Cisco Expressway

Hi all,
When we need to use cisco expressway ? My customer will use cisco sx10, sx80, and immersive. Connection between all telepresence endpoint is via WAN (MPLS). Do i need to deploy cisco expressway-c or expressway-e ?

The Expressway series doesn't have traversal licenses, instead it's refereed to as Rich Media Session licenses. If you have have an H323 and SIP endpoint, the interworked call will consume a single RMS license on each Expressway Core and Edge server, so a total of two licenses will be needed for the call. Below is taken from the Expressway data sheet and outlines what a RMS licenses is used for:
Each concurrent call session terminating on a system not using Cisco Unified Communications Manager or Cisco HCS (for example, B2B calls, Cisco Jabber Guest and Cisco Collaboration Meeting Rooms) requires a Cisco Expressway Rich Media Session license. Also, each concurrent call requiring interworking also requires a Cisco Expressway Rich Media Session license. Examples of such calls include H.323-to-SIP interworked calls and H.264 SVC-to-H.264 AVC calls.
However, as the Expressway series is meant to be used with CUCM, and it's a SIP only solution, where is this H323 endpoint residing or calling from?

Similar Messages

Cisco Expressway Softwares

Hi
I'm new to Cisco Expressway solution, in the Cisco site there is only one downloadable file with version X8.2.
Do we need two VMs for expressway ? (for Expressway C and E) or we can use one VM ?
Please guide
Rgds
$

If you have a look on CCO, and look under "All Release", you should be able to find the Virtual OVA file for X8.2.1 which you can fire up as a demo (no licence required).
Once you have the Virtual Machine built with the above OVA file, you can upgrade it with the .tar.gz to a more recent version if you wish - with X8.2.2 being the latest (and including the fixes for the "ShellShock" Bash vulnerability.
Wayne
Please remember to rate responses and to mark your question as answered if appropriate.

Cisco Expressway with BE6K

Hi,
If we propose Cisco Expressway on Cisco BE6k, how many applications we can have with medium density? AS i check dockwiki, 4 apps + 1 mandatory
prime collaboration.
So my understanding is on a medium density BE6K bundle, we can have 4 apps (CUCM + CUC + Expressway C + Expressway E) and 1 mandatory prime collab provisioning. Is my understanding about sizing is correct? Is there anything else for Mgmt or ELM is also required??
Ajay

Hi Ajay,
It is not mandatory to install install Prime Collaboration - but this is the only option for the "+1". If you don't deploy PCP, then all of the server resources may be dedicated to your collaboration applications.
In this case, you will have 2 CPUs each for UCM, Expressway C and Expressway E, 1 for CUC and 1 reserved for ESXi - so this is valid for a Medium Density server (8 CPU). The memory footprint will fit too.
ELM is co-resident with UCM, so no need for a separate install there.
You'll just need to decide how to manage your network connectivity / separation for Expressway C / E. This document might be of interest for this.
Hope this helps,
Andy

Cisco ExpressWay-E/C on UCS

Dear Experts,
I am new to Cisco UC world and trying to understand and implement the Cisco ExpressWay-E/C technology.Can anyone help me to understand the following .
1.Is there is any specific reason to place ExpressWay-E in MDZ ?
2.Do i need additional Firewall for Cisco Expressway-C ?
3.Does Cisco ExpressWay-E/C support different internal domains?.
4.Does Cisco Expressway-E/C surrport if I have internal domain server hosted on public network ?
Thanks
Tamimi

1. Expressway-E is the vehicle that is used to communicate with clients who are on the internet. For this specific reason, you have to place the Expressway-E in the DMZ or the outside network, both configurations are supported by Cisco.
2. Additional firewall is not needed. The example that the guides show is an example for customers who have additional firewall and if they dont allow traffic to be routed directly from the internal network to the external.
3. You can configure different domains on the Expressway C/E and in most cases will work but this configuration is not supported by Cisco.
4. Not sure I understand this question but if you are asking about having to host your own Public DNS servers, then that shouldnt be a problem and doesnt have a correlation with Expressway C/E.

Cisco expressway 8945 series 9900

Hi, fellow Cisco engineers! Could you tell me someone does Cisco Expressway solution support Cisco Phone 8945 or Cisco Phone Series 9900?

The VPN phone client or home office router w/VPN are the only supported remote or mobile solutions for the 8900 and 9900 series ip phones. MRA (Mobile Remote Access) via the Expressway or Expressway-E are not supported.

Licensing of Cisco Expressway

Hi, fellow engineers. I have a couple question about Telepresence design. If I need to add Jabber Guest. What kind of licence will be required apart from Cisco Expressway Rich Media Session? How about endpoints? For instance, what kind of licence do I need to purchase so that I make a call from remote office by EX 90? I mean I want to make a call the Headquarter from Teleworker.

Hi Mikhail,
Deployment guide provides these details.
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/Guest/10_0/icg/JABC_BK_J0FC634A_00_jabberc-installation-and-configuration-guide/JABC_BK_J0FC634A_00_jabberc-installation-and-configuration-guide_chapter_010.html
Please note that in a production environment, Cisco Jabber Guest requires that your Cisco Unified Communications Manager be configured to work with Cisco Expressway.
Cisco Jabber Guest can be pointed directly to Cisco Unified Communications Manager for lab deployments only. You must configure a SIP trunk on Cisco Unified Communications Manager for this deployment. This option is best suited to a lab deployment in which the goal is to familiarize yourself with Cisco Jabber Guest without the additional overhead of configuring Expressway. However, without configuring Expressway, Cisco Jabber Guest is not supported in a production environment.
HTH
Manish

Third Party CA certificate requirement for Cisco expressway C and E

Hi All,
We have implemented MRA solution for our customer, We had ask to procure the CA certificate from Third party CA certificate issuing vendor.
We had shared CSR request generated from Expressway C and E application to generate SSL certificate, As per cisco document we had ask to procure “Quick SSL premium single domain” CA certificate for Expressway Series E and C server but as per the certificate issuing vendor, the application required “Quick SSL premium multi domain” as they observed extra SANs in CSR generated from the Expressway C and E applications. Need help to find out application required certificate, who are using Third Party CA certificate for MRA solution.

First of all, I don't see how you cant get away with single domain certificate. I have looked into this more. This is because you need to add your domain name in the SAN as detailed below.
Secondly, I am not sure where you are going to generate the certificates from..You should generate your CSR from here..
Go to Maintenance > Security certificates > Server certificate
NB: Customer’s service discovery domain is required to be included as a DNS SAN in all Expressway-E server certificates
This is what the CSR page looks like

Cisco Expressway Core & Edge Cluster, or Disaster Recovery Setup

Hi All,
Dear experts,
I have two sites HQ & Branch.below are my questions for Expressway Core & Edge Cluster
1. Can i create one cluster for 6 sever for Expressway Core and distribute 3 server in HQ & 3 server in Branch for HA
2. Can i create one cluster for 6 sever for Expressway Edge and distribute 3 server in HQ & 3 server in Branch for HA
3. How would be the DNS SRV records and call flow work if the main site Expressway Edge goes down in HQ. How the Branch Side Expressway Edge becomes active for B2B calls.
4. What is the best design to have disaster recovery for Expressway core and Expressway Edge between Sites(HQ & Branch)
Regards,
Irf

Regarding 1 and 2, as long as the round trip delay is no more than 30ms maximum, you should be fine. I presume the HQ Branch offices for the Expressway-Core have a shared internal network, since the Core goes inside the corporate network, while the Edge goes in the DMZ or outside the network for public access.
For 3, as long as you have your SRV records setup correct, you can set the priority of which office gets used first, and then second, in case of a failure.
I don't have an answer for 4 unfortunately.

Cisco Expressway C and E Certificates

Hi
I need some help on expressway C and E certificates. I need to know which certificates are reuired on both the systems.
What is the complete procedure to generate the license from internal Microsoft CA server and upload these certificates to Expressway C and E?
Regards
Rohit Mahajan

Here is the document Jamie is referring to:
Expressway Certificate Creation and Use Deployment Guide

Ask the Expert: Plan, Design, and Implement Mobile Remote Access, the Cisco Collaboration Edge Architecture

Welcome to the Cisco® Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about planning, designing, and implementing mobile remote access (Cisco Collaboration Edge Architecture) with Cisco subject matter experts Aashish Jolly and Abhijit Anand.
Cisco Collaboration Edge Architecture is an architecture that provides VPN-less access of Cisco Unified Communications resources to Cisco Jabber® users. This discussion is dedicated to addressing questions about design best practices while implementing mobile remote access.
For more information, refer to the Unified Communications Mobile and Remote Access via Cisco VCS deployment guide.
Aashish Jolly is a network consulting engineer who is currently serving as the Cisco Unified Communications consultant for the ExxonMobil Global account. Earlier at Cisco, he was part of the Cisco Technical Assistance Center (TAC), where he helped Cisco partners with installation, configuring, and troubleshooting Cisco Unified Communications products such as Cisco Unified Communications Manager and Manager Express, Cisco Unity® solutions, Cisco Unified Border Element, voice gateways and gatekeepers, and more. He has been associated with Cisco Unified Communications for more than seven years. He holds a bachelor of technology degree as well as Cisco CCIE® Voice (#18500), CCNP® Voice, and CCNA® certifications and VMware VCP5 and Red Hat RHCE certifications.
Abhijit Singh Anand is a network consulting engineer with the Cisco Advanced Services field delivery team in New Delhi. His current role involves designing, implementing, and optimizing large-scale collaboration solutions for enterprise and defense customers. He has also been an engineer at the Cisco TAC. Having worked on multiple technologies including wireless and LAN switching, he has been associated with Cisco Unified Communications technologies since 2006. He holds a master’s degree in computer applications and multiple certifications, including CCIE Voice (#19590), RHCE, and CWSP and CWNP.
Remember to use the rating system to let Aashish and Abhijit know if you have received an adequate response.
Because of the volume expected during this event, our experts might not be able to answer every question. Remember that you can continue the conversation on the Cisco Support Community Collaboration, Voice and Video page, in the Jabber Clients subcommunity, shortly after the event. This event lasts through June 20, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Marcelo,
Yes, there are some requirements for certificates in Expressway.
Expressway Core (Exp-C)
- Can be signed by either External or Internal CA
- Better to use a cluster name even if you start with 1 peer in Exp-C cluster. In the future, if more peers are added, changes would be minimal.
- Better to use FQDN of cluster as CN of certificate, this way the traversal zone configuration on Expressway-E won't require any change even if new peers are added to Exp-C cluster.
- If CUCM is mixed mode, include security profile names (in FQDN format) as Subject Alternate Names
- The Chat Node Aliases that are configured on the IM and Presence servers. They will be required only for Unified Communications XMPP federation deployments that intend to use both TLS and group chat. (Note that Unified Communications XMPP federation will be supported in a future Expressway release). The Expressway-C automatically includes the chat node aliases in the CSR, providing it has discovered a set of IM&P servers.
- For TLS b/w CUCM, IM-P & Exp-C
+ If using self-signed certificates on CUCM, IM/P. Load Cisco Tomcat, cup, cup-xmpp certificates from IM-P on Exp-C. Load callmanager, Cisco Tomcat certificates from CUCM on Exp-C.
+ If using Internal CA signed certificates on CUCM, IM/P. Load Root CA certificates on Exp-C.
+ Load CA certificate under tomcat-trust, cup-trust, cup-xmpp-trust on IM-P.
+ Load CA certificate under tomcat-trust, callmanager-trust on CUCM.
Expressway Edge (Exp-E)
- Signed by External CA
- Configured Unified Communications domain as Subject Alternate Name
- If using a cluster, select FQDN of this peer as CN and FQDN of Cluster + this peer as Subject Alternate Name.
- If XMPP federation is being deployed, enter the same Chat Node Aliases as entered in Exp-C.
For more details, please refer to the Certificate Creation Guide for Cisco Expressway x8.1.1
http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Cisco-Expressway-Certificate-Creation-and-Use-Deployment-Guide-X8-1.pdf
- Aashish

Ask the Expert: Cisco TelePresence for the Enterprise

Welcome to the Cisco® Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Telepresence® for the enterprise.
Cisco experts Jaret, Fernando, and Fred will be covering all Cisco TelePresence products. Topics include Cisco TelePresence endpoints and TelePresence infrastructure such as the Cisco TelePresence Video Communication Server (VCS), Cisco Expressway Series, Cisco Unified Communication Manager (CallManager), Cisco TelePresence Servers (MSE 8710, on Virtual Machine, etc.), MCU (MSE 8510, etc.), Cisco TelePresence Management Suite (TMS), and all other Cisco TelePresence related devices.
Jaret Osborne is an 8-year Cisco Advanced Services veteran. In his Advanced Services tour, Jaret has covered all aspects of Cisco Unified Communications and TelePresence products, including both enterprise and service provider verticals. Most recently Jaret has been working with global service providers supporting their Cisco TelePresence as a Service offerings while also incubating new cloud services at Cisco.
Fernando Rivas is a Cisco Advanced Services NCE, starting in the Cisco Technical Assistance Center (TAC), 2007, on the Collaboration Technology Team mastering the Cisco Unified Communication technologies and specialized in call control CUCM,VCS) and conferencing (MeetingPlace, Telepresence). In 2011, he joined Cisco Advanced Services as a member of the Cisco Collaboration team and participated in several Cisco TelePresence and video-related technologies deployments. Currently he is a member of the Video Cloud Technology Team, supporting video exchanges in several and architecting new private video cloud solutions for large enterprises. Fernando holds a routing and switching CCIE® certification (22975).
Fred Mollenkopf is a Cisco Advanced Services Network consulting engineer working at Cisco for the last 7 years. Fred has led some of the largest Cisco Unified Communication and Collaboration deployments done for Cisco customers and partners. Over 15 years’ experience in data networking with a specialization in Cisco Unified Communications in 2004. Currently he is a member of the SP Video Advanced Services Team, supporting SP video exchanges and the Cisco Telepresence solutions. Fred maintains an active CCIE® in Voice (17521).
Remember to use the rating system to let Jaret, Fernando, and Fred know if you have received an adequate response.
Because of the volume expected during this event, Jaret, Fred, and Fernando might not be able to answer every question. Remember that you can continue the conversation in the Collaboration, Voice and Video Community, under the sub-community TelePresence, shortly after the event. This event lasts through August 15, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Tenaro,
Additionally here are the most common login issues. Unfortunately this includes items related to Presence implementation but I commented where we did not use these in our lab setup for CUCM Phone Capabilities only.
Login Issues
Problem:
Jabber Unable to Sign-in Through MRA
Solution
This can be caused by a number of things, a few of which are outlined below.
1. Collaboration Edge SRV record not created and/or port 8443 unreachable
For a jabber client to be able to login successfully using MRA, a specific collaboration edge SRV record must be created and accessible externally. When a jabber client is initially started it will make server DNS SRV queries:
_cisco-uds : this SRV record is used to determine if a CUCM server is available.
_cuplogin : this SRV record is used to determine if an IM&P server is available.
_collab-edge : this SRV record is used to determine if MRA is available.
If the jabber client is started and does not receive an SRV answer for _cisco-uds and _cuplogin, and does receive an answer for _collab-edge then it will use this answer to try to contact the Expressway-E listed in the SRV answer.
The _collab-edge SRV record should point to the FQDN of the Expressway-E using port 8443. If the _collab-edge SRV is not created, or is not externally available, or if it is available, but port 8443 is not reachable, then the jabber client will fail to login.
2.  Unacceptable or No Available Certificate on VCS Expressway
After the jabber client has received an answer for _collab-edge, it will then contact the expressway using TLS over port 8443 to try to retrieve the certificate from the expressway to setup TLS for communication between the jabber client and the expressway.
If the Expressway does not have a valid signed certificate that contains either the FQDN or domain of the Expressway, then this will fail and the jabber client will fail to login.
If this is occurring, the you should use the CSR tool on the Expressway, which will automatically include the FQDN of the expressway as a Subject Alternative Name.
MRA requires secure communication between the Expressway-C and Expressway-E, and between the Expressway-E and external endpoints.
Expressway-C Server Certificate Requirements:
The Chat Node Aliases configured on the IM&P servers. This is required if you are doing XMPP federation. The Expressway-C should automatically include these in the CSR provided that an IM&P server has already been discovered on the Expressway-C.
The names in FQDN format of all Phone Security Profiles in CUCM configured for TLS and used on devices configured for MRA. This allows for secure communication between the CUCM and Expressway-C for the devices using those Phone Security Profiles.
Expressway-E Server Certificate Requirements:
All domains configured for Unified Communications. This includes the domain of the Expressway-E and C, e-mail address domain configured for Jabber, and any presence domains.
The Chat Node Aliases configured on the IM&P servers. This is required if you are doing XMPP federation.
The MRA Deployment guide describes this in greater detail on pages 17-18. (http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Mobile-Remote-Ac...
Note: In our lab for testing Phone Capabilities only, we did not include the Chat Node Aliases in the certificate as we were not using IM&P.
3.  No UDS Servers Found in Edge Config
After the Jabber client successfully establishes a secure connection with the Expressway-E, it will ask for its edge config. This edge config will contain the SRV records for _cuplogin and _cisco-uds. If these SRV records are not returned in the edge config, then the jabber client will not be able to proceed with trying to login.
To fix this, make sure that _cisco-uds and _cuplogin SRV records are created internally and resolvable by the Expressway-C
More information on the DNS SRV records can be found on page 10 of the MRA deployment guide for X8.1.1 (http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Mobile-Remote-Access-via-Expressway-Deployment-Guide-X8-1-1.pdf)
Note: In our lab for testing Phone Capabilities only, we did not include the DNS SRV for _cuplogin.
4.  The Expressway-C logs will indicate the following error: XCP_JABBERD Detail="Unable to connect to host '%IP%', port 7400:(111) Connection refused"
If Expressway-E NIC is incorrectly configured, this can cause the XCP server to not be updated. If the Expressway-E meets the following criteria, then you will likely have this issue:
Using a single NIC
Advanced Networking Option Key is installed
Use Dual Network Interfaces option is set to “Yes”
To correct this problem, change the “Use Dual Network Interfaces” option to “No”
The reason this is a problem is because the Expressway-E will be listening for the XCP session on the wrong network interface, which will cause the connection to fail/timeout. The Expressway-E listens on TCP port 7400 for the XCP session. You can verify this by using the netstat command from the VCS as root.
Note: We used a Dual Network Interface Expressway for testing but were not using XCP, so this was not applicable to us.
5.  VCE-E Server hostname/domain name does not match what is configured in the _collab-edge SRV.
If the Expressway-E Server hostname/domain name does not match what was received in the _collab-edge SRV answer, the jabber client will not be able to communicate to the Expressway-E. The Jabber client uses the xmppEdgeServer/Address element in the get_edge_config response to establish the XMPP connection to the Expressway-E.
This is an example of what the xmppEdgeServer/Address would look like in the get_edge_config response from the Expressway-E to the Jabber client:
<xmppEdgeServer>
<server>
<address>ott-vcse1.vcx.cisco.com</address>
<tlsPort>5222</tlsPort>
</server>
</xmppEdgeServer>
To avoid this, make sure that the _collab-edge SRV record matches the Expressway-E hostname/domain name. Enhancement CSCuo83458 has been filed for this.
Note: This was one of our issues when we first setup. We adjusted our Expressway-E to insure the below:
System > Administration > System Name this was the FQDN
System > DNS > System Host Name was the host portion of the FQDN
System > DNS > Domain Name was the domain portion of the FQDN
System > Clustering > Cluster Name (FQDN for Provisioning) was the FQDN
6. Unable to log into certain IM&P servers. VCS logs say "No realm found for host cups-example.domain.com, check connect auth configuration"
From the Expressway-E, go to Configuration -> Unified Communications -> IM&P Servers. Open each server and click "Save" again. Not sure exactly why this happens.
Note: This was N/A to our test and can be ignored with Phone Capabilities only.
Thanks
Fred

Expressway-E/C Cluster max proxied registration

Dear all
I have seen in the Datasheet if we have Expressway Cluster with 6 , the capacity will increase to maximum of 10'000 proxied registration
Is that correct If build a cluster with 2 the capacity will be increase to 5000 ? or less ?
Clustered Cisco Expressway capacity
● Up to 6 Cisco Expressway appliances and virtual machines can be deployed as a clust to increase capacity and provide redundancy
● Clustering increases the maximum call capacity by up to 4 times
has anybody Idea whats the reason?
Thanks for any Feedback.
Best Regards
Georg

Georg -
I was just about to reply to your comment, but I wanted to look up something first and actually found an issue with the data sheet that my very first reply was based on.
I'm going to assume when you mention "2 clusters", you're referring to a cluster of 2 servers.
According to the data sheet, a VCS using the small/medium/large deployment size can have up to 2500 registrations on each server in a cluster, for a cluster of two (2), you'd have up to 5000.
The admin guide says a VCS using the small/medium deployment size can have up to 2500 registrations on each server in a cluster, for a cluster of two (2), you'd have up to 5000. However, a VCS using the large deployment size can have up to 5000 registrations on each server in a cluster, for a cluster of two (2), you'd have up to 10000.
Regarding the data sheet and admin guide differences, I'd go by the admin guide. To me, it wouldn't make sense to provide a large deployment version of the VCS and keep it's capacity the same as the small versions.
The VCS Admin Guide on pg 202 lists the above information.

Expressway LIC-EXP-RMS Rich Media Session license requirements

I can't seem to find the answer documented anywhere on this. The docs state:
Each concurrent call session terminating on a system not using Cisco Unified Communications Manager, Business Edition or Cisco HCS (for example, B2B calls and Jabber Guest) requires a Cisco Expressway Rich Media Session license. Also, each concurrent call requiring interworking also requires a Cisco Expressway Rich Media Session license. Examples of such calls include H.323-to-SIP interworked calls or H.264 SVC-to-H.264 AVC calls.
So assuming I have an EX90 registered to my CUCM, and I want to place a call that terminates at some external companies video endpoint across the internet, by way of my Expressway Core and Expressway Edge pair, do I need the LIC-EXP-RMS just on the Expressway E, or do I need the license on both boxes?
If it's the latter, do you have to pay for 2 sessions to get 1 call like described, or can the same license be applied to both boxes (although it can only be registered/bound to one serial number) ?
Just the answer would be great, link(s) to supporting documentation would be even better.
Thanks,
Chad Marsh

I don't follow why it would use the RMS license on the C and not the E.
If the call I described were in the reverse direction, (from public external endpoint to CUCM-registered endpoint) would the RMS license then be needed on the Expressway-E?
A co-worker forwarded me a preso from Cisco TME tneumann that states the following, which doesn't really agree with your answer:
<quote>
Rich Media Session licenses are consumed for either traversal or non-traversal call types
A traversal call will require a Rich Media Sessions license on both the Expressway E and Expressway C
</quote>
There must be some call flow scenarios published somewhere in Cisco that documents this license usage?

Unable to open the expressway-Edge page

Hi Folks,
I want to know while deploying cisco expressway is it essential to have expressway-C and expressway-E must be on same version.
I have expressway-C on x8.2.1 while expressway-E on x8.1.1. Would it work or it needs to be on same version.

It's recommended to have them run on the same version, and only run different versions for brief periods of time, such as during upgrades. If for some reason you do run them with different versions, just be sure that you check the release notes to make sure there are no changes in software features or conflicts that would prevent something from functioning, but as I said they should be on the same version.
FYI, the title of your discussion and what you had asked is different, suggest you edit your post and change the title to be match your question.

Ports from isp for the VPN less (Expreeway C&E ) cisco jabber.

Hi Team
What ports need to open from isp for configuring the VPN less (Expreeway C&E ) cisco jabber?
Regards,

Hi Waqas,
Please check the following
http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment_Guide-X8-1.pdf
HTH
Manish

Cisco Expressway

Similar Messages

Maybe you are looking for