Verifying Registration on the Cisco Expressway
For an endpoint to use the Expressway as its H.323 gatekeeper or SIP registrar, the endpoint must first register with the Expressway. The Expressway can be configured to control which devices are allowed to register with it by using the following mechanisms:
A device authentication process based on the username and password supplied by the endpoint
A registration restriction policy that uses either Allow Lists or Deny Lists or an external policy service to specify which aliases can and cannot register with the Expressway
Restrictions based on IP addresses and subnet ranges through the specification of subzone membership rules and subzone registration policies
You can use these mechanisms together. For example, you can use authentication to verify an endpoint’s identity from a corporate directory and use registration restriction to control which of those authenticated endpoints may register with a particular Expressway. You can also control some protocol-specific behavior, including:
The Registration Conflict Mode and Auto Discover settings for H.323 registrations
The SIP registration proxy mode for SIP registrations
In a Cisco Unified CM deployment, endpoint registration for SIP devices may be provided by Unified CM. In this scenario, the Expressway provides secure firewall traversal and line-side support for Unified CM registrations. When configuring a domain, you can select whether Unified CM or Expressway provides registration and provisioning services for the domain.
H.323 systems such as gateways, multipoint control units (MCUs), and content servers can also register with an Expressway. They are known as locally registered services. These systems are configured with their own prefix, which they provide to the Expressway when registering. The Expressway then knows to route all calls that begin with that prefix to the gateway, MCU, or content server as appropriate. These prefixes can also be used to control registrations. SIP devices cannot register prefixes. If your dial plan dictates that a SIP device should be reached via a particular prefix, then you should add the device as a neighbor zone with an associated Search Rule using a pattern match equal to the prefix to be used.
When registering, the H.323 endpoint presents the Expressway with one or more of the following:
H.323 IDs
E.164 aliases
URIs
Users of other registered endpoints can then call the endpoint by dialing any of these aliases. Note the following recommendations:
Register your H.323 endpoints using a URI. This facilitates interworking between SIP and H.323, as SIP endpoints register using a URI as standard.
Do not use aliases that reveal sensitive information. Due to the nature of H.323, call setup information is exchanged in an unencrypted form.
When registering, the SIP endpoint presents the Expressway with its contact address (IP address) and logical address (Address of Record). The logical address is considered to be its alias and generally is in the form of a URI.
An endpoint may attempt to register with the Expressway using an alias that is already registered to the system. How this is managed depends on how the Expressway is configured and whether the endpoint is SIP or H.323:
H.323: An H.323 endpoint may attempt to register with the Expressway using an alias that has already been registered on the Expressway from another IP address. You can control how the Expressway behaves in this situation by configuring the Registration Conflict Mode setting on the H.323 page (Configuration > Protocols > H.323).
SIP: A SIP endpoint will always be allowed to register using an alias that is already in use from another IP address. When a call is received for this alias, all endpoints registered using that alias will be called simultaneously. This SIP feature is known as forking.
All endpoints must periodically re-register with the Expressway to keep their registration active. If you do not manually delete the registration, the registration could be removed when the endpoint attempts to re-register, but this depends on the protocol being used by the endpoint:
H.323 endpoints may use “light” re-registrations that do not contain all the aliases presented in the initial registration, so the re-registration may not get filtered by the restriction policy. If this is the case, the registration will not expire at the end of the registration timeout period and must be removed manually.
SIP re-registrations contain the same information as the initial registrations, so they will be filtered by the restriction policy. This means that, after the list has been activated, all SIP registrations will disappear at the end of their registration timeout period.
The frequency of re-registrations is determined by the Registration Controls setting for SIP (Configuration > Protocols > SIP) and the Time to Live setting for H.323 (Configuration > Protocols > H.323).
Check that all endpoints that are expected to be registered are actually registered to the relevant Expressway and that they are registering the expected aliases. All successfully registered endpoints are listed on Status > Registrations > By Device. If the expected endpoints are not registered, review the following items:
The endpoint’s registration configuration. Is it configured to register with the Expressway-E if located on the external network/Internet, and to register with the Expressway-C if located on the internal network?
The SIP domains.
Any registration restriction configuration applied to the Expressway.
In some cases, home endpoints may fail to register when using Service (SRV) records. This can happen if the endpoint uses the home router for its DNS server and the router’s DNS server software doesn’t support SRV records lookup. (This also applies to the DNS server being used by a PC when Jabber Video is running on it.) If registration failure occurs, do either of the following:
Change the DNS server on the endpoint to use a publicly available DNS server that can resolve SRV record lookups; for example, Google - 8.8.8.8.
Change the SIP server address on the endpoint to use the FQDN of a node in the Expressway cluster and not the cluster SRV record, so that the device performs an AAAA or A record lookup.