SX20 via MRA secure profile

[balmain99]

Hello,

Is it a requirement to have SX20 registered in Callmanager with secure profile first before before moving it outside with MRA?

[Jaime Valencia · Accepted solution]

The secure profiles are only required if you are using mixed mode and want secure communication as well when using MRA, if not, you'll only secure communication between the endpont and EXP-E, and internally it will be just SIP and RTP.

[nuinoahmed]

Hi Jaime,

I have probably same question as balmain99.  Your explanation above is clear but what I want also to clarify is if I have an out of the box SX20.  Can I just configure it via MRA and use Secure profile with no need to first register the endpoint to CUCM (Not via MRA) with secure profile.  Once this is successful you can only then register it via MRA with secure profile?  Thanks in advance.

[Jaime Valencia]

I have not tried that scenario of trying to use secure profiles with an out of the box device, it *might* work as it should receive the device config via MRA, but I'm not 100% sure.

If it doesn't work, I'd probably try without a secure profile, then try to apply the secure profile once the device has been registered, and then attempt again a new MRA registration.

[balmain99]

Hello Jamie,

Thanks for your previous answer, it cleared things.

Now, if I may, I have MRA in my infrastructure working with Jabber without a problem.

When trying the out-of-the-box SX20 outside (after having registered it internally) I get a certificate error.

I am not using a security profile. The certificate authority is Verisign and it is already contained in the CAs of the SX20.

What could be the problem ?

[nuinoahmed]

Hello Balmain99

Does your Expressway E certificate contain you SIP domain in the SAN?