Voice is not working in Cisco Jabber

[Alexander Rusin]

Hello, friends, help me.,

I have configured the expressway c\e vX14 bundle package.3.7, CUCM v14.0.1.13900, IM v 14.0.1.13900

everything works from the local network, cisco jabber connects, calls and voice passes

But from the global network, the chat is working, the call (alarm) is going through, but there is no voice in both directions. Although jabber says that all services are connected

The firewall used is Cisoc ASA
exspressway-c is on the same network as CUCM and IM
exspressway-e is in the DMZ zone
No nat is configured between the exspressway-c and exspressway-e servers and the entire IP is open.
Ports 8443,5060,5061,5222 have been opened and forwarded from the global network

What could be the problem?

[Mohammadreza Hadi]

on Expressway Edge >> no need of port 5060 >> remove it >> keep only 5061 , 8443 , 5222 (all tcp)

also, you must open a UDP range of port for Voice & Video traffic >> starting with 36000 udp & end with 59999 udp

almost for each one call through expressway, you will need 2 udp port
so assume you want to handle 100 calls simultaneously through expressway >> you need 200 port udp

so >> open port 36000 UDP To 360200 UDP >> on Expressway Edge

then test call again..

also, do a system reboot will be good..

(on my own projects >> i open port 36000 UDP  To  38000 UDP >> for make sure maximum capacity be existed..!!!

[Alexander Rusin]

It didn't help , even the counters don't work out for incoming ACLs
, and there are no votes for this rule either.

access-list OUTSIDE_nl line 9 extended permit udp any host 192.168.2.5 range 36000 59999 (hitcnt=0) 0

[Mohammadreza Hadi]

dear @Alexander Rusin 
anyway you must open this UPD port range, for passing through of Media (voice & video..)
it's mandatory, if you not opened them before then..

i suggest to check again you firewall, to see for what reason counters are not increasing..

& see this URL's, maybe Helps >>

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X15-0/ip-port/exwy_b_cisco-expressway-ip-port-usage-configuration-guide-x15/exwy_m_default-port-ranges.html

https://community.cisco.com/t5/unified-communications-infrastructure/expressway-edge-firewall-ports/td-p/2740267

https://community.cisco.com/t5/switching/port-forwarding-udp-port-range-from-36000-to-59999-on-cisco/td-p/2787192

https://community.cisco.com/t5/telepresence-and-video-infrastructure/firewall-ports-for-the-vcs-expressway-deployment/td-p/2442141

[Alexander Rusin]

I'm in a complete stupor.
I have redesigned the scheme for an implementation with two network cards. moreover, I put esxpdessway C and E in the same subnet, without a firewall, and still there is no voice!
The log analyzer also writes the error of changing the sip between E and C, but there is simply nothing there to change the traffic now.

a= fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1;max-fs=3601;max-rcmd-nalu-size=1344,,is different than:, ,a=fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1;max-fs=3601;max-rcmd-nalu-size=1344,a=rtpmap:126 H264/9000 0

I have a question:
do you need a license for expressway to work with media and voice in MRA mode?

[Roger Kallberg]

No there are no license needed for MRA.

[Nithin Eluvathingal]

What is your Dual NIC configuration? Have you mentioned the NAT IP on the External Interface on the Expressway E interface page? As @Roger Kallberg  mentioned, there is no license required for MRA.

Can you explain a little more of your setup and if possible share the configuration screenshots.

[Alexander Rusin]

Yes, at the moment the circuit has been converted to a dual network interface.
and even simplified the scheme to this

ASA

access-list OUTSIDE_nl line 9 extended permit tcp any host 192.168.230.205 eq 8443
access-list OUTSIDE_nl line 9 extended permit tcp any host 192.168.230.205 eq 5222
access-list OUTSIDE_nl line 9 extended permit tcp any host 192.168.230.205 eq 5061
access-list OUTSIDE_nl line 9 extended permit udp any host 192.168.230.205 range 36000 59999
access-list OUTSIDE_nl line 9 extended permit udp any host 192.168.230.205 eq 5061
access-list OUTSIDE_nl line 9 extended permit udp any host 192.168.230.205 range 3478 3483
access-list OUTSIDE_nl line 9 extended permit udp any host 192.168.230.205 range 24000 29999

nat (DMZ,outside_nl) source static Expressway-E interface service Expressway-tcp_5222 Expressway-tcp_5222
nat (DMZ,outside_nl) source static Expressway-E interface service Expressway-tcp_8443 Expressway-tcp_8443
nat (DMZ,outside_nl) source static Expressway-E interface service Expressway-tcp_5061 Expressway-tcp_5061
nat (DMZ,outside_nl) source static Expressway-E interface service Expressway-udp_5061 Expressway-udp_5061
nat (DMZ,outside_nl) source static Expressway-E interface service Expressway-UDP Expressway-UDP

CUCM ip 192.168.33.203,204

IM ip 192.168.33.201

[Nithin Eluvathingal]

Do you see UDP traffic on the firewall?
The Expressway E configuration appears to be correct, unless I missed something.
What do you see on the CSA tool in the CollabEdge Validator?

[Alexander Rusin]

Unfortunately, I don't have the CSA deployed.

the fact of the matter is that all counters from an external address to an internal one over UDP = 0

host 192.168.230.205 range 36000 59999 (hitcnt=0)

host 192.168.230.205 eq 5061 (hitcnt=0)

host 192.168.230.205 range 3478 3483 (hitcnt=0)

host 192.168.230.205 range 24000 29999 (hitcnt=0)

at the same time, there are counters in nat

24 (DMZ) to (outside_nl) source static Expressway-E interface service Expressway-UDP Expressway-UDP
translate_hits = 3753, untranslate_hits = 72715

object service Expressway-UDP
service udp destination range 36000 59999

object network Expressway-E
host 192.168.230.205

[Nithin Eluvathingal · Accepted solution]

CSA is not something you need to deploy. Go to https://cway.cisco.com/csa-new. You can upload the logs there, and there is also another option, CollabEdge Validator, which requires you to provide end user login credentials to test the MRA.

[Alexander Rusin]

Yes, I tested the logs there.

[Alexander Rusin]

Well, I found my mistake!

service udp SOURCE range 36000 59999

[Nithin Eluvathingal]

Which means the issue was from your firewall. I hope your issues have been fixed.
As @Mohammadreza Hadi  mentioned, if you have 5060 opened from outside, this is not required and it must be the secure one, 5061.

[Alexander Rusin]

port 5060 is not open