Lab / Ecosystem atlas

Ecosystem atlas

Calling, Contact Center, Meetings, Devices, Control Hub, workforce management, recording, emergency calling, analytics, and AI agents. Diagrams are study drawings. They are not Cisco architecture posters.

SIP TLS toward the cloud. Endpoints do not register through the Local Gateway.

Certificate-based trunks use destination TCP 5062. The FQDN must match the certificate.

Registration-based trunks use destination TCP 8934. The Canon records a 250-call CUBE cap for that mode.

One PSTN choice per location. Premises PSTN uses a Local Gateway.

Outbound media from the local gateway. UDP is the production transport. TCP media is not supported.

When ICE succeeds inside the org, media can go direct on these ranges.

Devices send direct media on 19560-19661 when optimization succeeds. Room Series uses its own ranges.

RedSky. 933 does not alert public safety. Kari's Law email is a separate Control Hub setting.

Choose the provider before you enable users. Processing media disables Calling end-to-end encryption.

E2EE is opportunistic and off by default. Recording, auto attendant, and a mixer drop it.

The organization is the boundary. People you add start without admin rights.

Org SSO maps an attribute to uid. Partner SSO uses mail, not uid.

Firmware and activation also use 6970 and, for older MIC renewal, port 80 to sudirenewal.cisco.com.

b2exve tells suite customers to also allow the Meetings network-requirements article. This drawing does not copy that matrix.

Multi-tenant contact center. The flow is not a Unified CM dial plan.

Start Flow cannot be removed. Validation starts off. Publish waits for a clean check.

Bring-your-own virtual agent must escalate with AGENT_TRANSFER.

Orientation for workforce management. SKU scope in py6u9h is Enterprise, CCE, and CCX. Multi-tenant fit stays unverified.

Keep Analyzer's clocks apart from the desktop widget. The rooms record a 5-second default versus 60 seconds on the widget.

Salesforce is Lightning only. On-premises Dynamics is unsupported on the connector article. Chat and email are not on these connectors.

Canon study order, not a Cisco runbook. Calling migration and contact-center migration are different projects.

Do not edit a port order after FOC. Test emergency with 933 before you call the public network.

Dedicated Instance is not multi-tenant Calling. Interop trunks are certificate trunks.

Site survivability is a gateway mode. It is not a second Webex cloud.

b2exve QoS table. Windows source-port split for audio versus video needs the port-range feature enabled.

Filter HTTPS by domain. Filter signaling and media by port and the article's IP subnets. Do not paste subnets from memory.

Phones may reuse SIP source ports. Strict source-port preservation breaks registration. Turn SIP ALG off.

cscan.webex.com is a pre-check. It is not a substitute for a live call.

Control Hub

The organization is the boundary for users, roles, locations, and services. A person you add starts without administrative privileges. T1-R01. Control Hub article.

Webex Calling

Each location picks Cisco Calling Plan, Cloud Connected PSTN, or premises PSTN on a Local Gateway. Phones do not register through that gateway. T2-R01 T2-R02.

Devices

Claim by MAC or activation code. Firmware and activation use the device-configuration ports in the Calling port reference, including TCP 443 and 6970. T2-R04.

Meetings

The Calling port reference tells suite customers to also allow the separate network-requirements article for Meetings and messaging. This atlas does not copy that matrix. Meeting UDP ranges are not restated here. b2exve.

Webex Contact Center

Multi-tenant: entry point, flow, queue, team. Enterprise is a different product with Router, Logger, PG, and CUIC. T3-R01 T4-R01.

Workforce management

Forecast, schedule, and adherence live with WFO, not with Calling CDR. Article py6u9h scopes the listed WFO SKUs to Enterprise, CCE, and CCX. Multi-tenant applicability is unverified. T3-R09.

Recording and quality

Select the Calling provider before you enable users. Webex recordings: one year, 100 GB. Dubber Go: 30 days. Recording disables Calling end-to-end encryption. Quality-management SKUs are a contact-center add-on, not that toggle. T2-R06.

E911

Port 443 to api.wxc.e911cloud.com and wxc.e911cloud.com. Test with 933. Do not prove the design by calling emergency services. Ports page.

Analytics

Control Hub analytics retention and the Calling troubleshooting view are different clocks. The Canon records a 21-day troubleshooting window and a longer analytics window for Pro Pack. Re-check both live articles before you quote a retention number in a design. T1-R06 T2-R08 T3-R07.

AI agents

Virtual Agent–Voice, AI Assistant, and AI Agent Studio are different surfaces. A bring-your-own virtual agent escalates with AGENT_TRANSFER. T8-R05.

Integrations and future hooks

Published connectors: Salesforce Lightning, Dynamics CIF, ServiceNow. No customer logo wall is drawn here, because this lab does not invent deployments. A future hook is a webhook or connector you have not turned on: recording events, Connect flows, and CRM screen pop. Build from the article, not from a peer-product column. T8-R03 T8-R04.

Sources

Port Reference for Cisco Webex Calling, retrieved 2026-10-15. Revision history includes September 07, 2026.
Enhanced emergency calling for Webex Calling.
Manage call recording for Webex Calling.
End-to-end encryption for Webex Meetings and Webex Calling.
Configure Virtual Agent-Voice and bring your own virtual agent.
Webex WFO feature-specific SKUs.