Expressway Media Traversal Considerations

BC.

Expressway media traversal is a solution offered by Cisco for enabling secure audio and video communications between endpoints located in different networks. It provides a way to establish a media path between endpoints that cannot communicate directly due to network address translation (NAT), firewall, or other security devices. When using Expressway media traversal, there are several considerations that need to be made.

A. It is possible to NAT both Expressway-E interfaces: In order to use Expressway media traversal, it is necessary to configure NAT for the Expressway-E interface that is facing the internet. This allows incoming traffic from the internet to be properly routed to the internal network where the Unified Communications Manager (UCM) or other endpoint is located. Additionally, it may be necessary to configure NAT for the Expressway-C interface that is facing the internal network to properly route outgoing traffic.

B. The Unified Communications traversal zone should be used for MRA: Mobile and Remote Access (MRA) is a feature that allows users to securely access the UCM and other resources from outside the corporate network. When using MRA, it is recommended to use the Unified Communications traversal zone on the Expressway for secure communication. This zone provides secure traversal for voice, video, and data traffic between the Expressway-E and Expressway-C.

C. The Expressway-E must be put in a firewall DMZ segment: In order to provide secure access to the Expressway-E from the internet, it is recommended to place it in a DMZ segment on the firewall. This allows for greater security by isolating the Expressway-E from the internal network and limiting the attack surface.

D. Expressway Control is the traversal server installed in the DMZ: Expressway Control is a component of the Expressway solution that provides management and control for the Expressway-C and Expressway-E. It is recommended to install Expressway Control in the DMZ for security reasons. This allows for better control and monitoring of traffic to and from the Expressway-E.

E. Cisco UCM zone should be either traversal server or client: When using Expressway media traversal, it is necessary to configure a traversal zone between the Expressway-C and UCM. The UCM can be configured as either a traversal server or traversal client. When the UCM is configured as a traversal server, it is responsible for managing the media path between endpoints. When the UCM is configured as a traversal client, it relies on the Expressway for media traversal. The choice between the two configurations depends on the specific deployment and requirements.