Cisco MRA - Jabber Registration Rejected

[lj_tech]

Hi All,

I've been setting up Cisco MRA using Exp-E and Exp-C and a CUCM 11.5 in the inside. I have followed all the guides, both expressways are up, the traversal zone is up and running on both sides. I can succesfully register jabber when i'm inside the network but when i try the same from outside i get the following error:

tvcs: Event="Registration Rejected" Reason="Unknown domain" Service="SIP" Src-ip="91.73.59.27" Src-port="13701" Protocol="TCP" AOR="sip:CUCM” Contact="<sip:0746a691-dcad-9395-487e-10ac046f28aa@100.100.168.13:53570;user\=phone;transport\=tls>;+sip.instance\="<urn:uuid:00000000-0000-0000-0000-e4e6f72ba687>";+u.sip!devicename.ccm.cisco.com\="BOTTEST”;+u.sip!model.ccm.cisco.com\="575";+u.sip!mtpreferredmode.ccm.cisco.com\="voip";video;x-cisco-mra-ha\=AR_SK;x-cisco-reg-id\=2;+u.sip!userid.ccm.cisco.com\=“ADusername” Duration="720" Level="1" UTCTime="2022-02-24 14:45:35,769"

The error appears both on the Expressway-E and C. On the jabber client, i successfully discover the services from outside, i'm being prompted to enter my user and password for the phone services but then it never logs in. I'm trying this on a Jabber for Android but i have tried it on an iPhone as well with the same result.

I am using the same domain inside and outside, and that's how it is configured on both expressways, so i'm not sure why the error unknown domain.

I would appreciate your input if you've ran into this issue.

Thanks!

[b.winter]

Hi,

• What is your exact CUCM version?
• Are you able to login successfully internally?
• What is your external domain?
• To which FQDN does the SRV record resolve to?
  • Is this FQDN configured in the EXP-E under "System --> DNS"?
• What is your EXP version?
  • Keep in mind the following note for EXP version >= 14.0.2: The Certificate Authority (CA) that signed the Expressway-C certificate must be added to the tomcat-trust & CallManager-trust list of Cisco UCM, even if it is in non-secure mode, otherwise MRA services may be impacted.
• Have you also configured the Reverse pointer for EXP-E? EXP-C also needs to resolve the IP to the FQDN of EXP-E (lots of people forget this)
• Have you checked the PRT of Jabber?

You can take the Jabber PRT and the EXP logs and upload them to this page: https://cway.cisco.com/csa/

It's a Cisco tool, that analyzes the logs for you automatically and may provide solutions for different errors.

[lj_tech]

Hi and thanks for your reply.

Let me answer your questions and maybe give a bit more details:

• What is your exact CUCM version? - 11.5.1.21900-40
• Are you able to login successfully internally? - Yes, I can log in with no problem when i'm inside the network
• What is your external domain? - apollonet.ca
• To which FQDN does the SRV record resolve to? - expe.apollonet.ca
  
  • Is this FQDN configured in the EXP-E under "System --> DNS"? - Yes (see attached screenshot)
• What is your EXP version? - X12.7.1
• Have you also configured the Reverse pointer for EXP-E? EXP-C also needs to resolve the IP to the FQDN of EXP-E (lots of people forget this) - I can resolve both EXP-E and EXP-C.
• Have you checked the PRT of Jabber? - Yes, i did this and i'm attaching the output as the only problem i get is on the softphone registration side (Failed to register softphone to CUCM with error 408 Request Timeout.)

Thanks!

[b.winter]

The SRV Checker says, that the port 5222 (TCP/TLS) is closed.

But this port needs to be open.

Check out the firewall port usage guide of your expressway version:

 

[lj_tech]

Hi b.winter,

As far as i understand, 5222 is used for IM and Presence, which i do not use, and it is not essential for phone services and MRA.

I will get access to my lab tomorrow and i will open 5222 to check if that helps anyway.

Thanks.

[lj_tech]

Hi b.winter,

i just checked again the config and the guidelines for MRA. Port 5222 is only relevant for XMPP and we do not use IM and Presence, we only want to use Mobile Remote Access, so Phone Only mode. As i said in the initial message here, the traffic is going through all the way to both the publisher and subscriber, i'm able to authenticate but then the registration is rejected with this error of Unkonwn Domain.

I would appreciate any other tips anyone may have.

thanks,

[b.winter]

Have you already taken logs of EXP-C and -E and PRT of Jabber and tried to upload it also on the CSA?

How does your Jabber-xml look like? (maybe you can post it)

Which domain and how is it configured in the EXP-C?

[lj_tech]

Yes, i have and I'm a bit confused on how to read the issue but i'm attaching some screenshots for you to see. I've done these test using Jabber on Windows and it gives exactly the same error when I test with Jabber on Andriod.

This is from Exp-E:

The only errors i see are on the SIP registration part as you can see above.

And here's few screenshots from the analysis on the Exp-C logs with similar output:

As for the jabber-config.xml file i'm not sure where to find it but it looks like it's missing:

admin:file view tftp jabber-config.xml
jabber-config.xml: File not found

How do i create one? Isn't this in CUCM by default?

[Roger Kallberg]

It is not in CM by default. It’s a regular XML text file and you can use any regular text editor to create it. My personal preference would be Notepad++. The content of the file is very well documented in this document. Only include values that you have changed from default. For anything kept at default there is no need to include it. Tomorrow when I’ve got access to a CM I can provide you with a screenshot of the configuration we use, however it’s in CM 12.5 or 14 where it is possible to configure this in the webUI, but the settings as such are exactly the same, just in another format.

[Roger Kallberg]

Example of Jabber configuration for reference.

[lj_tech · Accepted solution]

Thanks Roger, i appreciate you sharing this.

I did though found the problem i had specifically and it had to do with the fact that on Exp-C under Configuration - Protocols, the SIP UDP and TCP modes were disabled. I turned both modes on and all Jabber clients are now registering with no problem.

Check the screen below:

Thank you all for giving me different suggestions and ideas for troubleshooting this issue.

[Roger Kallberg]

Glad to hear that you managed to solve it.

Likely you would not need to have UDP enabled for SIP as that should not be used for MRA. Please see this from one of our C nodes for reference.

[Roger Kallberg]

Please share your configuration of the domain in your Expw-C. For reference this is a screenshot of the same from one of our C's.

[lj_tech]

Here it is:

[Roger Kallberg]

Is the domain of the user that logs into Jabber in the initial login view the same as this domain?