8.1 Webex Suite Overview & Control Hub Architecture

8.1 Webex Suite Overview & Control Hub Architecture

Enterprise collaboration has evolved from disparate on-premises voice and video systems into integrated, multi-tenant cloud collaboration platforms. The Cisco Webex Suite unifies enterprise calling, video meetings, persistent messaging, and large-scale webinars under a global cloud-native architecture managed through Cisco Webex Control Hub.

---

1. Webex Suite Architecture & Core Services

The Webex Suite architecture operates as a globally distributed microservices platform hosted across georedundant Cisco cloud data centers and public cloud infrastructure. Each core workload within the suite delivers specialized collaboration capabilities while sharing a unified identity, security, and administrative plane.

Core Pillars of the Webex Suite

1. Webex Calling: Enterprise-grade cloud PBX service providing carrier-grade call routing, auto-attendants, hunt groups, call pickup groups, multi-level interactive voice response (IVR), call recording integration, and unified messaging. Webex Calling connects to the Public Switched Telephone Network (PSTN) via Cloud-Connected PSTN (CC-PSTN) partners, Cisco Calling Plans, or on-premises Local Gateways (Cisco Unified Border Element / CUBE).
2. Webex Meetings: High-definition multi-party conferencing supporting up to 1,000 interactive video participants. Delivers intelligent features such as Webex Assistant AI transcription, automated action item extraction, real-time closed captioning, multi-lingual translations, digital whiteboarding, and customizable breakout sessions.
3. Webex Messaging: Persistent team messaging supporting one-to-one direct messaging and multi-party team spaces. Features rich text formatting, file and document attachment sharing, native whiteboarding, space moderation controls, and end-to-end encryption managed via the Cisco Key Management Service (KMS).
4. Webex Webinars: Scalable virtual presentation and broadcast platform supporting up to 100,000 attendees. Incorporates presenter green rooms, stage management controls, interactive attendee polling and Q&A via Slido, and streaming to third-party CDNs.

Network Infrastructure & Port Requirements

+-------------------------------------------------------------------------------------+
|                            ENTERPRISE CLIENT NETWORK                                |
+------------------------------------------+------------------------------------------+
                                           | 
         +---------------------------------+---------------------------------+
         |                                                                   |
         v [Signaling: HTTPS / WSS / TLS]                                    v [Real-Time Media: SRTP / SRTCP]
   Outbound TCP 443 / TCP 8934                                         Outbound UDP 5004, 9000, 19560-65535
         |                                                                   |
         v                                                                   v
+------------------------------------------+       +------------------------------------------+
|     WEBEX IDENTITY & SIGNALING BROKER   |       |        WEBEX GLOBAL MEDIA MESH CLOUD     |
| - Identity Broker (idbroker.webex.com)   |       | - Real-time Voice / Video Switching      |
| - Control Hub REST API (webexapis.com)   |       | - STUN / TURN Relays (Port 3478)         |
| - Signaling Gateway (SIP over TLS)       |       | - Adaptive Bandwidth & QoS Marking       |
+------------------------------------------+       +------------------------------------------+

Webex endpoints communicate outbound over enterprise firewalls without requiring inbound firewall openings:

• Signaling Traffic: Encrypted via TLS 1.2 or TLS 1.3 over TCP port 443 (HTTPS and Secure WebSockets) to cloud brokers. Webex Calling devices and the Webex App send SIP over TLS to destination TCP port 8934 (Local Gateways use 8934 for registration-based trunks and 5062 for certificate-based trunks).
• Real-Time Media Traffic: SRTP and SRTCP over UDP. Meetings media goes to destination UDP 5004 (and 9000); Webex Calling media from devices and the Webex App goes to UDP 19560-65535 on Cisco's media relays, with the Webex App sourcing audio from 8500-8599 and video from 8600-8699.
• Interactive Connectivity Establishment (ICE): When direct UDP connectivity is blocked by restrictive stateful firewalls, endpoints fall back to Session Traversal Utilities for NAT (STUN) and Traversal Using Relays around NAT (TURN) proxies over UDP or TCP port 3478, or TLS tunneling over TCP port 443.

---

2. Cisco Webex Control Hub Architecture

Cisco Webex Control Hub (admin.webex.com) is the central single-pane-of-glass administrative console for managing all users, devices, services, security policies, and diagnostic analytics across an organization.

Administrative Console Structure

Customer Organizations (Orgs) and Partner Administration

• Customer Organization (Org): Every enterprise tenant exists as an autonomous Customer Org identified by a globally unique Organization ID (UUID). All user identities, license subscriptions, service configurations, and security encryption keys are strictly isolated within the customer Org boundary.
• Cisco Partner Hub: Managed service providers and Cisco certified partners access a specialized multi-tenant portal allowing authorized partner engineers to manage multiple customer Orgs. Partner administrators can configure customer services, assign subscriptions, and troubleshoot issues without requiring permanent local administrator credentials inside each individual customer directory.

---

3. Organizational Structure & Licensing Management

Webex resources are provisioned through subscription license pools assigned to customer Orgs. Understanding the operational differences between license types is essential for capacity planning and cost containment.

Webex Calling License Tiers

Automated License Assignment Templates

In large enterprises, manually allocating licenses to hundreds or thousands of onboarded employees is operationally unviable. Webex Control Hub provides Automated License Assignment Templates:

1. Assignment Criteria: Rules can target the entire organization, specific verified email domains, or directory groups synchronized from Active Directory or cloud Identity Providers (IdPs) via SCIM.
2. License Selection: The template specifies the exact licenses to assign automatically upon user creation (e.g., Webex Calling Professional, Webex Meetings 200, Webex Messaging, and Webex Assistant).
3. Shortfalls: If a subscription runs out of licenses, Control Hub reports the shortage, and the missing licenses must be added before new users receive them.

---

4. Governance, Compliance, and Auditing

Enterprise collaboration platforms process sensitive intellectual property and regulated communications. Control Hub provides an extensive compliance framework to meet legal, regulatory, and corporate governance obligations.

Administrator Audit Log

Every administrative action executed within Control Hub is logged immutably in the Administrator Audit Log:

• Tracked Events: User additions, role elevations, license reallocations, password resets, domain claiming modifications, dial plan changes, and security policy adjustments.
• Recorded Metadata: Actor Name, Actor Email, Actor UUID, Target Resource, Action Executed (Create, Update, Delete), Client IP Address, Category, and Timestamp in UTC.
• Access: Viewable in Control Hub, exportable as CSV, and available through the admin audit events API (/adminAudit/events) for ingestion into Security Information and Event Management (SIEM) systems such as Splunk.

Compliance Officer Role & Retention Policies

To enforce the principle of least privilege, Control Hub separates operational administration from regulatory compliance:

• Compliance Officer Role: A specialized administrative role granted strictly to legal, risk, or compliance personnel. Compliance Officers cannot modify operational call routing, register devices, or manage billing, but possess exclusive access to compliance tools.
• Retention Policies: Enforces organization-wide lifecycles for persistent messaging, direct 1:1 spaces, group spaces, and shared files. Content is kept indefinitely by default, or administrators can set a retention period after which it is deleted.
• Automated Purging: When a message or file exceeds the configured retention window, background cloud cleanup jobs permanently purge the content from primary databases and backups. Purged data cannot be recovered by users or administrators.

Legal Hold & eDiscovery

• Legal Hold: When an organization anticipates or enters litigation, a Compliance Officer can place specific custodians (users) or spaces on Legal Hold:
  • Overrides global retention policies for designated custodians.
  • Prevents messages, file attachments, and message edit/deletion histories from being purged, even if the user deletes the message or the global retention policy expires.
  • Remains active until explicitly released by the Compliance Officer.
• eDiscovery Search & Export:
  • Enables Compliance Officers to search across all spaces, 1:1 direct conversations, shared files, and meeting transcripts using custodian email addresses, space identifiers, date ranges, and keyword queries.
  • Search results are packaged into secure downloadable ZIP containers containing content formatted as EML files or JSON structures alongside cryptographic verification hashes.

---

5. Analytics, Quality Telemetry & Call Diagnostics

Monitoring real-time voice and video performance across distributed networks is critical for maintaining telecommunications service levels.

Media Telemetry & Quality Thresholds

During active calls and meetings, Webex endpoints transmit Real-Time Transport Control Protocol (RTCP) receiver reports to Webex cloud telemetry collectors every few seconds. Telemetry monitors three foundational metrics:

$\text{Latency (RTT)} \le 150 \text{ ms (one-way)} \quad | \quad \text{Jitter} \le 30 \text{ ms} \quad | \quad \text{Packet Loss} < 1.0\%$

• Latency / Round-Trip Time (RTT): One-way delay must remain below 150 ms (300 ms RTT). Latency exceeding 200 ms one-way induces conversational overlap and unnatural pauses.
• Jitter (Delay Variation): Must not exceed 30 ms. Jitter exceeding 50 ms overwhelms endpoint jitter buffers, resulting in dropped packets and audio distortion.
• Packet Loss: Audio packet loss must remain strictly under 1.0% (and video under 2.0%). Loss exceeding 3.0% produces severe audio clipping and unintelligible speech.

Control Hub Troubleshooting

Control Hub's Troubleshooting view (under Monitoring) shows live and recent calls and meetings, participant by participant:

1. Participant Path Inspection: Maps the end-to-end media path from the caller's Webex App or hardware phone, across the local enterprise access network, through edge gateways, to the specific Webex cloud media cluster.
2. Granular Metric Telemetry: Visualizes continuous graphs of audio/video send and receive bitrates (kbps), packet loss percentages, jitter values, and resolution/framerate shifts over the entire duration of the call.
3. Transport Protocol Detection: Identifies whether the client successfully established direct UDP media transport (e.g., port 5004) or fell back to TCP/TLS over port 443 through an HTTP proxy or TURN relay due to firewall blocking, immediately exposing the root cause of call quality degradation.