All cloud registered Webex apps and Cisco Video devices initiate outbound connections only. Cisco’s Webex Cloud never initiates outbound connections to cloud registered Webex apps and Cisco Video devices, but can make outbound calls to SIP devices.

Webex services for meetings and messaging are hosted in globally distributed data centers that are either Cisco owned (e.g. Webex data centers for identity services, meeting services, and media servers) or hosted in a Cisco Virtual Private Cloud (VPC) on the Amazon AWS platform (e.g. Webex messaging micro-services, messaging storage services). Webex services also reside in Microsoft Azure data centers for Video Interop with Microsoft Teams (VIMT).

トラフィックのタイプ:

Webex app and Cisco Video devices establish signaling and media connections to the Webex cloud.

Signaling traffic
Webex app and Cisco Video devices use HTTP as HTTP over TLS (HTTPS) and Secure Web Sockets (WSS) over TLS for REST based signaling to the Webex cloud. Signaling connections are outbound only and use URLs for session establishment to Webex services.

TLS signaling connections to Webex services use TLS version 1.2 or 1.3. The cipher selection is based on the Webex server TLS preference.

Using either TLS 1.2 or 1.3, Webex prefers ciphers suites using:

• ECDHE for key negotiation
• RSA-based certificates (3072-bit key size)
• SHA2 authentication (SHA384 or SHA256)
• Strong encryption ciphers using 128 or 256 bits (for example, AES_256_GCM)

Webex supports cipher suites in the following preference order for TLS version 1.2 connections*:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Note - CBC mode encryption is supported for older browsers without more secure GCM mode encryption.
   
Webex supports cipher suites in the following preference order for TLS version 1.3 connections*:

TLS_AES_256_GCM_SHA384
TLS_CHACHA_POLY1305_SHA256
TLS_AES_128_GCM_SHA256

Note – With TLS 1.3, ECDHE key negotiation and RSA-based certificates are a mandatory part of the specification and this detail is therefore omitted in the cipher suite description.
 
*The cipher suites and cipher suite preference order may vary for some Webex services
 
Establishing signaling connections to Webex services using URLs
If you have deployed proxies, or firewalls to filter traffic leaving your enterprise network, the list of destination URLs that need to be allowed to access the Webex service can be found in the section "Domains and URLs that need to be accessed for Webex Services".

Webex strongly recommends that you do not alter or delete HTTP header values as they pass through your proxy/ firewall unless permitted in these guidelines https://www.w3.org/TR/ct-guidelines/#sec-altering-header-values. Modification or deleting of HTTP headers outside of these guidelines can impact access to Webex Services, including loss of access to Webex services by Webex apps and Cisco Video devices.

IP アドレスによる Webex シグナリング トラフィックのフィルタリングは、Webex により使用される IP アドレスが動的で、いつでも変更されてしまう可能性があるため、サポートされていません。

Media traffic
The Webex app and Cisco Video devices encrypt real-time media for audio, video, and content sharing streams using the following encryption ciphers:

• AES-256-GCM 暗号化
• AES-CM-128-HMAC-SHA1-80 暗号化

AES-256-GCM is the preferred encryption cipher by the Webex app and Cisco Video devices to encrypt real time media.      

AES-CM-128-HMAC-SHA1 is a mature cipher that has proven interoperability between vendors. AES-CM-128-HMAC-SHA1 is typically used to encrypt media to Webex services from endpoints using SRTP with SIP signaling (e.g. Cisco and 3rd party SIP devices).

In preference order, Webex apps and Cisco Video devices support UDP, TCP and TLS as media transport protocols. If UDP ports are blocked by your firewall, Webex apps and Cisco Video devices will fall back to TCP. If TCP ports are blocked Webex apps and Cisco Video devices will fall back to TLS.

UDP – Cisco recommended media transport protocol
In line with RFC 3550 RTP – A Transport Protocol for Real-Time Applications, Cisco prefers and strongly recommends UDP as the transport protocol for all Webex voice and video media streams.
 
Disadvantages of using TCP as a media transport protocol
Webex apps and Cisco Video devices also support TCP as a fall-back media transport protocol. しかし、Cisco は音声とビデオ メディア ストリームのトランスポート プロトコルとして、TCP を推奨していません。これは、TCP が接続指向であり、データを上位レイヤーのプロトコルに信頼性をもって配信し、正しく順序付けられるように設計されているためです。TCP を使用すると、送信側は損失したパケットを確認応答されるまで再送信し、受信側は損失したパケットが回復するまでパケット ストリームをバッファします。メディア ストリームの場合、この動作は待ち時間/ジッタの増大として現れ、通話の参加者により経験されるメディアの品質に影響します。

Disadvantages of using TLS as a media transport protocol
Encrypted TCP connections (TLS) can suffer from a further degradation in media quality due to potential Proxy server bottlenecks. If TLS is used as the media transport protocol by Webex apps and Cisco Video devices with a configured proxy server, this media traffic will be routed through your proxy server which can create bandwidth bottlenecks and subsequent packet loss.   Cisco strongly recommends that TLS is not used to transport media in production environments.

Webex メディアは、内部で開始された 5 タプル（送信元 IP アドレス、宛先 IP アドレス、送信元ポート、送信先ポート、プロトコル）のストリームを Webex Cloud に発信する対称のストリームを使用して、双方向にメディアをフローさせます。
 
The Webex app and Cisco Video devices also use STUN (RFC 5389) for firewall traversal and media node reachability testing. 詳細については、「Webex ファイアウォール テクニカル ペーパー」を参照してください。
 
Webex  – Destination IP address ranges for media
To reach Webex media servers that process media traffic leaving your enterprise network, you must allow the IP subnets that host these media services to be reachable via your Enterprise firewall. Webex メディア ノードに送信されるメディア トラフィックの宛先 IP アドレス範囲は、セクション「Webex メディア サービスの IP サブネット」で確認できます。