MRA login over Expressway-E is failing

[yare]

I setup a expressway C and E, I am trying to Login a MRA over expressway E and C but receiving this message from 

Collaboration Solutions Analyzer, SRV Checker

MRA login over Expressway-E xx.xxx.xxx.xxx will fail because neither the top level domain xxxxx.co.uk nor the subdomain collab-edge.xxxxx.co.uk is found in the SSL certificate SAN field.

Action plan

Create an SSL certificate with either the top level domain xxxxxx.co.uk or the subdomain collab-edge.xxxxxx.co.uk in the SAN field and upload it to the Expressway-E xx.xxx.xxx.xxx.

[Roger Kallberg]

So what is your actual issue? It’s pretty clear in the output of the test with CSA what is at fault. Have you updated your certificate to include what is listed as needed in the output from CSA?

[yare]

The actual issue is that I cannot log in to MRA Jabber. This is the error message that I am receiving: 'Cannot communicate with the server. Reset Cisco Jabber to continue.'

My Expressway E certificate is signed by an internal Windows CA. When I generated the CSR from Expressway E, the Subject name was set to expe1.xxxxx.xo.uk. However, I am not sure where or how to edit the SAN field and add additional subject names

[Roger Kallberg]

You do it on the E where you create the CSR. Using an internal CA is not recommended for the E.

[b.winter]

I think, the fields in the CSR generation page in Expressway is very clear about that:

Recommended reading lecture for a rainy day: Expressway administration guide or certification guide.

 

[yare]

Many thanks gents,  I will try to edit the CSR and generate a new certificate for Expressway E and see if that resolve the issue. I will update you later.

[yare]

The certificate issue is resolved but still can not login MRA. " Cannot communicate with the server"

I can see a different error message on CSA under user login tab "Failed to retrieve user's home cluster."

[Roger Kallberg]

2 questions. #1 have you defined the CM(s) in the C?, #2 does the user that you try to login with have home cluster set on the end user object?

[yare]

yes, the user that I am trying to login with has:

Home Cluster

Enable User for Unified CM IM and Presence (Configure IM and Presence in the associated UC Service Profile)

Secondly CUCM cluster addresses are defined on the Expressway C under configuration>Unified Communications>Unified CM Servers

[Nithin Eluvathingal]

Are these user able to use jabber internally ? Did this worked ?

Second, refresh the CUCM nodes from Expressway C.

2.12.0.0

[yare]

the user can login locally but still getting MRA communication error to the server.

a quick question, on the Expressway C, do I need to add only publisher or both publisher and subscriber as CM servers?

[b.winter]

Subscribers are added automatically.
Do you also have IM&P? If yes, you also need to add the IM&P-Pub in EXP-C. And furthermore, you need to open the port 5222 in the FW as also shown in the screenshot you provided.

[yare]

2023-05-11T14:46:27.883+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="POST" Request="https://imp.xxxxx.co.uk:8443/EPASSoap/service/v80" Rule="https://imp.xxxxxx.co.uk:8443/EPASSoap/service/v80" Match="exact" Type="Automatically generated rule for CUPS server" UTCTime="2023-05-11 13:46:27,883"
2023-05-11T14:46:27.795+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="POST" Request="https://imp.xxxxx.co.uk:8443/EPASSoap/service/v80" Rule="https://imp.xxxxxx.co.uk:8443/EPASSoap/service/v80" Match="exact" Type="Automatically generated rule for CUPS server" UTCTime="2023-05-11 13:46:27,795"
2023-05-11T14:46:27.684+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="GET" Request="https://cucmsub01.xxxxx.co.uk:8443/cucm-uds/version" Rule="https://cucmsub01.xxxxx.co.uk:8443/cucm-uds/version" Match="exact" Type="Automatically generated rule for CUCM server" UTCTime="2023-05-11 13:46:27,684"
2023-05-11T14:46:27.631+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="GET" Request="https://cucmpub.xxxxx.co.uk:8443/cucm-uds/version" Rule="https://cucmpub.xxxxxx.co.uk:8443/cucm-uds/version" Match="exact" Type="Automatically generated rule for CUCM server" UTCTime="2023-05-11 13:46:27,631"

[Roger Kallberg]

---

@yare wrote:

2023-05-11T14:46:27.883+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="POST" Request="https://imp.xxxxx.co.uk:8443/EPASSoap/service/v80" Rule="https://imp.xxxxxx.co.uk:8443/EPASSoap/service/v80" Match="exact" Type="Automatically generated rule for CUPS server" UTCTime="2023-05-11 13:46:27,883"
2023-05-11T14:46:27.795+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="POST" Request="https://imp.xxxxx.co.uk:8443/EPASSoap/service/v80" Rule="https://imp.xxxxxx.co.uk:8443/EPASSoap/service/v80" Match="exact" Type="Automatically generated rule for CUPS server" UTCTime="2023-05-11 13:46:27,795"
2023-05-11T14:46:27.684+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="GET" Request="https://cucmsub01.xxxxx.co.uk:8443/cucm-uds/version" Rule="https://cucmsub01.xxxxx.co.uk:8443/cucm-uds/version" Match="exact" Type="Automatically generated rule for CUCM server" UTCTime="2023-05-11 13:46:27,684"
2023-05-11T14:46:27.631+01:00	traffic_server[7237]: Event="Request Allowed" Detail="Access allowed" Reason="In allow list" Username="jsmith" Deployment="1" Method="GET" Request="https://cucmpub.xxxxx.co.uk:8443/cucm-uds/version" Rule="https://cucmpub.xxxxxx.co.uk:8443/cucm-uds/version" Match="exact" Type="Automatically generated rule for CUCM server" UTCTime="2023-05-11 13:46:27,631"

---

Not sure what you're intent is with your last post. Can you please elaborate?

[yare]

I meant to show expressway C is communicating  to IM&P and CUCM and authenticating the MRA user.

I re-added cucm publisher/subscriber and IMP servers into the Expressway C. However the login issue is still same error message