Expressway 8.9.1 - IM&P Federation With Microsoft-based Organizations Skype for Business

[ciscodrew]

Has anyone set this up successfully yet?

I have followed the brief config included in the doc starting on page 53, but I am not having much luck.

See attached Doc S4BFED.pdf for config that works.

[Amit23]

hello,

what error or issue coming when following the given steps?

[ciscodrew]

I have a Skype for Business trial account to test and I am not able to send chats either way.

I am seeing this in the event logs on the Expressway C - Detail="Proxy Authentication Required" Protocol="TLS" Response-code="407"

[ciscodrew]

I was able to get it working with Skype for business / Office 365 account.

[ruudvanstrijp]

Hi! What did you change to get it to work? I am also receiving the 407 proxy auth required message from IM&P (for chats coming from O365 SfB, via Expressway-E and -C), and I notice IM&P doesn't route chat messages to the Expressway-C.

I am using a valid Office 365 SfB account, which can federate with other SfB accounts in other domains. So federation on the O365 side is ok.

[ciscodrew]

There are a few steps missing from the guide of course.

If I remember correctly, we had to do the following:

1 - add expressway C cert to CUP trust on IM&P

2 - Configure trusted peer on IMP for expressway C

3 - Configure Incoming ACL on IMP to allow expressway C

4 - Install Microsft root cert that Skype uses on IMP under cup trust - I think.

I would have to double check my notes but I think that is it.

After successfully federating with S4B, we were able to federate with Microsoft.com domain.

[ruudvanstrijp]

Adding the Expressway-C cert to cup-trust did the trick, even though my Expressway-C and IM&P servers use the same root CA. Thanks!

Another thing that isn't noted in the guide, is that Exp-C's neighbor zone to IM&P should point to port 5062 (Peer Auth Listener) and not to the Server Auth listener (5061). I read somewhere that you might need to swap ports on these services, but I didn't do that. I just send the neighbor route to 5062.

[ciscodrew]

Yes , you are correct we had to change the ports on the neighbor zone as well.

Forgot to add to previous post.

[mstokman]

Hi! I have got chat working, but the presence status is not updating on S4B site. Any idea why this is not working? When i change the status on the S4B client i can see that on the jabber client. The jabber status is now shown on the S4B client

[ciscodrew]

I had the same issue as well. I cannot remember exactly what is was that fixed. I think it was either or both of these two:

1 - make sure to create internal DNS record for CUPS PUBLIC FQDN to point CUPS PUB.

2 - Change port to 5062 as mentioned above.

[mstokman]

Hi, I changed the outgoing search rule and now it works! Thanks

[j.house]

What change did you make to the outgoing search rule (and which rule was it)?

[j.house]

I have 2-way IM working, but I can only see the Skype presence in jabber they cannot see my presence.  any suggestions?

[ruudvanstrijp]

Did you receive the question in Jabber asking to share your presence after you initiated the chat from Jabber to Skype?

[j.house]

no I do not receive the pop up.  I have removed the contact from Jabber and re-added, and the same has been done on the Skype side.