nerdexam
Cisco

300-820 · Question #175

Refer to the exhibit. An engineer must configure a B2B traversal zone. Trusted certification authority and server certificates are uploaded to Cisco Expressway-C and Expressway-E servers. After the…

The correct answer is B. The peer 1 address in Expressway-C is not the FADN of Expressway-E. E. The traversal zone TLS verify subject name in Expressway-E does not match the FQDN of. A B2B traversal zone TLS failure on Expressway-C is caused by specifying the wrong peer address and a mismatched TLS verify subject name, both of which prevent successful mutual TLS verification.

Cisco Expressway for Collaboration

Question

Refer to the exhibit. An engineer must configure a B2B traversal zone. Trusted certification authority and server certificates are uploaded to Cisco Expressway-C and Expressway-E servers. After the traversal zone configuration is completed in Expressway-C, the error message in the exhibit appears. What are the two reasons for the error? (Choose two.)

Exhibit

300-820 question #175 exhibit

Options

  • AThe peer 1 address in Expressway-C must be replaced by the FQDN of Expressway-C.
  • BThe peer 1 address in Expressway-C is not the FADN of Expressway-E.
  • CThe communication port is not set to 7001.
  • DThe FQDN of Expressway-E cannot be resolved by the DNS server.
  • EThe traversal zone TLS verify subject name in Expressway-E does not match the FQDN of

How the community answered

(53 responses)
  • A
    4% (2)
  • B
    85% (45)
  • C
    2% (1)
  • D
    9% (5)

Why each option

A B2B traversal zone TLS failure on Expressway-C is caused by specifying the wrong peer address and a mismatched TLS verify subject name, both of which prevent successful mutual TLS verification.

AThe peer 1 address in Expressway-C must be replaced by the FQDN of Expressway-C.

The peer 1 address should reference Expressway-E, not Expressway-C; pointing it back to itself would create a loop and is not the correct fix.

BThe peer 1 address in Expressway-C is not the FADN of Expressway-E.Correct

The peer 1 address in Expressway-C must be the FQDN of Expressway-E so that TLS certificate verification can succeed; using an IP address or incorrect FQDN causes the TLS handshake to fail because the certificate CN or SAN will not match.

CThe communication port is not set to 7001.

The default traversal zone port between Expressway-C and Expressway-E is 7001 for H.323 but TLS SIP traversal uses port 7443; the port is not the cause of this specific TLS error.

DThe FQDN of Expressway-E cannot be resolved by the DNS server.

A DNS resolution failure would produce a different error indicating the host cannot be reached, not the TLS certificate mismatch error shown in the exhibit.

EThe traversal zone TLS verify subject name in Expressway-E does not match the FQDN ofCorrect

The TLS verify subject name configured on Expressway-E must match the FQDN presented in the Expressway-C certificate; a mismatch causes the traversal zone to reject the connection during mutual TLS negotiation.

Concept tested: Expressway B2B traversal zone TLS certificate configuration

Source: https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway/200270-Configure-B2B-Calling-on-Expressway.html

Topics

#Expressway Traversal Zones#TLS Certificate Verification#FQDN Configuration#Network Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-820 Practice