Can you provide more details regarding your setup, is it a single domain or multi domain. what entries you made for both internal and external DNS.
Also go through the below BUG ID.
CSCve56060
Thank you Nithin
The only thing we see in the event log is the following error below, although I did not think we need any services configured for _cuplogin?
edgeconfigprovisioning: Level="WARN" Detail="Service not found for edge config response" Service="_cuplogin" User="userid" UTCTime="TIME"
when we run a packet capture the only error we see is attached.
If I run a capture on selecting every parameter of the expressway-c ( and upload it to the cway Tools) I see the following error on the CSA Tac Tool, however, we cannot see any blocks by the firewall between the C & E.
Traversal XMPP connection failed to cause Jabber MRA login failure MRA
Related documentation:
Description
The connection from VCS-C to VCS-E on port 7400 failed to establish, this connection is used to reverse proxy XMPP traffic.
Action
Verify that VCS-E is listening on port 7400 and that traffic is allowed by the firewall
2021-03-16T11:56:37.212+00:00 uc-mraxpc-01 XCP_JABBERD[7937]: UTCTime="2021-03-16 11:56:37,212" ThreadID="140099653502720" Module="Jabber" Level="ERROR" CodeLocation="mio.c:1242" Detail="Unable to connect to host 'uc-imp-01.xyz.uk', port 7400:(111) Connection refused"
can you provide the below details.
Internal domain
External domain
Dual NIc or Single NIC
A record details created on internal DNS.
what you mean by _cisco-uds._ & _cisco-uds._tcp ?? AFAIK you need to create only cisco-uds._tcp and that not required for the latest versions of expressway.
uc-imp-01.xyz.uk is this CUCM or IMP ?
DNS entries for MRA
Dual domain with Dual NIC.
Example Configuration.
Internal Domain:- abc.local
External Domain:- abc.com
CUCM IP addresses:- 192.168.10.10 HostName :- cucm.abc.local
IM Presence address:- 192.168.10.11 HostName :- im.abc.local
Expressway C address :- 192.168.10.12 HostName :- express-c.abc.local
Expressway Internal NIC :- 192.168.10.13 HostName :-
Expressway DNZ NIC address :- 192.168.20.13 HostName :- express-e.abc.com
Expressway public IP:- 168.10.20.54
Internal DNS Entries
======================================================
A-record(Forward and Reverse):-
Domain:- abc.local
cucm.abc.local 192.168.10.10
im.abc.local 192.168.10.11
express-c.abc.local 192.168.10.12
Domain :- Create a subzone abc.com
express-e.abc.com 192.168.10.13(Internal NIC IP)
======================================================
Srv-Record
New versions of Expressway doesn't need below for C to discover CUCM.But required when jabber user logins internally.
======================================================
_cisco-uds._tcp.abc.local SRV service location:
priority = 6
weight = 30
port = 8443
svr hostname = cucm.abc.local
======================================================
Public DNS:-
A-record :-
======================================================
Domain:- abc.com
express-e.abc.com 168.10.20.54
======================================================
Srv-Record
======================================================
_collab-edge._tls.abc.com SRV service location:
priority = 3
weight = 7
port = 8443
svr hostname = express-e.abc.com
======================================================
_sips amd _sip are configured on public DNS.
Thanks, Nithin,
We are making progress, I can now log in using iPhone, Andriod, and Jabber on PC and get some services like corporate directory and enabling single number reach for example.
however,
the phone services are not working.
Did you tried login from internal network ?
The error which you face when turning on the TLS is due to certificate.
As @Nithin Eluvathingal wrote the error seen with TLS verification set to on is caused by issues with the verification of the certificate. There are a few things with this that commonly is the cause.
- The content of the SAN in the certificate does not include the name of the cluster and/or the Expressway nodes in the cluster.
- The FQDN name set on the traversal zone can not be found in the certificate.
- The FQDN name in traversal zone configuration cannot be resolved via name lookup in DNS.
- IP address is used for the “name” in zone configuration instead of FQDN.
- The names in the SAN can not be resolved in DNS.
- The CA certificates used to sign the server certificate is not uploaded into both C and E. If an internal CA is used for the C server certificate the root CA and if applicable intermediate certificates of the internal CA need to be also uploaded on the E apart from on C. The reverse is also true for E to C, however here the server certificate is for the most signed by a public CA. In either case the CA certificates needs to be present in the trust store on both C and E to form what in PKI is known as the the chain of trust.
Try collabedge validator on CSA tool and see if get any errors.
Also collects logs from jabber and use it on CSA tool.
If we turn on TLS we get this error?
With TLS on or off we get no errors when we capture a failed login the attempt and upload to CSA Tool it shows as clean no errors.
