Cisco CLCEI 300-820 cheat sheet

Cloud-only Webex: all services (calling, messaging, meetings) hosted by Cisco; Control Hub is the single admin plane and no on-premises UC infrastructure is required.

Hybrid services split control and media: Control Hub manages users and licensing in the cloud while call control, gateways, and PSTN stay on-premises (e.g., Hybrid Calling with Unified CM).

Webex Hybrid Calling registers devices to cloud Webex but routes calls through the on-premises Unified CM via a connector (Expressway-based or Cisco Webex Hybrid Call Service), keeping PSTN on local gateways.

Hybrid Calendar, Hybrid Message (Unity Connection), and Hybrid Directory are separate opt-in services; enabling one does not enable the others, and each has its own connector prerequisites.

The Webex Edge for Devices model registers room devices to the cloud for management/software while media can remain on-premises via Webex Edge Connect or local gateway, reducing WAN dependency.

Non-hybrid (cloud-only) calling uses Webex Calling with Cisco or third-party PSTN; hybrid calling is chosen when existing Unified CM dial plans, gateways, and PSTN contracts must be preserved.

Cisco Webex Hybrid Services require a supported connector host (Expressway-C/E pair or a dedicated connector VM) with outbound TCP 443 to Webex cloud endpoints and no inbound firewall openings.

Deployment decision rule: if the customer requires cloud meetings/messaging but keeps existing PBX dial plans and PSTN, select Hybrid Calling; if no on-prem UC exists, select Webex Calling (cloud-only).

Control Hub is the cloud portal for user, device, and license management; roles include Full Administrator, User Administrator, Device Administrator, and Read-Only Administrator, assignable per organization or per location.

Licensing is subscription-based per user: a Webex Meetings license and a Webex Calling license are separate SKUs; assigning a Calling license to a user without a device or number provisions the softphone only.

Bulk user provisioning uses CSV templates in Control Hub (Users > Manage Users > Import); required columns include email, display name, and license assignments, and errors are reported per row.

Directory synchronization from Active Directory (via Cisco Directory Connector) or Azure AD creates and maintains users in Control Hub; synced attributes are authoritative, and manual edits to synced fields are overwritten on next sync.

License assignment can be automated via directory group mapping (e.g., AD security groups mapped to Webex licenses) so that group membership drives entitlement without manual Control Hub edits.

Control Hub analytics and troubleshooting include call quality (MOS), meeting diagnostics, and device status; the Troubleshooting section shows per-user call and meeting history for a rolling window.

Single sign-on (SSO) in Control Hub uses SAML 2.0 with an identity provider (e.g., Azure AD, Okta); once SSO is enforced, local Control Hub passwords are disabled for those users.

Control Hub enforces number management: phone numbers are assigned to users, workspaces, or auto-attendants, and unassigned numbers remain in the inventory for later assignment or release.

Expressway-C sits in the internal network and connects to Unified CM and other internal services; Expressway-E sits in the DMZ and terminates the secure tunnel to the Webex cloud.

The Expressway-C to Expressway-E connection uses a secure traversal zone over TCP 7001 (and 7002 for some services); the Expressway-E to Webex cloud uses outbound TCP 443 only, with no inbound ports required.

Firewall rules: internal-to-DMZ allow TCP 7001/7002 and needed media ports; DMZ-to-internet allow outbound TCP 443 to Webex cloud endpoints and UDP for media (e.g., 33434-33598 or the configured range).

Expressway-E requires a public certificate signed by a trusted CA for the traversal zone and a DNS SRV/A record resolvable from the internet; the certificate must include the Expressway-E FQDN.

Traversal zone configuration: on Expressway-C set the traversal zone to point to Expressway-E, enable 'Traversal' and 'Media' on the zone, and configure the same shared credentials on both peers.

Hybrid services (Calendar, Calling, Message, Directory) each are enabled on the Expressway-C connector; the connector registers to Webex cloud and shows status in Control Hub under Services.

NAT and DNS: Expressway-E in the DMZ typically uses static NAT; ensure the external DNS name resolves to the NAT address and that hairpin NAT is not required for cloud endpoints.

Troubleshooting checklist: verify Expressway-C/E tunnel status, certificate validity and chain, DNS resolution of Webex cloud domains, and outbound 443 connectivity from Expressway-E.