Showing results for 
Search instead for 
Did you mean: 

MRA Expressway E complaining about RMS License "Out of Compliance"



Ok. We are running an Expressway Cluster Pair that is ONLY for Mobile Remote Access. 
There should not be anything going on that would require a Rich Media Session License, and yet the ExpE Nodes are complaining that they are out of compliance because of missing RMS Licenses. Its only on the Expressway Es.

Does anyone know why that is and how to prevent it. 

Problem is that the Exps are now registered in a Smart Account and that will also raise an alert. Which in turn raises questions with the department responsible for managing the smart account. 

Any info you be appreciated.


Screenshot 2023-02-02 102719.png

1 Accepted Solution

Accepted Solutions

Now I had access to an Expressway, a re-cap:

1) Delete DNS SRV records for SIP / H.323 in the public DNS, so they are not resolved to your Expressway-Es public IP.

2) Turn off unused services: You can turn of H323 (Configuration --> Protocols --> H323), SIP/UDP (Configuration --> Protocols --> SIP --> UDP mode --> off) and SIP/TCP (Configuration --> Protocols --> SIP --> TCP mode --> off)
SIP/TLS needs to stay on for MRA!!

You can also block those protocols (H323, SIP/UDP and SIP/TCP) already on the FW infront of the EXP-E.
You can also add FW rules directly on the EXP-E under System --> Protection --> Firewall Rules

3) Add a call policy rule to block all SIP/h323 calls:
First: Activate the policy service (Configuration --> Call Policy --> Configuration --> Call policy mode --> Local CPL)
Second: Add a "block all" rule (Configuration --> Call Policy --> Rules --> New)
- Source type: From address
- Rule applies to: unauthenticated callers
- Source pattern: ".*" (without the double quotes)
- Destination pattern: ".*" (without the double quotes)
- Action: Reject

View solution in original post

13 Replies 13

Nithin Eluvathingal
VIP Mentor VIP Mentor
VIP Mentor

There could be some one trying to make a B2B call which consume the RMS license. harden your expressway asper the best practices and enable the protection features on expressway.

Response Signature


Thanks for your reply. Makes sense. 

Any documentation on what the "best practices" are? Is there a hardening guide?  I can't find anything.


Refer admin expressway admin guide and there are some Cisco Live contents available regarding this topic.



Response Signature


Ok. Thank you. I will dig into that. 

VIP Advisor VIP Advisor
VIP Advisor

If you have DNS SRV records for SIP / H323: delete them. You don't need them for MRA
You can also disable SIP/TCP and SIP/UDP on Exp-E. They are also not needed for MRA.

Add a policy rule that blocks everything: Source-pattern ".*" and Dest-pattern ".*" (without the double quotes).

Hello @b.winter 
I was about to post a response saying that you did a great post on this a while back where you posted a little bit more information on how to go about to set up the policy rules. Tried to find it, but got nowhere. Would you have the chance to link to it or share the information once more?

Edit: Funny enough, I did find your post and to my big surprise it was a response to the OP of this post. @JaySchiller You got this response from @b.winter back in late 2022,, have you done the changes he suggested there?

Response Signature

To be honest, I totally forgot about this post. 

But, yes, I did implement the changes. And it did indeed help with the complaints about the missing Telepresence Room Licenses. Not against the missing RMS Licenses. 

I would image that what @b.winter suggest might be the Answer.
"Add a policy rule that blocks everything: Source-pattern ".*" and Dest-pattern ".*" (without the double quotes)."

I did not find the time to test this yet. 


FYI We did put in the policy back when you asked this the other time and from what we have been able to tell we have not seen any alerts for this since, nor experienced any drawbacks from it. It’s a five minutes effort, so it’s advisable to get it done so that you can get rid of these nuisance alerts.

Response Signature

VIP Advisor VIP Advisor
VIP Advisor

Hi Jay,
yes, you are correct. The rule in the other post is just for registration attempts to the Expressway.
But you are now having the problem with normal SIP / H323 calls to the Expressway.

What I mean with policy rules section "Configuring Call Policy"