When you go through the telephony setup wizard in CCA the instructions mention setting up your UC500 with a SA500. The recommended way to configure them is SA switch port to UC500 WAN according to the wizard documentation.
From what I can tell from working on these units in our demo lab the reason for this instruction is due to the UC500 Vlan1 (default data) not allowing you (via CCA) to turn off DHCP (I believe Cisco is changing this in their next CCA version). In this configuration you would then connect your switch to the UC500 and phones/PC's to the switch and everything should work.
Of course if your following the networking this means the SA unit is Firewalling you from the internet and the UC500 is firewalling you from the SA unit there by creating a DMZ. Any phones plugged into the SA unit switch ports won't connect to the UC500 and though PC's connected will be able to get to the internet, they won't be able to see the rest of your internal network. Fine for some deployments, however you also mention you want to connect your 2 sites. The configuration for this, though do-able, would be a nightmare in my opinion.
There are a couple of options that should work to get around this:
1) disable NAT and Firewall on Wan port of UC500 there by opening up the WAN port for all traffic. At this point you have to make a decision on DHCP...(staying with in CCA support requirements I would disable DHCP on the SA unit as you currently have to use the CLI to remove it from the UC500). Configure the SA with a static IP or reserve it in the DHCP config and you should have everyone on the same network. Connecting sites should be an easy VPN config from there.
2) Don't use the SA unit at all. The UC500 comes with firewall, NAT and intrusion prevention(addl purchase I think). Connect and configure your internet to the WAN port of the UC500. Connect switch to UC500 switch port, connect phones / computers to switch. Use VPN capability on UC500 to connect both offices.
3) Connect UC500 switch port to SA switch port. Again, DHCP would need to stay on the UC500 as in option 1. This puts everyone on the same network, however in my lab the smart ports and topology view seemed to get a bit confused with phones plugged into the SA. With no phones plugged in smart port wants to make this port a router port, with phone plugged in to the SA smart ports wants to make the port a phone/pc port. Phone and computers seemed to function fine with Phone/computer setting though topology view showed a dual connection to the phone.
One addl note: I haven't tried to use internet connectivity from the phone (such as spa525G2 weather or news feeds) on any of these configurations so I would test it before you deploy into a live enviornment to make sure it performs as designed.
Hope this helps.
