I85PREP
⌘ K
Cisco 300-815 CLACCM study materials
Cisco 300-815 CLACCM study resources

Cisco 300-815 CLACCM: Mobility and Remote Access

Cisco 300-815 CLACCM · Work through your exam, one topic at a time.

All guide sections

Mobility and Remote Access

Domain 4 - Mobility and Remote Access

This domain (10%) tests how Jabber and other clients reach CUCM from outside the network - primarily Mobile and Remote Access (MRA) through Expressway, plus VPN and hybrid services.

MRA architecture

MRA lets Jabber register to CUCM without a VPN. Traffic flows client → Expressway-E (in the DMZ) → Expressway-C (inside) → CUCM. Between C and E you configure a Unified Communications traversal zone, with the C side acting as traversal client and the E side as traversal server. On Expressway-C you define the Unified CM servers with TLS verification enabled.

Service discovery and certificates

  • Public DNS holds a SRV record _collab-edge._tls.<domain> pointing at the Expressway-E, plus an A record.
  • Internal DNS holds _cisco-uds._tcp and _cuplogin._tcp pointing at CUCM. Jabber resolves _cisco-uds first: if it answers, the client is inside and connects directly; if not, it falls back to _collab-edge and goes out through Expressway.
  • The Expressway-E certificate must be CA-signed and include the SRV domain (for example collab-edge.example.com) in its SANs; Expressway-C must trust Expressway-E and the CUCM tomcat and CallManager certificates.
  • Client-facing ports on Expressway-E are SIP over TLS 5061 and HTTPS 8443.

VPN and hybrid

Jabber can instead ride an AnyConnect VPN, detecting the tunnel and re-registering inside. Hybrid services (call and messaging) are delivered by registering Expressway-C with the Webex cloud through the Hybrid Services connector. Neither MRA nor VPN replaces SRST survivability at a branch.

Worked example

Remote Jabber users report they cannot sign in, while office users are fine. Public DNS has both _collab-edge._tls and _cisco-uds records. Jabber resolves _cisco-uds to the CUCM publisher, attempts HTTPS 8443 straight to the cluster, times out at the firewall, and never tries Expressway. The fix is to remove _cisco-uds from public DNS and keep it internal only.

Traps that cost marks

  • Leaving internal discovery records in public DNS - the most common MRA failure.
  • A certificate whose SAN holds the hostname but not the SRV domain, so clients reject the TLS handshake.
  • Forgetting to enable the traversal zone or the UC traversal option, so Expressway-E accepts registrations but cannot reach CUCM.
  • Assuming MRA provides branch survivability; it does not replace SRST.