MRA issue with new phone model

[PatWruk]

We're currently testing out a new model of phone (9861) to allow for Wifi connectivity instead of wired due to some of our locations horrible wiring setup. Our current setup for remote locations is to use MRA for the phones, and that is working using 7841s. The problem we're running into now is we cannot get the 9861 to authenticate using MRA, after entering the activation code it just sits at 'Activating'.

If we go into settings -> Issues and diagnostics -> Issues, on the phone. It shows 2 issues: No password provided, and Resync failed. For the resync failed error in there it shows 3 errors, all the same, "Prov 1 Resync Failed. Reason: Error - Empty file"

Looking at our Expressway-Es we also can't see a connection coming from the public IP of the phone that matches the timeframe of the connections.

We configured the phones almost exactly like the other phones we currently have with some tweaks for model specifics. Wired not using MRA the phones work fine, we just can't get them to use MRA

The phones shipped with firmware PHONEOS.3-1-1 and we tried to upgrade to PHONEOS.3-4-1

Any ideas on what to try next?

[Maren Mahoney]

Looking at our Expressway-Es we also can't see a connection coming from the public IP of the phone that matches the timeframe of the connections.

---

This is the first thing to solve. Check the DNS settings for the phone. If you have a laptop on the same subnet, can you ping the FQDN of your Expressway-E? What does nslookup show you when you try to resolve the FQDN? If you don't have a laptop, you can still use nslookup and set it to the DNS server that is the same as the one on the phone.

If the FQDN of the Expressway-E resolves from the perspective of the phone, your next step would be to trace the traffic coming from the phone to the Expressway. Is there a firewall or other device blocking the traffic?

It occurs to me, too, that this model has both an Enterprise and an MPP version (CUCM vs Webex). Do you have the Enterprise version of the phone? (Nevermind.....Cisco did the flexible OS with this model that supports both. My bad.)

Let us know what you find and we can go from there.

Maren

[PatWruk]

I hooked up a laptop in the same vlan and was able to resolve the dns. I then wired the phone in the same vlan which won't allow registration without MRA and tried to register while doing a packet capture from the switch. I can see communication between the 9861 and our Expressway-E that ends with a reset from the Expressway then a few retransmissions from the phone with no response from the Expressway. I then hooked up a 7841 and did the same capture and there is a lot more traffic and it does register over MRA.

Looking at our firewall, I'm not seeing anything being blocked and I can see the traffic there.

[Maren Mahoney]

Okay. So I'm reading that the 9861 you're having trouble with is now seen on the Expressway-E logs. This is good news, as this means the issue will be on the configuration side and not the Internet side.

Do you see communications regarding that phone on the Expressway-C? 

Can you post the packet capture when the phone tried to register so we can see what the phone is being told?

Maren

[PatWruk]

Here is the packet capture, I'm currently grabbing a log from the Expressway-C to see if i can see anything special there

[PatWruk]

I'm not finding anything special in the logs for Expressway-C or E that would point to that phone. Not that I'm that great at reading these logs. I connected the 9861 to my cell phone to get a unique IP from everything else we have connected and looking at that packet capture it looks the same. The main difference is after hitting activate, it says activating for about 5 seconds then says "Reboot the phone or contact your administrator". So I'm guessing there is something on the network causing issues, but also a configuration issue in Expressway/CUCM.

[PatWruk]

I ended up opening a case with TAC, it turns out it was a missing certificate issue. Not 100% sure of the why it effects those phones and not the 78XX, but adding those to expressway-e fixed it.

[Roger Kallberg]

if you could provide a little more context on the missing certificate it would be helpful for others that ends up in the same situation as you and find this thread by searching.