN entry for Hybrid Call Service

In a list of multiple entries, the Cisco Webex cloud uses the first entry on the left for Hybrid Call Service, and that first entry must not contain a wildcard.

See this example of three FQDN entries from left to right (the first one being for Hybrid Call Service): cluster1.example.com *.example.com example*.com

Different from Expressway-E

Must be different from the Expressway-E system, DNS, and domain name. Otherwise, Expressway-E strips the route header.

New entry for Hybrid Call Service

If your current FQDN entry in Unified CM doesn't meet the requirements listed above, you can add a new element to the beginning of the cluster FQDN setting for Hybrid Call Service

For example, if your existing FQDN setting in Cisco Unified Communications Manager is *.example.com *.example.org, add a unique, non-wildcard entry at the beginning of the field: "cluster1.example.com *.example.com *.example.org"

You are not required to restart Cisco Unified Communications Manager or services for a cluster FQDN change to take effect.

Step 3

Record or write down the name of the FQDN value that you want to use for Hybrid Call Service. You need it for this procedure: Configure Search Rules on Expressway-C (to Unified CM).

Step 4

Go to Device > Device Settings > SIP Profile to create a new SIP profile that is based on the Standard SIP Profile For Cisco VCS template.

  1. Click Find, choose Standard SIP Profile For Cisco VCS, and then click Copy.

  2. Enter a name for the new profile—for example, Standard SIP Profile for Cisco Webex Hybrid Calling.

  3. Scroll to Trunk Specific Configuration, and then set Early Offer support for voice and video calls to Best Effort (no MTP inserted).

    You can apply this setting to a new SIP trunk to the Cisco Webex cloud (routed by external domain webex.com). The setting does not affect any existing SIP trunking or call routing.

  4. Leave all other fields with their default values and save your changes.
Step 5

(Optional) If your Expressway pair runs MRA or B2B, go to System > Security > SIP Trunk Security Profile and create a new SIP trunk security profile for Cisco Webex Hybrid Services.

  1. Enter a name for the new profile that is related to Cisco Webex or Hybrid Call Services—for example, SIP Trunk Security Profile for Cisco Webex Hybrid Calling.

  2. Leave the Enable Digest Authentication check box unchecked.

  3. Do not set the incoming port value to 5061. Instead, change to an appropriate alternative—We recommend 5561.

    We recommend that you use TLS. This setting doesn't require Unified CM to be in mixed mode. In this case, you must specify the following:

    • Transport type—TLS instead of TCP/UDP

    • X.509 Subject Name—Must match one of the Subject Alternative Names (SANs) of the Expressway-C.

  4. Leave all other fields with their default values and save your changes.
Step 6

Go to Device > Trunk to create a new SIP trunk to the Expressway-C, and then link the Cisco Webex SIP profile to this trunk.

  1. Choose SIP Trunk as the trunk type; leave the other settings, and click Next.

  2. Configure these settings and leave the defaults for any settings not mentioned:

    Field Name

    Value

    Name

    Hybrid_Calling_SIP_Trunk (for example)

    Device Pool

    Choose a device pool that contains the device-specific settings that you want the SIP trunk to inherit.

    Calling and Connected Party Info Format

    Deliver URI and DN in connected party, if available

    This setting enables blended identity. It allows the SIP trunk to transmit the enterprise-side party's directory URI to Cisco Webex.

    The directory URI is what allows the cloud to match the enterprise end user to Webex Teams user account. This match enables parallel ringing on the user's enterprise devices and Webex Teams.

    Note 

    You must also apply this setting on any intercluster trunks within your organization and SIP trunks to any organizations that you want to work with Hybrid Call Service.

    Destination Address

    Enter the Expressway-C node addresses in the fields.

    SIP Profile

    Standard SIP Profile for Cisco Webex Hybrid Calling (for example)

  3. Save your changes.
Step 7

Go to Call Routing > SIP Route Pattern to create a pattern that matches the Cisco Webex SIP address IPv4 pattern.

Field Name

Value

IPv4 Pattern

*.webex.com

Pattern Usage

Domain Routing

Description

Routing to Cisco Webex

Route Partition

Choose a route partition to contain this SIP route pattern. You must also include the same partition in the rerouting calling search space (CSS) of the Cisco Spark-RD.

(We do not recommend using the <None> partition.)

SIP Trunk/Route List

Choose the trunk you created—Hybrid_Calling_SIP_Trunk (for example)

SIP Profile

Standard SIP Profile for Cisco Webex Hybrid Calling (for example)

Example

Combine Hybrid Call Service with other solutions, such as B2B and MRA

  • You can run Cisco Webex hybrid calls, B2B calls, and MRA calls across the same Expressway.

  • If MRA is set up on your Expressway: For the trunk that you create for Cisco Webex, use a port other than 5060/5061 on Cisco Unified Communications Manager. This setup avoid conflicts with MRA calls and device registrations. On Cisco Unified Communications Manager, set up the Device Security Profile for your Cisco Webex trunk to use a port other than 5060 or 5061.

  • If B2B is set up on your Expressway: You can reuse your existing B2B trunks between Cisco Unified Communications Manager and Expressway for Cisco Webex hybrid calls. If you want to run B2B calls and Cisco Webex hybrid calls on separate trunks between the Expressway-C and Cisco Unified Communications Manager, you cannot run TLS on both trunks at the same time. See this bug overview for more information.

  • If any of your Cisco Webex Hybrid Calling traffic goes over B2B, you must preserve the SIP parameters on all zones for all Expressways that are involved in call routing to and from the enterprise.

What to do next

Prepare Cisco Unified Communications Manager User Accounts for Hybrid Call Service

Prepare Cisco Unified Communications Manager User Accounts for Hybrid Call Service

Configure Unified CM users so that their corresponding Cisco Webex Teams accounts in the cloud are activated with the correct call settings. Call Connector creates the remote destination on the user's Cisco Spark Remote Device after all the Unified CM settings are properly configured.

Before you begin

Use this diagram to understand the required fields for Hybrid Call Service:

Figure 1. Required Unified CM User Fields for Hybrid Call Service

Note

If you use LDAP synchronization in your Unified CM deployment, some of this user configuration may already be complete.

Procedure

Step 1

From Cisco Unified CM Administration, go to User Management > End Users, choose any criteria, click Find, and then open the user account that you want to configure.

Step 2

Verify that the user has a valid Directory URI that contains the same domain as your organization.

Step 3

Verify that Mail ID contains the user's email address.

Step 4

Under the user's Service Settings, check the Home Cluster checkbox.

Configure this setting on the Cisco Unified Communications Manager where each user is homed and where their devices are registered.

The user only requires a Cisco Spark-RD at a minimum to be activated for Hybrid Call Service.

Note 

If Cisco Spark-RD is the user's only device, you must configure the desired Call Forward Busy (CFB) destination (for example, Unity Connection) for when a hybrid call is declined in the Cisco Webex Teams app.

When you set up Hybrid Call Service, you cannot activate a user with only an Extension Mobility profile and no associated device. For a user who is associated to a device (including a Cisco Spark-RD) and has an Extension Mobility profile, Hybrid Call Service activates and should work.

Step 5

(Optional) To associate a line appearance to an end user for presence and to enable the on-the-phone status information to IM and Presence clients when this line appearance is off-hook, click Line Appearance Association from Presence. The Line Appearance Association for Presence window appears from where you can choose product type, device name, directory, partition, or description. The choices available in this window depend on the lines associated with the controlled devices. Click Save.

Step 6

Return to the user account, scroll to Directory Number Associations, and then set the primary extension to the user's directory number.

Before you enable Webex Teams users for Hybrid Call Service, make sure that the user's associated Directory Number Alerting Name and ACSII Alerting Name are no more than 30 characters in length. The names can only contain letters, numbers, spaces, and the following special characters: !#$'()*+,./:;=?@^_
Step 7

Save your changes.
Step 8

If you created Cisco Spark-RD automatically from the call connector, set the primary extension to a directory number, and then save your changes.

Configure Cisco Spark-RD Automatically from the Call Connector

Every Hybrid Call Service user requires a virtual device called a Cisco Spark Remote Device (Cisco Spark-RD). This virtual device is attached to a user's work number and links the user's Cisco Webex Teams account SIP identity to the enterprise SIP identity so that calls anchor on the Unified CM side or fork to the Cisco Webex cloud side. From a technical standpoint, the Cisco Spark-RD masks outbound calls from Cisco Webex and displays the user's work number for calls from the Cisco Webex Teams app. Incoming calls also ring both the user's Cisco Webex Teams app and desk phone.

To automate your configuration, on the Expressway-C connector host you can create Cisco Spark-RD for all your users in one step. The connector shows the remote device field values from your Cisco Unified Communications Manager, and then you can choose the values specific to your deployment. After the connector creates Cisco Spark-RDs, they are automatically moved to the users' control lists and their Cisco Webex SIP addresses are automatically created as remote destinations.

Before you begin

  • Cisco Spark-RD is required for your hybrid deployment. For manual and automatic creation on a supported release, you must use Cisco Spark-RD for new activations.

  • If you choose automatic configuration, a new remote device (CTI or Cisco Spark-RD) and remote destination is created when the new user is activated in https://admin.webex.com.

  • CTI-RDs created with an earlier release must be migrated over to Cisco Spark-RD. You can use a conversion tool on the Call Connector to transition existing CTI-RD to Cisco Spark-RD. See Tool to Migrate CTI-RD to Cisco Spark-RD.

Procedure

Step 1

From the Expressway-C connector host, go to Applications > Hybrid Services > Call Service > Unified CM Servers, and then the Cisco Unified Communications Manager node that you configured.

Step 2

For Spark Remote Device Configuration Type, choose Automatic.

Caution 

When using automatic remote device configuration, do not manually create a remote device and add the Cisco Webex SIP address as a remote destination.

Step 3

Choose values from the prepopulated lists for the Device Pool, Location, Calling Search Space, and Reroute Calling Search Space.

These settings are shared across all of the automatically created Cisco Spark-RD. Read these documents to understand the settings:

  • Device pools

  • Locations

  • Calling search spaces

    Note 

    • For Cisco Spark-RD, the CSS is used for outbound calls initiated by the Cisco Webex Teams app to enterprise phones or the PSTN.

      The Rerouting CSS determines the route to remote destinations of the Cisco Spark-RD. This CSS must include the partition that contains the SIP route pattern for the Cisco Webex cloud. It does not need any other partitions.

    • The calling search space must be able to route to the partition of the PSTN gateway or trunk, and any other destinations that you want your Cisco Webex Teams users to be able to reach (conference bridges, enterprise-to-enterprise trunks, and so on).

Step 4

Click Add to automatically create the Cisco Spark-RD.

Manually Create a Cisco Spark-RD and Associate it with a Unified CM User

Every Hybrid Call Service user requires a virtual device called a Cisco Spark Remote Device (Cisco Spark-RD). This virtual device is attached to a user's work number and links the user's Cisco Webex Teams account SIP identity to the enterprise SIP identity so that calls anchor on the Unified CM side or fork to the Cisco Webex cloud side. From a technical standpoint, the Cisco Spark-RD masks outbound calls from Cisco Webex and displays the user's work number for calls from the Cisco Webex Teams app. Incoming calls also ring both the user's Cisco Webex Teams app and desk phone.

The Call Connector's automatic option applies the same set of device pool, location, and calling search space to all devices. This option may not be ideal for a large scale deployment. Use the manual device creation method if you need to specify different settings in some of the remote devices.

Before you begin

  • Follow the remote device creation steps only if you didn't automatically create remote devices from the connector on the Expressway-C connector host.

  • A user can have multiple remote devices, but only one can be in the list of controlled devices for Cisco Webex purposes.

  • Whether you manually or automatically create remote devices, Call Connector will automatically create the remote destination, which contains the user's Cisco Webex SIP address.

Procedure

Step 1

From the Expressway-C connector host, go to Applications > Hybrid Services > Call Service > Unified CM Servers, and then the Cisco Unified Communications Manager node that you configured.

Step 2

For Spark Remote Device Configuration Type, choose Manual, and then click Save.

Step 3

From Cisco Unified CM Administration, go to Device > Phone, then Add New, and then choose Cisco Webex Remote Device.

Step 4

For Owner User ID, specify the user who you are configuring.

The Device Name is automatically created after you choose the user account. If you see an error, you may have to manually shorten the device name.

Note 

A manually created Cisco Spark-RD must be 15 characters or less. If the device name is 15 characters or more, the user remains in a pending activation state.

Step 5

For line association, specify the user’s primary extension (the user’s shared line).
Step 6

Ensure that the partition used by the SIP route pattern is listed in the remote device's rerouting calling search space (CSS). The route from the remote device to the SIP trunk happens through the rerouting CSS.

Use these documents to understand the settings that the remote device uses:
Note 

  • For Cisco Spark-RD, the CSS is used for outbound calls initiated by the Cisco Webex Teams app to enterprise phones or the PSTN.

    The Rerouting CSS determines the route to remote destinations of the Cisco Spark-RD. This CSS must include the partition that contains the SIP route pattern for the Cisco Webex cloud. It does not need any other partitions.

  • The calling search space must be able to route to the partition of the PSTN gateway or trunk, as well as any other destinations that you want Cisco Webex Teams users to be able to reach (conference bridges, enterprise-to-enterprise trunks, and so on).

Step 7

Save your changes.
Step 8

From Cisco Unified CM Administration, go to User Management > End User, and then open the user's account.

Step 9

Under Device Information, click Device Association.

Step 10

Specify any search criteria and click Find.

Step 11

Check the remote device that you created, and then save your changes.

The remote device is associated to the user and is added to the controlled devices list. The Cisco Webex SIP address is automatically created as the remote destination.

Activate Hybrid Call Service for Your Organization

Use this procedure to begin the initial setup for Hybrid Call Service Connect in Cisco Webex Control Hub. These settings ensure that Hybrid Call Service Connect is first enabled for your organization before you do further configuration. You specify the desired subdomain for your company, and that setting creates Cisco Webex SIP addresses to identify users in the Cisco Webex cloud. Then, you toggle on Hybrid Call Service Connect for your organization. Last, you enter the SIP destination address which resolves to your Expressway-E in the call traversal pair. This entry is typically a DNS-SRV record which can resolve to multiple Expressway-Es.

Before you begin

  • You must complete all prerequisites in the Prepare Your Environment chapter and all the required deployment steps in this chapter before you can activate Hybrid Call Service. Otherwise, the Call Service Connect activation button will be greyed out.

If you have multiple Expressway-Es for redundancy, we recommend that you create a dedicated DNS-SRV record with a subdomain specifically for the mutual TLS port on Expressway-E. For Hybrid Call Service, the secure mutual TLS connection is a requirement for the Expressway-E and cloud to trust each other.

Procedure

Step 1

From the customer view in https://admin.webex.com, perform one of the follow steps:

  • From the first-time setup wizard for a new organization, choose Enterprise Settings
  • For an existing Cisco Webex organization, go to Settings, and then scroll to Cisco Webex SIP Addresses.
Step 2

Follow the on-screen instructions to configure a custom SIP subdomain for your organization.

This subdomain value creates individual Cisco Webex SIP addresses for each user and Webex-registered device. The addresses are used to receive calls from any standards-based SIP calling service. See Cisco Webex SIP Addresses for more information.

Step 3

Go to Services, and then click Settings on the Hybrid Call card.

Step 4

Scroll to Call Service Connect, and then click Activate to enable the service for your organization.

Tip 

At this point, you can view the prerequisites in Control Hub before activation to make sure your environment is ready.
Caution 

If the Connect activation button is not available, you missed necessary configuration. Make sure you start over and follow all the prerequisites in the Prepare Your Environment chapter and every deployment step in this chapter.

Step 5

Scroll to the Default SIP Destination field on the same page, and then enter a network value that resolves to your Expressway-E and the SIP mutual TLS port.

Enter a network value using one of these formats:

Address Format

Example Of Value to Enter (In Bold)

SRV domain

_sips._tcp.sipmtls.example.com

Hostname/FQDN:port

example.com:5062

IP address:port

203.0.113.0:5062

For multiple IP address entries, you must use the DNS SRV record method.

Tip 

The SRV record can take time to request. If you want to start a trial or pilot, you can use hostname:port for a single Expressway-E so that you can proceed with the setup steps. You can modify this setting later and use the SRV record when that becomes available.

Step 6

Click Test to run a tool that checks that it can connect to the Expressway-E SIP destination you entered.

The tool initiates a TLS connection to that address. The results indicate whether the Expressway-E is reachable and secure.

Note 

If you're a partner sales administrator, you can run this test on behalf of your customer.
Step 7

After the test shows the results, click View test results to get more details on what the test ran and the outcomes.

The results show the type of lookup (such as DNS SRV), FQDN, IP address, and the specific connection tests such as a socket connection, SSL handshake with the Expressway-E, and a SIP OPTIONS ping. If any tests fail, the tool shows suggested steps to troubleshoot the issue. See Hybrid Connectivity Test Tool (Control Hub) for more information.

Step 8

Save your changes.
Step 9

(Optional) If you have your own certificates, check Upload your own certificate, and then browse to and upload self-signed custom certificates that you want to use instead of the Webex default trust list.

We recommend that you For more information about manual certificate management, see Custom Certificates for Mutual TLS Authentication between Expressway-E and the Cloud.

Add SIP Destinations to Hybrid Call Expressway Clusters

A single SIP destination means that all of the hybrid call traffic goes through a single Expressway-E or DNS SRV entry. You may want to add more SIP destinations to override the default entry so that you have more control over where the hybrid call traffic is routed. After you add a default SIP destination for Hybrid Call Service Connect, you can add more SIP destinations to individual hybrid call clusters in Cisco Webex Control Hub.

Before you begin

Finish registration of any new or existing Call Connector resources by using these steps: Register Expressway-C Connector Hosts to the Cisco Webex Cloud

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Services, and then click View all from the Hybrid Call card.

Step 2

Click the resource, and then click Edit cluster settings.

Step 3

Scroll to Cluster > Default SIP Destination Override, choose Configure a SIP Destination for the cluster, and then enter a network value that resolves to your Expressway-E and the SIP mutual TLS port.

Enter a network value using one of these formats:

Address Format

Example Of Value to Enter (In Bold)

SRV domain

_sips._tcp.sipmtls.example.com

Hostname/FQDN:port

example.com:5062

IP address:port

203.0.113.0:5062

For multiple IP address entries, you must use the DNS SRV record method.

Tip 

The SRV record can take time to request. If you want to start a trial or pilot, you can use hostname:port for a single Expressway-E so that you can proceed with the setup steps. You can modify this setting later and use the SRV record when that becomes available.

Step 4

Click Test to run a tool that checks that it can connect to the Expressway-E SIP destination you entered.

The tool initiates a TLS connection to that address. The results indicate whether the Expressway-E is reachable and secure.

Note 

If you're a partner sales administrator, you can run this test on behalf of your customer.
Step 5

After the test shows the results, click View test results to get more details on what the test ran and the outcomes.

The results show the type of lookup (such as DNS SRV), FQDN, IP address, and the specific connection tests such as a socket connection, SSL handshake with the Expressway-E, and a SIP OPTIONS ping. If any tests fail, the tool shows suggested steps to troubleshoot the issue. See Hybrid Connectivity Test Tool (Control Hub) for more information.

Step 6

Save your changes.

What to do next

Repeat these steps to associate more SIP destinations with specific Call Connector clusters. (Any clusters that don't have a SIP destination continue to use the default one that you initially configured.)

Restart the Call Connector from the Expressway-C

Disable and reenable the Call Connector, so that the connector captures Unified CM user and device configuration changes that you made while deploying Hybrid Call Service. During this restart cycle, the connector creates a remote destination with the Cisco Webex SIP address on the Cisco Spark Remote Device. This address is associated with end user accounts and the corresponding Webex Teams accounts. Toggle this setting as a troubleshooting step if you experience any issues, too.

When you upgrade your Unified CM an environment with hybrid services and Webex Teams, information that is cached in the Call Connector might be stale. In this case, the affected items are the automatic synchronization of the database cache or reporting the new Unified CM version to the Webex cloud. Restart the Call Connector to select the latest information in the new database and also publish the new Unified CM version information to the Webex cloud services.

Before you begin


Caution

Restarting the Call Connector creates extra load on Unified CM publishers. Consider restarting the Call Connector during off-peak hours; during busy hours, a restart may cause service issues.

Procedure

Step 1

From Expressway-C, go to Applications > Hybrid Services > Call Service > Call Service Overview, change the call connector status to Disabled, and then click Save.

Step 2

Change the status back to Enabled, and then save again.

Troubleshooting Tips

Later, you may need to change to Unified CM end users or devices. If you do this to fix a configuration error, even if the call connector's "user validation test" passes for that user, you must restart Call Connector so that it selects the configuration change.

Things to Keep in Mind About Unified CM Cache

Call Connector maintains a cache of Unified CM data, so that AXL requests have limited performance impact on Unified CM nodes during user discovery and activation.

Cached data includes:

  • Users

  • Devices (including user associations)

  • Directory numbers (including line appearances, user association, URIs)

  • Remote Destinations

Call Connector uses change notifications on the publisher nodes to pull new user data. The poll interval is every 2 minutes. Because of limitations with Unified CM change notifications, the cache is rebuilt every night at 11 pm local time or upon Call Connector restart.

Check Your User Configuration for Cisco Webex Hybrid Call Service

With the user validation check, you can check whether Cisco Unified Communications Manager users are properly configured for Hybrid Call Service. The test checks all the configuration prerequisites, such as email, directory URI, and Cisco Spark Remote Device settings. To assist with your configuration or troubleshooting, you can save any user errors or warnings as a CSV file.

To prevent activation errors, we recommend that you run this test and address any configuration issues before you activate users for Hybrid Call Service in Cisco Webex Control Hub.

Before you begin

Configure the Connection to Cisco Unified Communications Manager

Procedure

Step 1

From the Expressway-C connector host, choose Applications > Hybrid Services > Call Service > Unified CM Servers, and choose the registered Cisco Unified Communications Manager that you want to check.

Step 2

Perform one of the following steps:

  • Upload a CSV file of a user list if you want to check the configuration of specific user accounts, and then click Run (Specific User List).
  • Click Run (All Users) to check the configuration of all the user accounts registered to the Cisco Unified Communications Manager.

A report appears with user accounts that contain configuration errors or warnings.
Step 3

Save the information as a CSV file and use it as a checklist to fix user and system settings in Cisco Unified Communications Manager.

Step 4

Address any configuration issues in the Cisco Unified Communications Manager device and user settings.

What to do next

Verify the Connector Status

Configure the Expressway-E for Hybrid Call Service

Enterprise calls are securely routed over the Expressway pair. If you want to reuse an existing pair, some of the required traversal configuration for Hybrid Call Service may already be in place. However, read the procedures that follow to ensure that Expressway-E and Expressway-C are correctly configured.

Procedure

  Command or Action Purpose
Step 1

Update the Expressway-E Trust List with Cisco Webex Cloud Certificates

Your Expressway-E must trust the certificate issuer of the server certificates that are passed by the server during the client/server SSL handshake with the Cisco Webex cloud. To establish this trust, you must add these certificates to the trusted CA list on your Expressway-E.

Step 2

Perform one of the following tasks, depending on your configuration:

Set up a mutual TLS port as part of establishing a trusted connection between your on-premises and the cloud. From a technical standpoint, Hybrid Call Service SIP uses mutual TLS between the Expressway-E and Cisco Webex, so each side authenticates the other. This behavior requires valid and verifiable certificate and trust configuration on both sides.

Step 3

Create an Automatic Webex DNS Zone (Expressway-E to the Cisco Webex Cloud)

The DNS zone allows your Expressway-E to identify and route calls between Cisco Unified Communications Manager and the Cisco Webex cloud. The DNS zone is used because a secure mutual TLS connection between the cloud and Expressway-E is required to map the appropriate domains.

The Webex Zone pre-configures the zone with the correct settings for Hybrid Call Service.

Step 4

Configure a Secure Traversal Server Zone from Expressway-E to Expressway-C

If you already have a traversal zone pair (typically for business-to-business (B2B) calling) or Unified Communications traversal zone pair (typically for Mobile and Remote Access (MRA)), or both, then we recommend that you create a separate traversal zone pair for Hybrid Call Service.

Step 5

Create Inbound and Outbound Search Rules on Expressway-E

Search rules define how the Expressway routes calls (to destination zones) in specific call scenarios. When a search rule is matched, the destination alias can be modified according to the conditions defined in the search rule. Create search rules on Expressway-E to:

  • Identify calls from the Cisco Webex cloud and route down the traversal zone to Expressway-C.

  • Identify calls from Cisco Unified Communications Manager and route through the DNS zone to Cisco Webex.

Update the Expressway-E Trust List with Cisco Webex Cloud Certificates

Your Expressway-E must trust the certificate issuer of the server certificates that are passed by the server during the client/server SSL handshake with the Cisco Webex cloud. To establish this trust, you must add these certificates to the trusted CA list on your Expressway-E.

Before you begin

If you don't have an existing Expressway pair deployed, read the following documents to design your new Expressway pair to work together:

Procedure

  Command or Action Purpose
Step 1

From Expressway-E, go to Applications > Cloud Certificate management.

Step 2

Click Get certificates for the cloud to automatically add and manage the certificates.

Step 3

To verify the added certificates, go to Maintenance > Security certs > Trusted CA certificate to view the entries that were added.

Configure Call Processing Language Rules on Expressway-E

If Expressway-C and Expressway-E run both Hybrid Call Service and mobile and remote access (MRA) traffic, but no business-to-business traffic, the system must reject any SIP message not generated by MRA endpoints or Cisco Webex Hybrid Services.

You can create Call Processing Language (CPL) rules to mitigate fraudulent call attempts. We recommend doing this for toll fraud mitigation.

If business-to-business traffic is not included in the same Expressway, and because this traffic enters from the default zone, the following CPL rule will prevent any fraudulent access to Expressway-E.

Procedure

Step 1

From Expressway-E, go to Configuration > Call Policy > Configuration, set Call Policy mode to Local CPL, and then click Save.

Step 2

Go to Configuration > Call Policy > Rules, click New.

This opens the Add Call Policy rule page.

Step 3

Configure the following settings:

Field

Setting

Source type

From address

Rule applies to

Unauthenticated callers

Source pattern

.*@example\.calls\.webex\.com.*, where example is your company's subdomain.

Destination pattern

.*

Action

Reject
Step 4

Click Add to save this new rule.

Step 5

(Optional) In case TLS must be set to On, or B2BUA must be engaged on Expressway-E for some unknown reason, create the following CPL rule to block any TLS call from the Default Zone.

This step is not needed if TLS is switched off.

  1. From Expressway-E, go to Configuration > Call Policy > Configuration, set Call Policy mode to Local CPL, and then click Save.

  2. From related tasks, go to Edit Call Policy rules.

  3. Click New.

  4. Configure the following settings:

    Field

    Setting

    Source type

    Zone

    Originating Zone

    DefaultZone

    Destination pattern

    .*

    Action

    Reject

  5. Click Add to save this new rule.

Configure Services and Mutual TLS Authentication Between a New Expressway-E and the Cisco Webex Cloud

If Expressway-C and Expressway-E are dedicated to Hybrid Call Service, or more generally to Cloud services using Mutual TLS only (such as Hybrid Services and CMR Hybrid), you don't require H.323, SIP UDP, SIP TCP and SIP TLS on Expressway-E.

Before you begin

Procedure

Step 1

From Expressway-E, go to Configuration > Protocols > H.323, and then set H.323 mode to Off, and then save your changes.

Step 2

Go to Configuration > Protocols > SIP, and then configure these settings:

Field Name

Value

Configuration

SIP mode

On

UDP mode

Off

UDP port

5060

TCP mode

Off

TCP port

5060

TLS mode

On

TLS port

5061

Mutual TLS mode

On

Mutual TLS port

5062

TCP outbound port start

25000

TCP outbound port end

29999

Session refresh interval (seconds)

1800

Minimum session refresh interval (seconds)

500

TLS handshake timeout (seconds)

5

Certificate revocation checking

Certificate revocation checking mode

Off

Registration controls

Standard registration refresh strategy

Maximum

Standard registration refresh minimum (seconds)

45

Standard registration refresh maximum (seconds)

60

Outbound registration refresh strategy

Variable

Outbound registration refresh minimum (seconds)

300

Outbound registration refresh maximum (seconds)

3600

SIP registration proxy mode

Off

Authentication

Delegated credential checking

Off

Advanced

SDP max size

32768

SIP TCP connect timeout

10
Step 3

Click Save.

Step 4

Go to Configuration > Zones > Zones, and then click DefaultZone.

Step 5

Configure the following fields:

Field Name

Value

Policy

Authentication mode

Do not check credentials

SIP

Media encryption mode

Auto

ICE support

Off

Multistream mode

On

Enable Mutual TLS on Default Zone

On

This setting enables mutual TLS (Mutual Transport Layer Security) on the dedicated mutual TLS port 5062 on incoming connections through the Default Zone.

Step 6

Click Save.

Configure Services and Mutual TLS Authentication Between an Existing Expressway-E and the Cisco Webex Cloud

Expressway-E can be shared between mobile and remote access (MRA), business-to-business (B2B), and Cisco Webex Hybrid Call Service media traffic. If Expressway is used for B2B traffic, turn off those services that are not needed. H.323 is a signaling protocol that doesn't allow for encryption and should be switched off if it's not critical for the company. SIP UDP must be switched off for security reasons. This change won't affect the calling scenarios, because only SIP endpoints with IP dialing use SIP UDP. Endpoints that are involved with IP dialing are typically H.323-based. SIP TCP should be switched off if it's not critical for the company.

Before you begin

Procedure

Step 1

From Expressway-E, go to Configuration > Protocols > H.323, and then set H.323 mode to Off, unless this setting is critical for your organization.

Step 2

Go to Configuration > Protocols > SIP, and then configure these settings:

Field Name

Value

SIP mode

On

UDP mode

Off

TCP mode

Off, if possible. If this breaks services such as B2B, set it back to On.

TLS mode

On

Mutual TLS mode

On

Mutual TLS port

5062
Step 3

Click Save.

Step 4

Go to Configuration > Zones, and then click Default zone.

Step 5

Set Enable Mutual TLS on Default Zone to Off.

Step 6

Click Save.

Create an Automatic Webex DNS Zone (Expressway-E to the Cisco Webex Cloud)

The DNS zone allows your Expressway-E to identify and route calls between Cisco Unified Communications Manager and the Cisco Webex cloud. The DNS zone is used because a secure mutual TLS connection between the cloud and Expressway-E is required to map the appropriate domains.

On Expressway, you can choose the Webex DNS zone which automatically creates a pre-configured zone for Hybrid Services. The system applies the correct settings and you cannot modify the zone. You can only have one zone of this type.

Before you begin

This option is only available in Expressway X8.11.4 and later. Ensure that you're on a supported Expressway traversal pair for Hybrid Call Service, as documented in Cisco Expressway Requirements.

Procedure

Step 1

From Expressway-E, navigate to Configuration > Zones > Zones and click New.

Step 2

For Type, choose Webex, and then save your changes.

This step creates the Hybrid DNS zone, identified by the automatically populated name Webex Zone.

Step 3

(Optional) Next to the hybrid domain, click Check Connectivity.

The connectivity test tool queries DNS for the supplied SRV domain and displays the results of the query if the lookup was successful. It then attempts a TCP connection followed by a TLS connection if applicable according to the DNS SRV protocol.

Configure a Secure Traversal Server Zone from Expressway-E to Expressway-C

If you already have a traversal zone pair (typically for business-to-business (B2B) calling) or Unified Communications traversal zone pair (typically for Mobile and Remote Access (MRA)), or both, then we recommend that you create a separate traversal zone pair for Hybrid Call Service.

However, if you need to share the zones between the different services:

  • You can share the Unified Communications traversal pair between MRA and Hybrid Call Service (you can only have one Unified Communications traversal zone pair between Expressway-C and Expressway-E).

  • Do not share a B2B traversal pair with Hybrid Call Service. Create a separate traversal pair between Expressway-E and Expressway-E if they are used for B2B and Hybrid Call Service.

Procedure

Step 1

From Expressway-E, go to Configuration > Zones > Zones, and then click New.

Step 2

Configure these settings:

Field

Value

Configuration

Name

Webex hybrid traversal server

Type

Traversal server

Hop count

15 (Default)

Connection credentials

Username

Enter traversal, for example.

Password

Go to Add/Edit Local authentication database, click New, enter traversal as the username, and then set a password. Click Create Credentials, and then close the window.

H.323

Mode

Off

Protocol

Assent (Default)

Port

6006 (Default)

H.460.19 demultiplexing mode

Off (Default)

SIP

Mode

On

Port

7004 or any value in 7XXX range. (This value must match the port number that is configured on Expressway-C.)

Transport

TLS

TLS verify mode

On

TLS verify subject name

Enter one of the Subject Alternative Names (SANs) of an Expressway-C certificate. For a cluster, enter at least a common SAN that is shared between all Expressway-C cluster peers.

Media encryption mode

Force encrypted

ICE support

Off (Default)

Multistream mode

On (Default)

SIP poison mode

Off (Default)

Preloaded SIP routes support

On

SIP parameter preservation

On

Note 

This parameter must be set to On for all zones on all Expressways that are involved in call routing to and from the enterprise.

Step 3

Do not change settings under Authentication or UDP/TCP Probes.

Step 4

Click Create zone.

Create Inbound and Outbound Search Rules on Expressway-E

Search rules define how the Expressway routes calls (to destination zones) in specific call scenarios. When a search rule is matched, the destination alias can be modified according to the conditions defined in the search rule. Create search rules on Expressway-E to:

  • Identify calls from the Cisco Webex cloud and route down the traversal zone to Expressway-C.

  • Identify calls from Cisco Unified Communications Manager and route through the DNS zone to Cisco Webex.

Before you begin

Configure a Secure Traversal Server Zone from Expressway-E to Expressway-C

Procedure

Step 1

From Expressway-E, go to Configuration > Dial Plan > Search rules, and then click New.

Step 2

Click New.

We're creating a rule to identify calls coming from Cisco Webex (through the DNS zone) and route them inwards (through the traversal zone) to Expressway-C.

Step 3

Configure the following settings:

Field

Value

Rule Name

Enter Webex Hybrid inbound calls, for example.

Description

Enter Route traffic from Webex Hybrid Cloud to UCM via Expressway-C, for example.

Priority

100 (Default)

Protocol

SIP

Source

Named

Source name

Webex hybrid DNS zone, for example. Choose the Cisco Webex DNS zone from the drop-down list.

Request must be authenticated

No (Default)

On successful match

Stop

Target

Webex hybrid traversal server, for example. Choose the traversal server zone (or Unified Communications traversal zone) that you modified in the previous section.

State

Enabled (Default)

Step 4

Click Create search rule.

Step 5

Click New.

We're creating a rule to identify calls coming from Cisco Unified Communications Manager (through the traversal zone) and route them outwards (through the DNS zone) to Cisco Webex.

Step 6

Configure the following settings:

Field

Value

Name

Enter Webex Hybrid outbound calls, for example.

Description

Enter Route traffic from Expressway-E to Webex Hybrid Cloud, for example.

Priority

100 (Default)

Protocol

SIP

Source

Named

Source name

Webex hybrid traversal server, for example. Choose the traversal server zone (or Unified Communications traversal zone) that you modified in the previous section.

Request must be authenticated

No (Default)

Mode

Alias pattern match

Pattern Type

Regex

Pattern string

.*@.*\.webex\.com

Pattern behavior

Leave

On successful match

Stop (Default)

Target

Webex hybrid DNS zone, for example. Choose the Cisco Webex DNS zone from the drop-down list.

State

Enabled (Default)

Step 7

Click Create search rule.

What to do next

Configure a Secure Traversal Client Zone From Expressway-C to Expressway-E

Configure the Expressway-C for Hybrid Call Service

Procedure

  Command or Action Purpose
Step 1

Configure a Secure Traversal Client Zone From Expressway-C to Expressway-E

Create a dedicated traversal client zone on Expressway-C. Though Cisco Webex traffic can coexist on the same traversal zone with MRA or B2B, we recommend that you create a dedicated traversal client zone on Expressway-C, specifically for handling Hybrid Call Service signaling and media. That way, any settings for B2B or MRA won't affect Cisco Webex traffic, and the other direction won't be affected either.

Step 2

Create an Expressway-C Neighbor Zone for each Unified CM Cluster
Configure neighbor zones for each Cisco Unified Communications Manager cluster to which you want to route:

  • Each zone can accommodate 6 peer addresses, which supports a Cisco Unified Communications Manager cluster with 6 nodes.

    If you need to connect to a Cisco Unified Communications Manager cluster with more nodes, you can configure an SRV record for that cluster and use Expressway-C to discover neighbor nodes by SRV lookup.

  • This neighbor zone must route to a Cisco Unified Communications Manager home cluster—the zone can route to an SME if the SME is Unified CM 12.0(1).

  • The exact port to use for each zone depends on the SIP trunk security profile that you configured on Cisco Unified Communications Manager. If you have B2B or MRA configured, we recommend that you use 5561 for SIP TLS and 5560 for SIP TCP so that the new configuration doesn't interfere with your existing setup.

  • Do not reuse any existing neighbor zones to Cisco Unified Communications Manager for MRA.

Step 3

Configure Search Rules on Expressway-C (to Unified CM)

Search rules define how the Expressway routes calls (to destination zones) in specific call scenarios. When a search rule is matched, the destination alias can be modified according to the conditions defined in the search rule. Configure search rules on Expressway-C to route calls to the correct Unified Communications Manager cluster based on the route header.

Configure a Secure Traversal Client Zone From Expressway-C to Expressway-E

Create a dedicated traversal client zone on Expressway-C. Though Cisco Webex traffic can coexist on the same traversal zone with MRA or B2B, we recommend that you create a dedicated traversal client zone on Expressway-C, specifically for handling Hybrid Call Service signaling and media. That way, any settings for B2B or MRA won't affect Cisco Webex traffic, and the other direction won't be affected either.

Procedure

Step 1

From Expressway-C, go to Configuration > Zones > Zones, and then click New.

Step 2

Configure these settings:

Field

Value

Configuration

Name

Webex Hybrid traversal client (for example)

Type

Traversal client

Hop Count

15

Connection credentials

Username

traversal

Password

Enter the password that you created on the Expressway-E for the traversal account.

H.323

Mode

Off

SIP

Mode

On

Port

7004 or any value in 7XXX range. (This value must match the port number that is configured on Expressway-E.)

Transport

TLS

TLS verify mode

On

Accept proxied registrations

Deny

Media encryption mode

Force encrypted

ICE support

Off

Multistream mode

On

SIP poison mode

Off

Preloaded SIP routes support

On

SIP parameter preservation

On (Enables this zone to process SIP INVITE requests that contain the route header.)

Note 

This parameter needs to be set to On for all zones on all Expressways that are involved in call routing to and from the enterprise.

Authentication

Authentication policy

Check credentials

Accept delegated credential checks

Off

Client settings

Retry Interval

120

Location

Peer 1-6 address

Enter the Fully Qualified Domain Name (FQDN) of the traversal server. If you are using secure traversal, then this value must be either the Common Name or one of the Subject Alternate Names on the traversal server's certificate. IP addresses or hostnames are not recommended. If the traversal server is a cluster of VCS Expressways, this is the FQDN of one of the peers in that cluster.

Step 3

Click Create Zone.

Create an Expressway-C Neighbor Zone for each Unified CM Cluster

Configure neighbor zones for each Cisco Unified Communications Manager cluster to which you want to route:

  • Each zone can accommodate 6 peer addresses, which supports a Cisco Unified Communications Manager cluster with 6 nodes.

    If you need to connect to a Cisco Unified Communications Manager cluster with more nodes, you can configure an SRV record for that cluster and use Expressway-C to discover neighbor nodes by SRV lookup.

  • This neighbor zone must route to a Cisco Unified Communications Manager home cluster—the zone can route to an SME if the SME is Unified CM 12.0(1).

  • The exact port to use for each zone depends on the SIP trunk security profile that you configured on Cisco Unified Communications Manager. If you have B2B or MRA configured, we recommend that you use 5561 for SIP TLS and 5560 for SIP TCP so that the new configuration doesn't interfere with your existing setup.

  • Do not reuse any existing neighbor zones to Cisco Unified Communications Manager for MRA.

Procedure

Step 1

From Expressway-C, go to Configuration > Zones > Zones, and then click New. Create a zone for each cluster.

Step 2

Configure these settings:

Field

Value

Configuration

Name

UCM Neighbor for Cisco Webex (for example)

Type

Neighbor

Hop Count

15

H.323

Mode

Off

SIP

Mode

On

Port

Enter the Cisco Unified Communications Manager listening port number, such as 5561.

If MRA is deployed, standard 5060 and 5061 ports are used as line-side registration. The configured port (5561) must match the listening port configured in the Communications Manager SIP Trunk Security Profile. Ports 5060 and 5061 can be used if MRA is not enabled.

Transport

TCP is the default, but we recommend TLS for connecting Expressway-C to Unified CM. For a trunk that is enabled for SIP TLS, Unified CM does not need to be in mixed mode.

If you want to use TLS, see "Connecting Expressway to Unified CM Using TLS" in the Cisco Expressway and CUCM via SIP Trunk Deployment Guide for your Expressway and Unified CM version.

TLS Verify Mode

On to verify the CallManager certificate for subsequent SIP communications.

Accept proxied registrations

Allow

Media encryption mode

Auto

ICE support

Off

Multistream mode

On

Preloaded SIP routes support

On

AES GCM support

On

Authentication

Authentication policy

Do not check credentials

SIP authentication trust mode

Off

Location

Look up peers by

Address or Service record

Choose Address if you want to enter up to 6 IP addresses, hostnames, or FQDNs of individual Unified CM nodes in the neighbor cluster.

Choose Service record if you want Expressway to query DNS for an SRV record that resolves to the addresses of the nodes in the neighbor cluster.

Peer 1-6 addresses

If you chose to Lookup peers by Address, enter IP addresses or hostnames for each server in the 6 peer address fields.

For TLS negotation, the peer address must match the CN name that is used in the Unified CM certificates; otherwise, TLS negotiation fails.

Service Domain

If you chose to Lookup peers by Service Record, enter the domain to search for. Expressway will prepend the protocol and transport, then do the DNS query based on the other parameters in your neighbor zone configuration.

For example, if SIP mode is On and TLS verify mode is on, then when you enter example.com, Expressway queries DNS for _sips._tcp.example.com..

Step 3

Configure these fields for the zone profile:

Field

Value

Advanced

Zone profile

Custom, the zone profile to use for the supported version of Unified CM for Hybrid Call Service.

Monitor peer status

Yes

Call signaling routed mode

Always

Automatically respond to H.323 searches

Off

Automatically respond to SIP searches

Off

Send empty INVITE for interworked calls

On

SIP Parameter Preservation

On

Note 

This parameter needs to be set to On for all zones on all Expressways that are involved in call routing to and from the enterprise.

SIP poison mode

Off

SIP encryption mode

Auto

SIP REFER mode

Forward

SIP multipart MIME strip mode

Off

SIP UPDATE strip mode

Off

Internetworking SIP search strategy

Options

SIP UDP/BFCP filter mode

Off

SIP UDP/IX filter mode

Off

SIP record route address type

IP

SIP Proxy-Require header strip list

Leave this field blank.
Step 4

Click Create Zone.

Configure Search Rules on Expressway-C (to Unified CM)

Search rules define how the Expressway routes calls (to destination zones) in specific call scenarios. When a search rule is matched, the destination alias can be modified according to the conditions defined in the search rule. Configure search rules on Expressway-C to route calls to the correct Unified Communications Manager cluster based on the route header.

Before you begin

For the Expressway-E to Unified CM search rule, you need the cluster fully qualified domain name (FQDN) value that you configured in this procedure: Configure Cisco Unified Communications Manager Settings for Hybrid Call Service.

Procedure

Step 1

Go to Configuration > Dial plan > Search rules .

Step 2

Click New.

We're going to create a rule to identify calls coming from the Expressway-E (through the traversal zone) and route them inwards (through the neighbor zone) to Cisco Unified Communications Manager.

You'll need a rule for each Unified CM cluster that is trunked to the Expressway-C.

Step 3

Configure the following settings:

Field

Value

Rule Name

From Webex Hybrid Cloud to Unified CM via Expressway-E, for example.

Description

Route traffic from Expressway-C to Unified CM, for example.

Priority

60

Protocol

SIP

Source

Named

Source name

Choose Webex Hybrid Traversal client.

Request must be authenticated

No

Mode

Alias pattern match

Pattern type

Prefix

Pattern string

cluster1.example.com, for example. This is the Cluster Fully Qualified Domain Name enterprise parameter value for the Cisco Unified Communications Manager cluster.

Add the other cluster FQDNs (cluster2.example.com, cluster3.example.com, and so on) for the corresponding Cisco Unified Communications Manager neighbor zones that you need to create on the Expressway-C.

Pattern behavior

Leave (The alias is not modified.)

On successful match

Stop

Target

Choose the Cisco Unified Communications Manager neighbor zone—for example, UCM Neighbor for Cisco Webex.

This setting will be different for each cluster; each cluster should have its own neighbor zone.
Step 4

Click Create search rule.

Step 5

Click New.

We're going to create one rule to identify any calls (by Hybrid Calling users or Cisco Webex devices in a Place) arriving at Expressway-C that are destined for Cisco Webex, and route them outwards (through the traversal client zone) to the Expressway-E.

Step 6

Configure the following settings:

Field

Value

Rule Name

From Unified CM to Webex Hybrid Cloud via Expressway-E, for example.

Description

Enter Route traffic from Unified CM to Expressway-E, for example.

Priority

70

Protocol

SIP

Source

Named

Source name

UCM Neighbor for Cisco Webex, for example.

Request must be authenticated

No

Mode

Alias pattern match

Pattern type

Regex (The string is treated as a regular expression.)

Pattern string

.+@.*\.(rooms|calls)\.webex\.com.*

Pattern behavior

Leave (The alias is not modified.)

On successful match

Stop

Target

Webex Hybrid traversal client

State

Enabled
Step 7

Click Create search rule.

Enable Hybrid Call Service for Cisco Webex Teams Users

Use this procedure to enable a small number of Cisco Webex Teams users for Hybrid Call Service. See Ways to Add and Manage Users in Your Organization for other methods, such as using a bulk CSV template or Active Directory synchronization through Cisco Directory Connector.


Note

When you use bulk import or directory synchronization to import users, users must have email addresses in the source system. Those must be the addresses they use for Cisco Webex Teams because you map them to the Cisco Webex user ID.

If a user does not have an email address in Unified CM, the Call Connector cannot discover the user. Hybrid Call Service does not work for that user.

Using Cisco Directory Connector you can map either the mail attribute or the userPrincipalName attribute to the Cisco Webex UID, but the value must be the user's email address.

Before you begin

  • Cisco Webex Teams users must already be assigned a paid license that provides them with core Cisco Webex messaging and meeting capabilities.

  • You cannot enable the same user for both Hybrid Call Service and Cisco Webex Calling (Formerly Spark Call).

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Users, choose a specific user from the list, or use the search to narrow the list, and then click the row to open an overview of the user.

Step 2

Click Edit, and then ensure that the user is assigned at least one paid service under Licensed Collaboration Services. Make necessary changes, and then click Save.

Step 3

In the user's overview under Hybrid Services, click Call Service, and then click the the Aware toggle ot turn it on.

Aware does not provide any features to the user, but it is still a required step when you enable users for Hybrid Call Service.

Step 4

Save your changes. Return to the user's overview and under Hybrid Services, click Call Service, and then click the the Connect toggle ot turn it on.

Step 5

Click Save.

After you enable users for the service, these steps occur:

  • The connector service in the cloud waits for 2 minutes to collect users in batches.

  • Call Connectors are notified about user discovery; one designated connector for each cluster is notified.

  • The connectors request a batch of users to be discovered and then consult the local cache to verify the user configuration.

  • The Cisco Webex Teams user status changes from Pending Activation to Activated. The length of time for this change depends on the number of users that you're enabling for the service.

This diagram shows how fields from Unified CM (on the left) are mapped in the Cisco Webex Teams user account view (on the right).

Figure 2. Field Mapping Between The Unified CM End User Account and Webex Teams User Account Cisco Webex Control Hub

What to do next

On the user's overview, you can find this information:

  • User status and history

  • Further details on status (Activation, errors, and so on)

  • Cluster and node the user is hosted on

  • Directory URI

  • Primary DN

  • Phone Number

  • Unified CM FQDNs

Test the Softphone Functionality for Hybrid Call Service

Use this procedure to test Hybrid Call Service softphone call scenarios in the Cisco Webex Teams app. These steps verify whether you correctly configured Hybrid Call Service Connect and can help isolate any potential issues.

Calls are anchored through the caller's Unified Communications Manager. Any transformations and routing rules are applied exactly as if the call had been placed from a desk phone.

When dialing from Cisco Webex Teams, use the same dial strings or prefixes as you do on your desk phone; Cisco Webex Teams functions like any other desk phone registered to your Unified Communications Manager.

Before you begin

  • Unless otherwise stated, these steps assume that the person who initiates the test calls (you or another test user) is enabled for Hybrid Call Service.

  • Open your Cisco Webex Teams apps.

Procedure

Step 1

Place a call from your primary desk phone to another hybrid user's desk phone.

If you configured the service correctly:

  • For the called party, both the Cisco Webex Teams app and desk phone ring.

  • A space appears at the top of both of your lists in Cisco Webex Teams.

  • If the call is answered on the app, the call duration appears.

  • After the call ends, a record of the call appears under in your apps.

Step 2

Place a call from your Cisco Webex Teams app to another hybrid user in one of the following ways.

  • Search for the user in Cisco Webex, and from the space with that user, go to the activity menu , and then choose Call .
  • From , enter the user's primary directory number or directory URI.

In all of these cases, the called party is notified on both the app and desk phone.

What to do next

Known Issues and Limitations with Hybrid Call Service for Webex Teams Users

This section covers the known issues and limitations for Hybrid Call Service for users. Each entry is presented in a logical flow with the expected behavior, from registering the Expressway-C to enabling users for Hybrid Call Service to call behavior (including call history).

If you also have Mobile and Remote Access deployed, see Unsupported Expressway Features and Limitations.

Use Case Expected Behavior Limitations and Exceptions Issues and Workarounds

Deployment

Register the Expressway-C to host Call Connector

Download and install Call Connector on Expressway-C

Each Expressway-C cluster must have a unique IP address for the master peer

 N/A

Configure Call Connector

Establish AXL connection between Call Connector and Unified CM

 N/A N/A
Configure SIP connection between Unified CM and Cisco Webex through Expressway-C/E Calls to and from domain callservice.webex.com securely routed through the Expressway-C/E over public Internet

Multiple secure SIP trunks between Unified CM and Expressway-C are not supported by Unified CM

N/A
Enable User for Hybrid Call Service

  • Find user’s home cluster, assign user to Call Connector

  • Use call connector to create Cisco Spark-RD on Unified CM 11.5(1) SU3 or later. Or manually provision Cisco Spark-RD in Unified CM.

  • Call Connector automatically adds the remote destination URI (Cisco Webex SIP Address) in both cases.

The name for an automatically created Cisco Spark-RD is based on the Unified CM user ID and are limited to a maximum of the first 15 characters. A manually created Cisco Spark-RD must also be 15 characters or less.

The user remains in a pending activation state because the remote destination URI (Webex SIP address) is too long:

  • Replace CTI-RD with Cisco Spark-RD (may require Unified CM upgrade)

A remote destination for hybrid call users (such as user@example.calls.webex.com) cannot be associated to both a Cisco Spark-RD and Remote Destination Profile at the same time. Otherwise, the remote device fails to activate.

Call Behavior
Call from Hybrid Call Service user’s Cisco Webex Teams app to company extension or PSTN number Address is interpreted and call is routed by Connect user’s Unified CM N/A

No video or share:

  • Replace CTI-RD with Cisco Spark-RD (may require Unified CM upgrade)

Unified CM licensing out of compliance:

  • Replace CTI-RD with Cisco Spark-RD (may require Unified CM upgrade)

Call to Hybrid Call Service user’s UC device also offered to Connect user’s Cisco Webex Teams app Notification and option to “Answer” on Connect user’s Cisco Webex Teams app

Call may be offered to Hybrid Call Service user’s Jabber client or SNR Remote Destination on same platform as Cisco Webex Teams app, with resulting conflicts

Calls from a user’s Cisco Webex Teams app to a hunt group are not offered to the Cisco Webex Teams app of a hunt group member who is also a Connect user.

Depending on the Unified CM release, users' UC devices may continue to alert after the call is declined on the Hybrid Call Service user’s Cisco Webex Teams app.

Call does not alert on user’s Cisco Webex Teams app:

  • Replace CTI-RD by Cisco Spark-RD (may require Unified CM upgrade)

Call answered on UC device may be reported as missed on user’s Cisco Webex Teams app

Persistent Call busy

  • Replace CTI-RD with Cisco Spark-RD (may require Unified CM upgrade)

Users' UC devices continue to alert

  • Upgrade to Unified CM 11.5(1) SU5 or 12.5(1), which contains a fix that immediately diverts a call to the user's UC voicemail when declined in the Webex Teams app.

Call history entry for when an incoming call ends that was placed to a Hybrid Call Service user

Calls answered on Webex Teams are logged in call history.

Calls answered on UC endpoints are logged as a “missed call” in call history.

N/A

Call history entry for when a Hybrid Call Service makes an outgoing call

  • Calls that originate from Webex Teams are logged in call history.

  • Calls that originate from UC endpoint depend on the remote party:

    • Calls to a Webex Teams or Meetings URI are logged in call history.

    • Calls to a fellow Hybrid Call Service user who answers on Webex Teams are logged in call history.

  • Calls from a UC endpoint to a PSTN or UC only user do not appear in Webex Teams call history.

  • Calls from a UC endpoint to a fellow Hybrid Call Service user that are answered on the user's UC endpoint appear as a "missed call" in call history.

N/A

Call to a Hybrid Call Service user from a Cisco Webex Calling (formerly Spark Call) user.

If the call originates in the calling user's Webex Teams app, the call is offered to the Hybrid Call Service user's Webex Teams app and enterprise desk phone.

If the call originates from a connected desk phone in the calling user's Webex Teams app, the call is offered to the Hybrid Call user's Webex Teams app but is not offered to the Hybrid Call Service user's enterprise desk phone.

—

Call to a Hybrid Call Service user who is configured for Single Number Reach (SNR).

The call is offered to the user's mobile Cisco Webex Teams app and mobile number at about the same time.

The call that arrives first takes priority in the native dialer (whether or not the device is on the lock screen). So if the Cisco Webex Teams app call arrives first, there is no opportunity to answer the SNR call on mobile voice. If the SNR call arrives first, the user can still answer the Cisco Webex Teams call, but only by first opening the app.

On mobile, users can prevent Cisco Webex Teams calls from using the native dialer by using this procedure.

If the option is set to disallow answering on the lock screen, the user must always open the Cisco Webex Teams app to answer an in-app call.

Calls to a hunt group may or may not alert the Webex Teams app of a Hybrid Call Service user. This behavior depends on the specific configuration of the hunt group. Alerting the Webex Teams apps of a Hybrid Call Service user does not depend on whether the user is logged into or out of the hunt group.

Hunt groups are not supported.

 N/A N/A

Call from Hybrid Call Service user’s Cisco Webex Teams app to IP address

IP address dialing is not supported.

 N/A N/A

Deactivate Hybrid Call Service For Your Organization

You can temporarily deactivate Hybrid Call Service for your organization if you need to perform maintenance (such as changing Webex SIP addresses). You can permanently deactivate Hybrid Call Service if you no longer need to run the service.

Procedure

Step 1

From the customer view in https://admin.webex.com, deactivate Hybrid Call Service for your organization by going to Services, choosing Edit settings on the Hybrid Call card, scrolling to Call Service Connect, and then clicking Deactivate.

As soon as the service is deactivated, Hybrid Call Service calls will not route. This step temporarily converts you to a cloud calling organization; during this state, you can perform related maintenance as needed (for example, modify the SIP addresses for calling.

Note 

Deactivating Hybrid Call Service does not remove the service from Webex Teams users or clean up any automatically created Cisco Spark-RD on Unified CM.

Step 2

Choose a step, depending on your goal:

  • If you deactivated the service temporarily, ensure that any needed configuration is completed, go back to the customer view in https://admin.webex.com, and reactivate Hybrid Call Service for your organization by going to Services, choosing Edit settings on the Hybrid Call card, scrolling to Call Service Connect, and then clicking Activate.
  • If you deactivated the service permanently, you may need to perform additional cleanup on Webex Teams user accounts and Unified CM.

    • Remove the Hybrid Call Service toggles from Webex Teams user accounts. (You can do this individually or in bulk.)

    • Remove any remaining Cisco Spark-RD on Unified CM.

Related Documentation

See the following documents for further information about Cisco Webex Hybrid Services, including how to manage and troubleshoot your deployment:

Table 1. Related Documentation for Cisco Webex Hybrid Services

Category

Links to Documentation

Planning

Management

Troubleshooting

If you're looking for something else, you can search https://collaborationhelp.cisco.com. You can also bookmark https://www.cisco.com/go/hybrid-services.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us