I have a BE6K solution with a VCS-C VM installed but unfortunately I cannot install a VCS-E as the server is only medium density and only supports 4 application VMs.
I have registered two SX20s to the VCS-C using h323/SIP and configured the VCS-C with zones and search rules to allow external internet calls. Out of curiosity I also configured a direct NAT to the VCSC from a public IP address and inbound h323/SIP calls work without any issues.
Is this acceptable for a small scale solution and not use a VCSE? My only other choice is to remove the VCSC all together and just have standalone SX20s.
For security purposes, you definitely need a vcse. Your VCSE would sit in your DMZ and your VCSC will sit in your internal network. All traffic to and from the internet should be sent via your VCSE. Your VCSC shouldn't be connecting to the internet at all..Thats a big risk you are taking even for a small deployment