VCS Expressway event log errors when Jabber for iPhone and Windows log in

[Ruslan Moldaliev]

hi folks,

I've deployed Collaboration Edge with VCS Control and Expressway:

my Jabber for iPhone succesfully can log in from Internet and it can IM but not calls and I see next messages in VCS Expressway when Jabber is logging in:

2015-03-27T18:00:28+02:00	tvcs: Event="Authentication Failed" Service="SIP" Src-ip="Client-in-the-Internet-IPaddress" Src-port="49543" Detail="No valid authentication" Protocol="TLS" Method="REGISTER" Level="1" UTCTime="2015-03-27 16:00:28,204"
2015-03-27T17:58:55+02:00	tvcs: Event="Authentication Failed" Service="SIP" Src-ip="Client-in-the-Internet-IPaddress" Src-port="49535" Detail="No valid authentication" Protocol="TLS" Method="REGISTER" Level="1" UTCTime="2015-03-27 15:58:55,786"
2015-03-27T17:58:32+02:00	tvcs: Event="Authentication Failed" Service="SIP" Src-ip="Client-in-the-Internet-IPaddress" Src-port="49527" Detail="No valid authentication" Protocol="TLS" Method="REGISTER" Level="1" UTCTime="2015-03-27 15:58:32,202"
2015-03-27T17:58:08+02:00	tvcs: Event="Inbound TLS Negotiation Error" Service="SIP" Src-ip="Client-in-the-Internet-IPaddress" Src-port="49512" Dst-ip="Expressway-IPaddress" Dst-port="5061" Detail="No SSL error available, probably remote disconnect" Protocol="TLS" Level="1" UTCTime="2015-03-27 15:58:08,582"

"Digest User" in the "Protocol Specific Information" section of Phone Configuration selected right user. in this Jabber I see following error "Failed to get device configuration". however Jabber for Windows and for Android hasn't such issues - they succesfully can log in from Internet and it can do calls and IM but I see next messages in VCS Expressway when Jabber is logging in. The same log line appears when Jabber for Android log in:

tvcs: Event="Inbound TLS Negotiation Error" Service="SIP" Src-ip="Client-in-the-Internet-IPaddress" Src-port="56751" Dst-ip="Expressway-IPaddress" Dst-port="5061" Detail="No SSL error available, probably remote disconnect" Protocol="TLS" Level="1" UTCTime="2015-03-27 14:19:11,769"

and I can't find any information which describe such types of error.

thanks!

[mkbarry89]

Hi Ruslan,

Were you able to resolve this issue? I am currently running into the same problem and can't seem to find any information on it either. It works on windows but when I try and connect to my phone services on the iphone it doesn't work.

Thanks,

Mike

[Ruslan Moldaliev]

hi,

unfortunately no, there is a little information in the Internet regarding this error. I still haven't resolve this issue.

but since then I have done many reconfigurations and somehow Jabber for Iphone sometimes can connect phone services and I can't find out pattern of this behavior:).

as far as I remeber, major changes were updating CUCM and CUP from 10.5.1 to 10.5.2 and maybe migration of VCS to Expressway.

if you find out the truth, let me know please.

[kelvinffhan]

Hi Ruslan,

Do you have any luck to resolve the issue as I am hitting the same issue as well. Is this certificate related issue? Looking forward your reply, Thanks.

[johannes.wendling]

Hi,

I had the same problem.

In my case, the problem was caused by the Expressway E certificate.

It had the role Basic Constraint: "Subject Type=CA" assigned.

After signing a new CSR with End Entity role, the problem was fixed.

I can recommend to open a TAC case, my TAC engineer found the certificate error within minutes.

Johannes

[Ruslan Moldaliev]

hi,

great news!

unfortunately I don't have opportunity to test this solution now.

kelvinffhan  I would appreciate if you reported back whether it solved your issue or no.

thanks in advance!

[ebogutskyi]

Hi Ruslan,

I have the same kind of problem: I cannot login to Phone Services from jabber on internet. And I'm getting same errors in log.

Did you find a solution? Certificate seems to be right.

[Ruslan Moldaliev]

hi,

seems like I've dealt with the issue but it was really long ago and unfortunately I don't remember details. sorry.

have you tried solution suggested above?

[ebogutskyi]

Hi Ruslan,

We are using self-signed certificates for now, will check that as soon as certificates will be signed. But I tried so many variations of settings, so now I'm not sure could it be so obvious issue like certificate. I have a NAT reflection through Sonicwall and I'm not sure is it translating everything properly. Anyways, I opened SR and hope Cisco guys will figure that out.

Thanks for quick respond!