Choosing a Deployment Model for a Regulated Multinational with On-Premises Calling
A European healthcare group with 12,000 employees runs Cisco Unified Communications Manager 14 on-premises in Frankfurt and Singapore, with PSTN gateways in both sites. The company wants to adopt Webex App for messaging and meetings but must keep all clinical call recordings and voicemail in the EU. Latency between Singapore and Frankfurt averages 180 ms. They already have an Expressway-C/E pair in Frankfurt for Mobile and Remote Access serving 3,000 remote clinicians, but Singapore has no Expressway. The CIO wants a hybrid model that preserves existing CUCM dial plans and hunt groups, avoids duplicating user identities, and limits PSTN spend. A pilot of 200 users is planned for 90 days. Procurement asks whether Webex Calling, UCM Cloud, or a Webex Hybrid model is appropriate. The security team will not allow inbound ports from the internet to CUCM.
1. Recommend a target deployment model for the 200-user pilot and the eventual 12,000-user rollout. Justify the choice against Webex Calling, UCM Cloud, and a Webex Hybrid model, and state which components must sit in Singapore.
Read the worked answer
The best fit is a Webex Hybrid model: keep CUCM as call control and voicemail, use Webex cloud for messaging and meetings, and connect the two with Hybrid Services. Webex Calling would move call control and PSTN to the cloud, which conflicts with the requirement to preserve existing CUCM dial plans, hunt groups, and EU voicemail/recording controls unless a full migration is funded. UCM Cloud could preserve CUCM behavior, but it still relocates call control and does not address the existing Frankfurt investment or the no-inbound-to-CUCM constraint as cleanly. Hybrid lets the pilot use the existing Frankfurt Expressway pair for 200 users while Directory Connector and SSO prevent duplicate identities.
Singapore must get its own Expressway-C/E pair before rollout because 180 ms to Frankfurt is poor for MRA and Hybrid Services registration; centralizing the pair adds latency and a single point of failure. The Singapore pair should register to the same Webex organization and CUCM cluster. Validate that Webex Meetings data residency is set to the EU region, while clinical voicemail and recordings remain on CUCM. Do not expose CUCM to the internet; all traversal stays through Expressway.
2. What must be validated on the Expressway and certificates before the pilot can be considered production-ready?
Read the worked answer
Validate Expressway capacity, certificates, NAT, DNS, and service registration before calling the pilot production-ready. Confirm the Frankfurt Expressway-E public certificate is CA-signed, contains the Expressway-E FQDN and the collaboration/MRA domains used by Webex, and chains correctly; Expressway-C should trust the same CA. Check that Expressway-E static NAT is configured with the correct public IP and that the firewall permits inbound TCP 443 and 8443 for MRA and Hybrid Services, plus SIP 5061 where required. Outbound from Expressway-C to Webex must be allowed on TCP 443.
Confirm the Expressway pair is registered and healthy in Control Hub, Hybrid Calendar/Directory/Message connectors show connected, and the 200 pilot users can register externally. Test capacity against 3,000 remote clinicians plus 12,000 eventual users, not just the pilot. Validate DNS resolution from Expressway-C to CUCM and from Expressway-E to the Webex cloud. Because Singapore has no local pair, measure pilot users there separately; if they are included, expect poor results until a Singapore pair exists.
3. Identify two architecture risks and the migration sequencing you would use.
Read the worked answer
Risk one is identity duplication: Directory Connector can create a second Webex identity if users already have consumer or acquired-company accounts with alias email addresses. Risk two is calendar/room-resource mismatch: clinical rooms and scheduling may depend on Exchange resources that are not ready for Hybrid Calendar, and recordings must remain in the approved EU store.
Sequence the work as follows: clean Active Directory (UPN, mail, alias) first; claim domains and enable SSO; deploy Directory Connector into a test group; pilot messaging and meetings for 200 Frankfurt users; add Hybrid Calendar only after Exchange permissions and room mailboxes are validated; then enable MRA for the pilot. Add the Singapore Expressway pair before extending to Singapore users. Keep CUCM dial plans and PSTN gateways unchanged during the pilot, and define rollback by disabling Hybrid Services in Control Hub rather than changing CUCM call routing.