Limiting Expressway MRA access for Jabber

[Randall White]

Is there a way to prevent certain Jabber users from accessing Expressway from off-net (MRA)?

I have a certain group of users that are allowed to use Jabber IM/Chat while on-net, but should not be able to log in from off-net.

There is another group of users that are allowed to use Jabber Chat and Softphone (CSF/TCT/BOT devices) while off-net via MRA.

I tried to set the REMOTEACCESS switch in the jabber-config.xml file to OFF. This stopped the Jabber Phone services, but users could still send IM/Chat messages.

I am running Expressway/MRA X8.7 with CUCM 11.0, and IM&P is on premises.

Thanks, Randy

[Jaime Valencia]

No

http://docwiki.cisco.com/wiki/TelePresence_FAQ#Can_I_limit_user_access_via_MRA_to_just_certain_users_.2F_groups.3F.3F

[Shashank Mahajan]

Currently this functionality/feature does not exist for the Collaboration Edge solution. Enhancement requests CSCus94318 and CSCux35528 are already filed for this feature.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCus94318
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCux35528

You can try one of the following workarounds:

• By default RemoteAccess parameter in JabberConfig.xml is set to ON. So either set it to OFF globally via jabber-config.xml and then apply group config to those who need it or (if only few users need to be restricted) just set it to OFF to selected devices via group config file. One thing worth mentioning is that for this parameter to work config files must be downloaded first so if the RemoteAccess is set ON globally - first (external) login would still work, but then additional group config would be downloaded and subsequent logins wouldn't work. If they would login internally first then first external login wouldn't work.

• If you are using a single domain then there is no way to restrict the access. In the case of multiple Domain, you can make one Domain only for internal and have that Domain assigned to users you want to restrict connect from outside. For other users you can assign separate domain which should allow access for users from outside. If you have single domain, currently Expressway does not have any method to differentiate users accessibility as all users will be using same Domain.

[Randall White]

Thank you. Do you know if this feature is currently on a road map?

I tried changing the RemoteAccess parameter, but it didn't prevent Jabber IM access. I will ask if the customer is interested in changing Domains, but I don't think that is possible.

[Jaime Valencia]

Shashank already provided the relevant bugs, and using the RemoteAccess parameter is no longer supported

Remove RemoteAccess from Jabber Configuration Parameters guide

CSCuy21990

That was only meant to be used in the very beginnings of MRA back with Jabber 9.6 and 9.7

[ryankaplan]

I assume if it cant be done use .xml on Jabber, then a way to prevent it on hardphones is not an option at this moment.

Much like a Phone VPN profile was allowed for Annyconnect, there is not control once Expressway is provisioned to prevent phones from leaving the company and attempting to use MRA

[Jaime Valencia]

Correct, with Jabber there are a few options, and 12.0 now is introducing a way to control Jabber MRA access, not available yet, but it's going to be available in the future.

For phones, there is no way to prevent phones from using MRA, aside from using a public CA that is not listed as supported for MRA, but if you need just some phones to use MRA, and some others not, no way to do that.

[DOM.RF NOC]

Hi!

May be it is possible to limit access by using SSO for external authentication?

[Jaime Valencia]

CUCM and Jabber 12.0 will provide the ability to configure if a user can use full UC, IM only or no Jabber over MRA.

But yes, the previous solution would be to use external SSO to deny the access over MRA and only allow it internally.

[Yasoda Palachulla]

So now the Jabber 12.0 is released. Can we restricted Specific users using Jabber over MRA?

[Jaime Valencia]

Yes, you need both, CUCM and Jabber 12.x, I suggest using the latest releases of each.

[Nathan Grovhoug]

Edited: 

For those looking for the documentation 

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/12_0_1/systemConfig/cucm_b_system-configuration-guide-1201/cucm_b_system-configuration-guide-1201_chapter_01011010.html#task_F3E0C536FD10B3E92C338CF12BB33721

Thanks