<div dir="ltr">We're actually on 8.6.1.<div><br></div><div>I dug through the logs a bit more and found the same user also had an 8800 series phone logged in via MRA. Doing some further searching, I found someone who had the same issue logging into Jabber with an 8841 already logged in via MRA.</div><div><br></div><div>I had the user unplug their 8841 and they were able to login to Jabber fine after this.</div><div><br></div><div>It looks like I'll be reaching out to the feature preview folks to make sure they know about this issue.</div><div><br></div><div>Brian</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Sep 15, 2015 at 8:20 AM, Kevin Przybylowski <span dir="ltr"><<a href="mailto:kevinp@advancedtsg.com" target="_blank">kevinp@advancedtsg.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">I almost upgraded our VCS servers to 8.6 last week and noticed a couple reviews on CCO so I stuck with 8.5.3. I’ll give 8.6.1 a try in a few days.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><img width="1023" height="460" src="cid:image001.png@01D0EF8E.A89E1030"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Ryan Huff<br>
<b>Sent:</b> Monday, September 14, 2015 4:00 PM<br>
<b>To:</b> <a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>; <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> Re: [cisco-voip] MRA (Collaboration Edge) Intrusion Protection<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p>Brian .... I had this issue this weekend in 8.6. My original issue was the "no home uds cluster" but I had issues with the proxy protocol violation.<u></u><u></u></p>
<p>Tac's response was go to 8.6.1 (released 9/11/15 ... yikes) or roll back to 8.5<u></u><u></u></p>
<p>Thanks,<u></u><u></u></p>
<p>Ryan<u></u><u></u></p><div><div class="h5">
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
-------- Original Message --------<br>
From: Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>><br>
Sent: Monday, September 14, 2015 03:49 PM<br>
To: <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
Subject: [cisco-voip] MRA (Collaboration Edge) Intrusion Protection<u></u><u></u></p>
<div>
<p class="MsoNormal">Is anyone else having issues with the "HTTP proxy protocol violation" automated detection feature or Expressway?<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I've got over 10,000 hits on this built-in rule and it seems to be blocking some legitimate logins via Jabber.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It looks like this in the event log:<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">2015-09-11T21:05:09-04:00 sh[1195]: Event="Intrusion Protection" Src-ip="X.X.X.X" Detail="Collaboration Edge HTTP Intrusion Protection blocking X.X.X.X" Level="INFO" UTCTime="2015/09/12-01:05:09"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2015-09-11T21:05:09-04:00 traffic_server[24581]: Event="Sending HTTP error response" Status="429" Reason="Unknown Status" Dst-ip="X.X.X.X" Dst-port="52940" UTCTime="2015-09-12 01:05:09,151" <u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It looks like this in the Jabber log:<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">2015-09-11 17:09:15,746 INFO [0x00000dc0] [ls\src\http\BasicHttpClientImpl.cpp(399)] [csf.httpclient] [csf::http::executeImpl] - *-----* HTTP response code 0 for request #2 to
<a href="https://myexpressway.client.com:8443/bG9naWNub3cuY29t/get_edge_config?service_name=_cisco-uds&service_name=_cuplogin" target="_blank">
https://myexpressway.client.com:8443/bG9naWNub3cuY29t/get_edge_config?service_name=_cisco-uds&service_name=_cuplogin</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2015-09-11 17:09:15,746 ERROR [0x00000dc0] [ls\src\http\BasicHttpClientImpl.cpp(404)] [csf.httpclient] [csf::http::executeImpl] - There was an issue performing the call to curl_easy_perform for request #2: CONNECTION_TIMEOUT_ERROR<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It looks like this in the detailed expressway logging:<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">2015-09-11T11:12:06-04:00 atlitexpe1 UTCTime="2015-09-11 15:12:06,146" Event="System Configuration Changed" Node="<a href="mailto:clusterdb@127.0.0.1" target="_blank">clusterdb@127.0.0.1</a>" PID="<0.3251.0>" Detail="xconfiguration fail2banJailStatus uuid
12f52e25-4df6-4fd3-9697-621d9de3a796 jail: http-ce-intrusion total_fails - changed from: 202411 to: 202416"<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Anyone else seeing issues like this? This particular user also has an 8841 at home. Is there a limit to number of MRA connections behind a single public IP?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Brian Meade<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>