I need to configure a 7821 for a remote worker through a Sonic firewall to an expressway server

[ppellettiere]

I need to configure a 7821 for a remote worker through a Sonic firewall to an Expressway server.

Do I have to configure anything on the Phone prior to connect it to the firewall?

How does the phone route to the expressway server from the firewall/VPN ?

Thanks,

Pete

[Rajan]

Hi Pete,

WIth expressway solution, the expressway servers itself provides the firewall traversal to the internal network, i dont think you need to go through another firewall. You can hardcode the TFTP server IP address on the phone and you might need to connect the phone first in the internal network if it has not got the required certificates and then move it to the remote location.

HTH
Rajan
Pls rate all helpful posts

[Mohammed al Baqari]

Hi,

You need to allow the following port list through your sonic wall.

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment-Guide-X8-9-2.pdf

You need to make sure that you are running firmware 11.5(1) on the phone. If not, then connect your phone to cucm environment to upgrade the phone firmware.

You need to make sure that your expressway is signed by a CA that is listed in 7821 trusted CAs. See the trusted CAs below.

https://www.cisco.com/c/en/us/support/collaboration-endpoints/unified-ip-phone-7800-series/products-technical-reference-list.html

Once the phone boots it will ask for the service domain and from their will discover expressway and connect to it. If you got your expressway working for jabber then your expressway/cucm config should be good to go.

[ShaheerEP5682]

Could you please guide me in detail.

Currently, my environment have expressway solution and Jabber is working fine remotely.

but it’s not signed by CA.

still can I use Ip phone to register from external?

what are the mandatory requirements to get it done or please provide the steps to make Ip phone register from home.

Thank You in Advance…

[Jaime Valencia]

The MRA configuration contains the steps for both, Jabber and IP Phones, that's the document you need to review.

It's mandatory to have the EXP-E signed by a public CA from the ones listed here:

https://www.cisco.com/c/en/us/support/collaboration-endpoints/unified-ip-phone-8800-series/products-technical-reference-list.html

The phones only have those CAs in the trust list, anything not in the list will not work.