Jabber with Different AD Domains

[zdesignstudio]

Hello,

I have a CUCM/IMP w/ MRA deployment going in our lab but recently I have noticed I am unable to join from a PC on our production network.When I say recently it is realisticly 6 months or so. It seems to be around the same time I moved to Windows 10 on my machine. If I use my phone to connect it works fine both internal to Lab and via MRA.

I have also noticed I am unable to login to other clients' Jabber instances with my own local account for troubleshooting.

[Jaime Valencia]

Assuming you have everything properly configured for MRA in your lab and production network, there should be no problem.

[zdesignstudio]

Its not just my production network but other customers' network as well. They can connect internal and external (MRA) with no issues using their domain computer but I cannot from my PC which is part of a different domain.

[Jaime Valencia]

What troubleshooting have you done so far?

[zdesignstudio]

1. Uninstalled and reinstalled Jabber using the UPN_DISCOVERY_ENABLED=false set.

2. Set IP address in Jabber for both CUCM and IMP to bypass auto discovery.

3. Tried to connect via LAN and MRA from production domain computer with same result.

Keep getting cannot communicate with server. Not sure if something on my PC is causing it to muck up.

[Jaime Valencia]

What about DNS and SRVs?

I'd try your credentials on some other system, or take a look at a PRT.

[zdesignstudio]

All SRV and DNS records seem to resolving correctly. Here is an un-scrubbed PRT for the lab for an internal attempt.

[Alok Jaiswal · Accepted solution]

What i see in the logs is below

2017-05-02 09:18:40,906 DEBUG [0x00002fd4] [ice\src\services\impl\Blacklist.cpp(134)] [csf.config] [CSFUnified::BlacklistAddress::operator ==] - Blacklist HOST match found for http://gcilab-cucmp:6970/CSFwnelson.cnf.xml with a reason of [Unable to connect to the TFTP server during the initial fetch of the device configuration file: 3]
2017-05-02 09:18:40,906 WARN [0x00002fd4] [mpl\ucm-config\tftp\TftpFileSet.cpp(597)] [csf.config] [csf::ucm90::TftpFileSet::fetchGlobalSettingsFile] - Error: Could not fetch GlobalSettings TFTP file
2017-05-02 09:18:40,906 ERROR [0x00002fd4] [mpl\ucm-config\tftp\TftpFileSet.cpp(658)] [csf.config] [csf::ucm90::TftpFileSet::download] - failed to retrieve the global settings file, result : TFTP_REQUEST_FAILED
2017-05-02 09:18:40,906 INFO [0x00002fd4] [mpl\ucm-config\tftp\TftpFileSet.cpp(662)] [csf.config] [csf::ucm90::TftpFileSet::download] - Results of file retrieval-> Initial Profile: TFTP_CONNECTION_FAILED, Encrypted Profile: FILE_URLS_NOT_SET, Service Profile: TFTP_REQUEST_FAILED, Global Settings Profile: TFTP_REQUEST_FAILED
2017-05-02 09:18:40,906 ERROR [0x00002fd4] [mpl\ucm-config\tftp\TftpFileSet.cpp(690)] [csf.config] [csf::ucm90::TftpFileSet::download] - failed to retrieve the XML file set, result : TFTP_CONNECTION_FAILED an empty file set will be returned
2017-05-02 09:18:40,906 DEBUG [0x00002fd4] [l\ucm-config\ConfigFilesProvider.cpp(48)] [csf.config] [csf::ucm90::ConfigFilesProvider::downloadTftpFiles] - Finished downloading TFTP file(s)

Are you able to resolve "gcilab-cucmp" from the PC ? It looks it has issue with to fetch cnf.xml from the TFTP.

Just to double check can you access the below URL from the PC  ?

http://gcilab-cucmp:6970/jabber-config.xml.

If above is successfull then try to access the below.

http://gcilab-cucmp:6970/CSFwnelson.cnf.xml

Atleast it will confirm that you can resolve the "gcilab-cucmp" from PC as well as the port 6970 is accessible.

Regards,

Alok

[Alok Jaiswal]

Since you mentioned its Different domain, most of the time if the PC is not part of same domain then you need to specify FQDN instead of just the NETBIOS name or alias, because it doesn't append the @domain.com to any query by default

Rgds,

Alok

[zdesignstudio]

Alok,

Thanks for verifying what I was also seeing in the logs. I was unable to resolve gcilab-cucmp but was able to resolve it as a FQDN. The issue was with my computer in that it didn't have the domain listed in it's DNS Suffix Search List (same for all other customer domains too). Once I added the domain to the list on my actual Windows machine, I connected right away. I also verified again with a customer network by added their suffix to my search list on my computer and was able to connect.

Thanks,

[fedor.solovev]

5 cents to add:
if you run installation command while Cisco Jabber is already installed, MODIFY application will work as well, so no need to uninstall it and install from scratch.