jabber client inside network: you cannot access outside of your corporate network

[jaheshkhan]

Our client facing issue while login to jabber iphone client inside LAN network. The error message is as follows:
"you cannot access outside of your corporate network"

What could be the reason..

The issue is not for all users only for certain amount of users.

From the same iphone jabber client they cannot login with different account as well. They reset the client and tried. they uninstalled the jabber client and installed it back and then tried. but it all ended with same error message.

[Jaime Valencia]

I'd start by reviewing a PRT and checking all the DNS/SRVs and necessary ports are working properly.

[jaheshkhan]

If that's so why it's not impacting all. It's happening only for some. That too for mobile client..

Cucm and imp versions are 11.5 SU8

[Roger Kallberg]

This is where the PRT from the affected clients is of interest. In this you likely can find the information for the cause of this.

Maybe not the magic bullet you look for as it would require you to do the work of digging through the log files in the PRT.

[Nithin Eluvathingal]

check if the mobile users DNS is able to resolve the SRV record. change the DNS on mobile device and see if it resolve the issue. because I faced similar issue with one of our ISP in this region. changing the DNS to 8.8.8.8, they where able to login. 

[jaheshkhan]

But they told me they are facing this issue for internal network as well. that too same iPhone users...i already told them to get PRT.. waiting to get collected.

[Shalid Kurunnan Chalil]

Hi,

may be the WiFi doesnt resolving the internal DNS query and/or resolving the collab edge.

just a thought, could you please look at the MRA policy on the call manager and see if the affected users assigned to different policy than the working user.

User Profile on the end user page.

See the MRA policy on the User Management >> USer Settings >> User Profile

Mobile and Remote Access Policy

[jaheshkhan]

Thanx .. but I already mentioned this problem happening internal lan. So how come mra come into picture. I think this is happening bcoz of some DNS issue it seems.. they are monitoring issue to happen again 

[Shalid Kurunnan Chalil]

OK. Understood.

I have seen in many customers their Wi-Fi setup are bit different than the internal LAN network. I believe the Iphone connected via Wi-Fi.

If the Jabber on iPhone unable to resolve the cisco uds srv record, and if it resolving collab edge and you have MRA policy to block the jabber access, then the error present on JAbber is "Sign in from your corporate network".

But again as others mentioned, Jabber PRT will tell it. if you can run the Jabber prt logs  on https://cway.cisco.com/csa. it gives you the DNS query result and possible reason for the error. 

Apologies if i misunderstood your issue.

Regards,

[jaheshkhan]

how can we get logs if they are not even able to login to jabber??? 

[Nithin Eluvathingal]

If it’s over MRA take logs from expressway c and e. You can refer below document 

https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway/213360-collect-expressway-vcs-diagnostic-log-fo.html

for video refer below

https://video.cisco.com/video/5810050375001

[Roger Kallberg]

You don’t need to be able to login to create PRT from a Jabber client.

[jaheshkhan · Accepted solution]

WE found jabber user in subscriber only facing this issue. 

Restarted IMP Publisher first then IMP Subscriber . Then we found HA in presence residency group ended in failover status. Clicked failover button for publisher and subscriber and both server ended up normal status.

then user is able to login to server without any issue

[BalajiSivaraj49175]

To enable MRA need to use the following procedure,

[BalajiSivaraj49175]

Jabber users, the MRA access policy that you configured must be associated to your Cisco Jabber users during the LDAP sync. For information on how to provision end users, see the End User Configuration.