topic Re: Expressway E internal and external dns in Collaboration Applications

Expressway E internal and external dns

plp_pnlr — Mon, 25 Oct 2021 10:54:05 GMT

Does the internal and external dns for expway e must have the same domain name? I have configured dual nic on E. And traversal zone is working but jabber can't connect to internal server.

Re: Expressway E internal and external dns

b.winter — Mon, 25 Oct 2021 11:11:22 GMT

Hello,

what you mean with dns?

The configured DNS-servers in EXP-E? Or the DNS-names of EXP-E?

As far as I have in my head, the EXP-E the only DNS-entries that it needs to resolve for MRA to work is it's own A-record and the corresponding PTR at your public DNS-provider.

The most that you my have to be sure is, that EXP-E can resolve the A-Record and PTR of EXP-C too.

So for MRA, it would then need an internal DNS-server, that can resolve the EXP-C related DNS-entries.

Re: Expressway E internal and external dns

Nithin Eluvathingal — Mon, 25 Oct 2021 11:11:34 GMT

Its not mandatory to have the same domain. I have customer using MRA feature who's Internal and external domains are different.

Take logs from Both E and C and run it on CSA tool. Its give you more information.

You can access CSA tool from https://cway.cisco.com/csa/

Detailed steps to collect the logs has been mentioned on below document.

https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway/213360-collect-expressway-vcs-diagnostic-log-fo.html

Re: Expressway E internal and external dns

Mahmoud Belhaj — Mon, 25 Oct 2021 17:47:33 GMT

Hello @plp_pnlr

Does the internal and external dns for expway e must have the same domain name?

Domain name in DNS Server with MRA can working with same domain or with different domain like expe.local - expe.com or expe.com(internal) - expe.com (external) - SRV cisco-uds for internal and collab-edge for external .

but insure from domain is configured correctly in expe (expe.com as external)

Best Regards

Re: Expressway E internal and external dns

plp_pnlr — Tue, 26 Oct 2021 02:59:18 GMT

Hi Mahmoud,

is there a way in expe to identify if its for external? because on Domains you can add domain names?

Re: Expressway E internal and external dns

Nithin Eluvathingal — Tue, 26 Oct 2021 04:09:51 GMT

Assume that your internal domain as abc.local and external domain as abc.com.

Configure Expressway-C System>> Dns :-

System host name:- ExpreswayC

Domain name:- abc.local

Configure Expressway-E System>> Dns :-

System host name:- ExpreswayE

Domain name:- abc.com

Have you taken logs from Expressway E and C and run it on CSA tool. It gives you more insight to your problem.

Re: Expressway E internal and external dns

plp_pnlr — Tue, 26 Oct 2021 08:19:32 GMT

on CSA, it says no issues were found. but jabber recieves 'can't communicate with the server' error. on Configuration>domains, do I need to add both internal and external domains? and in exp-C zones>peer address, do I need to put also the exp-eexternal address? b'cause I think it should be only the internal address.

Re: Expressway E internal and external dns

b.winter — Tue, 26 Oct 2021 08:58:40 GMT

Assuming, you have split DNS internally, under "configuration --> domains" you need to set all external domains, for which the users login from external via MRA.

Taking Nithin's example: "abc.com".

Exp-C then needs to resolve the SRV "_cisco-uds._tcp.abc.com" via it's internal DNS server.

Under "Exp-C zones --> peer address" it depends what you need to set.

If Exp-C can resolve the external FQDN of EXP-E, then you can set this as peer address.

If it only can resolve the internal FQDN of EXP-E, then you can set this as peer address.

If it can resolve both, then you can choose.

But: whatever FQDN you choose, it has to be in the certificate of the EXP-E!!!

If it isn't, you get a TLS connection error.

Note:

Some of the public CA's don't accept internal domains in the CSR's.

Therefore, the only option is to use an external FQDN in the cert of EXP-E --> therefore, the peer address in EXP-C also needs to point to the external FQDN.

Re: Expressway E internal and external dns

Nithin Eluvathingal — Tue, 26 Oct 2021 09:54:14 GMT

Lets Assume,

Expressway C iP address 192.168.10.10 and hostname express-C.
Expressway E internal ip address 192.168.10.11 and hostname express-E .
Your Static IP as 72.72.72.11
Domain abc.local and abc.com

On internal DNS:-

Domain abc.local

A-record :- express-C.abc.local 192.168.10.10

Domain abc.com (sub zone)

A-record :- express-E.abc.com 192.168.10.11

Public DNS:-

A-record :- express-E.abc.com 72.72.72.11

_collab-edge._tls.abc.com   SRV service location:
          priority       = 3
          weight         = 7
          port           = 8443
          svr hostname   = express-E.abc.com

Configure Expressway-C System>> Dns :-

System host name:- ExpreswayC

Domain name:- abc.local

Configure Expressway-E System>> Dns :-

System host name:- ExpreswayE

Domain name:- abc.com

Add both domains on Expressway C

Expressway C >>Configurations >>Domain

Certificate:-

Expressway C

it can be internal CA signed certificate.

Expressway E:- it should be public CA signed certificate. When generating CSR for expressway E, "Make sure you add abc.com as DNS filed"

Re: Expressway E internal and external dns

plp_pnlr — Mon, 01 Nov 2021 04:09:54 GMT

The problem is now solved. Not only the FQDN of exp-E must be on its certificate but also the domain name of public DNS. also tcp was not enabled on the MRA setting. Thank you all for your help.

Re: Expressway E internal and external dns

Mahmoud Belhaj — Mon, 01 Nov 2021 08:02:49 GMT

Yes always the issue happened with

FQDN you choose, it has to be in the certificate.

If it isn't, you get a TLS connection error.

best regards and aorry for late

Re: Expressway E internal and external dns

ausjustin — Mon, 04 Apr 2022 10:00:15 GMT

is it missing the FQDN for express C when generate CSR on Expressway E ？

Re: Expressway E internal and external dns

ausjustin — Mon, 04 Apr 2022 10:02:36 GMT

Regarding the certificate, Is it the expressway E has to add on FQDN expressway C ? if yes, the Public CA no accept the internal domain name.

Re: Expressway E internal and external dns

Nithin Eluvathingal — Mon, 04 Apr 2022 10:15:27 GMT

Expressway E certificate must contain the external domain as the dns field.

when generating csr add this files as dns.

there is no need to add the expressway c details on E certificate.