ZPM Proxy - How it works & Use Cases

⚙️ Setup Guides
1

How does the ZPM Proxy Work?

In certain situations or use cases, ZPM requires on-premise connectivity to connect to Cisco CUCM or Active Directory. An on-premise appliance will serve as a proxy server for the ZIRO Platform for Microsoft (ZPM) to establish a connection to a customer’s on-premise environment.

  • Existing customers with ZPC (Ziro Provisioning for Cisco) enable their ZPC as the proxy; there is no new VM to install.

  • Customers without ZPC must deploy the proxy VM on their network.

Network Security Requirements and Recommendations

Outbound Connections

The proxy server will establish an outbound connection using a binary protocol over a TCP byte stream on port 7000 to the cloud-based ZPM application hosted in the Microsoft Azure Commercial Cloud.

The proxy will also require local network connectivity to Active Directory via LDAPS over 636 and/or to the Cisco UC Environment HTTPS APIs over port 443.

Inbound Connections

HTTPS (port 443) and SSH (port 22) inbound Access to the ZIRO platform should be strictly limited to the local network.

Do not expose your proxy to the Internet

It is highly recommended that the ZIRO proxy is not accessible from the internet under any circumstances or across any ports, and it should only have access to the local endpoints that it requires (e.g., LDAP or CUCM).

Proxy - Network Diagram

image
image1998×1316 171 KB

:link: See How to Deploy On-Premise ZIRO Proxy Server OVA for steps on how to deploy the proxy OVA.

:link: See ZPM Proxy - How to setup Connection between ZPM and Proxy on how to configure the connection between ZPM and your proxy or ZPC.

ZPM Proxy Use Cases

This section will delve into the various use cases for the ZPM proxy, highlighting its potential applications and benefits.

Updating On-Premise AD (LDAP) for Extension Dialing with Auto-Attendants

See :link: How Update On-Premise AD from ZPM to enable this feature

For auto-attendant dial by extension to function correctly one of the following fields need to be populated in Microsoft Entra ID:

  • TelephoneNumber (On-Premise AD and Microsoft Entra ID)
  • HomePhone (On-Premise AD)
  • Mobile (On-Premise AD and Microsoft Entra ID)
  • OtherTelephone (On-Premise AD)

Customers using On-Premise AD with AD Connect cannot directly modify certain Microsoft Entra ID fields.

Updating On-Premise AD (LDAP) for AD Based SBC Routing/Forking

See :link: How Update On-Premise AD from ZPM to enable this feature

Some customers may want to use On-Premise AD for call routing purposes such as routing through different providers or different PBX (Cisco vs Teams) based on On-Premise AD attributes.Example of SBC setup guides:

  • AudioCodes - AD Based Routing
  • Ribbon - Call Forking Based on Active Directory User Attributes

Managing a Hybrid Dial plan between CUCM and Microsoft Teams

:link: How to Check CUCM number from ZPM (dial plan sync) Walkthrough Guide

In environments using hybrid calling with PSTN calls going to both Teams and Cisco, it is essential to have a dial plan that can access both CUCM and Teams. This visibility allows the helpdesk to identify who is assigned a phone number in CUCM and who is assigned one in Teams. It enables them to quickly assign available numbers to users across either environment without mistakes and better support their environment.

image
image1718×892 116 KB