unable to join on-premise Weber room kit to E2E encrypted Webex meetin

[goranpilat]

Hello,

As title says, I cannot join CUCM registered Room Kit Plus over expressway to Webex meeting which has end-to-end encryption. I get the following message on TV screen:

"You can't join this meeting because your video system doesn't support end-to-end encrypted meetings. Please join from the Webex Meetings or Webex app or from a Cisco Webex cloud-registered device."

If the meeting is started without E2E encryption, device joins normally.

Any idea how to join these devices to the E2E enc meetings?

Thanks a lot for any suggestions,

Goran

[b.winter]

Is encryption configured E2E? So also the traffic between Video-Enpoint and CUCM, CUCM and Expressway, Expressway and Webex?
If not every call leg is encrypted, then probably you get this message.

[Jonathan Schulenberg]

https://help.webex.com/en-us/article/5h5d8ab/End-to-end-encryption-with-identity-verification-for-Webex-meetings#Cisco_Reference.dita_93711eff-3c4f-4648-a393-c578a897bea3
“SIP video or telephone devices cannot join E2EEv2 meetings, as E2EEv2 is not available in the SIP protocol.”
This is not supported. SIP encryption is done per-logical hop (eg Expressway-E & Webex). I presume Cisco excluded support for SIP because they cannot ensure/validate that it’s encrypted end-to-end.

[goranpilat]

Thanks, Jonathan!

I came across the same document, but really couldn't make myself believe it as all the endpoints nowadays are SIP endpoints. So what does it mean? If I have on premise endpoints, I am basically depending on the far side enabling e2e or not (nowadays more and more people enabling it as it sounds secure and why not use it). So I'll have a full room of executives waiting to connect to Webex, only to be disappointed seeing that e2e is on and they have to use their laptops? Am I missing something here? Is this another way of squizing out on premise infrastructure in favour of registering everything on webex?

Br

Goran

[Jonathan Schulenberg]

"...all the endpoints nowadays are SIP endpoints"

If only this were true; the VC industry seems to be moving away from SIP. All three of the major meeting platforms now use non-SIP architectures when their respective ecosystem endpoints join a meeting (e.g. Cisco & Webex; Zoom & Zoom Rooms; MSFT & MTR). SIP seems relegated to interop these days, unfortunately.

"So what does it mean?"

You have two options:

1. Don't use the E2EE session type for a meeting that you want on-prem endpoints to join.
2. Register the endpoints to Webex, either as native cloud-reg or with Webex Edge for Devices so they maintain a CUCM registration for phone calls and SIP URI dialing but are managed by Webex (e.g. Hybrid Calendar) and join Webex Meetings natively.

IMO, E2EE should be used sparingly. It disables a bunch of commonly used functionality - NBR recording and PSTN dial-in/callback, for example. Use it only when necessary. A normal Webex Meeting uses encryption everywhere it can.

[goranpilat]

Jonathan, thanks gain for reply.

As per your suggestion, I have already tried the following:

1. Register the endpoints to Webex, either as native cloud-reg or with Webex Edge for Devices so they maintain a CUCM registration for phone calls and SIP URI dialing but are managed by Webex (e.g. Hybrid Calendar) and join Webex Meetings natively.

But unfortunately it did not do the job. I tried to start the webex with OBTP, but got exact the same error message, so I figured only thing OBTP does is that it launches SIP call in simpler way (one button). Should it start the webex in the native way (as if started from Webex app?

Thnx again

Goran

[Jonathan Schulenberg]

Yes, it should perform what is internally called a Locus join. Did you complete the Webex optimized experience for Webex Edge for Devices section, setting Webex > Meetings JoinProtocol: Webex?

[goranpilat]

Jonathan,

It was indeed set to SIP under Webex > Meetings JoinProtocol, I changed it to Webex, but unfortunately I am getting same error. On Expressway I see that it tried joining via SIP again, although I turned ON both WebexEdge and CloudUpgradesMode. After setting these and restarting the device I am getting the following:

"Cloud Aware Config Invalid

Cloud calling configuration doesn't apply, because cloud upgrades/configuration is not enabled."

As If I'm still missing something here...

"

[Roger Kallberg]

Have you linked the video device to Control Hub with the Webex Device Connector? This is what enables the device to be Edge for Devices or cloud aware as it’s also known as.

[goranpilat]

Hi. Yes, on webex i can se them green and online

[Jonathan Schulenberg]

Depending on the extent to which you have customized the xConfig on that endpoint, it may be worth a factory reset, let it re-register to CUCM, delete it from WCH, and then reattempt the Edge for Devices onboarding process. If that doesn't work I would open a TAC case focused on the "Cloud Aware Config Invalid" error.

[goranpilat]

Jonathan, I figured it out!

In addition to setting the following (all on device):

meeting Join Protocol to SIP, Cloud Upgrade mode to ON and MultiPoint Mode to AUTO

I also had to set (which was a bit tricky as it wasn't clear) the following on webex control hub:

Device>settings>Webex Edge for Devices>Allow Control Hub to manage configurations to ON

At that moment all calling towards webex works (OBTP, Webex Join Button, Calling via SIP URI)

thanks a lot once again