I85PREP
⌘ K
CCIE Collaboration study materials
CCIE Collaboration study resources

CCIE Collaboration: Collaboration Edge and Security

CCIE Collaboration · Work through your exam, one topic at a time.

All guide sections

Collaboration Edge and Security

Domain 4: Collaboration Edge and Security

This domain tests Expressway Mobile and Remote Access, business-to-business calling, CUBE, certificate and firewall design, secure signaling, and toll-fraud controls. The exam expects you to trace a remote Jabber or SIP call across zones and trust boundaries.

Core rules

  • MRA uses Expressway-C inside the enterprise and Expressway-E in the DMZ, joined by a traversal zone. Expressway-E presents a public CA-signed certificate; Expressway-C uses an internal certificate trusted by CUCM and IM&P.
  • Firewall openings for MRA include HTTPS, SIP TLS, and TURN media ports; DNS SRV records must resolve the Expressway-E name from outside.
  • Jabber MRA uses UDS for configuration and contact search, IM&P for presence, and CUCM for call control; no VPN is required.
  • B2B calling uses Expressway neighbor zones and SIP normalization to reconcile dial plans and SIP dialects.
  • CUBE terminates SIP trunks, applies SIP profiles, and enforces dial-peer policy. Toll-fraud prevention includes restricting dial peers, using translation profiles, and blocking unauthorized outbound patterns.
  • Security design includes TLS 1.2 for SIP, SRTP for media, certificate trust, SAML SSO for CUCM, and hardened access to administrative interfaces.

Worked example

Remote Jabber users cannot log in over MRA. Check the Expressway-E certificate SANs for the SIP and XMPP domains, confirm the traversal zone is active, verify inbound firewall rules for HTTPS and SIP TLS, confirm external DNS SRV records, and check that Expressway-C is registered as an MRA server in CUCM. Reasoning: MRA fails at the first broken trust or discovery step; certificates, DNS, firewall, and traversal zone are the usual sequence.

Traps

  • Placing Expressway-C in the DMZ; it belongs inside, with Expressway-E in the DMZ.
  • Using self-signed certificates on Expressway-E for remote clients.
  • Opening only HTTPS and forgetting SIP TLS or TURN media ports.
  • Assuming B2B works without SIP normalization when provider dialects differ.
  • Leaving unrestricted dial peers on CUBE and enabling toll fraud.