00 · Header

T4 · Webex Contact Center Enterprise

Sizing & HA

Gateway Enterprise T4-R08 PSTNCVPRouterDesktop
Illustrated scene for Sizing & HA. Original drawing, not a product screenshot.
Sequence · PSTN → CVP → Router → Desktop PSTNCVPRouterDesktop 123
Color-coded sequence: PSTN → CVP → Router → Desktop. A packet moves along the arrows. Reduced motion keeps every step visible.

Unified CCE high availability is Side A and Side B for redundancy, not for load-balancing. A Webex CCE what’s-new sentence about 48,000 agents is a different number from the Finesse 2,000-user line in the design guide.

Room T4-R08 Version v0.1 last-verified: TODO Difficulty L3 Est. time 90–110 min Prereq T4-R01 Reading 22 min

01 · Executive summary

Five lines, then why it matters

  • The private network carries synchronization and MDS traffic. The public network carries traffic between Central Controllers and PGs and is the alternate path that distinguishes a component failure from a network failure. [cite:1]
  • Never split one component’s private traffic onto a low-priority path and a high-priority path. That disables failover. [cite:1]
  • On a private-network failure, a router with device majority goes isolated-enabled and keeps handling traffic. Without majority it goes isolated-disabled and stops. [cite:1]
  • If the private network stays down longer than the 14-day retention of Config_Message_Log, logger resynchronization uses Unified ICMDBA. [cite:1]
  • Where possible, do not run devices, call processing, or CTI Manager on the Unified CM publisher. PGs are hot standby: only one side is active. [cite:1]
Why it matters. People add Side A and Side B and then load-balance calls across them. The design guide says the opposite. People also paste 2,000, 12,000, and 48,000 into one sentence. Those numbers live on different pages.

02 · Architecture map

Two sides, two networks

  • 1Side A majority rule
  • 2Side B majority rule
  • 3Private path stays whole
  • 4Public path, redundant if you can
Mermaid source (not rendered)
flowchart LR
  A[Side A] --- P[Private network]
  B[Side B] --- P
  A --- U[Public network]
  B --- U

03 · Core concepts

Redundancy, majority, and three different caps

Not load-balancing

The two sides are for redundancy, not load-balancing. Either side can run the full load. Sides A and B perform the same messages and produce the same result. During a failure the surviving Router takes the call midstream without user intervention. [cite:1] re-check

PG hot standby

Only one PG is active and controlling the peripheral. When the active side fails, the surviving side takes over and runs stand-alone until the other side returns. Then the PGs return to redundant operation. [cite:1]

Device majority is asymmetric

Side A has majority when it can communicate with at least half of its total enabled PGs. Side B has majority when it can communicate with more than half. Each router decides for itself. [cite:1]

Three caps, three pages

The design guide says each Finesse server can support the CTI maximum of 2,000 users, and the total across the two servers in that cluster cannot exceed 2,000. The same chapter names 2000 Agent, 4000 Agent, and 12,000 Agent Reference Designs in a QoS paragraph. A January 2025 Webex CCE what’s-new line says 48,000 concurrent agents and 300 calls per second on a single tenant. Do not add them. [cite:1] [cite:2]

What each failure does

FailureWhat the design guide saysCite
Private network onlyRouters enter isolated-enabled or isolated-disabled based on device majority. They resynchronize when the private network returns.[cite:1]
Router has no majorityIsolated-disabled. It stops processing traffic.[cite:1]
LoggerShuts down when its router goes idle. Each logger talks only to its own router. Automatic resync if the private network returns before 14 days of Config_Message_Log retention. After that, Unified ICMDBA.[cite:1]
Call already at VRU or agentA router failure does not affect it.[cite:1]
Public network, desktop and phone on opposite sidesThe phone stays on the other subscriber. The PG cannot see it. Unified CCE signs the agent out.[cite:1]
Both networks between sitesCatastrophic. Each router checks majority. Calls whose voice path is on the failed public WAN fail, and the PG writes a TCD. If both sides are isolated-enabled, Side B’s service restarts when the network is restored.[cite:1]
CUIC clusterA publisher and up to 7 subscribers. Processing spreads across active nodes and bypasses failed nodes.[cite:1]
Unified CM publisherWhere possible, no devices, call processing, or CTI Manager services on the publisher.[cite:1]

04 · Ecosystem

What HA touches

PSTNCVPRouterDesktop This room
Mini map of the neighbors named on this room’s sequence. Orientation sketch, not a new product claim.

Glossary

Side A and Side B
The two redundant instances. Not a load-balance pair. [cite:1]
Private network
Separate physical network for synchronization, MDS, and state transfer after isolation. [cite:1]
Public network
Separate path between Central Controllers and PGs. Also the path that lets fault tolerance tell a dead component from a dead network. [cite:1]
Device majority
The test a router runs when it loses its peer. Side A: at least half the enabled PGs. Side B: more than half. [cite:1]
Isolated-enabled
The router keeps handling traffic because it has device majority. [cite:1]
Isolated-disabled
The router stops processing because it does not have device majority. [cite:1]
Config_Message_Log
14-day retention. Inside that window, logger resync is automatic when the private network returns. [cite:1]
Hot standby PG
One side active. The other takes over and runs stand-alone until redundancy returns. [cite:1]
Finesse 2,000
The design guide’s per-cluster user maximum tied to the CTI server maximum. Both servers together stay at or under 2,000. [cite:1]
Reference design names
2000 Agent, 4000 Agent, and 12,000 Agent appear in the QoS paragraph. They are not the Webex CCE what’s-new figure. [cite:1]
48,000 agents
January 2025 what’s-new: Webex CCE supports 48,000 concurrent agents and 300 calls per second on a single tenant. [cite:2] re-check
TCD
The record the PG creates when a call fails because the public WAN voice path failed. [cite:1]

Mind map

Mermaid source (not rendered)
mindmap
  root((HA))
    Private network
    Public network
    Device majority
    Reference designs

Sister matrix

Orientation only. No parity matrix equates this duplex model with another vendor’s region pair.
SisterWhat the cited page saysWhy it mattersConfig touchpointTypical failureCite
Workforce managementpy6u9h is the WFO SKU scope. The HA chapter does not size WFM servers.Agent count and WFM seats are different worksheets.SKU article, then the WFM guide for that release.Using the Finesse 2,000 line as a WFM server count.[cite:3]
Quality management and recordingNot given a retention number in the HA chapter.A failed public WAN creates a TCD. That is not a recording file.Read the recording guide separately.Treating a TCD as the audio archive.[cite:1]
E911, RAY BAUM, Kari, RedSkyThe HA chapter does not configure emergency calling. SRST is mentioned when an agent site loses the public network to both sites: the voice gateway can provide local dial tone, and phones in SRST cannot function as contact-center agents.Local dial tone is not agent routing, and it is not a location proof.Emergency articles for the phone. This chapter for the sign-out.Calling SRST mode a staffed queue.[cite:1]
Analytics and reportingCUIC is a publisher plus up to 7 subscribers. Processing spreads and skips failed nodes. That is a different pattern from the Router.Do not apply “not load-balancing” to CUIC, and do not apply CUIC’s spread to the Router.T4-R07 for reports. This chapter for the cluster shape.Expecting both routers to split calls because CUIC spreads work.[cite:1]
Salesforce, Dynamics 365, ServiceNowNot sized in this chapter.CRM capacity is not device majority.The CRM guide for the desktop you deployed.Adding CRM users to the PG enabled count.[cite:1]
Virtual agentsNot a duplex rule in the paragraphs read here.A bot leg is still a call the router has already delivered or has not.T4-R05 and the CCAI guide.Counting virtual agents against the Finesse 2,000 line without a page that says to.[cite:2]
IVR and self-serviceOn a public-network loss at an agent site, Unified CVP gateways can run a local survivability TCL script to reroute inbound calls.Survivability script is not the comprehensive SendToVRU path.This chapter for the failure. T4-R05 for the normal IVR.Debugging Call Studio when the gateway is in survivability.[cite:1]
Digital channelsThe same chapter says Digital Routing runs active/standby inside Cloud Connect publisher and subscriber nodes, and that there is no dedicated private network between those Cloud Connect nodes. Replication uses the public network.Digital routing redundancy is not the Router private network.Cloud Connect nodes and the MR PG.Drawing a private MDS link between Cloud Connect nodes.[cite:1]
Identity and SSOCisco IdS is a publisher and a subscriber. The cluster replicates configuration and authorization codes. On reconnect it picks the most recent data.An IdS split is not a router split.IdS cluster. Finesse sign-in is T4-R06.Restarting a router to fix an IdS code mismatch.[cite:1]

Integration edges

FromToMechanismWhat movesCite
Side ASide BPrivate networkSynchronized data, control messages, MDS, state transfer[cite:1]
Central ControllerPGPublic networkTraffic between them. Redundant connections, ideally different carriers.[cite:1]
Router ALogger ADirectMessages only to its own logger. Router B does the same with Logger B.[cite:1]
RouterEnabled PGsDevice majority testHalf, or more than half, depending on the side[cite:1]
Finesse serverCTI serverOne connectionUp to the 2,000-user cluster maximum[cite:1]
CUIC publisherUp to 7 subscribersCluster replicationConfiguration. Work spreads and skips failed nodes.[cite:1]
Cloud ConnectMR PGPublic networkDigital Routing active/standby. No dedicated private network between the Cloud Connect nodes.[cite:1]
Webex CCE tenantAgentsWhat’s-new scale sentence48,000 concurrent agents and 300 CPS, single tenant, January 2025[cite:2] re-check

Bridges

This chapterNeighborPeer labelCite
Unified CCE duplexWebex CCE’s 48,000-agent sentence is a what’s-new line, not a replacement for device majority.No vendor parity matrix.[cite:1] [cite:2]
Reference design QoS names2000, 4000, and 12,000 Agent Reference Designs are named for public-link QoS behavior.A cloud region pair is not automatically one of those designs.[cite:1]
Publisher guidanceDedicated Instance has its own “do not run CallManager on the publisher” line in a different article. Quote the article you are in.Teams Phone survivability is not this private network.[cite:1]

Future hooks

  • Canon plan: when the design guide is updated past March 15, 2025, re-read device majority before you teach the half versus more-than-half rule.
  • The 48,000 / 300 CPS sentence stays re-check until a page newer than January 2025 repeats it.
  • Do not build a firewall ACL from the QoS discussion. The chapter is about priority, not a port list.

Ecosystem troubleshooting

SymptomLikely mix-upCheckMoveCite
Calls are pinned to one side to “use capacity”Load-balancing was assumedThe guide says either side runs the full load and both process every callStop steering. Fix the failed side instead.[cite:1]
Digital tasks stop when someone looks for a private linkCloud Connect was drawn like a Router pairThe chapter says there is no dedicated private network between those nodesCheck MR PG connectivity and the public path.[cite:1]
A proposal quotes 48,000 Finesse users on one PGThe what’s-new tenant figure was pasted onto the Finesse cluster line2,000 is the design-guide cluster total. 48,000 is the what’s-new tenant sentence.Cite each number on its own page.[cite:1] [cite:2]
CUIC is expected to freeze like a router when one node diesThe spread model was ignoredCUIC bypasses failed nodesTreat a dead subscriber as capacity the cluster skips, then read the report guide if data is wrong.[cite:1]

05 · Flow

From a private-network break to a restored logger

StepFromToMechanismNotesCite
1Side ASide BPrivate networkHeartbeats and synchronized state. QoS required.[cite:1]
2Private pathBoth routersFailureEach router tests device majority on its own.[cite:1]
3Router with majorityCallsIsolated-enabledTraffic continues. Route requests queue until that state.[cite:1]
4Router without majorityIdleIsolated-disabledProcessing stops. Its logger shuts down.[cite:1]
5Surviving routerIn-progress VRU or agent callNo tear-down from the router failure itselfThe guide says those calls are not affected by the router failure.[cite:1]
6Private networkLoggersResyncAutomatic inside 14 days. Unified ICMDBA after that.[cite:1]
7Public WANVoice pathBoth networks failedCalls on that WAN fail. PG writes a TCD. Side B restarts on restoration if both sides were isolated-enabled.[cite:1]
8Phone on the far subscriberAgentPublic failure with split registrationPG cannot see the phone. The agent is signed out.[cite:1]

06 · Config

Design rules you can check on a drawing

  1. Draw Side A and Side B as a redundant pair. Do not label them active/active load-balance for the Router. [cite:1]
  2. Draw two physical networks. Put MDS and sync on the private network. Put Central Controller to PG traffic on the public network. [cite:1]
  3. Keep all private traffic for a component on the same link. Do not split low-priority and high-priority private traffic. [cite:1]
  4. Require QoS on private networks. On public links, read the QoS note for the 2000 Agent and 4000 Agent Reference Designs, and the delay warning for the 12,000 Agent Reference Design. [cite:1]
  5. Prefer redundant public connections on different carriers. [cite:1]
  6. Keep devices, call processing, and CTI Manager off the Unified CM publisher where you can. [cite:1]
  7. Size one Finesse cluster to the 2,000-user total. If the paperwork says 48,000 agents, cite the January 2025 Webex CCE sentence and mark it re-check. Do not replace the Finesse line with it. [cite:1] [cite:2]

Screenshot slot: a redacted duplex diagram with private and public paths labeled from the design guide, not from a customer WAN.

07 · Limits

Numbers that must stay on their own row

ItemValueSourceVerified?
Router sidesRedundancy, not load-balancing. Either side runs the full load.[cite:1]re-check Guide updated March 15, 2025
Side A device majorityAt least half of total enabled PGs[cite:1]re-check
Side B device majorityMore than half of total enabled PGs[cite:1]re-check
Logger auto-resync window14 days of Config_Message_Log[cite:1]re-check
Finesse users per Agent PG cluster2,000 total across the two servers. Each server can carry the full load if the other fails.[cite:1]re-check
CUIC subscribersUp to 7, plus a publisher[cite:1]re-check
Public QoS reference designsNamed 2000 Agent, 4000 Agent, and 12,000 Agent[cite:1]re-check QoS behavior, not a tenant cap
Webex CCE single tenant48,000 concurrent agents, 300 CPS[cite:2]re-check January 2025 what’s-new
HSRP versus heartbeatPrivate heartbeat interval printed as 100 ms. Public heartbeat interval printed as 400 ms. Hold time should be lower than five times the heartbeat.[cite:1]re-check

08 · Troubleshooting

Split brain, split registration, split numbers

SymptomLikely causeEvidenceFixCite
Both routers keep routing after the private link diesBoth had device majorityThe guide says none, one, or both can have majorityExpect Side B to restart when the networks return if both were isolated-enabled[cite:1]
One router goes quietIt lost device majorityIsolated-disabled stops processingRestore PG visibility or the private path. Do not force load onto a disabled side.[cite:1]
Loggers disagree after a long outagePrivate network was down more than 14 daysConfig_Message_Log retentionResynchronize with Unified ICMDBA[cite:1]
Failover feels randomPrivate high and low priority were split across linksThe guide says that split disables failover behaviorPut all private traffic for the component on one link[cite:1]
Agents sign out when the public WAN dropsDesktop and phone registered on different sidesThe PG cannot see the phoneThe sign-out is the documented result. Rehome so phone and desktop share a side when you can.[cite:1]
Calls at agents drop when only the router peer link failsNot what the router-failure sentence saysIn-progress VRU or agent calls are not affected by the router failure itselfLook for a public WAN voice-path failure if the calls actually dropped[cite:1]
A 12,000 Agent Reference Design detects server failure slowlyQoS on the public linksThe chapter says QoS can delay detection in that designRead that paragraph before you enable public QoS there[cite:1]
Finesse refuses users past 2,000 on one PGThe cluster totalTwo servers, 2,000 users combinedAdd another Agent PG and another Finesse cluster. Multiple Finesse clusters cannot share one Agent PG.[cite:1]
Digital routing has no private heartbeatExpected for Cloud ConnectNo dedicated private network between those nodesUse MR PG connectivity, not the Router private design[cite:1]
A slide says the product maximum is 48,000 because of this design guideThe what’s-new sentence was merged with the reference-design names48,000 is nhy3hvdb. The design guide’s 12,000 name is a QoS reference design.Split the citations[cite:2] [cite:1]

09 · Self-question ladder

Twelve rungs

L0What are Side A and Side B for?

Redundancy. Not load-balancing. Either side can run the full load, and both process every call. [cite:1]

L1What breaks if the private and public networks share one failure domain?

The design requires two independent physical networks so a single failure does not look like both a dead component and a dead path. A simultaneous failure of both is called catastrophic. [cite:1]

L1Why is Side B’s majority test stricter?

Side A needs at least half of its enabled PGs. Side B needs more than half. [cite:1]

L2What moves on the private network?

Synchronized data, control messages, MDS client communication, and the state transfer used to recover from isolation. [cite:1]

L2What does isolated-enabled mean?

The router has device majority and continues handling traffic. Isolated-disabled means it stops. [cite:1]

L2How long can the private network stay down before logger resync is manual?

14 days, the retention of Config_Message_Log. After that, use Unified ICMDBA. [cite:1]

L3How do you prove an agent sign-out was the split-registration case?

Desktop on one side, phone on the other, public network failed, phone did not rehome, PG could not see the phone. [cite:1]

L3A call is already with an agent when the router peer fails. What does the guide say happens to that call?

A router failure does not affect in-progress calls that have already reached a VRU or an agent. [cite:1]

L3Why can public QoS be a bad idea on a 12,000 Agent Reference Design?

The chapter says QoS on those public links can delay detection of server failures. It allows public QoS in the 2000 and 4000 Agent Reference Designs. [cite:1]

L4How is CUIC HA different from Router HA?

CUIC uses a publisher and up to 7 subscribers and spreads processing around failed nodes. The Router pair does not load-balance. [cite:1]

L4Where does 48,000 come from?

The January 2025 Webex CCE what’s-new entry: 48,000 concurrent agents and 300 calls per second on a single tenant. It is not the Finesse 2,000 line. [cite:2] re-check

L5What constraint stops you from treating both isolated-enabled routers as a permanent design?

The guide calls a dual-network failure catastrophic. If both sides are isolated-enabled, Side B restarts when connectivity returns so it can re-establish communication with its peer. [cite:1]

10 · Lab

Paper lab: label the number before you use it

11 · Quiz

Twelve checks

0 revealedAnswers stay closed until you open them.
Q1MCQ

Side A and Side B exist for:

  1. Redundancy, not load-balancing
  2. A 50/50 call split
  3. Two customers
  4. Digital-only routing
Reveal

A. [cite:1]

Q2MCQ

Side B has device majority when it can see:

  1. More than half of its enabled PGs
  2. At least one PG
  3. The publisher only
  4. Neither network
Reveal

A. Side A’s test is at least half. [cite:1]

Q3Scenario

Private traffic for one component is split into a high-priority link and a low-priority link. What does the guide say that does?

Reveal

It disables the component failover behavior. All private traffic for the component must use the same link. [cite:1]

Q4MCQ

QoS is required on:

  1. All private networks
  2. Only the public network
  3. Only guest Wi-Fi
  4. No network
Reveal

A. [cite:1]

Q5MCQ

Logger automatic resync applies if the private network returns within:

  1. 14 days
  2. 14 minutes
  3. 2 minutes
  4. 48 hours
Reveal

A. Config_Message_Log retention. After that, Unified ICMDBA. [cite:1]

Q6Scenario

The agent desktop is on Side A and the phone is on Side B. The public network fails. What happens to the agent?

Reveal

Unified CCE signs the agent out because the PG can no longer direct calls to that phone. [cite:1]

Q7MCQ

Users across the two Finesse servers on one Agent PG cannot exceed:

  1. 2,000
  2. 48,000
  3. 12,000
  4. 7
Reveal

A. 48,000 is a different sentence. 7 is the CUIC subscriber count. [cite:1]

Q8MCQ

CUIC high availability in this chapter is:

  1. A publisher and up to 7 subscribers, spreading work around failed nodes
  2. The same as Router lockstep
  3. A single server
  4. Two private-only links
Reveal

A. [cite:1]

Q9Scenario

Both public and private networks fail, and both routers are isolated-enabled. What does the note say Side B does when the network returns?

Reveal

Side B’s service restarts to re-establish communication with its peer. [cite:1]

Q10MCQ

The 48,000-agent figure is from:

  1. The January 2025 Webex CCE what’s-new entry
  2. The Finesse cluster paragraph
  3. A BGP community
  4. The CUIC subscriber count
Reveal

A. It also states 300 calls per second on a single tenant. Re-check. [cite:2]

Q11Draw it

Draw two networks. Put MDS on one and Central Controller-to-PG traffic on the other.

Reveal

MDS on the private network. Central Controller to PG on the public network. [cite:1]

Q12Scenario

Where does the design guide prefer you not to run CTI Manager?

Reveal

On the Unified CM publisher, where possible, along with devices and call processing. [cite:1]

12 · Audio

Slots for Studio

Transcript slot

Studio fills this from the cites.

Transcript slot

Studio fills this from the cites.

Transcript slot

Studio fills this from the cites.

13 · Interview

Oral answers

30 seconds. Unified CCE runs Side A and Side B for redundancy. Both sides process every call. Either side can carry the full load. I do not load-balance the Router.

2 minutes. Two physical networks. Private carries sync and MDS and must stay on one link per component, with QoS. Public carries Central Controller to PG traffic. If the private network fails, Side A stays up when it sees at least half its enabled PGs. Side B stays up only when it sees more than half. The loser goes isolated-disabled and its logger stops. If the private network returns inside 14 days, logger resync is automatic. A call already at an agent is not dropped just because the router peer failed. If the phone and the desktop are on opposite sides and the public network fails, the agent is signed out.

30 seconds, the caps. Two thousand is the Finesse total on one Agent PG. Forty-eight thousand is a January 2025 Webex CCE sentence, with 300 calls per second. I do not add them.

2 minutes, the other clusters. CUIC is a publisher and up to seven subscribers, and it spreads work around a dead node. Cloud Connect digital routing is active/standby with no dedicated private network. Cisco IdS is its own publisher and subscriber pair. The Unified CM publisher should not run devices, call processing, or CTI Manager if I can avoid it. The design guide I am quoting was updated March 15, 2025, so these rows stay re-check.

What you will not say. You will not treat a 12,000 Agent Reference Design QoS warning as the Webex CCE tenant maximum.

14 · Citations

Ledger

Retrieved 2026-10-14. Study notes from public sources.

  1. Solution Design Guide for Cisco Unified Contact Center Enterprise, Release 15.0(1), High Availability and Network Design — cisco.com — updated March 15, 2025 — High availability and network design. Duplex, device majority, private and public networks, 14-day logger window, Finesse 2,000, CUIC subscribers, Cloud Connect, IdS, publisher guidance. re-check
  2. What’s new for administrators in Webex Contact Center Enterprise — help.webex — article nhy3hvdb — help.webex.com article nhy3hvdb. January 2025: 48,000 concurrent agents and 300 CPS on a single tenant. re-check
  3. Webex WFO: Feature Specific SKUs — help.webex — article py6u9h — help.webex.com article py6u9h. WFO scope. Not an HA sizing table.

15 · Re-engineer later

Still open

  • Open questions: a Webex CCE scale page newer than January 2025; whether the 12,000 Agent Reference Design name is still the label in a guide updated after March 15, 2025.
  • Facts still marked re-check: the whole design-guide chapter used here, and the 48,000 / 300 CPS sentence.
  • Assets missing: duplex SVG export, audio, a redacted reference drawing.
  • Ideas for v1.0: a three-row card that refuses to add 2,000 and 48,000.
  • Next review: re-read the high-availability chapter when Cisco updates it past March 15, 2025.

Sources and go deeper

Checked links were opened this month. A confirm row has no address because that page was not opened.

sources.json for this page.