Collaboration Edge and Services
Traversal, not just firewall pinholes
The Expressway pair is the centerpiece. Expressway-C sits in the enterprise, neighbors with CUCM through a traversal zone and a neighbor zone. Expressway-E sits in the DMZ facing the internet. Traffic between them crosses as a single TLS tunnel, so you never open a range of inbound RTP ports. Mobile and Remote Access lets Jabber register from outside without VPN: the client discovers Expressway-E through DNS SRV records, authenticates via CUCM, and carries signaling and media over the traversal zone.
B2B and the border element
Business-to-business calling uses Expressway-E as the edge with SRV-based dialing and static or dynamic peers. Cisco Unified Border Element (CUBE) is the SIP demarcation to the ITSP: normalization, header manipulation, codec and DTMF interworking, and security. Place CUBE between CUCM and the provider; place Expressway between CUCM and the internet.
Certificates and DNS fail first
Nearly every edge question turns on certificates: the CA chain must be complete, the SANs must include the names clients actually resolve, and C and E must trust each other's CA. The _collab-edge._tls SRV record must resolve to Expressway-E, and A/PTR records matter for SIP.
Worked example
Jabber signs in on the LAN but fails from home. Check in order: the SRV record, the Expressway-E certificate chain, traversal zone status, CUCM certificate trust on Expressway-C, and the user's UC service profile.