Before the first phone
Deployment
The port chapter is also a deployment checklist. These are the rows that decide whether the cluster comes up.
- Publisher first. The first node you install is the publisher. Subscribers install against it. Port 22/TCP has to stay open and unthrottled during that install.
- Time. CUCM uses NTP on 123/UDP. Certificates and CDRs lie when clocks disagree.
- Names. Phones resolve the cluster. Inside, _cisco-uds._tcp. Outside, for Mobile and Remote Access, _collab-edge._tls. A public answer for cisco-uds is the wrong record.
- Certificates. TLS on 5061 and HTTPS on 443 and 8443 fail closed when the name does not match. CAPF for phone certificates listens on 3804/TCP.
- Backups. DRS sends backups to SFTP on 22/TCP. A cluster without a tested restore is a design, not a deployment.
- Do not run DHCP on CUCM. The port chapter says Cisco does not recommend the CUCM DHCP server or DHCP client. Give the nodes static addresses.
- Phones get files on TFTP 69/UDP and HTTP 6970/TCP. SCCP is 2000/TCP. SIP is 5060 and 5061.
SRST is the branch router keeping phones registered when the WAN to CUCM is down. Failback is its own problem: the WAN can return while phones stay on the router. Treat that as a registration symptom, not a dial-plan symptom.