<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi all,<br>
i have a very strange behavior on my Jabber Video for iPAD.<br>
Setup:<br>
- CUCM 9.1(X) and IM&P 9.1(X) with real IPs behind firewalled
from an ASA.<br>
-CUCMs domain is not resolvable via public DNS in order for
on-demand VPN to work->works fine with iphone<br>
-Anyconnect on ipad with certificate authentication on ASA running
9.0.6 ->works fine<br>
-Group Policy with split include: the LAN where CUCM and IMP exists.
ALL DNS requests are sent in a private DNS in the same LAN as CUCM
and IM&Presence<br>
<b>Case 1: i pad Video and Voice Calling cannot be registered</b><br>
At IM&P->Application-> Legacy Client config: <u>TFTP is
configured </u><u>as FQDN (fully resolvable via DNS obtained via
Group Policy)</u><br>
what i see is that :<br>
Jabber as IM is registered via anyconnect tunnel<br>
then it queries the private DNS for CUCMs fqdn<br>
it gets the IP that is split tunneled<br>
then it <u>DOES NOT</u> use the vpn tunnel but via internet it gets
NATEd from the local router and tries to connect with this IP to TCP
5060 of the CUCMs IP obtained so it is blocked!<br>
<br>
<b>Case 2: i pad Video and Voice Calling can be registered</b><br>
At IM&P->Application-> Legacy Client config: <u>TFTP is
configured </u><u>as IP</u><br>
what i see is that :<br>
Jabber as IM is registered via anyconnect tunnel<br>
then it uses the IP of the CCUCM that is spli tunneled and<br>
then it DOES use the vpn tunnel and it tries to connect to TCP 5060
of the CUCMs IP with source IP of the anyconnect and it succeeds!<br>
<br>
Also, another way to make it work is tunnel all traffic: <u><b>unacceptable</b></u><u><b>!</b></u><br>
i do not want to use IP in the TFTP server field since when i do
that, i have no control on the on-demand-vpn.<br>
So, it is not that case
<a class="moz-txt-link-freetext" href="https://supportforums.cisco.com/thread/2177944">https://supportforums.cisco.com/thread/2177944</a> since i can make it
work through split tunnel when no DNS request is involved.<br>
But again, the DNS server, replies with the IP that i use in the
legacy client config!<br>
<br>
<br>
FYI, jabber for iphone running on iPAD does not have this issue! it
uses split tunnel policy correctly.<br>
<br>
Any thought are welcomed!<br>
<br>
BR<br>
Anthony<span style="font-size:10.0pt;mso-ascii-font-family:Calibri;
mso-fareast-font-family:"Times New
Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New
Roman";color:silver;mso-ansi-language:EN-US;
mso-fareast-language:EL" lang="EN-US"></span><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif";mso-fareast-font-family:
"Times New
Roman";mso-ansi-language:EN-US;mso-fareast-language:EL"
lang="EN-US"><o:p></o:p></span>
<div class="moz-signature">
<div class="Section1">
</div>
</div>
</body>
</html>