The Cisco Expressway product allows VPN-less connection from mobile 'Bring your own' devices and allows a user to access all the collaboration tools they have in the office environment when they are outside of the office.

Cisco Unified Communications mobile and remote access is a core part of the Cisco Collaboration Edge Architecture. It allows endpoints such as Cisco Jabber to have their registration, call control, provisioning, messaging and presence services provided by Cisco Unified Communications Manager (Unified CM) when the endpoint is not within the enterprise network. The Expressway provides secure firewall traversal and line-side support for Unified CM registrations.

The following diagram shows the Cisco Expressway architecture for Cisco HCS.

The following Cisco Jabber functions are supported without a VPN connection:

• IM and Presence

• Make and receive voice and video calls

• Mid call control (transfer, conference, mute, hold, park, handoff to mobile , and so on)

• Communications history (view placed, missed, received calls)

• Directory search: The HTTP proxy will allow Jabber to use the CUCM User Data Service (UDS)

• Escalate to Web conference (MeetingPlace / Cisco Webex)

• Screen share / file transfer when Jabber is in SSO mode

• Visual Voicemail (view, play, delete, filter by, sort by over HTTP)

The Cisco Collaboration Edge Architecture provides enabling for any-to-any collaboration for many types of endpoint devices. For the Cisco Expressway implementation in Cisco Hosted Collaboration Solutions the following endpoints are supported:

• Jabber Desktop - Windows
• Jabber Mobile - iPhone, Android, and iPad
• Hard endpoints - EX60, EX90
• Cisco DX Series endpoints
• 7800 Series IP phones
• 8800 Series IP phones

Note	DX/78XX/88XX endpoints have a fixed certificate trust list that is not configurable by the administrator. The Cisco Collaboration Edge Architecture needs to have a certificate signed by a real certificate authority.

The Cisco Expressway OTT Solution provides the following design highlights:

• Expressway-E is treated as an SBC and like any other endpoint is routed through the Firewall.
• Unified CM provides call control for both mobile and on-premises endpoints.
• Signaling traverses the Expressway solution between the mobile endpoint and UCM.
• Media traverses the Expressway solution and is relayed between endpoints directly; all media is encrypted between the Expressway-C and the mobile endpoint.

The following diagram illustrates these highlights.

The Expressway-E and Expressway-C platforms can be deployed in clusters of four (for n+2 redundancy) with the possibility of deploying multiple clusters if necessary. Clusters of six VMs can accommodate up to four times the maximum call capacity.

The three deployment options (distributed as OVAs) have the following specifications:

For more information, see https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/install_guide/Cisco-Expressway-Virtual-Machine-Install-Guide-X12-5-4.pdf.

In Large PoD HCS, it is expected that Expressway-C and Expressway-E will run on B-series blades. The above resource needs should be considered in the HCS recommendation for scaling/sizing.

For information on Expressway VM sizing options see Cisco Hosted Collaboration Solution Compatibility Matrix.

In this scenario each network element is clustered in the tested design. Other Cisco Expressway deployment options are available in the Cisco Expressway documentation. In HCS verification, only the Cisco Expressway-C was clustered.

Endpoints connect using one identity and one authentication mechanism to access multiple unified communications services. Authentication is owned by the IdP. No authentication occurs at the Expressway or at the internal unified communications services.

Cisco Jabber determines whether it is inside your network before it requests a unified communications service. When Jabber is outside of the network, it requests the service from the Expressway-E on the edge of the network. If SSO is enabled at the edge, the Expressway-E redirects Jabber to the IdP with a request to authenticate the user.

The IdP challenges Jabber to identify itself. After the identify is authenticated, the IdP redirects the Jabber service request to the Expressway-E with a signed assertion that the identity is authentic.

Because the Expressway-E trusts the IdP, it passes the request to the appropriate service inside the network. The unified communications service trust the IdP and the Expressway-E, so it provides the requested service to the Jabber client.

The provisioning of Jabber Client SSO involves such tasks as downloading the federation metadata file, configuring Unified CM and Cisco Unity Connection, configuring SAML SSO, and configuring AD FS. For more information, see the Cisco Unified Communications Domain Manager Maintain and Operate Guide.