Expressway Edge Traversal zone to "TLS verify" causes FW drops

[gfolens]

I noticed when enabling on the Expressway-Edge side TLS verify on the Traversal server link the FW between Edge and Core starts to drop packets coming from the Edge side.

Is this normal behaviour? Normally the FW ports should only be opened from Core to Edge. No ports to be opened in the reverse way. Correct?

[Nithin Eluvathingal]

Yes, you need to open the ports from C to E and not the reverse thats how the traversal zones works. I Never come across such a deployment where there is a firewall in between C and E so I never tested this in real. 

I always refer the MRA port usage guide, it has all   ports and its directions  mentioned in details. The below link is for version 12.5.

Can I know what packets are getting dropped through the firewall ?

Cisco Expressway IP Port Usage Configuration Guide (X12.5)https://www.cisco.com › expressway › config_guide