Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. You may choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

• Ensure that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.
• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin and Media, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.
• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin, Media and Web, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. You may choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

• Ensure that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.
• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin and Media, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.
• Ensure that the Internet Reverse Proxy virtual machines are in your DMZ network.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

For security reasons, Cisco recommends that you place the Internet Reverse Proxy in a separate subnet from the internal (Admin, Media and Web, if applicable) virtual machines. See Port Access With an Internet Reverse Proxy in the DMZ Network.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In an automatic deployment, we deploy all the virtual machines (other than the Admin virtual machine) for you. You may choose an automatic deployment if you are deploying a 50, 250, or 800 user system.

• Ensure that the Media virtual machine (if applicable) is on the same subnet as the Admin virtual machine.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

Make the following changes to your firewalls.

Network Routing Configuration

Make the following changes to your network routing.

Virtual Machine Deployment

In a manual deployment, you create all the virtual machines for your system using the OVA wizard from your vSphere client. You then install your system using a manual deployment.

You must choose a manual deployment if you are deploying a 2000 user system.

• Ensure that any additional internal virtual machines (Media and Web, if applicable) are on the same subnet as the Admin virtual machine.

Required IP Addresses

DNS Configuration

Make the following changes to your DNS configuration.

Note	There are some limitations for the hostname portion of the WebEx site URL and the Administration site URL. For a list of the words that you may not use, see WebEx Site and WebEx Administration URLs.

Firewall Configuration

Make the following changes to your firewalls.

Network Routing Configuration

Make the following changes to your network routing.

WebEx Site URL

End users access the WebEx site URL to host or attend meetings. This URL resolves to either the private VIP address or the public VIP address, depending on whether or not you are using a split-horizon DNS.

• Resolves to the public VIP address for all users, when you do not have “split-horizon” DNS.
• Resolves to the public VIP address for external users when you have split-horizon DNS.
• Resolves to the private VIP address for internal users when you have split-horizon DNS.

WebEx Administration URL

Administrators access the WebEx Administration URL to configure, manage, and monitor the system. This URL resolves to the private VIP address.

Names for the WebEx Site and WebEx Administration URLs

You may choose almost any names for these URLs, comprising all lowercase characters. However, you cannot use the following as the hostname in the site URLs:

This section describes the port access required in the external firewall when all the system virtual machines (Admin, and if applicable, Media, Web, and Internet Reverse Proxy) are in the internal network. This is the Internal Internet Reverse Proxy network topology.

Note

The Web node and Admin node send SMTP requests to the configured mail server. If there is a firewall between the internal Web and Admin virtual machines and the mail server, the SMTP traffic may be blocked. To ensure mail server configuration and mail notification work properly, port 25 or 465 (secure SMTP port number) must be open between the mail server and the Web and the Admin virtual machines.

Port Access in the External Firewall

If you have enabled public access, then the following ports are open inbound directly from the Internet to the Internet Reverse Proxy virtual machines in the internal network:

• TCP Port 80 to the public virtual IP (VIP) address
• TCP Port 443 to the public virtual IP (VIP) address

This section describes the port access required in the internal and external firewalls when you have internal virtual machines (Admin, and if applicable, Media and Web) in the internal network, and the Internet Reverse Proxy in the DMZ network.

Configure access control lists (ACLs) on the switch that permits traffic to the ESXi hosts for the system's virtual machines.

Port Access in the External Firewall

If you have enabled public access, then the following ports are open inbound from the Internet to the Internet Reverse Proxy virtual machines in the DMZ:

Note

Cisco strongly recommends that you open port 80 (http) in addition to port 443 (https), to simplify the end user experience (in a browser, users enter the WebEx site URL without having to remember whether it is http or https. However, for this product, the actual network traffic always flows over port 443 (SSL encrypted https).

Port Access in the Internal Firewall

The following ports must be open when the Internet Reverse Proxy is in the DMZ network. If you have restrictions on connections from the internal network to the DMZ network, then the following table applies. Allow TCP connections outbound from the internal network to the DMZ network segment on the following ports.

Note	No TCP connections need to be allowed from the DMZ segment in to the internal network for this product to work properly.

Note	UDP port 10162 is the only port that is open inbound from the DMZ to the internal virtual machines. This port is required for monitoring of the Internet Reverse Proxy by the system.

Note	Using iptables or access control lists (ACLs), configure the firewall so that connections to port 64616 only come from the Admin virtual machine.

Note

The Web node and Admin node send SMTP requests to the configured mail server. If there is a firewall between the internal Web and Admin virtual machines and the mail server, the SMTP traffic may be blocked. To ensure mail server configuration and mail notification work properly, port 25 or 465 (secure SMTP port number) must be open between the mail server and the Web and the Admin virtual machines.

Note	Especially when the Internet Reverse Proxy is in the DMZ network, allow Internet Control Message Protocol (ICMP) echo requests and replies. Otherwise, the Internet Reverse Proxy detect and the DNS server reachability validation may fail if the ICMP echo reply is not received.

These are some of the ports that are used during the deployment of Cisco WebEx Meetings Server. Once the deployment completes, you may optionally close any ports that were opened solely for the deployment.

TCP Port 443 should be open, in both directions, between vCenter and the Admin virtual machine for secure https management during an automatic system deployment. The Admin virtual machine uses this port to provide vCenter credentials to deploy the virtual machines automatically in vCenter.

The ports listed below are used for communication between the ESXi host and vCenter. If the ESXi host and vCenter are connected to a separate management network, you may not need to open these ports through the firewall. For a complete list of ports used by vCenter and the ESXi host, see your VMware documentation.

• UDP/TCP Port 902 in both directions between vCenter and the ESXi hosts for vCenter management
• (Optional) TCP Port 22 from the vSphere client to the ESXi hosts for SSH management
• UDP Port 514 from the ESXi hosts for your system to the internal syslog
• TCP Port 5989 in both directions between vCenter and the ESXi hosts for XML management

These ports are used for communication between Cisco WebEx Meeting Center and Cisco WebEx Meetings Server.

• The UDP ports used for internal clients for audio and video data transmission between UDP and SSL include:
  • For 50 user systems, use UDP port 9000
  • For 250 user systems, use UDP ports 9000, 9001, 9002, 9003
  • For 800 user systems, use UDP ports 9000, 9001, 9002, 9003, 9004, 9005, 9006, 9007, 9008, 9009
  • For 2000 user systems, use UDP ports 9000, 9001, 9002, 9003, 9004, 9005, 9006, 9007
• With the appropriate network settings, internal media servers allow connections through any port used by Meeting Center.
• The Internet Reverse Proxy only accepts connections from Meeting Center through TCP Ports 80 and 443.

Cisco supports Network Address Translation (NAT) traversal with this product for virtual machine IP addresses and for the virtual IP addresses (Public and Private VIPs) that are used in your system.

Note	For more information about NAT, see http:/​/​www.cisco.com/​en/​US/​tech/​tk648/​tk361/​technologies_​tech_​note09186a0080094831.shtml.

The following schematic diagram illustrates a typical NAT traversal for a 50 user system without HA. By using NAT, you can reduce the number of public IP addresses required for the product to just one IP address, instead of two (or three if you deploy HA). You may also deploy similar NAT deployments as long as these meet the overall system requirements.

Note	The use of multiple NATs and firewalls tends to increase latency, affecting the quality of real time-traffic for users.

In the diagram, an external user accesses the WebEx site to join or host a meeting. Following a DNS lookup, the IP address for the WebEx site is the NAT public IP address (Eth0). This NAT public IP address is for the external NAT firewall router (Firewall and NAT router 1), between the external network and the DMZ network.

The firewall router receives this request from the external user, and internally routes the request to the NAT private IP address for the router (Eth1, exposed to the DMZ network). Eth1 then sends the request to the public VIP address (also a NAT IP address in the private networking segment for the WebEx site).

You may use NAT IP addresses for the public VIP address, and the Internet Reverse Proxy IP addresses. The only NAT public IP address is the Eth0 IP address for the NAT firewall router.

Note	To ensure this NAT firewall router (between the Internet and DMZ network) routes the incoming packet correctly, set port mapping configuration on the NAT device, or apply other similar mechanisms to ensure the packet is routed correctly to the public VIP address and the Internet Reverse Proxy.

There is usually a second internal NAT firewall router between the DMZ network and the internal network. Similar to the external NAT firewall router, Eth0 is a DMZ NAT private IP address and is an interface to the DMZ network. Eth1 is also a NAT private IP address that is an interface to the internal network.

You may use NAT IP addresses for the private VIP address and the Admin virtual machine IP addresses.