Cisco Expressway Jabber MRA "cannot connect to cisco unified communication manager"

[Daniov1]

Hello.

In my eviroment I have Expressway for MRA

Internet>>EXP-E>>EXP-C>>Cisco UC servers

All the users in the organization trying to connect to jabber by MRA.

After the user logged in to Jabber for mobile(I see in CUCM the device is in Register mode)

In the mobile the UCServices write "Cannot connect to Cisco Unified Communication Manager Server, Check your network setting".

The firewall isnt blocking ports.

The status in unified communication is active, The traversal zone is active and the cucm as well.

Inside my organization(Lan) the jabber is working well.

I have cheked the firewall,Configuration on EXP-C and EXP-E.
I have tried to collect logs from EXP-C while login capture and I saw there is a problem between EXP-C and CUCM in port range 350101 - 350353 ( their is no firewall between of them).

[Daniov1]

Hello.

In my eviroment I have Expressway for MRA

Internet>>EXP-E>>EXP-C>>Cisco UC servers

All the users in the organization trying to connect to jabber by MRA.

After the user logged in to Jabber for mobile(I see in CUCM the device is in Register mode)

In the mobile the UCServices write "Cannot connect to Cisco Unified Communication Manager Server, Check your network setting".

The firewall isnt blocking ports.

The status in unified communication is active, The traversal zone is active and the cucm as well.

Inside my organization(Lan) the jabber is working well.

I have cheked the firewall,Configuration on EXP-C and EXP-E.
I have tried to collect logs from EXP-C while login capture and I saw there is a problem between EXP-C and CUCM in port range 350101 - 350353 ( their is no firewall between of them).

[ositechintl]

Hi,

I too have the same problem.

Did it resolved? 

[Daniov1 · Accepted solution]

Hi

Yes I solved it.

Their was FW issue , Check that the FW get the SIP TLS 5061 from the Internet interface(Eth0 for example) and that the traffic going to the DMZ Interface(Eth1 for example).

In my issue the Traffic arrive to Eth0 but not arrive to Eth1 and i didn't see any drop.

TLS 5061 inspection must be disabled In Check Point Firewall (Some version of Checkpoint have BUG: Inspection can be configured on another rule of 5061 but anyway it’s influencing on all rules with 5061 port in FW).

Daniel.