Which configuration does Cisco recommend for the peer address on the Expressway-C secure traversal zone when the Expressway-E has one NIC enabled?

The internal IP address is not reachable from Expressway-C when a single NIC is used with a NAT or DMZ boundary separating the two devices.

While the external IP address provides correct routing, using a raw IP instead of an FQDN prevents TLS certificate validation from succeeding, which Cisco does not recommend.

The internal FQDN resolves to the internal IP address, which is not routable from Expressway-C across the firewall boundary in a single-NIC deployment.

With one NIC on Expressway-E, Expressway-C must target the external-facing address. Cisco recommends using the FQDN rather than an IP address because TLS certificate validation requires the peer address to match the Common Name or Subject Alternative Name in the Expressway-E certificate, which is based on the FQDN. Using the external FQDN satisfies both the routing requirement and the certificate trust requirement.