CUCM - LDAP Problem

[jotaanne]

Hello Guys,

We have a CUCM Cluster with Version 12.0.1.22900-11 and We are having problems synchronizing our AD with our CUCM. I tried to sync and it supposedly syncs immediately but in reality it is not syncing.

I send the log file here so someone can try to help.

I already trying stop and started DIRSYNC and still doesn´t work.

[Maren Mahoney]

You may have hit the bug CSCuz91655. Your version of CUCM is not on the "fixed in version" list. Check with TAC.

Exception while performing sync using secure port in LDAP directory page - https://bst.cisco.com/bugsearch/bug/CSCuz91655

Unfortunately, the fix seems to be upgrade or disable secure LDAP.

Maren

[jotaanne]

Thank u for the fast Reply Maren,

Is there a way to only disable secure LDAP for Call Manager? We only work with secure LDAP, so i need a way to just have the Call Manager without secure LDAP or another solution without upgrading the CUCM or disable secure LDAP if exists.

[Maren Mahoney]

If you mean is there a way for MS-AD to selectively allow non-secure LDAP connections, I don't know. Someone else here may know, but you may have better luck posting that query in a Microsoft forum.

I would check with TAC first, regardless, in case my analysis is incorrect.

Maren

[Vaijanath Sonvane]

Hi @jotaanne,

Was this setup working before? Are there any changes made to the environment that broke the synchronization?

[jotaanne]

Yes it worked! I really don't know. I only know that we started using Secure LDAP in our AD and TLS v1.3.

[Vaijanath Sonvane]

Hi @jotaanne,

CUCM 12.0 supports TLS 1.0, TLS 1.1, and TLS 1.2.

TLS version 1.3 is only supported in CUCM Release 15SU2 Onwards.

In this case you have three options:

1. Update your LDAP to allow earlier TLS versions
2. Update your LDAP to allow non secure connection from CUCM
3. Upgrade you CUCM to 15SU2

[jotaanne]

Sorry for the misunderstanding. I went to talk to those responsible for our LDAP and they say they are using TLS v1.2 or higher. So, that's supposedly not the problem. IDK

[Edward Lau]

Have you confirmed the certificates of the LDAP server(s) are trusted by the UCM (tomcat-trust)?

[jotaanne]

Yes and they are.