you cannot login outside corporation network -jabber client

[susim]

Hi,

we are getting the below events on  expressway -e 

2021-02-10T14:26:14.648+03:00 traffic_server[7829]: Event="Sending HTTP error response" Status="403" Reason="Forbidden" Dst-ip="104.128.83.98" Dst-port="37247" UTCTime="2021-02-10 11:26:14,648"
2021-02-10T14:26:14.648+03:00 traffic_server[7829]: Event="get_edge_sso" Detail="Access denied" Reason="MRA not supported" Domain="domainname.com" Src-ip="104.128.83.98" Src-port="37247" UTCTime="2021-02-10 11:26:14,648"

on jabber getting the below error  

"you cannot login outside corporation 

cwa just rotating 

The device there is no change, the certificate is internal ,but it was working 

Thanks

[Nithin Eluvathingal]

Can you check all SRV record are configured properly and also check the srv from CSA tool. 

Take logs from both E and C and run it on CSA tool. This will give more information.

[susim]

Hi,

Srv records are fine  .

From inside everything working fine 

I will check the logs from c and e 

Thanks 

[susim]

Hi,

attached error from E .

Thanks 

[Roger Kallberg]

Looks like your configuration for connection zone between C and E is not correct. Please look through your configuration and verify that configuration is as per the deployment guide.

[Nithin Eluvathingal]

Can you check your Zones between E and C  and make sure its UP.

[susim]

Hi,

zone Status attached  from the  C 

In the second attached picture dns resolution failed ,but from the same network I can resolve . 

I don't think that could be the issue  

Thanks 

[Roger Kallberg]

Not sure if I understand what you mean that it’s not a problem with your zone configuration as both pictures shows failed errors?

Please review the configuration guide for MRA and make sure you have correctly configured all things in both C and E. As the connection between these is dependent on name resolution it’s imperative that DNS configuration, with the proper records is present, is correct. One common issue is also certificates, the C and E uses PKI chain of trust to form the connection. If the C do not have the certificate(s) for the CA that signed the certificate for the E in its trust store and the reverse for E to C it will not form the trunk between these.

[Nithin Eluvathingal]

From the pictures shared, it looks like your configurations for zones  are not correct. Also i see DNS resolution error. Not sure what you configured on C and E ,  and also whats your DNS configurations.

I would recommend you to go through the below guide and correct your configurations.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X12-5/exwy_b_mra-expressway-deployment-guide.html

[susim]

Hi,

I have a strange issue ,dns utitity is  resolving (from C ) any fqdn to ip address except the expressway e's fqdn

Thanks

[Nithin Eluvathingal]

You need to check your internal DNS entries.

• Is this single domain or multi domain
• Single nic or dual nic
• Whats your DNS entries including the A records

[susim]

Hi,

Here is my domain setup 

i can resolve  expressway E's fqdn from any other machine except from  'C' 

test.com (intenal) hosted internal 

test.com (external) hosted at ISP 

in internal dns server  , there is A records for both E and C 

in internal other than A records , there are SRV records _cisco-uds (pointed to cucm )  and _cuplogin (Jabber from inside it is working and from outside also was working .suddenly it stopped from outside  ) 

Attached the csa report , Expressway c is trying to resolve  the records from the dnscache 

Thanks 

[susim]

Hi ,

it is dual nic 

Thanks

[Nithin Eluvathingal]

_cuplogin is no more required. Flush DNS on expressway  C and E. since you said it was working before Make sure all your certificates are valid too.

Whats you internal DNS entry for expressway E, is this resolve to your Exp-E internal NIC ?

Also Run SRV checker on CSA tool.

[susim]

Hi,

Certificates are valid , SRV records are  resolution is ok from both outside and inside 

I am really confused why  EXP-C is not getting the ip address  of EXP-E  from  dns server 

but it can resolve any other fqdn public host and private host 

Whats you internal DNS entry for expressway E, is this resolve to your Exp-E internal NIC ?

it is just A record 

I am not using  any certificate from  EXTERNAL CA 

Thanks