Setting up business-to-business calling on Cisco Expressway

See also

Sources

1. 1
   The Basic Configuration guide cautions that an Any alias search rule on the Expressway-E carries a denial-of-service risk.

   Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 11: Configuring Traversal Zone Search Rules (note) · Checked 2026-09-25
2. 2
   Cisco advises avoiding the Any wildcard for the search rule Source setting to minimise toll fraud risk.

   Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > search rules (IP address rule guidance) · Checked 2026-09-25
3. 3
   Cisco's B2B technote configures the B2B traversal zone on a different port from the Unified Communications traversal zone (which uses 7001), using 7003 in its example on both Expressway-C and Expressway-E.

   Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-C > Traversal Zone (B2B client); Expressway-E > Traversal Zone (B2B server) · Checked 2026-09-25
4. 4
   The newest Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide on Cisco's configuration guide listing is the X14.0 edition, published 14 April 2021.

   Cisco Expressway Series - Configuration Guides · Configuration Guides list; entry 'Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0)' · Checked 2026-09-25
5. 5
   Traversal communications are initiated from Expressway-C to Expressway-E, so no ports need opening from the DMZ to the internal network for call handling.

   Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Firewall and NAT Settings · Firewall and NAT Settings · Checked 2026-09-25
6. 6
   A Call Policy rule with a blank source pattern applies to all incoming calls from the selected type of caller, Authenticated or Unauthenticated.

   Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > Call Policy rules > Source pattern · Checked 2026-09-25
7. 7
   Call Policy mode (Configuration > Call Policy > Configuration) is Off, Local CPL or Policy service.

   Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > Call Policy > Call Policy mode · Checked 2026-09-25
8. 8
   Call Policy rules at Configuration > Call Policy > Rules match a source pattern and a required destination pattern and apply an action of Allow or Reject.

   Cisco Expressway Administrator Guide (X15.3) - Dial Plan and Call Processing · Dial Plan and Call Processing > Call Policy rules · Checked 2026-09-25
9. 9
   With TLS verify On between Expressway-C and Unified CM, both servers' certificates must carry both client and server authentication usage, otherwise the TLS handshake fails.

   Troubleshoot Most Common Issues for Business to Business Calls Through Expressway · Issue: TLS verify on / certificate attributes · Checked 2026-09-25
10. 10
    For TLS between Expressway-C and Unified CM, the Expressway-C certificate or its issuing CA must be in the Unified CM trust store on all cluster servers, and the CallManager certificate or its CA must be in the Expressway-C trusted CA list.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Certificate validation · Checked 2026-09-25
11. 11
    Cisco recommends an external policy service over hand-written CPL scripts because of CPL's complexity.

    Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > Call Policy > CPL scripts · Checked 2026-09-25
12. 12
    Cisco's B2B technote instructs configuring the Cluster Fully Qualified Domain Name enterprise parameter in Unified CM, which accepts multiple comma-separated entries.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > CUCM > Cluster FQDN · Checked 2026-09-25
13. 13
    A Unified CM cluster upgraded from 8.x or earlier may keep a 5000-byte SIP Max Incoming Message Size; raising it to 11000 fixes B2B calls rejected as 'large message'.

    Troubleshoot Most Common Issues for Business to Business Calls Through Expressway · Issue: large SIP messages rejected · Checked 2026-09-25
14. 14
    For a TLS trunk, the Unified CM SIP trunk security profile's X.509 subject name must match the CN of the certificate presented by the Expressway-C.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > CUCM > SIP Trunk Security Profile · Checked 2026-09-25
15. 15
    Unified CM uses SIP route patterns to send calls for external domains to the Expressway-C trunk; Cisco's technote defers the exact pattern design to the Unified CM dial plan documentation.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > CUCM > SIP Route Pattern · Checked 2026-09-25
16. 16
    If the Unified CM Top Level Domain enterprise parameter is not set, inbound B2B calls to the organisation's own domain can loop via SIP route patterns or fail with 404 Not Found.

    Troubleshoot Most Common Issues for Business to Business Calls Through Expressway · Issue: Top Level Domain not configured · Checked 2026-09-25
17. 17
    When the same Expressway and Unified CM serve both MRA and B2B, the SIP port on the Unified CM trunk used for B2B must be changed from the default 5060 or 5061.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > SIP trunk between Unified CM and Expressway-C · Checked 2026-09-25
18. 18
    Neighbor zones offer pre-configured zone profiles for Unified CM, including 'Cisco Unified Communications Manager (9.x or later)', '(8.6.1 or 8.6.2)' and '(8.6 and below)'.

    Cisco Expressway Administrator Guide (X15.4) - Zones and Neighbors · Zones and Neighbors > Neighbor zone > Zone profile · Checked 2026-09-25
19. 19
    The Default Zone represents incoming calls from endpoints or devices that are unregistered or not recognized, and deleting its default links prevents incoming calls from unrecognised endpoints.

    Cisco Expressway Administrator Guide (X15.4) - Zones and Neighbors · Zones and Neighbors > The Default Zone · Checked 2026-09-25
20. 20
    Because Default Zone traffic under Do not check credentials is classified unauthenticated, setting Request must be authenticated to Yes on the Expressway-E rule toward the traversal zone should stop unauthenticated internet callers reaching the internal network through that rule.inferred

    Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > Request must be authenticated; combined with Device Authentication > Do not check credentials · Checked 2026-09-25
21. 21
    Any SIP or H.323 fixup/ALG function on the NAT firewall in front of the Expressway-E should be disabled because it interferes with Expressway operation.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Firewall and NAT Settings · Firewall and NAT Settings · Checked 2026-09-25
22. 22
    The Basic Configuration guide's DNS zone search rule on Expressway-E has priority 150, source All zones, Request must be authenticated No, a regex that excludes the local domain (of the form (?!.*@example\.com.*$).*), and target DNSZone.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 13: Configuring DNS Zone Search Rules · Checked 2026-09-25
23. 23
    The Basic Configuration guide's example DNS zone on Expressway-E has H.323 mode On, SIP mode On, fallback transport protocol TCP and Include address record Off.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 12: Configuring the DNS Zone (settings table) · Checked 2026-09-25
24. 24
    The DNS zone for B2B URI routing is created on the Expressway-E, not the Expressway-C.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > DNS configuration for business-to-business · Checked 2026-09-25
25. 25
    With SIP-to-H.323 interworking enabled, the Expressway-E DNS zone can automatically try the other protocol when looking up a remote domain.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > search rules and call routing · Checked 2026-09-25
26. 26
    An Expressway DNS zone is used to search for externally hosted systems, such as for business-to-business calling, by looking up the destination alias in DNS.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 12: Configuring the DNS Zone · Checked 2026-09-25
27. 27
    For traffic sent to its DNS zone, the Expressway-E performs a DNS SRV lookup for _sip or _sips on the domain taken from the domain portion of the SIP URI.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-E > DNS Zone · Checked 2026-09-25
28. 28
    With a zone authentication policy of Do not check credentials, message credentials are not checked and all messages are classified as unauthenticated.

    Cisco Expressway Administrator Guide (X15.0) - Device Authentication · Device Authentication > authentication policy options · Checked 2026-09-25
29. 29
    H.323 mode on the Expressway (Configuration > Protocols > H.323) is Off by default.

    Cisco Expressway Administrator Guide (X15.5) - Protocols · Protocols > H.323 · Checked 2026-09-25
30. 30
    The inbound B2B path therefore needs a rule on Expressway-E sending the organisation's own domain to the traversal zone and a rule on Expressway-C sending that domain to the Unified CM neighbor zone.inferred

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-C > Neighbor Zone to CUCM; Expressway-E > Traversal Zone · Checked 2026-09-25
31. 31
    The DNS zone's Include address record setting defaults to Off; when On, the Expressway queries A/AAAA records if NAPTR and SRV lookups fail, which can make the Expressway believe a search succeeded when the call will then fail.

    Cisco Expressway Administrator Guide (X15.4) - Zones and Neighbors · Zones and Neighbors > DNS zone settings > Include address record · Checked 2026-09-25
32. 32
    Configuration > Protocols > Interworking offers H.323 <-> SIP interworking modes Off, Registered only (default; gateway only if at least one endpoint is locally registered) and On (gateway regardless of registration).

    Cisco Expressway Administrator Guide (X15.5) - Protocols · Protocols > Interworking · Checked 2026-09-25
33. 33
    Cisco's B2B technote says the required licenses must be present on each Expressway and that missing licenses produce a 'Call license limit reached' error.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Licensing · Checked 2026-09-25
34. 34
    Maintenance > Tools > Locate tests how the Expressway would find an alias, and Maintenance > Tools > Check pattern tests a pattern or transform against an alias.

    Cisco Expressway Administrator Guide (X15.3) - Dial Plan and Call Processing · Dial Plan and Call Processing > Locate / Check pattern tools · Checked 2026-09-25
35. 35
    The Expressway-C neighbor zone destination port must match the incoming port set in the Unified CM SIP trunk security profile; a mismatch causes Unified CM to drop the TCP session on inbound B2B calls.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-C > Neighbor Zone to CUCM · Checked 2026-09-25
36. 36
    When TLS verify mode is On for the neighbor zone to Unified CM, the peer address must be the FQDN of the Unified CM node; with it Off, an IP, hostname or FQDN may be used.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-C > Neighbor Zone to CUCM (TLS verify) · Checked 2026-09-25
37. 37
    A neighbor zone on the Expressway-C targeting Unified CM is used to route inbound B2B calls to Unified CM.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > Expressway-C > Neighbor Zone to CUCM · Checked 2026-09-25
38. 38
    Where no MRA shares the Expressway pair or Unified CM cluster, the documented requirement to move the B2B trunk off 5060/5061 does not directly apply, though the neighbor zone and trunk ports must still match.inferred

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > SIP trunk between Unified CM and Expressway-C (conditional wording) · Checked 2026-09-25
39. 39
    The Basic Configuration guide's sample outbound B2B rule on Expressway-C uses source the Unified CM zone, a regex matching the remote domain, target the traversal client zone and On successful match Stop.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Optional Configuration Tasks · Optional Configuration Tasks > Task 21: B2B federation, sample dial plan · Checked 2026-09-25
40. 40
    The Preferred Architecture recommends CPL rules that allow only specific destinations and discard everything else, with an example rejecting calls whose From address claims the organisation's own domain.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > toll fraud prevention; Table 4-5 CPL example · Checked 2026-09-25
41. 41
    Cisco's Preferred Architecture advises that H.323 should be turned off as a security best practice, while acknowledging business reasons may prevent it.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > security / H.323 guidance · Checked 2026-09-25
42. 42
    When H.323 is enabled for B2B, Cisco's Preferred Architecture says SIP-to-H.323 interworking should be set to On for the Expressway-E.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > H.323 / interworking guidance · Checked 2026-09-25
43. 43
    The Preferred Architecture pairs CPL with the Expressway 'SIP authentication failure' intrusion protection rule, which jails a source IP after repeated failures within a detection window.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > intrusion protection · Checked 2026-09-25
44. 44
    Cisco's Preferred Architecture states unauthenticated calls should be restricted from reaching protected resources such as the PSTN, including via the Calling Search Space on Unified CM.

    Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Collaboration Edge · Collaboration Edge > toll fraud prevention and call policy · Checked 2026-09-25
45. 45
    Unified CM can append :5060 or :5061 to the destination URI, which makes the Expressway query A/AAAA instead of SRV records; a transform on Expressway-C that removes the port fixes this.

    Troubleshoot Most Common Issues for Business to Business Calls Through Expressway · Issue: DNS resolution fails for FQDN with port · Checked 2026-09-25
46. 46
    The Basic Configuration guide adds a priority-1 pre-search transform (Configuration > Dial plan > Transforms) that appends the local domain to aliases lacking an @, using regex ([^@]*) replaced with \1@example.com.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 8: Configuring Transforms · Checked 2026-09-25
47. 47
    The search rule setting Request must be authenticated restricts a rule to authenticated search requests and can be used to limit the services available to unauthenticated devices.

    Cisco Expressway Administrator Guide (X15.4) - Dial Plan and Call Processing · Dial Plan and Call Processing > search rule fields > Request must be authenticated · Checked 2026-09-25
48. 48
    Each RMS license allows either one video call or two audio-only SIP calls.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing > RMS license consumption · Checked 2026-09-25
49. 49
    A business-to-business call requires one Rich Media Session (RMS) license on the Expressway-E.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing > RMS license consumption, business-to-business calls · Checked 2026-09-25
50. 50
    SIP to H.323 interworking uses an RMS license on the node where interworking takes place if any of the endpoints are not registered to Cisco infrastructure.

    Cisco Expressway Administrator Guide (X15.4) - Call Types and Licensing · Call Types and Licensing > interworked calls · Checked 2026-09-25
51. 51
    When calls fail, Status > Search history shows the search attempts and Status > Logs > Event Log shows failure details.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - System Checks · System Checks > Call signaling · Checked 2026-09-25
52. 52
    Expressway search rule priorities range from 1 to 65534, with 1 the highest; On successful match can be Continue or Stop.

    Cisco Expressway Administrator Guide (X15.3) - Dial Plan and Call Processing · Dial Plan and Call Processing > Configuring search rules · Checked 2026-09-25
53. 53
    Search rule Source can be Any, All zones (registered devices plus neighbor and traversal zones), Local Zone (registered devices only) or Named (a specific zone or subzone).

    Cisco Expressway Administrator Guide (X15.3) - Dial Plan and Call Processing · Dial Plan and Call Processing > Configuring search rules > Source · Checked 2026-09-25
54. 54
    On Configuration > Protocols > SIP the transport defaults are UDP Off, TCP Off, TLS On and Mutual TLS Off, with standard ports 5060 for UDP/TCP and 5061 for TLS.

    Cisco Expressway Administrator Guide (X15.5) - Protocols · Protocols > SIP > transport mode settings · Checked 2026-09-25
55. 55
    SIP over UDP is disabled on Expressway by default.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - DNS Records · DNS Records > note under Public DNS table · Checked 2026-09-25
56. 56
    The Expressway SRV connectivity tester runs DNS SRV queries for a domain and protocol and attempts TCP/TLS connections to the returned hosts, with a downloadable .pcap.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - System Checks · System Checks > Connectivity testing · Checked 2026-09-25
57. 57
    For SIP B2B call routing, _sip._tcp and _sips._tcp SRV records for the organisation's domain must be created on public DNS servers.

    Configure Business to Business Audio/Video Calls through Expressway · Configure > DNS SRV records · Checked 2026-09-25
58. 58
    The Basic Configuration guide's public DNS for Expressway-E lists SRV records _sips._tcp (5061), _sip._tcp (5060), _sip._udp (5060), _h323cs._tcp (1720), _h323ls._udp (1719) and _h323rs._udp (1719), each targeting the Expressway-E FQDN, plus an A record for that FQDN.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - DNS Records · DNS Records > Public DNS (Expressway-E) table · Checked 2026-09-25
59. 59
    The same toll-fraud task loads a CPL file on Expressway-C with Call policy mode Local CPL, rejecting calls from the gateway zone to 9-prefixed destinations with status 403, optionally only when the caller is unauthenticated.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Optional Configuration Tasks · Optional Configuration Tasks > Task 22 > Expressway-C CPL · Checked 2026-09-25
60. 60
    The Basic Configuration guide's toll-fraud example on Expressway-E adds a priority-40 rule (source All zones) passing 9-prefixed numbers at the local domain to the traversal zone, then a priority-41 rule (source Any) rewriting other 9-prefixed calls to do-not-route-this-call, both with Stop.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Optional Configuration Tasks · Optional Configuration Tasks > Task 22: Restricting access to ISDN gateways (toll-fraud prevention) · Checked 2026-09-25
61. 61
    The traversal client's username and password are validated against the Expressway-E's local authentication database, configured at Configuration > Authentication > Devices > Local database.

    Cisco Expressway Administrator Guide (X15.4) - Zones and Neighbors · Zones and Neighbors > traversal zone configuration (connection credentials) · Checked 2026-09-25
62. 62
    The Basic Configuration guide's example traversal zone uses SIP port 7001 with TLS transport and H.323 Assent on port 6001.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 10: Configuring the Traversal Zone (settings table) · Checked 2026-09-25
63. 63
    An NTP server must be configured for Expressway traversal zones to work.

    Cisco Expressway Administrator Guide (X15.4) - Zones and Neighbors · Zones and Neighbors > traversal client zone requirements · Checked 2026-09-25
64. 64
    On the Expressway-C traversal client zone, the peer address should be the Expressway-E public IP address in a single-NIC deployment and the Expressway-E internal NIC address in a dual-NIC deployment; the wrong address can stop ACKs from Unified CM reaching the edge.

    Troubleshoot Most Common Issues for Business to Business Calls Through Expressway · Issue: ACK not forwarded to the Expressway-E · Checked 2026-09-25
65. 65
    In an Expressway pair the Expressway-E in the DMZ acts as the traversal server and the Expressway-C behind the firewall acts as the traversal client.

    Cisco Expressway Administrator Guide (X15.3) - Zones and Neighbors · Zones and Neighbors > Traversal Zone requirements (Traversal Client Zones / Traversal Server Zones) · Checked 2026-09-25
66. 66
    With Treat as authenticated, credentials are not checked and all messages are classified as authenticated.

    Cisco Expressway Administrator Guide (X15.0) - Device Authentication · Device Authentication > authentication policy options · Checked 2026-09-25
67. 67
    Cisco documents example non-default B2B trunk listening ports of TCP 5560 / TLS 5561 (Basic Configuration guide) and TCP 6060 / TLS 6061 (B2B technote).

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Optional Configuration Tasks · Optional Configuration Tasks > Task 21: B2B federation, MRA coexistence note · Checked 2026-09-25
68. 68
    Unified Communications (MRA) features require a zone of type Unified Communications traversal between Expressway-C and Expressway-E, distinct from the standard traversal client/server zone.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 10 note on Unified Communications traversal · Checked 2026-09-25
69. 69
    The Basic Configuration guide sets Calls to unknown IP addresses to Indirect on Expressway-C and Direct on Expressway-E, and adds an Any IP address rule on Expressway-C targeting the traversal zone.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - Routing Configuration · Routing Configuration > Task 14: Configuring External (Unknown) IP Address Routing · Checked 2026-09-25
70. 70
    To verify the traversal zone, check Status > Zones on both Expressway-C and Expressway-E that it is Active; if not, check firewall ports, NAT settings and authentication credentials.

    Cisco Expressway-E and Expressway-C Basic Configuration Deployment Guide (X14.0) - System Checks · System Checks > Zone status · Checked 2026-09-25

Documents

Cite this page

WarmTransfer. (2026, September 25). Setting up business-to-business calling on Cisco Expressway. WarmTransfer. https://warmtransfer.net/guides/expressway-b2b-setup

@misc{warmtransfer-expressway-b2b-setup,
  title  = {Setting up business-to-business calling on Cisco Expressway},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/expressway-b2b-setup},
  note   = {Verified 2026-09-25}
}