This section summarizes the public (external) and local (internal) DNS requirements for MRA. For more information, see the Cisco Jabber Planning Guide for your version on the Jabber Install and Upgrade Guides page.

The public, external DNS must be configured with _collab-edge._tls.<domain> SRV records so that endpoints can discover the Expressway-Es to use for Mobile and Remote Access. You also need SIP service records for general deployment (not specifically for MRA).

Although we recommend that the local, internal DNS is configured with _cisco-uds._tcp.<domain> SRV records, from X12.5 this is no longer a requirement.

Important

From version X8.8, if you use the IM and Presence Service over MRA (or any XMPP federation that uses XCP TLS connections between Expressway-C and Expressway-E), you must create forward and reverse DNS entries for each Expressway-E system. This is so that Expressway-C systems making TLS connections to them can resolve the Expressway-E FQDNs and validate the Expressway-E certificates. This requirement affects only the internal, LAN-side interface and does not apply to the external IP-side.

Create internal DNS records, for both forward and reverse lookups, for all Unified Communications nodes used with MRA. This allows Expressway-C to find the nodes when IP addresses or hostnames are used instead of FQDNs.

Ensure that the cisco-uds SRV records are NOT resolvable outside of the internal network, otherwise the Jabber client will not start MRA negotiation via the Expressway-E.

Ensure that the provisioning mode is set to Cisco UCM via Expressway.

These devices must verify the identity of the Expressway-E they are connecting to by validating its server certificate. To do this, they must have the certificate authority that was used to sign the Expressway-E's server certificate in their list of trusted CAs.

The devices ship with a list of default CAs which cover the most common providers (including Verisign and Thawte). If the relevant CA is not included, it must be added (for instructions, see the endpoint administrator guide).

Mutual authentication is optional, and these devices are not required to provide client certificates. If you do want to configure mutual TLS, you cannot use CAPF enrolment to provision the client certificates. Instead, manually apply the certificates to the devices. The client certificates must be signed by an authority that is trusted by the Expressway-E.

If you deploy these devices to register with Cisco Unified Communications Manager through MRA, be aware of the following points. For DX endpoints, these considerations only apply to Android-based devices and do not apply to DX70 or DX80 devices running CE software:

• Trust list: You cannot modify the root CA trust list on Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series devices. Make sure that the Expressway-E's server certificate is signed by one of the CAs that the devices trust, and that the CA is trusted by the Expressway-C and the Expressway-E.

• Off-hook dialing: The way KPML dialing works between these devices and Unified CM means that you need Cisco Unified Communications Manager 10.5(2)SU2 or later to be able to do off-hook dialing via MRA. You can work around this dependency by using on-hook dialing.

For information about which features are supported over MRA for specific clients and endpoints, refer to the relevant product documentation:

This section lists some key client and endpoint features that we know don't work with MRA-connected devices.

Note	Refer to your endpoint or client documentation for more information. The following list isn't exhaustive.

• Multiple IM and Presence clusters with different releases—If you have multiple IM and Presence Service clusters configured on Cisco Expressway-C, and some of them run pre-11.5 software, MRA endpoints may not be able to use features that require 11.5. The reason is that, using a round robin approach, Cisco Expressway-C may select a cluster on an older software version.

• Expressway-E with dual network interface—In Expressway-E systems that use dual network interfaces, XCP connections (for IM and Presence Service XMPP traffic) always use the internal interface. XCP connections may fail if the Expressway-E internal interface is on a separate network segment and is used for system management only, and where the Expressway-C traversal zone connects to the Expressway-E external interface.

• Cisco Jabber with E911—If you deploy Cisco Jabber clients over MRA with the E911NotificationURL feature, configure a static HTML page for the notification. MRA does not support scripts and link tags for the web page.

• Cisco Jabber Directory access—MRA supports Cisco Jabber directory access using the Cisco User Data Services (UDS). MRA doesn't support other directory access methods for Jabber.

• Unified Contact Center Express feature support—MRA doesn't support some Cisco Unified Contact Center Express features. For details, refer to the Unified Contact Center Express documentation.

• Endpoint failover behavior:

  • 78XX / 88XX series phones registered over MRA and using OAuth token may get de-registered when a CUCM node goes down but, will continue to communicate with another active node. And the phones will re-register after some time.

    Jabber registered over MRA and using OAuth token may get de-registered when a CUCM node goes down and displays a message "Your session is expired. Sign in again to keep using Cisco Jabber". You can sign in to your Jabber to continue using the service.

  • Cisco Jabber clients support IM and Presence Service and SIP Registration Failover over MRA. For more information, see SIP Registration Failover for Cisco Jabber. However, they don't support any other type of MRA - related redundancy or failover - including Voicemail and User Data Services (UDS). Clients use a single UDS server only.

    If an Expressway-C or Expressway-E node fails, active MRA calls through the failed Expressway node also fail. This behavior applies to all device types, including Jabber clients.

    For Unified CM failover over MRA, Cisco IP Phones need clustered Expressway-C and Expressway-E servers. IP Phones need at least the same number of Expressway-C and Expressway-E servers in the cluster as the number of Unified CMs in the Call Manager group configured on the IP phone. Note that devices running TC or CE software don't need clustered Expressway servers for Unified CM failover.

• Chat over MRA with OAuth Refresh Logins—Cisco Jabber 12.5 or later is needed if you want chat/messaging services over MRA with OAuth Refresh Authentication (self-describing tokens) and with IM and Presence Service presence redundancy groups. With pre-12.5 Jabber, user login fails in this scenario.

• Call Recording over MRA—Includes the following limitations:

  • MRA supports recording tones for Cisco Jabber clients and Webex Unified CM registered applications. Also note that CTI monitoring of Jabber mobile devices requires Unified CM 12.5(1)SU1 or later.

• Silent Monitoring over MRA—The following monitoring features are supported for compatible MRA-connected endpoints, provided that the deployed UC products are running compatible versions, the Silent Monitoring feature is configured on Cisco Unified Communications Manager, and SIP Path Headers are enabled on Expressway (as described in Enable SIP Path Headers):

  • Silent Monitoring is supported from X12.6.1.

  • Whisper Coaching and Whisper Announcements are supported from X12.6.2.

• Encrypted iX Channel—The Expressway doesn't encrypt the iX protocol on behalf of other entities. As a result, iX must be encrypted end to end, or unencrypted end to end. When iX is encrypted, the endpoints and conferencing server must handle encryption.

  Note	For iX to work over MRA, configure the conferencing server with an encrypted trunk to Unified CM and make sure that the endpoints/Jabber are running a suitable, iX-capable software version.

• Certificate Authority Proxy Function (CAPF) over MRA—MRA doesn't support certificate provisioning for remote endpoints. This limitation includes the Certificate Authority Proxy Function (CAPF). To use CAPF, complete the first-time configuration, including CAPF enrollment, on premises (inside the firewall). To complete subsequent certificate operations, you must bring the endpoints back on-premises.

• Encrypted TFTP—MRA supports encrypted TFTP configuration files over MRA when the CAPF enrollment has already been completed on-premises.

• Session Refresh features—The following session refresh features that rely on the SIP UPDATE method (RFC 3311) fail over MRA:

  • Request to display the security icon on MRA endpoints for end-to-end secure calls

  • Request to change the caller ID to display name or number on MRA endpoints

• P2P File Transfer—MRA doesn't support peer-to-peer file transfer when using IM and Presence Service and Jabber.

• Managed File Transfer over MRA—MRA supports Managed File Transfer (MFT) over MRA when using IM and Presence Service 10.5.2 and later (restricted version) and Jabber 10.6 and later clients. MRA doesn't support MFT with an unrestricted version of IM and Presence Service.

• File Transfer for Jabber—MRA supports file transfer with Cisco Jabber.

• Mobility Feature Support—MRA doesn't support additional Mobility features, including Session Handoff.

• Hunt Group Support—MRA supports hunt groups (including hunt pilots and hunt lists) when using Unified CM version 11.5(1)SU5, or any later version that has the relevant change.

• Self-Care Portal Access—MRA doesn't support the Cisco Unified Communications Self Care Portal.

• Key Expansion Module (KEM) Support for Compatible Phones—We have not officially tested and verified support over MRA for the KEM accessory for Cisco IP Phone 8800 Series devices. However, we have observed under lab conditions that KEMs with multiple DNs work satisfactorily over MRA.

  This feature is available as a preview feature but is not officially supported. To deploy the feature over MRA, SIP Path Headers must be enabled on Expressway (as described in Enable SIP Path Headers). In addition, you need a Unified CM software version that supports path headers (Release 11.5(1)SU4 or later is recommended).

• Currently, if one Expressway node in a clustered deployment fails or loses network connectivity for any reason (including if the Unified CM restarts or fails), all active calls going through the affected node will fail. The calls are not handed over to another cluster peer. Bug ID CSCtr39974 refers. This is not an MRA-specific issue and applies to all call types.

• We don’t support third-party network load balancers between MRA clients and Expressway-E.

• The Expressway cannot be used for Jabber Guest when it's used for Mobile and Remote Access (MRA).

• The Expressway-C used for MRA cannot also be used for Microsoft gateway service. Microsoft gateway service requires a dedicated Expressway-C.

• Maintenance mode is not supported over MRA for endpoints running CE software. The Expressway drops MRA calls from these endpoints when you enable maintenance mode.

• As Expressway only supports IPv4 mode for MRA connections, the IP configuration settings "IPv6 only" or "Both" are not supported. In the case of "Both", as Expressway does not proxy IPv6 MRA traffic from clients, intermittent issues may arise if clients send IPv6 instead of IPv4.

• Endpoint management capability (SNMP, SSH/HTTP access) is not supported.

• Multitple Presence Domains over MRA—This feature is supported from Expressway X12.6.3 with IM and Presence Service 10.0(x) or later. Compatible clients can be deployed into an infrastructure that has users in more than one domain or in domains with subdomains. We recommend no more than 75 domains in a Unified Communications default deployment.

  For XMPP/chat & presence federation through Expressway, the existing requirement that XMPP federation is supported on a single Expressway cluster only still applies.

  Note that for Expressway releases prior to X12.6.3, support for multiple presence domains was a preview feature with the following limitations:

  • Before X8.5, each Expressway deployment supported only one Presence domain. (Even though IM and Presence Service 10.0 and later supports Multiple Presence Domains.)

  • As of X8.5, you can create multiple deployments on the Expressway-C, but this feature is still limited to one domain per deployment.

  • As of X8.5.1, a deployment can have Multiple Presence Domains. However, this feature is in preview status only, and we recommend that you do not exceed 50 domains.

• Deployments on Large VM servers are limited to 2500 proxied registrations to Unified CM.

• The Expressway does not support some Cisco Unified Contact Center Express features for contact center agents or other users who connect over MRA. Jabber for Mac and Jabber for Windows cannot provide deskphone control over MRA, because the Expressway pair does not traverse the CTI-QBE protocol.

  However, if these Jabber applications, or other CTI applications, can connect to Unified CM CTIManager (directly or through the VPN) they can provide deskphone control of MRA-connected clients.

• For ICE passthrough calls, if Host and Server-reflexive addresses cannot negotiate successfully, endpoints can utilize relay address of the TURN server to establish optimized media path. However, when Expressway is used as a TURN server and if static NAT is configured on the Expressway-E, the media cannot be passed using the relay address (CDETS CSCvf85709 refers). In this case, default traversal path is used to traverse the media. That is, the media passes through Expressway-C and Expressway-E.

• The Expressway-E does not support TURN relay over TCP for ICE passthrough calls.

You can use the following supported Cisco Jabber SDK features over MRA:

• Sign in, sign out

• Register phone services

• Make or receive audio/video calls

• Hold and resume, mute/unmute, and call transfer

For more information, see the Getting Started Guide for Cisco Jabber SDK.