topic Okay please restart the in IP Telephony and Phones

Cisco ExpresswayMRA Connect to 2 CUCM Cluster.

617408kim — Sun, 17 Mar 2019 08:53:48 GMT

Hi Experts,

I am in process of configuring and testing Expressway MRA for two CUCM Cluster with same domain.

and login tests with jabber.

A couple of jabber IDs cannot log-in to IM&P

I wanto to make sure whether the configuration of each devices for MRA is correct or not

Do you think which configuration are needed to work MRA for two CUCM and IM&P Clusters?

[Expressway]

1. basic configuration such as NTP, DNS and so on.

2. enable MRA feature

3. add two IM&P clusters

4. add two CM Clusters

5. add customer domin

6. Traversal zone between expressway-e and expressway-c

[CUCM]
1. Enable Intercluster lookup service on two cucm clusters

2. Home cluster check box on two cucm clusters.

Yes all of these look okay.

Ayodeji Okanlawon — Mon, 09 Feb 2015 13:57:14 GMT

Yes all of these look okay. Can you describe in detail the issue you are having? Is your IM&P presence domain the same as your expressway-E and C domain?

Yes, all devices are using

617408kim — Tue, 10 Feb 2015 01:38:28 GMT

Yes, all devices are using same domain.

Actually I have 2 cucm clusters and 2 IM&P clusters.

Cluster A : cucm with 10.5.1.1000-7 version and an im&p with 10.5.1.12900-2.

Cluster B : cucm with 10.5.1.1000-7 and an im&p with 10.5.1.10000-9.

while I just add a cluster to the expressway, everything is fine.

But while I add two clusters to the expressway, a couple of jabber IDs in a Cluster A cannot login.

Have you checked that your

Ayodeji Okanlawon — Tue, 10 Feb 2015 09:25:50 GMT

This looks like an ILS related issue

If you have multiple Unified CM clusters, ILS (Intercluster Lookup Service) must be set up on all of the clusters. This is because the expressway has to authenticate a client against its home Unified CM cluster, and to discover the home cluster it sends a UDS (User Data Service) query to any one of the Unified CM nodes over ILS

Have you checked that your ILS service is working? If you have then please send jabber logs for the clients that cant login.

Hi, As I mentioned befere,

617408kim — Tue, 10 Feb 2015 10:44:24 GMT

Hi,

As I mentioned befere, there are 2 cucm and im&p clusters here.

prior to 10.x, ILS must be enable on all nodes. but with 10.X, ILS just be set up on the pub, and there is no ILS service on serviceability of cluster A sub cucm.

I attach ILS configuration screen on cluster A pub, sub and Cluster B pub

system components are as a below.

[Cluster A]

- CUCM : Pub 1ea , Sub 1ea

- IM&P : Pub 1ea

[Cluster B]

- CUCM : Pub 1ea

- IM&P : Pub 1ea

When I mean ILS service, I am

Ayodeji Okanlawon — Tue, 10 Feb 2015 10:53:22 GMT

When I mean ILS service, I am not referring to the service in serviceability. I mean is ILS within the cluster operational, which your pictures depict it is..

Can we have jabber logs please? So we can see why the login is failing.

Hi, you can see jabbers logs.

617408kim — Tue, 10 Feb 2015 14:18:41 GMT

Hi,

you can see jabbers logs. which logs are do you want to see and where can I get the logs on the local computere.

There are two ways to get

Ayodeji Okanlawon — Tue, 10 Feb 2015 15:33:36 GMT

There are two ways to get Jabber logs. You can generate a problem report from the client and it will include the log file in there or you can go to the following folder

C:\Users\userxxx\AppData\Local\Cisco\Unified Communications\Jabber\CSF\logs

You will find the logs here

Hi,I attached the log file

617408kim — Tue, 10 Feb 2015 15:42:22 GMT

Hi,

I attached the log file that you request.

Thanks

I have looked at the logs and

Ayodeji Okanlawon — Tue, 10 Feb 2015 16:38:21 GMT

I have looked at the logs and I have a few questions for you.

Is your user on this cluster?

Adding new home UDS URI: https://192.168.200.1:8443/cucm-uds/user/kim617408
Adding new home UDS URI https://192.168.200.2:8443/cucm-uds/user/kim617408

And is this the correct IM&P server for this user?

****************************************************************
2015-02-10 23:14:16,221 INFO [0x00002fdc] [ters\imp\commands\LoginCommands.cpp(158)] [imp.service] [IMPStackCap::LoginCommands::SignOn] - Signing into Presence Server. Server: 192.168.200.3, login mode: ON_PREM, result: 0
2015-02-10 23:14:16,222 INFO [0x00002fdc] [ters\imp\commands\LoginCommands.cpp(159)] [imp.service] [IMPStackCap::LoginCommands::SignOn] - ****************************************************************

Do you also have a webex messenger service/domain?

Yes, kim617408 is a test user

617408kim — Wed, 11 Feb 2015 04:24:13 GMT

Yes, kim617408 is a test user id and this user is on Cluster A

Cluster A have 2 cucm nodes and 1 im&p node.

192.168.200.1 - cucm pub
192.168.200.2 - cucm sub
192.168.200.3 - im&p pub

in addition, I don't have a webex messager service/domain.

Okay from the logs we see

Ayodeji Okanlawon — Wed, 11 Feb 2015 10:36:54 GMT

Okay from the logs we see that the client is getting authentication error with the presence server..

[imp.service] [IMPStackCap::Login::OnLoginError] - ****************************************************************

[IMPStackCap::Login::OnLoginError] - OnLoginError: (data=0) LERR_JABBER_AUTH <17>: Authentication error with server e.g. resource bind, TLS, create session or SASL error

[IMPStackCap::Login::OnLoginError] - ****************************************************************

We can at least conclude that ILS part is working because the client has been directed to its home cluster. We now need to know why its unable to login.

Can this client login to the server internally? Is this IM&P server configured with a presence domain of "insunginfo.co.kr"

If the answer is yes to both questions, then please use RTMT to send me the Tomcat security logs for the IM&P server. The link below shows how to do this..( you need to select the log name : Tomcat Security)

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-im-presence-service-version-105/117827-configure-unifiedpresenceserver-00.html?mdfid=286269517

++++WebEx messenger+++
Looking the the logs if does look like you have an active webex messenger service. This could create problems for you.

+++Here Jabber does a CAS lookup++++

*-----* Making HTTP request to: http://loginp.webexconnect.com/cas/FederatedSSO?org=insunginfo.co.kr.

[http::CurlAnswerEvaluator::curlCodeToResult] - curlCode=[0] result=[SUCCESS]

++++Here Jabber gets a 200 OK to the request for your domain++++

[http::executeImpl] - *-----* HTTP response from: http://loginp.webexconnect.com/cas/FederatedSSO?org=insunginfo.co.kr[0] -> 200

[http::CurlHttpUtils::getResponseCode] - Http Response Code = [200] for request [0]

++Jabber also does a successful service discovery on webex for the domain+++

[service-discovery] [CasLookupImpl::executeCasQuery] - CAS request finishes with response: [responseCode]200

[CasLookup::getCasLookupResult] - CAS lookup request has been successfully finished with domain: insunginfo.co.kr

+++++++++

Suggestion on this: Speak to your cisco AS/SE/account manager and find out if you have a webex service and ensure its only enabled for webex meeting and not webex messenger.

We just use public DNS

617408kim — Wed, 11 Feb 2015 17:11:19 GMT

We just use public DNS server. So I configure a Internal DNS server for Jabber.

Synchronization between two systems don't happen.

You asked me two questions as a below.

Q1. Can this client login to the server internally?
- When DNS server on the computer is changed into the internal DNS, jabber can login.

Q2. Is this IM&P server configured with a presence domain of "insunginfo.co.kr"
- How can I check it? Please explain it more detail.
- when I execute DNS lookup on expressway-c, IM&P server can find
Of cause, DNS setting on Expressway-c is assigend the Internal DNS.

I was testing several times to login jabber, and the last test was starting at 1:46 on the log.

in addition, we don't use webex message service. we just use on-promise webex server called CWMS.

Okay to check your IM&P

Ayodeji Okanlawon — Wed, 11 Feb 2015 18:15:41 GMT

Okay to check your IM&P presence domain please go to your IM&P server, system>cluster topology>settings (its under cluster topology) You will see your IM&P domain there..

Secondly the time on the security logs doesn't match the time on the jabber logs. Can you do another test with jabber and send the tomcat logs for that time.

in 10.x version, there is no

617408kim — Thu, 12 Feb 2015 10:03:32 GMT

in 10.x version, there is no cluster topoloy. it changed to Presence Topology.

I think the Value on Cluster Fully Qualified Domain Name is that you asked.

System > Enterprise Parameters Configuration > Clusterwide Domain Configuration > Cluster Fully Qualified Domain Name. At this field, Domain is diaplayed.

I also did jabber login test around 18:37:20 and send you the logs.

No I am not refeering to the

Ayodeji Okanlawon — Thu, 12 Feb 2015 12:58:35 GMT

No I am not refeering to the cluster fully qualified domain. In 10.X it is called default domain..Please check it here

Cisco Unified CM IM and Presence Administration > Presence > Settings > Advanced Configuration.
Choose Default Domain. (can you confirm that the domain is the correct one)

I have looked at tomcat logs and I can see a successfully login for the test user. I am keen on getting this sorted for you ( I am even ready to open a tac case if need be) but I want to check all the relevant things first..

If your domain is configured correctly.Please use RTMT to collect the following logs for the time frame that you do another test.

Cisco Client Profile Agent (CPA)
Cisco XCP Connection Manager
Cisco XCP Router
Cisco XCP Authentication Service

I will also need Expwe and C logs. To collect this please go to expwe server and navigate to

Maintenance > Diagnostics > Diagnostic logging

Network log level and Interworking log level both set to Debug
B2BUA log level set to Debug

PS: Does this affect all users on cluster A? Can users in Cluster B login? Have you tested with another user in cluster A?

Yes, I will confirm the

617408kim — Fri, 13 Feb 2015 06:02:06 GMT

Yes, I will confirm the domain is correct. and I will attach the captured file.

I was login test around 14:37 and collected logs on RTMT. while I collected logs on RTMT, warning was displayed as an attached file.

PS Question)
- Does this affect all users on cluster A? Can users in Cluster B login? Have you tested with another user in cluster A?

: At first test, a couple of user in Cluster A can login and all user in Cluster B can login. But all user in Cluster A and Cluster B cannot login at the moment.

and I send exp-c and exp-e logs to your e-mail. please check it up.

I have looked at the logs in

Ayodeji Okanlawon — Fri, 13 Feb 2015 10:47:20 GMT

I have looked at the logs in detailed and the failure is due the SASL (Simple Authentication and Security Layer ) error.

++++++++++++

2015-02-13T14:37:40+09:00 isje XCP_CM[8601]: UTCTime="2015-02-13 05:37:40,15" ThreadID="140509293991680" Module="cm-1.isje-XXXXX-co-kr" Level="WARN " CodeLocation="cm-1_jsmcp-1_xmppd-1" Detail="XMPPStream Error -- ErrorCode: 303 Details: bind-error: Invalid stream header, Errored address: X.X.X.X, Errored user jid: unknown"

2015-02-13T14:37:42+09:00 isje XCP_CM[8601]: UTCTime="2015-02-13 05:37:42,346" ThreadID="140509310777088" Module="cm-1.isje-XXXXXX-co-kr" Level="INFO " CodeLocation="SASLManager.cpp:290" Detail="Failed during SASL session with auth component"

2015-02-13T14:37:42+09:00 isje XCP_CM[8601]: UTCTime="2015-02-13 05:37:42,346" ThreadID="140509310777088" Module="cm-1.isje-XXXX-co-kr" Level="WARN " CodeLocation="cm-1_jsmcp-1_xmppd-1" Detail="XMPPStream Error -- ErrorCode: 107 Details: internal-server-error, Errored address: X.X.X.X, Errored user jid: unknown"

+++++++++++

Do you have port 5222 enabled inbound to Expwe from the internet on your firewall? This is the port used for XMPP traffic

Do you also have port 7400 enabled between Expw-C and E

I'd first like to convey my

617408kim — Mon, 16 Feb 2015 02:24:38 GMT

I'd first like to convey my appreciation for long terms supports.

I will talk about port 5222 and port 7400 with firewall engineer and update them.

At this point, I have a question.

What is different between using either Cluster_A or Cluster_B and using both of them?

I am a little confusing.

I am not sure I understand

Ayodeji Okanlawon — Mon, 16 Feb 2015 09:41:13 GMT

I am not sure I understand your question. Cluster_A is different from cluster_B. You have different users in different clusters hence you need your expressway to communicate with both clusters.