Cisco Cisco Expressway
Update IM&P's Incoming ACL
On each IM and Presence Service cluster's publisher node, you must update the incoming ACL with the IP address
and FQDN of all Gateway Expressway peers and all FE Servers.
and FQDN of all Gateway Expressway peers and all FE Servers.
1.
On the publisher node, go to System > Security > Incoming ACL.
2.
Add a new entry for the IP address of each Gateway peer.
3.
Add a new entry for the FQDN of each Gateway peer.
4.
Add a new entry for the IP address of each Microsoft server.
5.
Add a new entry for the FQDN of each Microsoft server.
6.
Save the ACL configuration.
For the detailed procedure, search for "Configure an Incoming Access Control List" in the document IM and
Presence Service Node Configuration for Partitioned Intradomain Federation.
Presence Service Node Configuration for Partitioned Intradomain Federation.
of
IM and Presence Service.
Restart the SIP Proxy Service
On each publisher node, restart the SIP proxy as follows:
1.
In Cisco Unified IM and Presence Serviceability, choose Tools > Service Activation.
2.
Restart the Cisco SIP Proxy service.
Troubleshoot Chat Between Jabber and Microsoft Clients
Diagnostic Information
Wireshark and rejected certificates
The Microsoft FE Server logs can be ambiguous when TLS connections are failing. You can use Wireshark to see
exactly which server is rejecting the certificate.
exactly which server is rejecting the certificate.
Trust configuration
Connections could also be failing because the servers do not trust each other. You need to configure incoming ACL
entries on IM&P, trusted hosts on Expressway, and trusted applications on Microsoft FE Servers.
entries on IM&P, trusted hosts on Expressway, and trusted applications on Microsoft FE Servers.
Asymmetric deployment
If you get chat/presence partially working, it could be because of the asymmetry in the deployment.
Also, if you get presence working but not chat, this could be because chat is a three-way handshake across the
asymmetrical link: subscribe > 200 OK > ACK but the ACK fails as it is trying to go direct from Microsoft FE to IM&P.
That link is the one that is not trusted.
asymmetrical link: subscribe > 200 OK > ACK but the ACK fails as it is trying to go direct from Microsoft FE to IM&P.
That link is the one that is not trusted.
64
Cisco Expressway with Microsoft Infrastructure Deployment Guide
Appendix 2: Chat / Presence Between Jabber and Microsoft Clients