Issues getting CMS WebRTC to work via Expressway

[Nick Halbert-Lillyman]

Hi All,

I'm trying to configure the CMS WebRTC via Expressway feature as per the following guide: http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/CMS-Expressway-Deployment-Guide_X8-9-2.pdf

And using the firewall ports guide here: http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment-Guide-X8-9-2.pdf

I've set everything up and can sign in, but when I try to launch video, the page says "lost connection to server" and fails.  When I look on the Expressway-E, it shows a turn relay in use when it's attempting to connect.

The firewall guide says I need to configure NAT reflection but they are a bit light on the detail - I think I've done it correctly but I might be missing something.

The strangest part is that I'm seeing drops on my firewall from my Expressway-E to the external PC's *private* IP address - 192.168.x.x.  While I could certainly permit this traffic, it's never going to reach the PC anyway as it's a private IP.

access-list DMZoutside_access_in denied udp DMZoutside/(Exp-E Outside IP) (24000) -> outside/(PC's private IP - 192.168.x.x) 

There don't appear to be any other drops to or from relevant IPs (Exp-C, both Exp-E addresses, external PC public IP, CMS IP)

I suspect I'm missing something in either the NAT or TURN config - any ideas much appreciated :)

[Patrick Sparkman]

Does it work if you browse to the CMS itself, and not via Expressway?

Are your certificates in place for Call Bridge, Web Bridge, XMPP?

Does your Web Bridge trust your Call Bridge certificate?

Do you have CMS configured to use TURN services on the Expressway-E?

[Nick Halbert-Lillyman]

Hi Patrick - Web bridge works fine internally, when not using Expressway certs are all good and the web bridge trusts the call bridge cert.

CMS is configured to use Exp-E as its TURN server, when I try to start video the Expressway even shows a TURN relay in use.

[Nick Halbert-Lillyman]

Just to follow up on this, the TAC worked with me to fix it.

Initially, the TAC re-added Expressway-E TURN server via the API instead of using the GUI.  In addition, I was missing outbound port UDP/3478 (I had TCP/3478 only).

[Natee Osatis]

Hi Friend,

Can you share what api command to enable TURN outbound port UDP/3478 for me please? I found same problem with you and tried to found out what the issue is.