I85PREP
⌘ K
Cisco 300-830 CLCCE study materials
Cisco 300-830 CLCCE study resources

Cisco 300-830 CLCCE: Cloud and Edge Networking Fundamentals

Cisco 300-830 CLCCE · Work through your exam, one topic at a time.

All guide sections

Cloud and Edge Networking Fundamentals

Domain 2, Cloud and Edge Networking Fundamentals, tests the plumbing beneath the architecture: DNS, ports, NAT, certificates, and media paths. Most failed edge deployments are correct products with wrong networking, so the exam asks for exact records and exact ports.

Name resolution

  • Internal clients use _cisco-uds._tcp.<domain> to find Unified CM, and _cuplogin._tcp for IM&P.
  • External MRA clients use _collab-edge._tls.<domain>; the SRV target must resolve to the Expressway-E public address.
  • Split DNS: the internal view resolves Unified CM and Expressway-C; the external view resolves only Expressway-E.

Ports that matter

  • Internet to Expressway-E inbound: TCP 5061 (SIP TLS), 5222 (XMPP), 8443 (HTTPS/UDS).
  • Expressway-C to Expressway-E: TCP 7001, or 7443 for TLS traversal; never expose 7001 to the internet.
  • Expressway-C to Unified CM: TCP 5061 and 8443.
  • CUBE media: RTP/RTCP UDP 16384–32767; SIP 5060 or 5061.

NAT and interfaces

Expressway-E has two interfaces, one facing Expressway-C and one facing the internet, with static NAT on the external side. Do not NAT between C and E, and disable NAT reflection on the firewall. CUBE typically sits behind NAT with its signaling and media ports mapped one-to-one.

Certificates and TURN

Both Expressways need CA-signed certificates from a trusted CA; the E certificate SANs must include the FQDNs clients resolve, including the SRV target. Expressway-E can run a TURN server (UDP/TCP 3478, TLS 5349) to relay media when ICE cannot find a direct path.

Worked example

Jabber works inside but not outside. Check in order: does _collab-edge._tls resolve publicly? Does the Expressway-E certificate chain validate and cover the SRV target? Is TCP 8443 open inbound? Is the traversal zone up? A failure at any step produces the same symptom, "cannot sign in", which is why the checks are ordered rather than guessed.

Traps

  • Publishing _cisco-uds externally and pointing clients at Unified CM.
  • Using self-signed certificates or omitting the intermediate chain.
  • Allowing 7001 inbound "to make traversal work".
  • Forgetting TURN ports, then blaming the dial plan for one-way media.