Expressway and Mobile and Remote Access

See also

Sources

1. 1
   Activation-code onboarding of phones over MRA needs Expressway X12.5.1, Unified CM 12.5(1)SU1 and IP phone firmware 12.5(1)SR3, or later.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Onboarding MRA Devices · Onboarding MRA Devices chapter, prerequisites for activation code onboarding · Checked 2026-09-24
2. 2
   For activation-code onboarding over MRA, the Cisco Manufacturing Root certificates must be in the Unified CM CallManager-trust store, and the OAuth Refresh Login Flow enterprise parameter must be Enabled.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Onboarding MRA Devices · Onboarding MRA Devices chapter, prerequisites for activation code onboarding · Checked 2026-09-24
3. 3
   The onboarding chapter lists these phones for activation-code onboarding over MRA: 7811, 7821, 7832, 7841, 7861, 8811, 8832, 8832NR, 8841, 8845, 8851, 8851NR, 8861, 8865 and 8865NR.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Onboarding MRA Devices · Onboarding MRA Devices chapter, supported devices · Checked 2026-09-24
4. 4
   MRA Access Control on Expressway-C sets the authentication path. The options include SAML SSO, UCM/LDAP basic authentication and combinations of the two. OAuth token with refresh can also be enabled.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Configuration · MRA Configuration chapter, configuring the authentication path (Configuration > Unified Communications > Configuration) · Checked 2026-09-24
5. 5
   With BiB recording over MRA, call capacity falls to about one-third of what it was.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations chapter, BiB Recording over MRA · Checked 2026-09-24
6. 6
   Remote endpoints find Expressway-E through a public DNS SRV record named _collab-edge._tls.<domain>.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, DNS records section, public DNS table · Checked 2026-09-24
7. 7
   The MRA Configuration chapter presents the setup in this order: UC mode, server addresses, SIP, intrusion protection, domains, discovery of UC servers, authentication path, optional OAuth and SAML, then the Unified Communications traversal zone.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Configuration · MRA Configuration chapter, section order · Checked 2026-09-24
8. 8
   Cisco Mobile and Remote Access (MRA) is part of the Cisco Collaboration Edge Architecture. It lets Unified CM provide registration, call control, provisioning, messaging and presence to endpoints such as Cisco Jabber when they are outside the enterprise network.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, opening section · Checked 2026-09-24
9. 9
   Cisco advises no more than ten deployment partitions and no more than 75 domains in a single deployment.

   Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations chapter, Deployment Partitions and Multidomain Best Practices · Checked 2026-09-24
10. 10
    In Dedicated Instance, MRA signaling and media between the endpoints and the Expressway nodes are always encrypted.

    Dedicated Instance network and security requirements · Dedicated Instance network and security requirements, Security for remote endpoints · Checked 2026-09-24
11. 11
    In Dedicated Instance, conditional DNS forwarding is not needed for MRA registration because Cisco pre-provisions all the external DNS records MRA requires.

    Dedicated Instance network and security requirements · Dedicated Instance network and security requirements, DNS requirements · Checked 2026-09-24
12. 12
    Dedicated Instance customers are entitled to MRA for 100% of their Knowledge Worker count and to B2B calls for 5% of it.

    Introduction to Dedicated Instance · Introduction to Dedicated Instance, Dedicated Instance sizing > Expressways · Checked 2026-09-24
13. 13
    In Webex Calling Dedicated Instance, Expressway-C and Expressway-E are deployed during service activation for MRA and B2B calling.

    Introduction to Dedicated Instance · Introduction to Dedicated Instance, Dedicated Instance sizing > Expressways · Checked 2026-09-24
14. 14
    At activation, the Dedicated Instance operations team deploys MRA for 20% of the Knowledge Worker licenses. The customer can expand to the full 100% entitlement, based on consumption, by raising a Cisco Support case.

    Introduction to Dedicated Instance · Introduction to Dedicated Instance, Dedicated Instance sizing > Expressways · Checked 2026-09-24
15. 15
    For Dedicated Instance, Cisco provides the domain and signs all the UC application certificates with a public Certificate Authority.

    Dedicated Instance network and security requirements · Dedicated Instance network and security requirements, certificate requirements · Checked 2026-09-24
16. 16
    For secure Webex app registration and SRTP in Dedicated Instance, SIP OAuth must be enabled on all the applications, including Unified CM, Unity Connection and Expressway.

    Webex Application Integration with Dedicated Instance for In-App Calling · Webex Application Integration with Dedicated Instance for In-App Calling, security prerequisites · Checked 2026-09-24
17. 17
    For the Webex app in Dedicated Instance, the Voice Service Domain set in the Control Hub UC manager profile must be the one Cisco provides for that Dedicated Instance region.

    Webex Application Integration with Dedicated Instance for In-App Calling · Webex Application Integration with Dedicated Instance for In-App Calling, service discovery / UC manager profile · Checked 2026-09-24
18. 18
    The Webex app can register to Dedicated Instance Unified CM either over direct peering or over MRA. Over MRA, the integration can also support ICE.

    Webex Application Integration with Dedicated Instance for In-App Calling · Webex Application Integration with Dedicated Instance for In-App Calling, integration methods · Checked 2026-09-24
19. 19
    On Expressway-C the administrator adds the publisher nodes of Unified CM, IM and Presence Service and Unity Connection. Expressway then discovers the subscriber nodes when Refresh Servers is run.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Configuration · MRA Configuration chapter, discovering internal UC servers · Checked 2026-09-24
20. 20
    In MRA, Expressway-E sits in the DMZ and provides secure firewall traversal. Expressway-C sits on the internal network and connects to Unified CM.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, Expressway-C and Expressway-E role description · Checked 2026-09-24
21. 21
    Field notice FN74362 lists Expressway X14.0.0 through X14.3.7 and X15.0.0 through X15.3.2 as affected by public CAs sunsetting the Client Authentication EKU.

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Affected Products section · Checked 2026-09-24
22. 22
    FN74362 says the Chrome Root Program will restrict roots in the Chrome Root Store to Server Authentication EKU only from March 2027.

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Background section · Checked 2026-09-24
23. 23
    Under FN74362, X15.4 lets Expressway-E take an upload of a Server-Authentication-only EKU certificate. X15.5 adds a UI that separates client and server certificates and options to turn off EKU checking.

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Solution section · Checked 2026-09-24
24. 24
    FN74362 says public CAs stop issuing certificates that combine Server and Client Authentication EKUs from May 2026. Expressway mTLS connections expect both EKUs.

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Background and Problem Description sections · Checked 2026-09-24
25. 25
    FN74362 says Expressway-E and Expressway-C must both be upgraded to the same fixed version.

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Solution section, note · Checked 2026-09-24
26. 26
    FN74362 offers three workarounds: switch to a CA that still issues combined-EKU certificates, renew existing combined-EKU certificates before the sunset, or move to a private PKI (Expressway-C only).

    Field Notice: FN74362 - Cisco Expressway: Impact on Secure Communication due to Upcoming Changes to TLS Certificates Issued by Public Certificate Authorities with Client Authentication EKU, Starting May 2026 - Workaround Provided · FN74362, Workaround section · Checked 2026-09-24
27. 27
    ICE Media Path Optimization lets MRA-registered endpoints send media directly to each other, bypassing the WAN and the Expressway servers.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization chapter, overview · Checked 2026-09-24
28. 28
    ICE passthrough requires the internal leg between Expressway-C and Unified CM to be encrypted. Unified CM must be in a secure mode, either SIP OAuth or mixed mode.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization chapter, limitations / prerequisites · Checked 2026-09-24
29. 29
    ICE Media Path Optimization over MRA needs Unified CM 11.5 or later and Expressway-C and Expressway-E X12.5 or later.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization chapter, prerequisites · Checked 2026-09-24
30. 30
    ICE Media Path Optimization is not tested or supported with Webex Hybrid Services, Jabber Guest, CMR Cloud or B2B calling. HCS Contact Center does not support ICE passthrough.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization chapter, limitations · Checked 2026-09-24
31. 31
    ICE over MRA needs Expressway-E configured as a TURN server to supply relay candidates.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization chapter, TURN server configuration · Checked 2026-09-24
32. 32
    Dedicated Instance Expressways may fall within the client-EKU sunset, because Cisco signs Dedicated Instance UC certificates with a public CA. No Dedicated Instance source read here says how Cisco handles this.inferred

    Dedicated Instance network and security requirements · Dedicated Instance network and security requirements, certificate requirements; read against FN74362 Problem Description · Checked 2026-09-24
33. 33
    Cisco Jabber Video for TelePresence does not work with MRA.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, client support note · Checked 2026-09-24
34. 34
    The port guide lists UDP 36000-59999 for RTP/RTCP media between off-premises endpoints and Expressway-E.

    Cisco Expressway IP Port Usage Configuration Guide (Includes X14.3 and X15.0 releases) - Mobile and Remote Access · Mobile and Remote Access chapter, Table 2 Connections Between Off-premises Endpoints and the Expressway-E · Checked 2026-09-24
35. 35
    The minimum Unified CM version for basic MRA is 10.0.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, Unified Communications requirements, version table · Checked 2026-09-24
36. 36
    When MRA serves more than one Unified CM cluster, Home Cluster Discovery must be configured.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, clustering section · Checked 2026-09-24
37. 37
    MRA cannot provision certificates to remote endpoints, CAPF included. CAPF enrollment has to be done on premises, inside the firewall, before the device goes remote.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, unsupported features and limitations · Checked 2026-09-24
38. 38
    The Expressway licensing model classes MRA calls (Unified CM remote sessions) as Registered calls, so they do not use Rich Media Session licenses.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing chapter, Registered calls / Unified CM remote sessions · Checked 2026-09-24
39. 39
    Cisco does not support third-party network load balancers between MRA clients and Expressway-E.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, unsupported features and limitations · Checked 2026-09-24
40. 40
    MRA lets Jabber clients communicate without connecting to the corporate network over a VPN.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, Jabber client connectivity section · Checked 2026-09-24
41. 41
    MRA with OAuth refresh logins needs Unified CM 11.5(1)SU3 or later.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, Unified CM version requirements for OAuth refresh · Checked 2026-09-24
42. 42
    From Expressway-C to Expressway-E, MRA uses TCP 7001 for SIP signaling, TCP 2222 for the SSH tunnels, TCP 7400 for XMPP, and UDP 2776-2777 for traversal media (UDP 36000-36011 on large systems).

    Cisco Expressway IP Port Usage Configuration Guide (Includes X14.3 and X15.0 releases) - Mobile and Remote Access · Mobile and Remote Access chapter, Table 3 Connections Between Expressway-C and Expressway-E · Checked 2026-09-24
43. 43
    Off-premises MRA endpoints reach Expressway-E on TLS 5061 for SIP, TLS 8443 for HTTPS/UDS and TCP 5222 for XMPP.

    Cisco Expressway IP Port Usage Configuration Guide (Includes X14.3 and X15.0 releases) - Mobile and Remote Access · Mobile and Remote Access chapter, Table 2 Connections Between Off-premises Endpoints and the Expressway-E · Checked 2026-09-24
44. 44
    MRA uses SIP over TLS for sessions, HTTPS over TLS for provisioning, directory and voicemail, SRTP for media, and XMPP over TLS for messaging and presence.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, protocol summary for the MRA architecture · Checked 2026-09-24
45. 45
    Push notifications over MRA deliver calls and messages to iOS and Android Jabber clients running in the background, using Apple and Google cloud services.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations chapter, Push Notifications over MRA · Checked 2026-09-24
46. 46
    MRA registrations proxied to Unified CM are limited to 5000 on the CE1200 appliance and 2500 on the Large VM and the CE1100.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing chapter, registration capacity note · Checked 2026-09-24
47. 47
    One Expressway Rich Media Session license covers either one video call or two audio-only SIP calls.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing chapter, Rich Media Session licenses · Checked 2026-09-24
48. 48
    Session Persistency, which lets a device roam without dropping the call, needs Unified CM 14SU1 or later.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations chapter, Session Persistency · Checked 2026-09-24
49. 49
    Over MRA, SIP Path headers must be enabled for Shared Lines, Multiple Lines, BiB call recording, Silent Monitoring and Key Expansion Modules. Cisco recommends Unified CM 11.5(1)SU4 or later for this.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations chapter, Enable SIP Path Headers · Checked 2026-09-24
50. 50
    Cisco recommends a single domain with split DNS as the ideal MRA configuration.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites chapter, DNS records section · Checked 2026-09-24
51. 51
    TURN control on Expressway-E uses port 3478 on Small and Medium systems and ports 3478-3483 on Large systems. TURN media uses UDP 24000-29999.

    Cisco Expressway IP Port Usage Configuration Guide (Includes X14.3 and X15.0 releases) - Mobile and Remote Access · Mobile and Remote Access chapter, Tables 2 and 3, TURN rows · Checked 2026-09-24
52. 52
    MRA is enabled by setting Unified Communications mode to Mobile and Remote Access on both Expressway-C and Expressway-E.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Configuration · MRA Configuration chapter, enabling Unified Communications mode · Checked 2026-09-24
53. 53
    Expressway-C and Expressway-E are linked for MRA by a traversal zone of type Unified Communications traversal, with TLS and media encryption.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Configuration · MRA Configuration chapter, creating the traversal zone · Checked 2026-09-24
54. 54
    Placing Expressway-C in a DMZ that uses static NAT is not a supported MRA deployment. Expressway-E is used for that position.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview chapter, unsupported deployments list · Checked 2026-09-24
55. 55
    In the X15.5 tech note's tests, the Unified Communications traversal zone and the port 2222 SSH tunnels failed or stayed inactive when Expressway-C's client certificate lacked the client EKU.

    Navigate Client EKU Sunset with Expressway x15.5 · Navigate Client EKU Sunset with Expressway x15.5, test scenarios · Checked 2026-09-24
56. 56
    Expressway X15.5 has separate server and client certificate stores. On upgrade from X15.4, existing server certificates are copied into the client store.

    Navigate Client EKU Sunset with Expressway x15.5 · Navigate Client EKU Sunset with Expressway x15.5, background / feature overview · Checked 2026-09-24
57. 57
    X15.5 adds the CLI setting xconfiguration SIP TLS Certificate ExtendedKeyUsage Checking Mode, which is ON by default. When OFF, inbound SIP TLS stops checking for the client EKU but still checks for the server EKU.

    Navigate Client EKU Sunset with Expressway x15.5 · Navigate Client EKU Sunset with Expressway x15.5, CLI configuration section · Checked 2026-09-24
58. 58
    The X15.5 tech note's recommended option pairs an internal-CA Expressway-C client certificate carrying both EKUs with public-CA server certificates carrying the server EKU only on Expressway-C and Expressway-E.

    Navigate Client EKU Sunset with Expressway x15.5 · Navigate Client EKU Sunset with Expressway x15.5, Option 1 · Checked 2026-09-24
59. 59
    In X15.5 the X15.4 CLI setting xConfiguration XCP TLS Certificate CVS EnableServerEkuUpload is no longer used.

    Navigate Client EKU Sunset with Expressway x15.5 · Navigate Client EKU Sunset with Expressway x15.5, background section · Checked 2026-09-24
60. 60
    The Dedicated Instance add-on bundles Cisco Unified Communications Manager, optional Cisco Unified IM and Presence, Cisco Unity Connection, Cisco Expressway, Cisco Emergency Responder in the Americas region only, and optionally Cisco Session Management Edition.

    Introduction to Dedicated Instance · Overview bullet list · Checked 2026-09-04

Documents

Cite this page

WarmTransfer. (2026, September 24). Expressway and Mobile and Remote Access. WarmTransfer. https://warmtransfer.net/knowledge/cucm-expressway-mra

@misc{warmtransfer-cucm-expressway-mra,
  title  = {Expressway and Mobile and Remote Access},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cucm-expressway-mra},
  note   = {Verified 2026-09-24}
}