<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Verdana Bold";
panose-1:2 11 8 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Verdana",sans-serif;
color:black;
font-weight:normal;
font-style:normal;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Inline<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;color:#1F497D">Matthew G. Loraditch – CCNP-Voice, CCNA-R&S, CCDA<br>
Network Engineer<br>
Direct Voice: 443.541.1518</span><span style="color:#1F497D"><br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><a href="https://www.facebook.com/heliontech?ref=hl"><span style="font-size:8.0pt;color:blue">Facebook</span></a></span><span style="font-size:8.0pt;color:#1F497D"> |
</span><span style="color:#1F497D"><a href="https://twitter.com/HelionTech"><span style="font-size:8.0pt;color:blue">Twitter</span></a></span><span style="font-size:8.0pt;color:#1F497D"> |
</span><span style="color:#1F497D"><a href="https://www.linkedin.com/company/helion-technologies?trk=top_nav_home"><span style="font-size:8.0pt;color:blue">LinkedIn</span></a></span><span style="font-size:8.0pt;color:#1F497D"> |
</span><span style="color:#1F497D"><a href="https://plus.google.com/+Heliontechnologies/posts"><span style="font-size:8.0pt;color:blue">G+</span></a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> cisco-voip [mailto:cisco-voip-bounces@puck.nether.net]
<b>On Behalf Of </b>Ahmed Abd EL-Rahman<br>
<b>Sent:</b> Friday, May 22, 2015 12:31 PM<br>
<b>To:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> [cisco-voip] Cisco Expressway for Jabber MRA query<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<span style="font-family:"Arial",sans-serif;color:#333333">Hi Gents,<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">I'm implementing Expressway C and E version 8.5.2 for MRA and i have the following client setup :<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- Split horizon DNS.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- 2 domains as follows, Internal: domainX.local and external: domainX.com<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- All UC servers are joining the internal domain, CUCM.domainX.local, IM&P.doaminX.local, CUC.domainX.local,....etc.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- Client has both local certificate authority (CA) to locally sign his servers certificates and also registered to public CA to sign his public servers certificates.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- I have EXP-C and EXP-E to enable the Mobile Remote Access for Jabber clients from outside.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">I'm able to make the EXP-C either on internal domainX.local or external domainX.com and for sure the EXP-E on the DMZ will be on the domainX.com as it will be a public and will be accessed from internet.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333"><o:p> </o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">my question is, should i place the EXP-C in the domainX.local (internal) or domainX.com (external) for the setup to work?<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">I have the following concerns in this regard:<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- If i placed the EXP-C in the external domainX.com, will its communication with the internal UC servers which are all in the internal domain be okay ? and will the certificate trust relation with all
UC servers and relation with the EXP-E will be fine?<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<b><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I would put the EXP-C on the internal domain.<o:p></o:p></span></b></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- If i placed the EXP-C in the internal will the certificate trust relation with all UC servers and relation with the EXP-E will be fine?<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<b><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As longs as you have the cas that issue the certificates in both trusted lists you will be fine<o:p></o:p></span></b></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- is it possible to have EXP-C certificates signed by local CA while the EXP-E certificates will be signed by public CA ? will it be okay?<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<b><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Same as above<o:p></o:p></span></b></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">- is the "Unified CM phone security profile names" as a part of the data to be entered when generating the CSR in the EXP-C mandatory ? i mean do i have to use TLS for phones through this security profile
or I can just enable the non-secure phone profile without TLS, and if i can use the non-secure phone profile, do i have to enter this field when generating the EXP-C CSR or can I leave it blank ?<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<b><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Not sure I don’t do secure phone traffic.<o:p></o:p></span></b></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt;outline: none;orphans: auto;text-align:start;widows: 1;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-family:"Arial",sans-serif;color:#333333">If any on have a working setup kindly brief me about it specially the domains and certificates parts.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:15.0pt">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I have all of this working minus the secure phones. My Expressway Cs are on my .local domain and have their certs from my AD CA, my E’s are setup dual NIC and their certs are “real”
public ssl certs and are on my .com. No issues.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#383E4C">Best Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:#1F497D"> </span><span style="font-family:"Verdana",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:1.0pt"><span style="font-family:"Verdana Bold";color:#383E4C">Ahmed Abd EL-Rahman<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:1.0pt"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#383E4C">Senior Network Engineer</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>