Monitoring Expressway-C and Expressway-E

What it is for

Expressway-C and Expressway-E connect devices outside the company network to the CUCM (Mobile and Remote Access, MRA) and carry video and business calls to the outside. If a traversal zone fails or the licences are used up, external Jabber clients cannot sign in or cannot make calls.

EasyUC shows the state of the Expressways in the dashboard in the CUCM Information tile. The Expressway section only appears if there is at least one entry in the CUCM under Device → Expressway-C. AXL schema 12.5 or later is required. There is one card per cluster, separated into Expressway-C and Expressway-E.

EasyUC only reads over HTTPS and stores only counters, no aliases or phone numbers. The Expressway-E is detected from the UC traversal zone of the Expressway-C and must be confirmed by an authorised person before EasyUC makes contact.

Prerequisites

• CUCM connection with AXL version 12.5 or later. The Expressway-C nodes are entered in the CUCM under Device → Expressway-C.
• Viewing: ROLE_APP_EXPRESSWAY (View Expressway in the role editor). Changing credentials, test, certificate, address and port: additionally ROLE_APP_EXPRESSWAY_EDIT (Change Expressway credentials). Administrators (ROLE_APP_ADMIN, ROLE_OWNER, ROLE_ADMIN or ROLE_SUPER_ADMIN) have both permissions. Help desk roles do not receive them automatically.
• On every Expressway cluster a dedicated local account, separate for C and E: access level Read-only, API access: Yes, Web access: No. From Expressway X15.2, API access is off by default for new accounts and must be switched on explicitly.
• Firewall: the appliance reaches all nodes of the C and the E on TCP 443 or the configured web administration port.
• If node names cannot be resolved from the appliance, have the IP addresses ready.

Step by step: connect the Expressway-C

1. In EasyUC Cisco, open the Dashboard and scroll to the CUCM Information tile.
2. After the entry has been made in the CUCM, wait up to five minutes. The card of the Expressway-C then appears in the Expressway section with the state Credentials missing.
3. Click Store credentials on the card.
4. Enter User name and Password of the account on the Expressway-C.
5. Under Applies to, choose whether the credentials apply to all Expressway-C clusters of this CUCM connection or to this cluster only.
6. Click Test connection. Check the message Connection successful., the version shown and the fingerprint of the certificate.
7. Click Save. After one minute at the latest the card shows zones and calls.

Step by step: confirm and connect the Expressway-E

1. On the card of the Expressway-E, read the notice Expressway-E detected from zone …. The state is Not confirmed.
2. Click Confirm….
3. Select the detected address or Other address and enter the internally reachable address under Host or IP address. The detected address is often a public name.
4. Check Web administration port and click Confirm.
5. If no Expressway-E was detected, click Enter manually and specify host and port.
6. Then click Store credentials on the card of the E, enter the account of the Expressway-E, click Test connection and Save. The order matters: credentials saved before the confirmation are discarded on confirmation.

Step by step: read the card

1. Check the state at the top of the card: OK, Warning or Faulty.
2. Read Current calls with Video and Audio, the peak of the last 60 minutes and, on the C, the share of which MRA.
3. Read Rich media sessions, Registrations and the System load.
4. Under Zones, check type and status of every zone, for example UC traversal, Traversal client, Traversal server, Neighbor zone and DNS zone, each with peers.
5. Check Alarms, Smart Licensing and the remaining validity of the certificate per node.

Fields and options

Check the result and narrow down errors

• Success: both cards show OK, the UC traversal zone is Active, and As of is at most a few minutes old.
• Re-enter credentials: address or port are new or have been changed. EasyUC sends stored credentials to the new address only after they have been entered again.
• Login rejected: the Expressway rejected the login. EasyUC will not query it again until the credentials are changed or successfully tested. This protects against a lockout by the intrusion protection of the Expressway.
• No API access: the account has no API access ("API access" setting) or Advanced Account Security is enabled. EasyUC will try again in one hour.
• Certificate changed: the certificate has a different key than at first contact. Check the fingerprint with Review new certificate and accept it. A renewed certificate with the same key does not trigger this.
• Unreachable: check address, port and firewall. For names that cannot be resolved, enter the IP address with Address….
• Wrong role: an Expressway-E answers at the address instead of a C, or the other way round. Check the address.
• Too many connection tests in a short time. Please wait one minute.
• This address has rejected several logins in the last 5 minutes. Check user name and password and wait for the pause to end.
• Update failed – showing the last known values. The query of the overview failed. Reload later.
• If the Expressway section is missing entirely: there are no Expressway-C entries in the CUCM, the AXL version of the connection is below 12.5, or you lack ROLE_APP_EXPRESSWAY.