The Maximum Transmission Unit (MTU) size defaults to 1500 post upgrade to X14.2 (from a lower version) while customizing the 'Maximum Transmission Unit (MTU)'. You must set it back to the intended value after a successful upgrade. To ensure MTU is set correctly, navigate to System > Network Interfaces > IP and then the appropriate LAN Number to check the current value.

Note	Restart the system for MTU size modification to take effect.

Signaling to no more than 2500 endpoints

Cisco is committed to maintaining strict compliance with all global export laws and regulations.

Every software release must comply with all relevant Export Control legislation - the US and local country regulations that control the conditions under which certain software and technology may be exported or transferred to other countries and parties.

Expressway is a media gateway and must provide media encryption or encrypted signaling to no more than 2500 endpoints. This restriction will be effective in the X14.2 release of the Cisco Expressway.

Note	The CAP of 2500 secured/crypto sessions is also applicable to Cisco TelePresence Video Communication Server (VCS) Series.

Encrypted signaling to endpoints refers to SIP registrations or SIP calls, H.323 registrations or calls, WebRTC calls, and XMPP registrations.

Important

Ensure that the limited number of encrypted signaling is not more than 2500 endpoints per instance of Expressway. A customer that needs to exceed this limit may deploy additional peers/clusters if entitled, to provide additional capacity.

Note

In the future release of the Cisco Expressway, the restriction will remain in place for ineligible customers, who may not use export-controlled functionality, but eligible customers who are permitted to use export-controlled functionality must order a new SKU (when available) that will allow them to exceed this limit (if running on suitable hardware), thereby reducing the total number of Expressway instances needed for some customers. For more information, see Cisco Expressway Administrator Guide (X14.2).

Various security-related improvement(s) apply in this release as part of ongoing security enhancements. Much of this is behind the scenes, but some changes affect the user interfaces or configuration.

Upload files along /tmp/ path

You must upload files along /tmp/ path to keep the file upload process secure.

For example, Consider the following command. Use /tmp/ at the beginning of the path:

xcommand Passworddictionarywrite /tmp/random_file

Enable DOS Protection for TrafficServer

There are default rate limits set for new connections on SIP and EDGE traffic categories Management category is also included in a monitoring capacity allowing visibility and logging of connection events above the configured level.

Approved Cryptographic Primitives and Parameters

Expressway does not support Anonymous Diffie Hellmen (ADH) cipher for SIP services, so TC/CE endpoints must enable certificate for SIP (Self-signed Certificate must be in On mode).

The REST API for Expressway is available to simplify remote configuration. For example, by third party systems such as Cisco Prime Collaboration Provisioning. We add REST API access to configuration, commands, and status information as new features are added, and also selectively retrofit the REST API to some features that were added in earlier versions of Expressway.

The API is self-documented using RAML, and you can access the RAML definitions at https://<ipaddress>/api/raml.

X14.0.9 and X14.2.1 release(s)

Jabber Over MRA intermittently plays Ringing Tone instead of Busy, when called Extension is Busy

A new CLI command is added that specifies the maximum delay of a SIP REFER message . It contains DtLineBusyTone during initial call dialog (ensure SIP messages proceeds in a sequence) that the server can handle (in milliseconds).

Expressway processes and sends SIP messages (REFER contain DtLineBusyTone parameter and 183 Session Progress), which causes Jabber Over MRA to intermittently play Ringing Tone instead of Busy Tone (bug ID CSCwc27302 refers).

Recommend adjust delay between 100-200 milliseconds.

The CLI command is: xConfiguration SIP Advanced BusytoneReferDelay: <0..2000>

X14.2 release

TLS Verification Mode

We have enabled server certificate verification by default when communication happens between VCS(ATS) and CUCM/CUP/JabberGuest/UNITY/CMS. When the customer upgrades to release 14.2, CA of CUCM/CUP/JabberGuest/UNITY/CMS server certificate should be present in VCS CA trust store. If the customer wishes to disable/enable server certificate verification, following is the command.

xConfiguration EdgeConfigServer VerifyOriginServer: OFF/ON

Smart Licensing Export Compliance

Signaling to no more than 2500 endpoints

Note

The Export Limit of 2500 registrations/calls/sessions is On by default for all customers. This means that now every customer will not be able to create more than 2500 encrypted connections. Encrypted signaling sessions to endpoints’ is capped at 2500. Product Activation Keys (PAK) Licensing (Option Keys) are removed from Cisco Expressway X14.2 release. Smart License is default and the only licensing mode for Expressway-C and Expressway-E.

Important

There are cases where Expressway does not have sufficient information available to determine if 2 encrypted signaling sessions are from the same endpoint. For example, with Jabber where Expressway sees separate SIP and XMPP registrations (separate encrypted signaling sessions) and is unable to determine if they are from a single endpoint. This is double counted. So a customer with 2200 Jabber users may think that it is fine to upgrade. But, after upgrading to X14.2, this will be seen as 4400 signaling sessions and they will get registration and calls rejected.

For more information, see Cisco Expressway Administrator Guide (X14.2).

Enabling or Disabling CDB API Access

Considering the Security of the Expressway product, access to CDB API has been disabled by default. They can be enabled or disabled using the Web User Interface or through REST API. You can enable or disable access to CDB REST API using the following REST API: https://%3CIP%20address%3E/api/provisioning/common/cdbrestapiaccess.

For more information, see Cisco Expressway Administrator Guide (X14.2).

Support for 4+1 and 5+1 Redundancy Models

Expressway supports the 4+1 and 5+1 redundancy models. Each cluster can have up to four or five Expressway nodes and a maximum of N+1 physical redundancy.

XCP Routing Table

This improvement displays content of the Extensible Communications Platform (XCP) routing table. This content is a complete data dump of the XCP routing information contained in Cisco Jabber. This information is useful for debugging from the XCP point of view. It is made available both in the routing.xml file on the VCS device and in the developer.xcp.jabber logs.

Additionally, the ConnectionManager information is also available as a data dump through developer logs. This information displays the state of ConnectedSockets and FailedRequests counters.

All this information will help administrators to check the routing information, the number of connections, and details of each Jabber client connection.

Reducing Email Notifications

The purpose of this improvement is to stop spamming the administrator with emails if, for some reason, multiple alarms are raised over a short period.

If the same alarm is raised two or more times within an hour, emails will be sent only once. If the same alarm gets lowered, and raised again, email will be sent, regardless of the time passed. Obviously, this only applies when the administrator has configured to receive email notifications on a device.

Alternate Method of Using xCommand FIPS

• Expressway Series: FIPS functionality is not supported through CLI command and Web User Interface.

• Cisco VCS: You must add J00 Option Key in Maintenance > Option keys in Add option key field (or using CLI command). The options available for FIPS (<leave/enter/status>) are only visible before adding the JOO Option Key. You can use the JOO Option Key only after it is added.

Note	Smart Licensing is FIPS compliant.

Cipher Preferences - ECDSA Cipher Preference Over RSA

ECDSA certificates are preferred over RSA.

Important

The following points lists the various upgrade path(s) that are mandatory for upgrading ciphers. When upgrading from version lower than 14.0 to 14.2, the ECDSA would be preferred. If you prefer RSA certificates over ECDSA, then prefix the cipher string with "ECDHE-RSA-AES256-GCM-SHA384:" using either Web User Interface (Maintenance > Security > Ciphers) or CLI command (xConfiguration Ciphers). When upgrading from version equal or higher than 14.0 to 14.2 or higher version, you have appended "ECDHE-RSA-AES256-GCM-SHA384:" to the default Ciphers List to prefer RSA certificates over ECDSA. If you prefer ECDSA certificates over RSA, then remove "ECDHE-RSA-AES256-GCM-SHA384:" from the cipher string using Web User Interface (Maintenance > Security > Ciphers) or CLI command (xConfiguration Ciphers). Any customer has a fresh install X14.2 image, ECDSA is being preferred. If you prefer RSA certificates over ECDSA, then prefix the cipher string with “ECDHE-RSA-AES256-GCM-SHA384:” using either Web User Interface (Maintenance > Security > Ciphers) or CLI command (xConfiguration Ciphers).

TLS 1.3 Support

From X14.2 release onwards, Expressway supports TLS 1.3 for SIP and Reverse proxy functionality.

Auto Created CE Zone Status

Expressway versions prior to X14.0.2 show a status of Active for CE zones where the Zone Profile had Monitor Peer status / Neighbor Monitor set to No - since the Expressway is not monitoring the peer status for the CE zones, the more accurate status of Address Resolvable is indicated.

Auto-created UC zones and associated Unified Communications zone profile are not customizable and Neighbor Monitor set to No is by design.

Starting with Expressway X14.0.2, auto-created CE (tcp/tls/OAuth) Zone destined for the UC node will show status as Address Resolvable as per a fix for CSCup29823.

Traffic Server Enforces Certificate Verification

Important

Before upgrading from pre-X14.0.2 release to X14.2, make sure the following certificate requirement is met.

Due to improvements in the traffic server service in Expressway, beginning in X14.0.2, the following must be in place for MRA.

Requirement - The Certificate Authority (CA) which signed the Expressway-C certificate must be added to the Tomcat-trust and CallManager-trust list of Cisco Unified Communications Manager (UCM), even if the UCM is in non-secure mode. And, restart the following services on CUCM side:

• Tomcat Service

• CallManager Service

• HA Proxy Service (if using TLS on Tomcat)

Reason - The traffic server service in Expressway sends its certificate whenever a server (UCM) requests it. These requests are for services running on ports other than 8443 (for example, ports 6971, 6972, and so on). This enforces certificate verification even if UCM is in non-secure mode.

For more information, see Mobile and Remote Access Through Expressway Deployment Guide.