Jabber MRA Login Issues

[Dave07]

 Dear All,

I have a new setup of CUCM,IMAP,CUC, Expressway C and E servers respectively. Jabber for andriod and desktop users are created on the CUCM and sync with the IMAP server. This works internally perfectly. However, while trying to login via MRA, i keep getting different errors from " unable to communicate with server, failed to start a new session". I can confirm that certficates have been exchanged properly between EXP C & E successfully and all services have been added. i.e" _collabe-edge._tls.domain.com. cisco_uds  and every other service required has been added on the DNS externally and internally. Howvever Jabber still failes to login via MRA. i am running version CUCM,IMAP & Jabber 12.0 as well as EXP C & E X8.10.1..

Please i need Help urgently.

[Jonathan Schulenberg]

Only one DNS SRV record or the other must resolve: _cisco-uds on the internal network and _collab-edge on the public internet. Make sure only one record or the other works depending which side of the firewall you’re on.

[Dave07]

@Jonathan Schulenberg what i have configured is for  _cisco-uds on the internal DNS  and _collab-edge on the public DNS. Are you saying i only need to configure one only?? I have a firewall between internal and external DNS.

[xeran]

As far as SRV records go, _cuplogin and _cisco-uds entries should be configured in internal DNS while _collab-edge should be configured for external DNS, as you said. Most likely explanation is probably ports. Can Expy C communicate with CUCM and IM&P over all the required ports? Another way of asking this might be: is Expy C in the same subnet as CUCM and IM&P? Security seems to bite us constantly...

[Dave07]

@xeran CUCM,IMAP,CUC,EXP-C AND EXP-E LAN1 are all within thesame subnet. Expressway C can communicate with all servers and even has a traversal zone with expressway-E successfully. The issue occurs once i try logging out the office.i.e MRA. Any ideas?

[Jonathan Schulenberg]

Expressway-E belongs in the DMZ, not the internal network. That’s the entire point of the product.

Also, are you using the dual NIC configuration on Exp-E? You should be but if not, be sure to read the part about NAT reflection carefully:

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-11/Mobile-Remote-Access-via-Expressway-Deployment-Guide-X8-11-4.pdf

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-11/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment-Guide-X8-11-1.pdf

[Dave07]

@Jonathan Schulenberg Many Thanks for this Links and your prompt response.

I am currently running a Dual NIC with the second interface LAN2: Statically Natted to the Public IP Address of the Expressway-E. I initially tried passing the traffic through the firewall with all the required ports opened and natting done correctly on the firewall. I have now tried to connect the Public IP of expressway-e to my ISP Modem with static nat on exp-e TURNED OFF. Even with this I am still unable to login via MRA.

I have followed through the documentation from cisco thoroughly but am still stuck. Any Ideas would be help?

[Flo.Matalis]

Hi Dave,

While waiting for Jonathan's reply, you may check this online troubleshooting tool to check from your end.

https://cway.cisco.com/csa/

CollabEdge validator helps deploy and troubleshoot Mobile and Remote Access feature. It simulates a Jabber login towards your Unified Communications Manager and IM & Presence servers through the Expressway-Edge. Each step in the process is evaluated and if an issue is found, details about the issue along with a corrective action plan are displayed.

[Jonathan Schulenberg · Accepted solution]

There's a lot going on here so it's difficult to give you specific steps to follow in the blind. The general next step I would take is to start looking at logs: Jabber PRT, Expressway-E, then Expressway-C.

[amatine52]

Dave, what was the root cause of this issue you had with Jabber.I am very curious, because what you have described is exactly happening to one of our customers. If you can shed some light on the exact resolution that would be greatly appreciated.