Cisco Expressway Series User manual

Cisco Expressway IP Port Usage
Configuration Guide
First Published: April 2017
X8.9.2
Cisco Systems, Inc. www.cisco.com

Preface
Change History
Date Change Reason
July
2017
Correction Outbound SIPsignaling removed from MRAdiagram and table.
April
2017
New
document
New format for information previously held in Expressway IP Port Usage for Firewall
Traversal.
Table 1 Cisco Expressway IP Port Usage Configuration Guide Change History
Related Documents
For Installation, See:
■Cisco Expressway Virtual Machine Installation Guide on the Expressway installation guides page.
■Cisco Expressway CE1100 Appliance Installation Guide on the Expressway installation guides page.
For Administration and Maintenance:
■See Expressway Administrator Guide
■See the Cisco Expressway Serviceability Guide on the Expressway Maintain and Operate Guides page.
■See Cisco Expressway External Policy Deployment Guide at the Cisco Expressway Series Configuration
Guides page.
For Clustering and Certificates (All Deployments):
■See Cisco Expressway Certificate Creation and Use Deployment Guide on the Expressway configuration
guides page.
■See the Cisco Expressway Cluster Creation and Maintenance Deployment Guide, for your version, on the
Cisco Expressway Series configuration guides page.
For Basic Call Control Deployment:
See Cisco Expressway Registrar Deployment Guide on the Expressway configuration guides page.
For Mobile and Remote Access to Cisco Unified Communications Manager Services:
See Mobile and Remote Access Through Cisco Expressway on the Expressway configuration guides page.
For Remote Configuration of MRA:
See Cisco Expressway RESTAPIReference Guide on the Expressway installation guides page.
For Microsoft Interoperability:
■See Cisco Expressway with Microsoft Infrastructure Deployment Guide on the Expressway configuration
guides page.
■See Cisco Jabber and Microsoft Skype for Business Infrastructure Configuration Cheatsheet on the
Expressway configuration guides page.
For Cisco Meeting Server:
■See the Cisco Meeting Server installation guides page.
■See deployment guides on the Cisco Meeting Server configuration guides page.
2
Cisco Expressway IP Port Usage Configuration Guide

■See the Cisco Expressway with Cisco Meeting Server Deployment Guide on the Expressway configuration
guides page.
Contents
Preface 2
Change History 2
Related Documents 2
How to Use This Document 5
Default Port Ranges 5
Basic Networking Connections 7
Basic Networking:Expressway 7
Networking Port Reference:Expressway 7
Basic Networking:Traversal Pair 9
Networking Port Reference:Expressway Traversal Pair 10
Clustering Connections 12
Cluster Connections Before X8.8 12
Cluster Port Reference Before X8.8 12
Cluster Connections X8.8 Onwards 13
Cluster Port Reference X8.8 Onwards 13
Provisioning, Registrations, Authentication, and Calls 14
SIP Calls 15
SIP Calls Port Reference 16
H.323 Calls 18
H.323 Calls Port Reference 20
TMS Connections 22
TMS Port Reference 22
LDAP Connections 24
LDAP Port Reference 24
Mobile and Remote Access 26
MRA Connections 26
MRA Port Reference 27
Jabber Guest Services 29
Jabber Guest:Dual NICDeployment 30
Jabber Guest:Dual NICDeployment Ports 31
3
Cisco Expressway IP Port Usage Configuration Guide

Jabber Guest:Single NICDeployment 32
Jabber Guest:Single NICDeployment Ports 33
Microsoft Interoperability Using Gateway Expressway 34
On-Premises Microsoft Clients 34
Off-Premises Microsoft Clients 35
Expressway with Microsoft Infrastructure Port Reference 36
Cisco Meeting Server 38
Web Proxy for Cisco Meeting Server WebRTC Connections 38
Web Proxy for Cisco Meeting Server Port Reference 39
SIP Edge for Meeting Server Connections 40
SIP Edge for Cisco Meeting Server Port Reference 41
XMPP Federation 43
XMPP Federation Connections 43
XMPP Port Reference 44
Serviceability 45
Serviceability:Expressway-C 45
Serviceability:Traversal Pair 46
Serviceability Ports:Traversal Pair 46
Cisco Legal Information 47
Cisco Trademark 47
4
Cisco Expressway IP Port Usage Configuration Guide

How to Use This Document
The purpose of this document is to help you configure and troubleshoot connections between infrastructure
components related to Expressway deployments.
There is a section for each of the popular Expressway deployments. Each has a diagram showing the major
infrastructure components and the connections between them, and also lists the connections in a table format.
The deployments build on each other where necessary. For example, if you wish to implement Mobile and Remote
Access, you should first configure a traversal pair. These relationships are described in the relevant deployment
guides.
Default Port Ranges
The following defaults are used throughout this document. Default port ranges may occasionally change (if
unavoidable) as new features are developed. Our documents list the current default ports for the given version
number.
Note:In some cases throughout this document we list port ranges used by third party infrastructure. These are default
values and we cannot guarantee that these are correct for your environment. We recommend you follow the
supplier's documentation to configure those connections.
Protocol Purpose Current
Range
Details
TCP Ephemeral ports 1024-65535 Outbound HTTP/S, LDAP
UDP Ephemeral ports 1024-65535 DNS, outbound TURNrequests
TCP Ephemeral ports 30000-
35999
UDP Ephemeral ports 30000-
35999
TCP Outbound SIP 25000-
29999
UDP&TCP Inbound TURN
requests on
Small/Medium
Expressway-E
3478 On Expressway-E only. Configurable to a port >= 1024
UDP&TCP Inbound TURN
requests on
Large
Expressway-E
3478-3483 On Large Expressway-E only. Configurable to a six port range with
first port >=1024.
UDP TURN relays 24000-
29999
On Expressway-E only.
Table 2 Default Port Ranges on Expressway
5
Cisco Expressway IP Port Usage Configuration Guide

Protocol Purpose Current
Range
Details
UDP RTP/RTCPmedia 36000-
59999
The range is configurable.
On S/MExpressway, the first two ports can be used for multiplexed
media if you do not use default/custom ports.
On LExpressway, the first twelve ports of the range are used for
multiplexed media. You cannot customize that subrange.
UDP Multiplexed
media on
Small/Medium
Expressway-E
systems
2776/2777
OR
36000/36001
2776/2777 is older pair but kept as default by the ability to
customize when the new default range was introduced with
S/Msystem options. Custom pair is defined on Configuration
>Traversal >Ports.
On Expressway-E only.
Note:In the connection maps and port references we do not show
all the port options for the sake of clarity. For example, if the
diagram shows 2776/2776, but you have chosen to use
36000/36001 instead, then you don't need to also open 2776/2777.
UDP Multiplexed
media on Large
Expressway-E
systems
36000-
36011
New range introduced with Largesystem option. This range is
always the first twelve ports of the RTP/RTCPmedia range, so it
will be different if you configure a different media range.
On Expressway-E Large OVAs or large scale appliances only.
Note:In the connection maps and port references we do not show
all the port options for the sake of clarity. For example, if the
diagram shows 2776/2776, but you have a large Expressway, then
you should open the first twelve ports of the media range instead of
2776/2777.
TCP SIPtraversal 7001 Configurable. SIPlistening port on the first Expressway-E traversal
server zone. Subsequent traversal server zones will use incremental
port numbers, eg. 7002, by default.
UDP H.323 traversal 6001 Configurable. H.323 listening port on the first Expressway-E
traversal server zone. Subsequent traversal server zones will use
incremental port numbers, eg. 6002, by default.
Table 2 Default Port Ranges on Expressway (continued)
6
Cisco Expressway IP Port Usage Configuration Guide

Basic Networking Connections
Basic Networking:Expressway
Networking Port Reference:Expressway
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Administrator SSH Admin PCs 1024-65535 TCP Expressway-C 22
Administrator HTTP*Admin PCs 1024-65535 TCP Expressway-C 80
Administrator HTTPS Admin PCs 1024-65535 TCP Expressway-C 443
Name resolution (DNS) Expressway-C 1024-65535 UDP & TCP†Internal name server 53
Time synchronization (NTP) Expressway-C 123 UDP Internal time server 123
Table 3 Basic Networking Ports for Expressway-C
7
Cisco Expressway IP Port Usage Configuration Guide

* Expressway redirects HTTPto HTTPSby default. You don't need to open the HTTP port, but you can allow HTTPfor
convenience and redirect to HTTPS.
† Expressway will attempt DNSresolution over TCPif the response is too large.
8
Cisco Expressway IP Port Usage Configuration Guide

Basic Networking:Traversal Pair
9
Cisco Expressway IP Port Usage Configuration Guide

Networking Port Reference:Expressway Traversal Pair
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Administrator SSH Admin PCs 1024-65535 TCP Expressway-C 22
Administrator HTTP*Admin PCs 1024-65535 TCP Expressway-C 80
Administrator HTTPS Admin PCs 1024-65535 TCP Expressway-C 443
Name resolution (DNS) Expressway-C 1024-65535 UDP & TCP†Internal name server 53
Time synchronization (NTP) Expressway-C 123 UDP Internal time server 123
Table 4 Basic Networking Ports for Expressway-C
* Expressway redirects HTTPto HTTPSby default. You don't need to open the HTTP port, but you can allow HTTPfor
convenience and redirect to HTTPS.
† Expressway will attempt DNSresolution over TCPif the response is too large.
Purpose Src. IP Src. ports Protocol Dest. IP Dst.
Ports
Administrator SSH Admin PCs 1024-
65535
TCP Expressway-E private
IP
22
Administrator HTTP Admin PCs 1024-
65535
TCP Expressway-E private
IP
80
Administrator HTTPS Admin PCs 1024-
65535
TLS Expressway-E private
IP
443
Internal name resolution (DNS)* Expressway-E private
IP
1024-
65535
UDP
&TCP
Internal name server 53
External name resolution (DNS) Expressway-E public
IP
1024-
65535
UDP
&TCP
External name server 53
Internal time synchronization
(NTP)*
Expressway-E private
IP
123 UDP Internal time server 123
External time synchronization
(NTP)
Expressway-E public
IP
123 UDP External time server 123
Table 5 Basic Networking Ports for Expressway-E
* You may prefer to connect Expressway-E to external DNSand NTP. You do not need both.
10
Cisco Expressway IP Port Usage Configuration Guide

11
Cisco Expressway IP Port Usage Configuration Guide

Clustering Connections
Cluster Connections Before X8.8
Cluster Port Reference Before X8.8
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Cluster database synchronization (IPSec AH) This
peer
N/A 51 Other
peers
N/A
Key exchange between peers (ISAKMP) This
peer
500 UDP Other
peers
500
Cluster recovery This
peer
30000-
35999
UDP Other
peers
4371
Cluster communication This
peer
30000-
35999
TCP Other
peers
4369-
4380
Bandwidth management (Expressway-C cluster
only)
This
peer
1719 UDP Other
peers
1719
Table 6 Cluster Synchronization and Communications
12
Cisco Expressway IP Port Usage Configuration Guide

Cluster Connections X8.8 Onwards
Cluster Port Reference X8.8 Onwards
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Cluster recovery This peer 30000-35999 TCP Other peers 4371
Cluster communication This peer 30000-35999 TLS Other peers 4372
Bandwidth management This peer 1719 UDP Other peers 1719
Table 7 Expressway-C Cluster Database Synchronization and Communications
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
SIPTCPSignaling This peer 25000-29999 TCP Other peers 5061
SIPTLSSignaling This peer 25000-29999 TLS Other peers 5061
RTP/RTCP This peer 36000-59999 UDP Other peers 36000-59999
Bandwidth management This peer 1719 UDP Other peers 1719
Table 8 SIPCalls Routed Between Peers (not shown on diagram)
13
Cisco Expressway IP Port Usage Configuration Guide

Provisioning, Registrations, Authentication, and Calls
SIP Calls 15
SIP Calls Port Reference 16
H.323 Calls 18
H.323 Calls Port Reference 20
TMS Connections 22
TMS Port Reference 22
LDAP Connections 24
LDAP Port Reference 24
14
Cisco Expressway IP Port Usage Configuration Guide

SIP Calls
15
Cisco Expressway IP Port Usage Configuration Guide

SIP Calls Port Reference
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
SIPsignaling Expressway-
C
25000-29999 TCP or
TLS
Expressway-
E
7001 (for first traversal zone;
7002 for second etc.)
SIPsignaling Expressway-
C
5060 UDP SIPendpoint 5060 (often, but could be
different, >=1024)
Port number defined by
registration (if registered) or by
DNSlookup
SIPsignaling Expressway-
C
25000-29999 TCPor
TLS
SIPendpoint >=1024
Port number defined by
registration (if registered) or by
DNSlookup
SIPsignaling SIPendpoint
(or its
firewall)
>=1024 UDP Expressway-
E
5060
SIPUDPdisabled by default.
Not recommended for internet
facing connections.
SIPsignaling SIPendpoint
(or its
firewall)
>=1024 TCP Expressway-
E
5060
SIPTCPdisabled by default
(X8.9.2 and later).
SIPsignaling SIPendpoint
(or its
firewall)
>=1024 TLS Expressway-
E
5061
SIPsignaling SIPendpoint
(or its
firewall)
>=1024 MTLS Expressway-
E
5062
Assent RTP
(traversed
media)
Expressway-
C
36000-59999 UDP Expressway-
E
2776 or 36000 (Small/Medium)
36000 - 36010 (even ports)
(Large)
Assent RTCP
(traversed
media)
Expressway-
C
36000-59999 UDP Expressway-
E
2777 or 36001 (Small/Medium)
36001 - 36011 (odd ports)
(Large)
Assent RTP
(traversed
media)
SIPendpoint
(or its
firewall)
>=1024
Could be the firewall
port where the media
egressed, rather than an
endpoint port
UDP Expressway-
E
36000-59999
Table 9 SIPCalls Port Reference
16
Cisco Expressway IP Port Usage Configuration Guide

Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Assent RTCP
(traversed
media)
SIPendpoint
(or its
firewall)
>=1024
Could be translated by
the firewall to port where
the media egressed,
rather than an endpoint
port
UDP Expressway-
E
36000-59999
Assent RTP
(traversed
media)
Expressway-
E
36000-59999 UDP SIPendpoint
(or its
firewall)
>=1024
Expressway waits until it
receives media, then sends
media to that source port
(which could be the port where
the media egressed the firewall,
not an endpoint port)
TURNcontrol Any
IPaddress†>=1024 (signaling port from endpoint or the
firewall)
UDP
&TCP
Expressway-
E
3478 (Small/Medium)
3478-3483 (Large)
TURNmedia Expressway-
E
24000-29999 UDP
&TCP
Any
IPaddress
>=1024
TURNmedia Any
IPaddress‡>=1024
Port of relevant
ICEcandidate:host
IPport, server reflexive
port (outside firewall
port), or TURNserver
port
UDP
&TCP
Expressway-
E
24000-29999
Table 9 SIPCalls Port Reference (continued)
† The request could be from any IPaddress, unknown to the TURNserver. Assume for example, that endpoint A and
endpoint C (TURNclients) in the diagram can use the Expressway-E TURNserver. The actual IPaddress from which
the TURNserver receives the request could be the endpoint's firewall egress address (NATed).
‡ The media could go to any of the candidate addresses. For example, before ICEnegotiation the TURNserver does
not know which of endpoint B's candidate addresses will be the highest priority.
Note:The endpoints A, B, and C in the diagram only show media connections to avoid unnecessary lines. They would
use the same signaling connections as shown for the other endpoints / bridges.
17
Cisco Expressway IP Port Usage Configuration Guide

H.323 Calls
Note:This diagram and following table apply specifically to Cisco VCSdeployments. You can use this information to
prepare an Expressway-based H.323 deployment, but remember that Expressway-Edoes not accept H.323
registrations.
18
Cisco Expressway IP Port Usage Configuration Guide

19
Cisco Expressway IP Port Usage Configuration Guide

H.323 Calls Port Reference
Purpose Src. IP Src. ports Protocol Dest. IP Dst. Ports
Initial
RASconnection
External address of
firewall protecting off-
premises endpoint
>=1024 UDP Expressway-
E (public)
1719
Initial
RASconnection
Expressway-C 1719 UDP Expressway-
E (private)
6001 (for first traversal zone,
6002 for second etc.)
Q.931 / H.225
signaling
Any (endpoint in the
Internet)
1720 TCP Expressway-
E (public)
1720
Q.931 / H.225
signaling
Expressway-E (public) 15000-
19999
TCP Any
(endpoint in
the Internet)
1720 (endpoint signaling port,
specified during registration.
Could be another port
>=1024)
Q.931 / H.225
signaling
Expressway-C 15000-
19999
TCP Expressway-
E (private)
2776 (Assent calls)
Q.931 / H.225
signaling
Expressway-C 15000-
19999
TCP Expressway-
E (private)
1720 (H.460.18 calls)
H.245 Expressway-C 15000-
19999
TCP Expressway-
E (private)
2776 (Assent calls)
H.245 Expressway-C 15000-
19999
TCP Expressway-
E (private)
2777 (H.460.18 calls)
H.245 Any (endpoint in the
Internet)
>=1024 TCP Expressway-
E (public)
Expressway-E (public)
H.245 Expressway-E (public) 15000-
19999
TCP Any
(endpoint in
the Internet)
>=1024 (endpoint H.245
signaling port)
H.245 External address of
firewall protecting off-
premises Assent endpoint
>=1024 TCP Expressway-
E (public)
2776
H.245 External address of
firewall protecting off-
premises H.460.18/19
endpoint
>=1024 TCP Expressway-
E (public)
2777
RTP
(multiplexed
traversal media)
Expressway-C 36000-
59998
(even
ports)
UDP Expressway-
E (private)
2776 (Small/Medium)
or 36000-36010 (even ports)
(Large)
RTCP
(multiplexed
traversal media)
Expressway-C 36001-
59999
(odd ports)
UDP Expressway-
E (private)
2777 (Small/Medium)
or 36001-36011 (odd ports)
(Large)
Table 10 H.323 Ports Reference
20
Cisco Expressway IP Port Usage Configuration Guide