Size the edge-side Expressway-E: OVA profile, TURN relay capacity for WebRTC, DMZ NIC plan, and firewall rules. Match your Expressway-C pair capacity.
Expressway-E sits in the DMZ, terminates external connections, and tunnels securely to Expressway-C inside. Sizing needs to match your C-side plus TURN relay load (WebRTC, iOS/Android clients). This tool computes capacity and emits a firewall rule set that your network team can apply.
Set inputs, click Size Expressway-E.
Matching E profile.
Relay capacity for WebRTC.
Dual NIC or single NIC NAT.
Port/direction rules.
Common mistake: deploying an E cluster smaller than C. Since every MRA registration and B2B call flows through E, and because E also handles TURN relay (media relay for NAT-impaired clients), E typically needs more capacity than C. A 2000-user MRA deployment with 20% TURN relay usage means 40 concurrent TURN sessions on top of 200 normal traversals. Each TURN relay uses 1 RMS license and consumes CPU for media relay.
Dual-NIC vs single-NIC. Dual-NIC (one leg in the internal DMZ, one in the external DMZ) is more secure and mirrors the classic 3-zone firewall model. Single-NIC with NAT is simpler to deploy and fine for small deployments, but requires your firewall to hairpin NAT traffic. Dual-NIC is recommended for any production deployment with > 500 users.
Cert strategy for E: public certs from DigiCert/Sectigo/Let's Encrypt work. Must include the public FQDN of the cluster + any SANs for MRA (_cisco-uds._tcp, _collab-edge._tls, etc). Some providers don't support underscore-SANs — verify before purchase. Let's Encrypt works but renewal automation is tricky on Expressway-E; use ACME with SSH hooks or external process.
Not recommended. Always put it in a DMZ behind a firewall. Never expose management interface.
443/tcp (SIP/TLS, XCP), 5061/tcp (SIP-TLS), 3478/udp (TURN), 24000-29999/udp (media).
No — E uses public certs, C can use internal. Different CA chains.
Default 24000-29999 UDP. Tune based on call volume.
Small org.
Mid-enterprise.
3 regions.
Our UC Modernization Sprint builds out Expressway DMZ, handles certs, firewall coordination, and cert renewal automation.