CCX Editor doesn't work properly using VPN

[ilmatte]

Hi there,

I am having trouble using the Cisco CCX Editor with a company VPN. When I am at office it works properly. When I try to open it from remote, either it doesn't start at all, or it starts and then I have problem reaching the script repository (when i click over there I get no answer), or when I try to open scripts which open normally in the company network, I get weird errors (see attachement).

I run the CCX Editor in Windows 11 launching it in compatibilty mode for Windows 7 as admin. I have installed Adoptium as JRE.

What can be the reason for that? Is a matter of firewall policy? Where can I find the necessary ports and protocols to be open?

Best regards,

[Nithin Eluvathingal · Accepted solution]

AFAIK, you need to open ports 6999 and 8443 on the firewall if you’re using the Script Editor over the VPN.

[ilmatte]

Are you sure about port 8443? In this document (Port Utilization Guide for Cisco Unified Contact Center Express Solution, Release 11.6(1) - Port Utilization in Unified CCX [Cisco Unified Contact Center Express] - Cisco) I read about ports TCP 6999 and 7

Maybe is just port 6999 and port 7?

What's the purpose of port 8443 when using the Script Editor?

[Elliot Dierksen]

You might need to launch wireshark or something else to do a packet capture so you could compare working and non-working sessions. My leaning would be towards differences in DNS name resolution or a problem with packet size (MTU/MSS).

[ilmatte · Accepted solution]

Ok I found one part of the problem. Looks like some missing policy (more specifcally the TCP ephemeral range specified here (Port Utilization Guide for Cisco Unified Contact Center Express Solutions, Release 11.0(1) - Port Utilization in Unified CCX [Cisco Unified Contact Center Express] - Cisco)
BUT
I keep getting the error I posted in my original post when opening just some scripts, some others open without any complaint. This doesn't look like a firewall problem, rather a Java error. Could anyone tell me what does it mean?

[Elliot Dierksen]

I think this is a job for wireshark so you can determine if the problem is network transport, or an application issue.

[Nithin Eluvathingal]

Did you open only port 6999 and not 8443?

[ilmatte]

No it was the TCP ephemeral port range. If you look at the link I posted there's a foot note saying:

TCP Ephemeral ports are used to accept connections during Java RMI communication. Java RMI clients know which port it need to connect, because RMI first connects to RMI Registry (well-known port - 6999) and get the information which ephemeral port client need to connect to Unified

I'm still having trouble about the Java errors, but I'm not sure is a matter of firewalls and closed ports. Just looking at the wireshark traces is not helping me at the moment.