All cloud registered Webex apps and Cisco Video devices initiate outbound connections only. Cisco’s Webex Cloud never initiates outbound connections to cloud registered Webex apps and Cisco Video devices, but can make outbound calls to SIP devices.

Webex services for meetings and messaging are hosted in globally distributed data centers that are either Cisco owned (e.g. Webex data centers for identity services, meeting services, and media servers) or hosted in a Cisco Virtual Private Cloud (VPC) on the Amazon AWS platform (e.g. Webex messaging micro-services, messaging storage services). Webex services also reside in Microsoft Azure data centers for Video Interop with Microsoft Teams (VIMT).

סוגי תעבורה:

Webex app and Cisco Video devices establish signaling and media connections to the Webex cloud.

Signaling traffic
Webex app and Cisco Video devices use HTTP as HTTP over TLS (HTTPS) and Secure Web Sockets (WSS) over TLS for REST based signaling to the Webex cloud. Signaling connections are outbound only and use URLs for session establishment to Webex services.

TLS signaling connections to Webex services use TLS version 1.2 or 1.3. The cipher selection is based on the Webex server TLS preference.

Using either TLS 1.2 or 1.3, Webex prefers ciphers suites using:

• ECDHE for key negotiation
• RSA-based certificates (3072-bit key size)
• SHA2 authentication (SHA384 or SHA256)
• Strong encryption ciphers using 128 or 256 bits (for example, AES_256_GCM)

Webex supports cipher suites in the following preference order for TLS version 1.2 connections*:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Note - CBC mode encryption is supported for older browsers without more secure GCM mode encryption.
   
Webex supports cipher suites in the following preference order for TLS version 1.3 connections*:

TLS_AES_256_GCM_SHA384
TLS_CHACHA_POLY1305_SHA256
TLS_AES_128_GCM_SHA256

Note – With TLS 1.3, ECDHE key negotiation and RSA-based certificates are a mandatory part of the specification and this detail is therefore omitted in the cipher suite description.
 
*The cipher suites and cipher suite preference order may vary for some Webex services
 
Establishing signaling connections to Webex services using URLs
If you have deployed proxies, or firewalls to filter traffic leaving your enterprise network, the list of destination URLs that need to be allowed to access the Webex service can be found in the section "Domains and URLs that need to be accessed for Webex Services".

Webex strongly recommends that you do not alter or delete HTTP header values as they pass through your proxy/ firewall unless permitted in these guidelines https://www.w3.org/TR/ct-guidelines/#sec-altering-header-values. Modification or deleting of HTTP headers outside of these guidelines can impact access to Webex Services, including loss of access to Webex services by Webex apps and Cisco Video devices.

סינון של תעבורת איתות Webex לפי כתובת IP אינו נתמך מכיוון שכתובות IP המשמשות את Webex הן דינמיות ועשויות להשתנות בכל עת.

Media traffic
The Webex app and Cisco Video devices encrypt real-time media for audio, video, and content sharing streams using the following encryption ciphers:

• צופן AES-256-GCM
• צופן AES-CM-128-HMAC-SHA1-80

AES-256-GCM is the preferred encryption cipher by the Webex app and Cisco Video devices to encrypt real time media.     

AES-CM-128-HMAC-SHA1 is a mature cipher that has proven interoperability between vendors. AES-CM-128-HMAC-SHA1 is typically used to encrypt media to Webex services from endpoints using SRTP with SIP signaling (e.g. Cisco and 3rd party SIP devices).

In preference order, Webex apps and Cisco Video devices support UDP, TCP and TLS as media transport protocols. If UDP ports are blocked by your firewall, Webex apps and Cisco Video devices will fall back to TCP. If TCP ports are blocked Webex apps and Cisco Video devices will fall back to TLS.

UDP – Cisco recommended media transport protocol
In line with RFC 3550 RTP – A Transport Protocol for Real-Time Applications, Cisco prefers and strongly recommends UDP as the transport protocol for all Webex voice and video media streams.
 
Disadvantages of using TCP as a media transport protocol
Webex apps and Cisco Video devices also support TCP as a fall-back media transport protocol. עם זאת, Cisco אינה ממליצה על TCP כפרוטוקול הובלה עבור זרמי מדיית קול ווידאו. הסיבה לכך היא ש-TCP מכוון לחיבור, ונועד לספק נתונים המסודרים נכון בצורה מהימנה לפרוטוקולים של השכבה העליונה. באמצעות TCP, השולח ישדר מחדש מנות אבודות עד שיקבלו אישור, והקולט יבצע אגירה של זרם המנות עד לשחזור המנות האבודות. עבור זרמי מדיה, התנהגות זו באה לידי ביטוי כהשהיה/ריצוד מוגברים, אשר בתורם משפיעים על איכות המדיה שחווים משתתפי השיחה.

Disadvantages of using TLS as a media transport protocol
Encrypted TCP connections (TLS) can suffer from a further degradation in media quality due to potential Proxy server bottlenecks. If TLS is used as the media transport protocol by Webex apps and Cisco Video devices with a configured proxy server, this media traffic will be routed through your proxy server which can create bandwidth bottlenecks and subsequent packet loss.  Cisco strongly recommends that TLS is not used to transport media in production environments.

מדיה של Webex זורמת בשני הכיוונים באמצעות סטרימינג פנימית יזומה של 5 רשומות (כתובת IP של מקור, כתובת IP של יעד, יציאת מקור, יציאת יעד, פרוטוקול) היוצאת אל ענן Webex.
 
The Webex app and Cisco Video devices also use STUN (RFC 5389) for firewall traversal and media node reachability testing. לפרטים נוספים, עיין בסקירה טכנית של חומת האש של Webex.
 
Webex  – Destination IP address ranges for media
To reach Webex media servers that process media traffic leaving your enterprise network, you must allow the IP subnets that host these media services to be reachable via your Enterprise firewall. ניתן למצוא את טווחי כתובת IP של היעד עבור תעבורת מדיה הנשלחת לצמתי מדיה של Webex בקטע "רשתות משנה של IP עבור שירותי מדיה של Webex".