Cisco Unified Contact Center Enterprise Solution Reference ...

Network Firewalls
Deployment
Topology
7-8
Cisco Unified Contact Center Enterprise 7.x SRND
Chapter 7 Securing Unified CCE
To aid in firewall configuration, these guides list the protocols and ports used for agent desktop-to-server
communication, application administration, and reporting. They also provide a listing of the ports used
for intra-server communication.
If firewalls are used inside the data center as part of the Unified CCE network, do not place them between
Cisco Unified CallManager and the Unified CCE servers (Peripheral Gateways and
Cisco Unified Outbound Dialer (Unified OUTD)) that communicate with the cluster for the site.
You can configure Cisco IOS and PIX/ASA firewalls for application inspection to process traffic
between the Cisco Unified CallManager and Cisco Unified IP phones with the Skinny Client Control
Protocol (SCCP). The inspection is handled by SCCP without any special configuration. The inspection
is not designed for traffic between the Unified OUTD and the Cisco Unified CallManager. The
Unified OUTD uses SCCP to communicate with the Cisco Unified CallManager and Real-Time
Transport Protocol (RTP) to communicate with voice gateways for the Call Progress Analysis feature.
Cisco firewall devices also feature the Computer Telephony Integration Quick Buffer Encoding
(CTI-QBE) application inspection. CTI-QBE is the protocol used by JTAPI to interface between the
Unified CCE Agent PG and the Cisco Unified CallManager. Note that the inspection feature in the Cisco
Firewalls is not compatible with the traffic flow between the PG and Cisco Unified CallManager.
The inspection limitations dictate that Cisco Unified CallManager and Unified CCE servers must be on
the same firewall interface (Figure 7-2).
The deployment in Figure 7-2 represents the recommended placement of firewalls and other network
infrastructure components in a Unified CCE deployment. The design model in Figure 7-2 incorporates
a parent Unified ICM system with legacy peripheral hosts and a child Cisco Unified System Contact
Center (Unified SCC) with a Cisco Unified CallManager cluster. The following best practices apply to
this type of deployment:
Cisco Unified CallManager and Unified CCE servers must be on the same firewall interface.
– Keep firewall deployment simple, with no more than two interfaces.
– Avoid using voice fixups, as they tend to reduce throughput.
– Block all traffic except for what is required by the applications (refer to the published port
guides listed in TCP/IP Ports, page 7-7).
Block the following ports at the enterprise perimeter firewall:
– UDP ports 135, 137, 138, and 445
– TCP ports 135, 139, 445, and 593
Deploy Layer-3 and Layer-4 ACLs that are configured as described in the port guides.
Isolate database and web services by installing dedicated WebView servers and historical data
servers.
Minimize the number of administrative workstation distributors (AWD) and make use of client AWs
(no database required) and Internet script editor clients.
Use the same deployment guidelines when the parent Unified ICM or child system Unified CCE
central controllers are geographically distributed.
OL-8669-05