I85PREP
⌘ K
Cisco CLCEI 300-820 study materials
Cisco CLCEI 300-820 study resources

Cisco CLCEI 300-820: Edge, Expressway, and Secure Firewall Traversal for Hybrid Services

Cisco CLCEI 300-820 · Work through your exam, one topic at a time.

All guide sections

Edge, Expressway, and Secure Firewall Traversal for Hybrid Services

This domain tests the Expressway pair and the firewall design that lets external endpoints reach internal call control without exposing UCM. Expect questions on which port, DNS record, or certificate breaks a registration.

Topology

Expressway-C sits in the internal network next to UCM; Expressway-E sits in the DMZ. They form a traversal zone, and only Expressway-E is reachable from the internet. UCM is never directly exposed. The same pair supports mobile and remote access, business-to-business calls, and Webex Edge for Devices.

Ports and DNS

  • On Expressway-E from the internet: SIP 5060 and 5061 TLS, HTTPS 8443 for MRA, and the media range UDP 36000 to 36011.
  • Between Expressway-C and Expressway-E: the traversal control channel on TCP 7001 plus the documented media range in Cisco's firewall traversal guide.
  • Outbound TCP 443 from Expressway-C to Webex for hybrid services and management.
  • External DNS SRV record _collab-edge._tls.<domain> pointing to Expressway-E on port 8443.
  • Internal DNS SRV record _cisco-uds._tcp.<domain> pointing to UCM for on-premises discovery.

Certificates

Expressway-E needs a CA-signed certificate whose SAN includes the SRV target hostname; Expressway-C needs a certificate that UCM trusts. Expired or SAN-mismatched certificates are the classic registration failure.

MRA configuration

Enable Mobile and Remote Access on Expressway-C, add UCM as a traversed Unified Communications service, trust the UCM Tomcat certificate, and confirm the SIP domain. Endpoints then register over HTTPS 8443 and place calls over SIP 5061.

Worked example

External Jabber cannot register. Check in order: does the SRV record resolve publicly to Expressway-E on 8443; does the Expressway-E certificate SAN contain that SRV target; is the traversal zone in Unified Communications mode; does Expressway-C trust UCM; is UDP media open. Reasoning: each check maps to one dependency in the registration chain, so a failure narrows quickly.

Traps that cost marks

  • Publishing 443 instead of 8443 for MRA.
  • Internal DNS returning the Expressway-E address, breaking on-premises discovery.
  • Missing hairpin NAT, so internal clients cannot reach the external address.
  • A wildcard certificate that does not cover the SRV target name.