topic Re: Jabber Secure Connect in Collaboration Applications

Jabber Secure Connect

Martin2m2 — Sun, 17 Mar 2019 21:35:19 GMT

Hi All,

I have been through loads of presentations and documents, but can't seem to find a definitive answer to my Jabber Secure Connect questions.

Customer of mine has plans to roll out Cisco Jabber for iPhone, Jabber for Android and Jabber for Windows (currently uses IPC since they do not have Presence).

He has CUCM 8.6 (with UCL) on two UCS-C servers and a ASA5510. No Presence server at the moment.

If the user does not require FULL application access on his iPhone or Android phone, but Jabber access only:

Q1: Is it correct that NO Cisco AnyConnect Secure Mobility client is necessary on the phone?

Q2: Is there a minimum version of Jabber for iPhone and Android to have the Secure Connect functionality included?

Q3: On the ASA you need the AnyConnect Mobile ASA5510 license. But do you need AnyConnect Essential or Premium licenses with the Secure Connect?

Q4: When you are not using the AnyConnect Secure Mobility client is it therefore a clientless SSL connection and is Premium required?

For the Jabber for Windows:

Q5: Does the Secure Connect functionality exist in the Jabber for Windows, if so in what version?

I could imagine that a full application access with the AnyConnect Secure Mobility client for a laptop is more logical.

Q6: If so, do you still require the AnyConnect Mobile ASA5510 license? Since it enables mobile OS platform compatibility and a Windows laptop is hardly a Mobile OS.

Q7: Is the AnyConnect Essential sufficient in combination with the AnyConnect Secure Mobility client or when are the Premium licenses needed in this case?

Thanks for any help,

Martin

Message was edited on April 19, 2013: Lisa Marcyes from the Cisco Collaboration Community Team added community category and tags for greater ease in filtering (no change to content).

Re: Jabber Secure Connect

mbrugge — Fri, 31 Aug 2012 19:39:20 GMT

Hello Martin,

Looks like I have the pleasure of working another one of your cases! I picked up your case and for the most part what you're assuming is correct. I think the one thing you're missing is the Mobility licenses (Mobile-k9).

For your questions I have some answers but I want to make sure I do the research to make sure I cover all the details you're asking about. As always I'll get you answers as soon as I can, but not sure if I'll get them to you by today. Just want to give you the heads up.

Regards,

CSE Marco Hirschmann

Op Aug 31, 2012 om 16:38 heeft "mkoek" <community@cisco.com<mailto:community@cisco.com>> het volgende geschreven:

Cisco Communities<https://communities.cisco.com/index.jspa>

Jabber Secure Connect

created by mkoek<https://communities.cisco.com/people/mkoek> in Unified Communications - View the full discussion<https://communities.cisco.com/message/101676#101676>

Re: Jabber Secure Connect

mbrugge — Fri, 31 Aug 2012 19:41:08 GMT

Hello Martin,

The AnyConnect Mobile and AnyConnect Premium/Essential licences are the licences required on the ASA.

More information in regards to these licences can be found here:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/overview_c78-527488.html

Regards,

Marco

Op Aug 31, 2012 om 16:38 heeft "mkoek" <community@cisco.com<mailto:community@cisco.com>> het volgende geschreven:

Cisco Communities<https://communities.cisco.com/index.jspa>

Jabber Secure Connect

created by mkoek<https://communities.cisco.com/people/mkoek> in Unified Communications - View the full discussion<https://communities.cisco.com/message/101676#101676>

Re: Jabber Secure Connect

Steven DiStefano — Fri, 31 Aug 2012 19:55:12 GMT

Nice work Marco.

I ran into this a while back, and I was very please to find that Essentials is all thats needed for Jabber Moble clients. But beware, if you already have Premium (whats used for SSL-VPN Phones), you cant mix the two on the same ASA, so you would be stuck buying more premium (MUCH MORE expensive).

Also Cisco says Jabber Mobile requires a min. of 8.4.1 on the ASA so the more recent the better.

Have HA ASA pair?

AnyConnect Essentials, AnyConnect Mobile (and look at the Botnet Filtering as well) are all shareable licenses. Buy one for the primary and the HA pair is covered since version 8.3, provided you follow the rules (same subnet)..

Re: Jabber Secure Connect

Martin2m2 — Mon, 03 Sep 2012 07:38:16 GMT

Thank you sdistef for your reply.

So do I have it correctly that (see my Q1): No Cisco AnyConnect Secure Mobility client is necessary on the phone, but only the Jabber client?

And that (see my Q3): On the ASA you need the AnyConnect Mobile ASA5510 license and AnyConnect Essential.

Can you help me with my other questions?

Q2: Is there a minimum version of Jabber for iPhone and Android to have the Secure Connect functionality included?

Q4: When you are not using the AnyConnect Secure Mobility client is it therefore a clientless SSL connection and is Premium required?

For the Jabber for Windows:

Q5: Does the Secure Connect functionality exist in the Jabber for Windows, if so in what version?

I could imagine that a full application access with the AnyConnect Secure Mobility client for a laptop is more logical.

Q6: If so, do you still require the AnyConnect Mobile ASA5510 license? Since it enables mobile OS platform compatibility and a Windows laptop is hardly a Mobile OS.

Q7: Is the AnyConnect Essential sufficient in combination with the AnyConnect Secure Mobility client or when are the Premium licenses needed in this case?

Re: Jabber Secure Connect

Martin2m2 — Mon, 03 Sep 2012 07:53:05 GMT

Hello Marco,

The webpage you posted about the ASA licenses is one of the many pages I went through before I made this post. It doesn't address my practical questions about when do you use which one, but only what can it do and leaves the interpretation to the reader.

With all the material I went through nothing has seem to cover the missing link between the UC Jabber clients and what ASA licenses or secure client are needed.

I am stuck with many questions and can't offer the customer any solution so far.

Q2: Is there a minimum version of Jabber for iPhone and Android to have the Secure Connect functionality included?

Q4: When you are not using the AnyConnect Secure Mobility client is it therefore a clientless SSL connection and is Premium required?

For the Jabber for Windows:

Q5: Does the Secure Connect functionality exist in the Jabber for Windows, if so in what version?

I could imagine that a full application access with the AnyConnect Secure Mobility client for a laptop is more logical.

Q6: If so, do you still require the AnyConnect Mobile ASA5510 license? Since it enables mobile OS platform compatibility and a Windows laptop is hardly a Mobile OS.

Q7: Is the AnyConnect Essential sufficient in combination with the AnyConnect Secure Mobility client or when are the Premium licenses needed in this case?

Re: Jabber Secure Connect

jocostel — Mon, 03 Sep 2012 09:24:21 GMT

Q5. No. Secure Connect is not included with Jabber for Windows and the current solution is to use the AnyConnect client in conjunction with Jabber for Windows.

I'm hoping others will chime in with appropriate answers to the additional questions.

Re: Jabber Secure Connect

Steven DiStefano — Mon, 03 Sep 2012 13:27:50 GMT

Hello friends.

Happy Labor Day.

Jabber for Windows simply rides secure connection from the PC to the headend. The PC is not a Mobile device, but the reality is that the corporate network is secure and the PC will have to make a secure connection to access anything on it, including Cisco UC. So Jabber leverages this and you wouldnt be buying anything 'additional' for Jabber or the ASA at the headend. You can use:

Use Cisco VPN Client (for windows) to establish an IPSEC VPN tunnel.
Use Cisco Anyconnect Secure Mobile Client (for Windows) to establish SSL-VPN connectivity

Jabber for iPhone will require its own tunnel for the Phone, UM, and Directory integration to operate.

(Jabber IM client does not require VPN if you are in hybrid mode (IM/P via WebEx).

After you license the user via UCL or CUWL, you need to address the ASA licensing. First Essentials. The size of the chassis determines the number you can cover with the single license (i.e. up to 750 supported on the 5520 for $250):

Then you will need the ASA Mobile License. This will interoperate with Essentials or Premium. Same theme as above. In my response above I didnt discuss this because I was replying to Marco's response of E and P. But one license all you need here per chassis:

I made a point earlier that I would avoid Premium if you can, cause its much, much, more expensive. But if you have it already on the ASA, then you have no choice but to buy more, since you can not mix E and P on the same ASA. Or buy a new smaller ASA for jabber Mobile?

You dont need Premium for Jabber Mobile. Here is a table showing the difference and what you can do with P that you cant get in E. But this is more of a security discussion, and I am just saying Jabber mobile only needs E. I am not a security expert.

Hope this helps a little more. CLick images to make them larger.

Re: Jabber Secure Connect

skilambi — Tue, 04 Sep 2012 23:48:10 GMT

martin

This deck walks you through the basics of ASA licensing so you at least know where each level fits. Premium is needed for Phone VPN on the UC side among other features that are mentioned in the link. For Jabber, VXI essentials does the job coupled with mobile when you have IPhone/Droid as an example

https://communities.cisco.com/docs/DOC-20044

I agree a comprehensive deck on ASA UC licensing is much needed something I have stressed many times to the various BU. In Fact bundle it with PRO to further drive the value of Cisco any connect with UC

Jabber for android 8.6 was the last client that bundled any connect in it. Check the release notes for android and IPhone for minimum ASA requirements and certificate requirements.

Srini

Re: Jabber Secure Connect

r.pennington — Wed, 05 Sep 2012 10:40:16 GMT

http://www.cisco.com/web/products/voice/docs/jabber_anyconnect_sales.pptx

This is quite a nice deck, don't know if it has all of you answers but it gives an overview of the process and ordering.

Re: Jabber Secure Connect

skilambi — Wed, 05 Sep 2012 12:53:15 GMT

Richard

Thanks for sharing it is a nice deck. This is surprising that a deck like this that has MSFT competitive stuff (or at least some references to it) is accessible without me even trying to login in. I tried it in multiple browsers and it didnt force me to authenticate. Also remember this entire thread is not on the partner side but on the public side of the community open to customers and partners. I know it's confusing but a trick is when you look up and see "Cisco Communities - Technology - Collaboration and so on" if there is no partner word in it, then you are on the public side and anyone can just pull this thread up without logging in. Maybe we should move it to the partner side for security purposes or have some authentication just for your PPT link..my 2 cents

Srini

Re: Jabber Secure Connect

r.pennington — Wed, 05 Sep 2012 13:56:24 GMT

It's located in the partner central Cisco.com so surprised the link would work with credentials.

Re: Jabber Secure Connect

skilambi — Wed, 05 Sep 2012 13:57:41 GMT

It sure did ☺

Thanks

Srini

Re: Jabber Secure Connect

e-scherer — Mon, 10 Sep 2012 08:39:55 GMT

Hello Marco,

can You give an example configuration for the ASA (for a Jabber client-connection)?

Thanks

Edgar

Re: Jabber Secure Connect

jsteinberg — Mon, 10 Sep 2012 19:50:48 GMT

I'm confused on the Secure Connect questions as well. The Jabber for Android 8.6 had the Secure Connect, but the 9.0 version removed the feature.

I've heard that jabber for iPad will have secure connect, but it is a long way away.

Is Cisco still moving towards a Secure Connect model or is the Android 8.6 to 9.0 a sign that the Secure Connect concept is being phased out ?

I believe Secure Connect for Windows Jabber was slated for 9.1, so I guess we will see the answer shortly.

Re: Jabber Secure Connect

skilambi — Mon, 10 Sep 2012 19:56:08 GMT

All apps are moving away from Secure connect. The slide was done before the updates happened. All apps will use Any connect standalone to launch

Thanks

Srini

Re: Jabber Secure Connect

Martin2m2 — Wed, 12 Sep 2012 07:22:45 GMT

Hi All,

I will try to summarize the discussion here for future reference to other users. And I have one additional question.

Comments are welcome.

Jabber for iPhone/Android

Q1: Is it correct that NO Cisco AnyConnect Secure Mobility client is necessary on the smartphone?

A1: You do need the AnyConnect Secure Mobility client. The developments are that Cisco has moved away from the Secure Connect feature in the Jabber for iPhone/Android. The AnyConnect client delivers a better connectivity experience and also the option to have VPN access for other applications.

Q2: Is there a minimum version of Jabber for iPhone and Android to have the Secure Connect functionality included?

A2: Not relevant anymore. It is going the other way, the newer versions of Jabber do not have Secure connect.

Q3: On the ASA you need the AnyConnect Mobile ASA5510 license. But do you need AnyConnect Essential or Premium licenses with the Secure Connect?

A3: For VPN connection with a laptop or smartphone with Jabber AnyConnect Essentials on the ASA is enough. Be carefull that you can't combine Essentials and Premium on one platform. If you wan to use the VPN Phone (with a deskphone) connectivity option then Premium is needed.

Q4: When you are not using the AnyConnect Secure Mobility client is it therefore a clientless SSL connection and is Premium required?

A4: No you can't do without, see A1 and A2.

For the Jabber for Windows:

Q5: Does the Secure Connect functionality exist in the Jabber for Windows, if so in what version?

I could imagine that a full application access with the AnyConnect Secure Mobility client for a laptop is more logical.

A5: No Secure Connect doesn't exist in Jabber for Windows.

Q6: If so, do you still require the AnyConnect Mobile ASA5510 license? Since it enables mobile OS platform compatibility and a Windows laptop is hardly a Mobile OS.

A6: NO, AnyConnect Mobile ASA5510 license is not needed for Jabber for Windows.

Q7: Is the AnyConnect Essential sufficient in combination with the AnyConnect Secure Mobility client or when are the Premium licenses needed in this case?

A7: NO, also in this case (JAbber for Windows with AnyConnect client) AnyConnect Essentials on the ASA is enough.

New Question:

Q8: Is it possible to setup the AnyConnect Secure Mobile client in such a way that ONLY the Jabber client has access over the VPN and no other applications? Customer wants the VPN connection to come up when Jabber is started and go down again when it is closed.

Many thanks to the contributors to this discussion.

Martin

Re: Jabber Secure Connect

skilambi — Thu, 13 Sep 2012 02:22:56 GMT

I don’t believe that solution is baked. Once the tunnel is set up all applications has access to the tunnel. Now can restrict what address are allowed on the tunnel/ports to restrict to a certain degree other applications. You can also do split tunneling to avoid You tube or other consumer applications from flowing through that tunnel

There is discussion on using any connect URI handlers(enhancements with 3.0) to programmatically connect/disconnect the tunnel when Jabber is launched/killed.

Thanks

Srini

Re: Jabber Secure Connect

abdullahimemphis08 — Tue, 25 Dec 2012 09:12:31 GMT

As said "No Secure Connect doesn't exist in Jabber for Windows".

Does this mean that I cant use jabber in windows with cisco anyconnect?. The problem is that cisco jabber when using cisco anyconnect version 3.1 only connects to the Presence server but it does not connect to the Call Manager both deskphone and softphone mode and also voicemail are not working but when inside the network both deskphone, softphone and voicemail features work.

Are there any ports that I can open other than the following:

8443 HTTP

2748 TCP

143 TCP/TLS

16384 to 3276 UDP

69 UDP

443 SSL

Re: Jabber Secure Connect

skilambi — Wed, 26 Dec 2012 15:11:51 GMT

No secure connect is a completely different thing. Secure connect was a plan to embed any connect inside the client itself so that when the client would launch the tunnel would be generated from within the client.

Jabber does support launching the any connect separately and that’s the strategy going forward.

For troubleshooting issues best to post here

https://supportforums.cisco.com/community/netpro/collaboration-voice-video/jabber

Thanks

Srini