Generate matched Traversal Client (Exp-C) and Traversal Server (Exp-E) zones. Ports, auth, SIP params, media encryption — all wired so C-initiated tunnels come up clean.
Expressway traversal is C-initiated: the Exp-C node opens a tunnel to Exp-E and calls flow through it. This tool produces the exact Client zone config for Exp-C and the matching Server zone config for Exp-E. Get these wrong and everything else (MRA, B2B) fails silently.
Set inputs, click Generate zone config.
Traversal Client zone config.
Traversal Server zone config.
Credentials on both sides.
CLI checks & log commands.
The whole reason Expressway exists is that Exp-C reaches out to Exp-E — not the other way. No inbound firewall rule from DMZ to inside. Exp-C opens a persistent TCP connection (default 7001) to Exp-E. Once established, that socket is used bidirectionally for signaling and media. This is why DMZ firewall rules go ANY → Exp-E (443/5061/3478/24000-29999) but NEVER E → C.
Auth on traversal: Exp-C logs in with a username/password. That user is a local account on Exp-E. Create it under Users > Local authentication database > New. This same credential is re-used by Exp-C for every zone. Rotate annually. The common bug is password mismatch — zone shows "failed" and the UI gives a generic error. Check /var/log/traversalzone on Exp-E.
UC vs B2B zone choice: for small deployments a single traversal zone handles both MRA and B2B (use port 7001, set zone type to "Unified Communications traversal"). For larger or regulated deployments, separate zones (7001 for UC, 7002 for B2B) makes call routing and audit easier — you can tell at a glance which leg is internal user vs partner. The zone license cost is the same either way.
Small: one (UC type). Larger: separate UC and B2B zones for easier ops.
Yes — Exp-C in one region, Exp-E in another. But add latency and have backup pair local.
Exp-C reconnects automatically every few seconds. Active calls may drop; new calls queue briefly.
Yes — enable mutual TLS. Exp-C trusts Exp-E cert and vice versa. Internal CA is fine.
Yes — Exp-C cluster talks to Exp-E cluster. Peers are added under Zone > Peer addresses.
1 of each.
2 C, 2 E.
Separate zones.
Our UC Modernization Sprint stands up Expressway pair, traversal zones, certs, and firewall coord in 2-4 weeks.