EXPWYC Traversal Zone TLS negotiation Failed

[YAARUB F. MILAD]

Enter the Fully Qualified Domain Name (FQDN) of the traversal server. If you are using secure traversal, then this value must be either the Common Name or one of the Subject Alternate Names on the traversal server's certificate. IP addresses or hostnames are therefore not recommended.

If the traversal server is a cluster of Expressway-Es, this is the FQDN of one of the peers in that cluster.

Range: 0 to 255 characters

Hello,

I have an issue with EPWYC Traversal Zone once I configured it and saved I got the following issue:

SIP: Failed to connect to (IP<x.x.x.x>):7001 : Connect failed

what could be the reason for this. where to look ?

Thanks all

[YAARUB F. MILAD]

I am using dual interfaces on EXPWYE and E's FQDN isn't reachable by C

[moyo oyegunle]

You can try the following.

1 First try and confirm network reachability to the Lan facing ethernet interface of the Exp-e. You can use the Ping, traceroute tools also try pinging the hostname of the expressway-e(This should help you check you have the correct DNS records) it should resolve to the internal IP.

2 You should look in the 1st DMZ , the Cisco Expressway guide provides ports that are required to be open or mapped(http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Cisco-Expressway-Basic-Configuration-Deployment-Guide-X8-1.pdf). Kindly make sure yours are.

3 If the above are fine you should make sure you have configured the Traversal Zone on the EXP-E to also use the same port as you did on the EXP-C.

4 You can look at status - logs - network logs to see network data.

[YAARUB F. MILAD]

I have solved the issue and it was due to inappropriate Cert template

[ahmed mahmoud]

This is mean that i can`t create zone before creating cert ?

[Patrick Sparkman]

You can create a UC Traversal Zone before you get a certificate, but the it won't become active without a valid certificate on the Expressway-C that matches the subject name that you enter in the zone you created on the Expressway-E.

[ahmed mahmoud]

Thanks friend , I have other question , How can expressway E know FQDN of expressway C although i put external domain on expressway E , how connectivity through internal dns occur ?

[Debayan Chowdhury]

Expressway E knows about the FQDN of the Expressway C when u enter the same while creating Traversal/UC Traversal Zone on the same. 

Expressway E doesn't initiate any connection however accepts the connection from Expressway C based on the port number configured on the UC Traversal and Traversal Zone , thus it learns about the IP address of Expressway C.  

[ahmed mahmoud]

Big thanks :)