AES-CM-128-HMAC-SHA1 is used to encrypt media to Webex services using SRTP, or SRTP with SIP signaling (e.g. Webex Room devices use AES-256-GCM for an end to end encryption of the S-Frame media payload with the Zero Trust Security feature for Webex Meetings (feature rollout commences Q1 CY’21) for more details see Zero-Trust Security for Webex Technical PaperĪES-CM-128-HMAC-SHA1 is a mature cipher that has proven interoperability between vendors. * The Webex app uses AES-256-GCM or AES-128-GCM to encrypt content for all Webex Meeting types. AES-256-GCM is used by the Webex app and Webex Room devices* to encrypt meeting content. The Webex app and Webex Room devices encrypt real-time media for audio, video, and content sharing streams using the following encryption ciphers:ĪES-256-GCM is a modern encryption cipher with a 256-bit encryption key. If you have deployed proxies, or firewalls to filter traffic leaving your enterprise network, the list of destination URLs that need to be allowed to access the Webex service can be found in the section 'Domains and URLs that need to be accessed for Webex Services'. Filtering Webex signaling traffic by IP address is not supported as the IP addresses used by Webex are dynamic and may change at any time. TLS version 1.2 only is supported by Webex services.Īll Webex features other than real-time media are invoked over a signaling channel that uses TLS.Įstablishing signaling connections to Webex services using URLs Webex services prefer TLS cipher suites using ECDHE for key negotiation, 256-bit symmetric encryption cipher keys and SHA-2 hash functions e.g.: Signaling traffic is protected by TLS using strong encryption suites. Signaling connections are outbound only and use URLs for session establishment to Webex services. The Webex app and Webex devices use HTTPS and WSS (secure websockets) for signaling. The Webex app and Webex Room devices establish signaling and media connections to the Webex cloud.

All data is encrypted in transit and at rest. Webex messaging micro-services, messaging storage services and media servers). Webex data centers for identity services, meeting services, and media servers) or hosted in a Cisco Virtual Private Cloud (VPC) on the Amazon AWS platform (e.g. Webex services for meetings and messaging are primarily hosted in globally distributed data centers, that are either Cisco owned (e.g. Cisco’s Webex Cloud never initiates outbound connections to cloud registered Webex apps and Webex Room devices, but can make outbound calls to SIP devices. For on-premises SIP-based call control products such as Cisco Unified CM, a SIP session is established through a border controller such as Expressway C & E, or CUBE SBC for calls to and from the Webex Cloud.įor details on the specific network requirements for the Webex Calling service see: Īll cloud registered Webex apps and Webex Room devices initiate outbound connections only.

Webex Room devices, Cisco IP Phones, and 3rd party products can join Webex Meetings using SIP.

The Webex Calling service and on-premises call control products such as Cisco Unified CM use SIP as their call control protocol. Webex cloud and on-premises call control registered devices using SIP The Webex app can also use the SIP protocol to join Webex meetings, but this is subject to the user either being called via their SIP address or choosing to dial a SIP URL to join a meeting (rather than use the functionality of the meeting native to the Webex app). The Webex App uses HTTPS signaling for Webex messaging and meeting services.This feature allows Webex devices to be administered via Webex Control Hub and to participate in Webex Meetings using HTTPS signaling (for details see ). On-premises SIP registered Webex devices can also use HTTPS signaling if the Webex Edge for devices feature is enabled.Cloud registered Webex Room devices use HTTPS signaling for all Webex services.All cloud registered Webex apps and devices use HTTPS to communicate with Webex messaging and meetings services:

Ephemeral ports aws