Security on Jabber in 3G network

[AlexandreOppermann]

Remote Jabber !

We implemented the expressway cisco to use the remote jabber, but when we are in the 3G network in the security jabber does not work. Any solution ?

//No CUCM

System - Security - Phone Security Profile

No CUCM the setting on the phone is:

Thanks.

[Jaime Valencia]

MRA is already secure between the endpoint and EXP-E, if you want encryption all the way back to CUCM, you would need to configure mixed mode in CUCM.

[AlexandreOppermann]

NO CUCM is already configured mixed mode. But does not work for iPhone using 3G network. Above I edited some settings made on the phone and also on CUCM. What settings are held in CUCM?

[AlexandreOppermann]

Any news ?

[bernhardczapp]

Your configuration isn't correct.

You have to use phone security profile names which look like FQDNs and are within the SAN of ExpresswayC. You can find more information in the configuration guides!

[AlexandreOppermann]

I'm not getting that connections are encrypted using the jabber calling from an iPhone for a desktop extension using the 3G network.

 On the internal network works in 3G not. We set the Expressway that structure. We tested with multiple users on the 3G network and internally.

Some Information:

- We Changed the name for the phone security profile in order to use FQDN format.

- We add the phone security profile name to the Exp C certificate SAN.

- The CUCM using security cluster how mixed mode, 

- IM&P service is working. Only with iphone happen this problem.

- We add the phone security profile name to the Exp C certificate SAN.

- I use jabber version 11.5.1  for iphone, for android and for desktop.

Follow the errors that happen in my iphone:   (phone service does not work.)

//CUCM In the phone I did some changes

What is the sollution ?

[bernhardczapp]

I had a similar problem. In my case ExpresswayC didn't trust the sips certificate of the cucm servers.

You can check this in the diagnostic logs of expressway c.

If ExpresswayC isn't able to verify the sip tls certificate it won't connect. In this case uploading (appending) the callmanager certificates to expressway c trusted ca certificates will help.