UC LabFree University

T4 · T4-R03

Firewall and traversal

ExportSVGPNGHTMLSheet

Learn it in 5 minutes

  • Open the ports your version's guide lists.
  • Signaling ports and media ranges are different lines.
  • Traversal media is not the same range as a phone's RTP range on the LAN.
  • One ACL copied from a blog is how outages start.
  • Write the source, destination, and direction.
ExportSVGPNGHTMLSheet

Visual

Firewall and traversal diagram
ExportSVGPNGHTMLSheet

What is going on

Cisco publishes a port reference with the Expressway and MRA guides. It changes. This lab does not reprint a port matrix as if it were current. The skill is to read the matrix for your version and test one flow: registration, then a call, then hold.

Confirm before relying. Confirm every port in the deployment guide for the Expressway version you run.

ExportSVGPNGHTMLSheet

Worked example

Registration works and the call has no audio. Signaling ports were opened. The media range for traversal was not. The ladder shows 200 OK. RTP counters on one side stay at zero.

ExportSVGPNGHTMLSheet

Quiz

1. A completed INVITE proves the firewall allows RTP.

ExportSVGPNGHTMLSheet

Ecosystem

Sister pieces sit on the ecosystem page: the glossary, the mind map, the integration map, and the sibling labs.

  • Traversal media — The UDP range Expressway uses for remote media.
  • Signaling — SIP or the HTTPS path used to register.

Config. Quote the guide's table row, the version, and the date you read it.

Troubleshooting. Capture on both sides of the firewall before you widen every range.

Bridge. CUBE PSTN media ranges and Expressway traversal ranges are different tables.

Mind map, sister technologies, and future hooks live on the ecosystem page.

ExportSVGPNGHTMLSheet

Sources

Product screens move. Confirm the guide for your release before you change a live system.

ExportSVGPNGHTMLSheet

Sources and go deeper

Opened 2026-10. A row marked confirm has no link, because that page was not verified.

sources.json Markdown