06-01-2017 07:46 AM - edited 06-01-2017 07:46 AM
What we found out was that Expressway needs to be configured in a dual nic configuration - one internal NIC and one External NIC. Trying to get it working on a single NIC with NAT through a PA will apparently not work. I also had to create a non-routable (internally) vLAN and use it on a DMZ port on the Palo ALto. I then took the Expressway interface configured for External access and put it on the DMZ vLAN. That Expressway NIC was configured with internal NAT, a security rule and direct NAT rule were created on the Palo Alto, and all worked afterward. I guess the real hold up was that a DMZ needed to be created on the PA (we didn't really have one prior to this) and the Expressway needed to be set to use dual interfaces. Once everything was configured and secured properly, we were able to register external SIP phones and make and receive calls.
