Expressway 8.9.1 - IM&P Federation With Microsoft-based Organizations Skype for Business

[ciscodrew]

Has anyone set this up successfully yet?

I have followed the brief config included in the doc starting on page 53, but I am not having much luck.

See attached Doc S4BFED.pdf for config that works.

[ciscodrew]

Can you send a screen shot of what you have configured under service parameters for the CUPs Public FQDN?

[j.house]

Here are the details you asked about.  thanks!

[ciscodrew]

for your search rule can you change to include "@"  in the beginning.

.*@hostname_IMP..........

[ruudvanstrijp]

j.house, did you also change the Peer Auth listener from 5061 to 5062? By default it's 5061 and Server Auth is 5062, but this needs to be switched for Federation with SfB to work.

Also, did you add the Exp-C and Exp-E as TLS Peer Subjects to the Peer Auth TLS Contect configuration in IM&P?

By the way, my Search Rule regex is in the same format as yours. I have the rule set up as 'Stop' on successful match.

[j.house]

I will check, on the ports...for the search rule I will change to stop...but yours is configured with the .*@?

thanks

[ruudvanstrijp]

Mine is configured without the .*@, see attached. But who knows, perhaps it works :)

[j.house]

After spending time with TAC it appears that I am getting a malformed packet error on the subscribe coming from Skype.  our return packet is malformed (see below).  IM&P is replying with the malformed route (example is bolded below).  I can see the skype presence in Jabber, but they cannot see my presence.

SIPMSG:
 |SUBSCRIBE sip:andrew.maxxxxxx@xxxxxx.com SIP/2.0
 Via: SIP/2.0/TLS 192.168.47.87:49408;branch=z9hG4bK9B369626.65E5A48A34611B0A;branched=FALSE;ms-internal-info="akWFFpZoo_sSNszNJjmOc04iLCNhEcDxexB6l11zTJFBOKpOVlBlhWTQAA"
 Via: SIP/2.0/TLS 192.168.47.88:54539;branch=z9hG4bK7702DE6C.DC261E106FED4B1A;branched=FALSE;ms-received-port=54539;ms-received-cid=28000
 Via: SIP/2.0/TLS 192.168.47.45:54203;ms-received-port=54203;ms-received-cid=CE600
 Call-ID: 9ac4e6c1a5f24458ba7f8dce55488ab9
 CSeq: 1 SUBSCRIBE
 Contact: <sip:jason@xxxxxx.com;opaque=user:epid:WMHcWPNxU1u7BMBWp1q_IQAA;gruu>
 From: "Jason xxxxxx" <sip:jason@xxxxxx.com>;tag=d0b4be2702;epid=859946f395
 To: <sip:andrew.maxxxxxx@xxxxxx>
 Max-Forwards: 68
 Record-Route: <sip:sip.xxxxxx.com:5061;transport=tls;epid=859946f395;lr>;tag=BA669EA55F6221DBA477A306CFA8282C
 User-Agent: UCCAPI/16.0.4510.1000 OC/16.0.4510.1000 (Skype for Business)
 Supported: com.microsoft.autoextend
 Supported: ms-piggyback-first-notify
 Event: presence
 Accept: application/msrtc-event-categories+xml,application/xpidf+xml,text/xml+msrtc.pidf,application/pidf+xml,application/rlmi+xml,multipart/related
 ms-asserted-verification-level: ms-source-verified-user=verified
 Content-Type: application/msrtc-adrl-categorylist+xml
 Content-Length: 475
 
 2017-04-05T12:47:42.872-04:00 UCCOLLABEDGE01 tvcs: UTCTime="2017-04-05 16:47:42,872" Module="network.sip" Level="INFO":  Action="Sent" Local-ip="174.xxxxxx.187" Local-port="5061" Dst-ip="108.93.245.145" Dst-port="52178" Detail="Sending Request Method=NOTIFY, CSeq=1, Request-URI=sip:jason@xxxxxx.com;opaque=user:epid:WMHcWPNxU1u7BMBWp1q_IQAA;gruu, Call-ID=9ac4e6c1a5f24458ba7f8dce55488ab9, From-Tag=eaa695b0-d1d1800a-13d8-45026-58e51fae-567f1527-58e51fae, To-Tag=d0b4be2702, Msg-Hash=3958071402052353361"
2017-04-05T12:47:42.872-04:00 UCCOLLABEDGE01 tvcs: UTCTime="2017-04-05 16:47:42,872" Module="network.sip" Level="DEBUG":  Action="Sent" Local-ip="174.xxxxxx.187" Local-port="5061" Dst-ip="108.93.245.145" Dst-port="52178" Msg-Hash="3958071402052353361"
 SIPMSG:
 |NOTIFY sip:jason@xxxxxx.com;opaque=user:epid:WMHcWPNxU1u7BMBWp1q_IQAA;gruu SIP/2.0
 Via: SIP/2.0/TLS 174.xxxxxx.187:5061;egress-zone=DefaultZone;branch=z9hG4bK062418431dc1f1fe462db772d900ddcf1730791.df9f521bfbfa85d59ff84add17f05423;proxy-call-id=e001665c-cd3d-4db5-9d80-591c944aaa16;rport,SIP/2.0/TLS 10.xxxxxx.187:5061;egress-zone=IMPTraversal;branch=z9hG4bKdf081152ab11025c33d3048b57d1d07c2300434.eac934b78f1da9669b0af73e29ee32ab;proxy-call-id=c50e0828-1908-4c5a-b21e-cf9dc6227521;received=10.xxxxxx.187;rport=26238;ingress-zone=TraversalIMP,SIP/2.0/TLS 10.129.209.209:5061;branch=z9hG4bK729ae69b-935fc789-cd7c8f33-52737151-1;received=10.129.209.209;ingress-zone=svrohcups1,SIP/2.0/TCP 10.xxxxxx.209:5060;received=10.xxxxxx.209;branch=z9hG4bKf352c2ab-48365432-5312151c-f580a9a2-1,SIP/2.0/TCP 10.xxxxxx.209:5080;received=10.xxxxxx.209;branch=z9hG4bK-58e51fae-3f03c077-6d0e8e35
 Call-ID: 9ac4e6c1a5f24458ba7f8dce55488ab9
 CSeq: 1 NOTIFY
 Contact: <sip:10.xxxxxx.209:5080;transport=TCP>
 From: <sip:andrew.maxxxxxx@xxxxxx>;tag=eaa695b0-d1d1800a-13d8-45026-58e51fae-567f1527-58e51fae
 To: "Jason xxxxxx" <sip:jason@xxxxxx.com>;tag=d0b4be2702;epid=859946f395
 Max-Forwards: 66

From Skype:
        <sip:sip.xxxxxx.com:5061;transport=tls;epid=859946f395;lr>;tag=BA669EA55F6221DBA477A306CFA8282C

IM&P's reply:
 Route: <sip:sip.xxxxxx.com:5061;transport=tls;lr;epid=859946f395>;tag=BA669EA55F6221DBA477A306CFA8282C
 User-Agent: Cisco-Systems-Federation 8.0
 Event: presence
 Subscription-State: active;expires=8587
 X-TAATag: 54709109-63db-433e-82ad-d9a100cbd2a0
 Content-Type: application/pidf+xml
 Content-Length: 304

[hari.n]

I am facing an issue in similar scenario, messages and presence cant able to reach, Can someone provide the configurations done on Exp-c and Exp-e including search rules and zone ? also provide me the details regarding certificate requirements and configs done in IM & P ? I have followed the interdomain federation with skype for business provided in im&p 11.5SU2 documentation

[j.house]

Here is the BUG ID for the malformed packets IM&P is sending:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve72788

[j.house]

What version of IM&P are you guys running?

[ciscodrew]

IM&P version 11.5.1SU2 Documentation says it is required for this to work.

[j.house]

That is interesting because Cisco has Identified that IM&P is sending malformed packets to external subscribe messages for Presence.  I am running SU2 as well.  Can you confirm that external Skype users can in fact see your presence status?

[ciscodrew]

presence was working both ways when I tested with S4B online. It was a trial S4B so I no longer have access.

[j.house]

the IMP neighbor zone should be configured as 5061 or 5062?

[ruudvanstrijp]

5062