topic Can you send a screen shot of in Unified Communications Infrastructure

Expressway 8.9.1 - IM&P Federation With Microsoft-based Organizations Skype for Business

ciscodrew — Tue, 19 Mar 2019 19:06:41 GMT

Has anyone set this up successfully yet?

I have followed the brief config included in the doc starting on page 53, but I am not having much luck.

See attached Doc S4BFED.pdf for config that works.

hello,

Amit23 — Tue, 14 Feb 2017 08:50:47 GMT

hello,

what error or issue coming when following the given steps?

I have a Skype for Business

ciscodrew — Tue, 14 Feb 2017 14:40:23 GMT

I have a Skype for Business trial account to test and I am not able to send chats either way.

I am seeing this in the event logs on the Expressway C - Detail="Proxy Authentication Required" Protocol="TLS" Response-code="407"

I was able to get it working

ciscodrew — Fri, 17 Feb 2017 14:46:15 GMT

I was able to get it working with Skype for business / Office 365 account.

Hi! What did you change to

ruudvanstrijp — Thu, 16 Mar 2017 11:12:00 GMT

Hi! What did you change to get it to work? I am also receiving the 407 proxy auth required message from IM&P (for chats coming from O365 SfB, via Expressway-E and -C), and I notice IM&P doesn't route chat messages to the Expressway-C.

I am using a valid Office 365 SfB account, which can federate with other SfB accounts in other domains. So federation on the O365 side is ok.

There are a few steps missing

ciscodrew — Thu, 16 Mar 2017 19:12:47 GMT

There are a few steps missing from the guide of course.

If I remember correctly, we had to do the following:

1 - add expressway C cert to CUP trust on IM&P

2 - Configure trusted peer on IMP for expressway C

3 - Configure Incoming ACL on IMP to allow expressway C

4 - Install Microsft root cert that Skype uses on IMP under cup trust - I think.

I would have to double check my notes but I think that is it.

After successfully federating with S4B, we were able to federate with Microsoft.com domain.

Adding the Expressway-C cert

ruudvanstrijp — Fri, 17 Mar 2017 12:41:31 GMT

Adding the Expressway-C cert to cup-trust did the trick, even though my Expressway-C and IM&P servers use the same root CA. Thanks!

Another thing that isn't noted in the guide, is that Exp-C's neighbor zone to IM&P should point to port 5062 (Peer Auth Listener) and not to the Server Auth listener (5061). I read somewhere that you might need to swap ports on these services, but I didn't do that. I just send the neighbor route to 5062.

Yes , you are correct we had

ciscodrew — Fri, 17 Mar 2017 13:48:17 GMT

Yes , you are correct we had to change the ports on the neighbor zone as well.

Forgot to add to previous post.

Hi! I have got chat working,

mstokman — Sat, 01 Apr 2017 07:27:03 GMT

Hi! I have got chat working, but the presence status is not updating on S4B site. Any idea why this is not working? When i change the status on the S4B client i can see that on the jabber client. The jabber status is now shown on the S4B client

What external SRV record is

j.house — Mon, 03 Apr 2017 21:24:46 GMT

What external SRV record is needed?...I see various "pieces" of documentation that mention the CUP-ServerFQDN-Public record being needed. I assume this record is what the sipfederationtls SRV record points to? then CUP-ServerFQDN-Public would point to the Expressway-e Public IP? thanks!

External DNS SRV record is

ciscodrew — Mon, 03 Apr 2017 21:41:01 GMT

External DNS SRV record is _sipfederationtls._tcp.<domain>.com which is pointed to the Expressway E\s

You will also need an internal DNS record for CUP-ServerFQDN-Public that points to CUPS cluster PUB.

I had the same issue as well.

ciscodrew — Mon, 03 Apr 2017 21:43:17 GMT

I had the same issue as well. I cannot remember exactly what is was that fixed. I think it was either or both of these two:

1 - make sure to create internal DNS record for CUPS PUBLIC FQDN to point CUPS PUB.

2 - Change port to 5062 as mentioned above.

thank you. has anyone tried

j.house — Mon, 03 Apr 2017 22:23:01 GMT

thank you. has anyone tried to create their search rules and IM&P routes to make a psuedo open federation config? Instead of manually adding routes and search rules for each and every domain you wish to federate with?

Hi, I changed the outgoing

mstokman — Tue, 04 Apr 2017 06:40:38 GMT

Hi, I changed the outgoing search rule and now it works! Thanks

I was able to get 2-way IM

j.house — Tue, 04 Apr 2017 22:07:10 GMT

I was able to get 2-way IM going but only if I initiate the conversation. if Skype initiates the conversation is get the following error on the Expressway-E:

Call Rejected with Detail="Proxy Authentication Required" Protocol="TLS" Response-code="407"

I also have no presence on either side. I have confirmed my search rules and routing...what am I missing?

Did you add Expressway-C's

ruudvanstrijp — Wed, 05 Apr 2017 07:49:53 GMT

Did you add Expressway-C's certificate to CUP-Trust? I think this is the step that solved all my Proxy Auth Required issues.

I assume you also have the route to imp-public.domain.com (hostname) and not only to the domain name? This is a feature/bug.

Yes, I have the Expressway-C

j.house — Wed, 05 Apr 2017 12:56:21 GMT

Yes, I have the Expressway-C's certificate as a CUP-Trust, that is what got IM working for me. I have the following route on the Expressway-C:

.*server-name-public\.us.domain\.com.*

It is Priority 100 and set for Microsoft SIP IM&P as the SIP Variant

That is correct right?

So I found part of my issue

j.house — Wed, 05 Apr 2017 15:47:29 GMT

So I found part of my issue which was a space at the end of my server-name-public regular expression. I was able to get Jabber to display Skype presence once that was resolved. it appears that the only remaining issue I have is my jabber presence can't be seen on the Skype client.

What change did you make to

j.house — Wed, 05 Apr 2017 16:00:46 GMT

What change did you make to the outgoing search rule (and which rule was it)?

Did you create an internal

ciscodrew — Wed, 05 Apr 2017 16:04:13 GMT

Did you create an internal DNS entry for CUPS PUBLIC FQDN and point to CUPS PUB?

Did you set the CUPS PUBLIC FQDN in service parameters?