Expressway E Port 443 access from Internet

[Nathan UC]

According to Cisco documentation, 443 is one of the ports that should be opened from Internet towards the Expressway-E IP. If we do that, the web-administration becomes accessible from the internet.

Is there a way to disable web-administration access from Public Internet?

[Manish Gogna]

Hi Nathan,

Here is a good discussion about Expressway security

https://communities.cisco.com/thread/29063

HTH

Manish

[Nathan UC]

Thanks Manish. Your links talks about general security measures for the VCS-E. However, not specifically about blocking admin web-interface while still allowing Mobile and Remove Access (MRA) to work.

I'm sure there should be a way to allow web management interface only from the internal interface of VCS-E and block this from external interface. (Dual NIC)

[Vinod.s]

What is the solution to disable Web-access from Internet .

We are running with B2B & MRA Feature .

[Roger Kallberg]

From internet you don't need port 443 to E open for the services you use, exception would be if you use TURN service. For more information on what is required to be open for MRA and B2B Expressway services please have a look at this document. https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment-Guide-X12-5.pdf

[Vinod.s]

Hi Roger,

I heard about firewall protection feature of expressway e. How I can use this feature to block web access over the Internet.

I means what should i filled in - Interface , Ip address , Prefix , Service , action .

[Roger Kallberg]

Don't actually have an answer to you on that as I never user this function in Expressway. As I wrote there is no need to have port 443 open in the firewall from internet. Only exception to this would be if you use TURN service for path optimization with ICE.