- Jabber Overview
- Workflows for Cloud and Hybrid Deployments
- Configure Policies
- Configure Clusters
- Create Users for Cloud Deployment
- Create Users for Hybrid Deployment
- Configure Deskphone Control
- Configure Softphone
- Configure Extend and Connect
- Configure Service Discovery for Remote Access
- Set Up Certificate Validation
- Configure the Clients
- Deploy Cisco Jabber Applications
- Remote Access
- Troubleshooting
Remote Access
Service Discovery Requirements Workflow
Command or Action | Purpose | |
---|---|---|
Step 1 | Service Discovery Requirements
| |
Step 2 | DNS Requirements
| |
Step 3 | Certificate Requirements
| |
Step 4 | Test _collab-edge SRV Record
|
Service Discovery Requirements
DNS Requirements
-
Configure a _collab-edge DNS SRV record on an external DNS server.
-
Configure a _cisco-uds DNS SRV record on the internal name server.
-
Optionally, if you deploy a hybrid cloud-based architecture where the domain of the IM and presence server differs from the domain of the voice server, ensure that you configure the Voice Services Domain to locate the DNS server that contains the _collab-edge record.
Certificate Requirements
Before you configure remote access, download the Cisco VCS Expressway and Cisco Expressway-E Server certificate. The Server certificate is used for both HTTP and XMPP.
For more information on configuring Cisco VCS Expressway certificate, see Configuring Certificates on Cisco VCS Expressway.
Test _collab-edge SRV Record
Test SRV Records
After creating your SRV records test to see if they are accessible.
Cisco Anyconnect Deployment Workflow
Command or Action | Purpose | |
---|---|---|
Step 1 | Application Profiles
| |
Step 2 | Automate VPN Connection
| |
Step 3 | AnyConnect Documentation Reference
| |
Step 4 | Session Parameters
|
Cisco AnyConnect Deployment
Application Profiles
After you download the Cisco AnyConnect Secure Mobility Client to their device, the ASA must provision a configuration profile to the application.
The configuration profile for the Cisco AnyConnect Secure Mobility Client includes VPN policy information such as the company ASA VPN gateways, the connection protocol (IPSec or SSL), and on-demand policies.
ASDM
You can provision application profiles for Cisco Jabber for iPhone and iPad in one of the following ways:
We recommend that you use the profile editor on the ASA Device Manager (ASDM) to define the VPN profile for the Cisco AnyConnect Secure Mobility Client.
When you use this method, the VPN profile is automatically downloaded to the Cisco AnyConnect Secure Mobility Client after the client establishes the VPN connection for the first time. You can use this method for all devices and OS types, and you can manage the VPN profile centrally on the ASA.
For more information, see the Creating and Editing an AnyConnect Profile topic of the Cisco AnyConnect Secure Mobility Client Administrator Guide for your release.
iPCU
You can provision iOS devices using an Apple configuration profile that you create with the iPhone Configuration Utility (iPCU). Apple configuration profiles are XML files that contain information such as device security policies, VPN configuration information, and Wi-Fi, mail, and calendar settings.
-
Use iPCU to create an Apple configuration profile.
For more information, see the iPCU documentation.
-
Export the XML profile as a .mobileconfig file.
-
Email the .mobileconfig file to users.
After a user opens the file, it installs the AnyConnect VPN profile and the other profile settings to the client application.
MDM
You can provision iOS devices using an Apple configuration profile that you create with third-party Mobile Device Management (MDM) software. Apple configuration profiles are XML files that contain information such as device security policies, VPN configuration information, and Wi-Fi, mail, and calendar settings.
To provision application profiles for Cisco Jabber for Android, use the profile editor on the ASA Device Manager (ASDM) to define the VPN profile for the Cisco AnyConnect Secure Mobility Client. The VPN profile is automatically downloaded to the Cisco AnyConnect Secure Mobility Client after the client establishes the VPN connection for the first time. You can use this method for all devices and OS types, and you can manage the VPN profile centrally on the ASA. For more information, see the Creating and Editing an AnyConnect Profile topic of the Cisco AnyConnect Secure Mobility Client Administrator Guide for your release.
Automate VPN Connection
When users open Cisco Jabber from outside the corporate Wi-Fi network, Cisco Jabber needs a VPN connection to access the Cisco UC application servers. You can set up the system to allow Cisco AnyConnect Secure Mobility Client to automatically establish a VPN connection in the background, which helps ensure a seamless user experience.
Note | VPN will not be launched because Expressway for Mobile and Remote Access has the higher connection priority even if VPN is set to automatic connection. |
- Set Up Trusted Network Connection
- Set Up Connect On-Demand VPN
- Set Up Automatic VPN Access on Cisco Unified Communications Manager
Set Up Trusted Network Connection
The Trusted Network Detection feature enhances the user experience by automating the VPN connection based on the user's location. When the user is inside the corporate Wi-Fi network, Cisco Jabber can reach the Cisco UC infrastructure directly. When the user leaves the corporate Wi-Fi network, Cisco Jabber automatically detects that it is outside the trusted network. After this occurs, Cisco AnyConnect Secure Mobility Client initiates the VPN to ensure connectivity to the UC infrastructure.
Note | The Trusted Network Detection feature works with both certificate- and password-based authentication. However, certificate-based authentication provides the most seamless user experience. |
Set Up Connect On-Demand VPN
The Apple iOS Connect On Demand feature enhances the user experience by automating the VPN connection based on the user's domain.
When the user is inside the corporate Wi-Fi network, Cisco Jabber can reach the Cisco UC infrastructure directly. When the user leaves the corporate Wi-Fi network, Cisco AnyConnect automatically detects if it is connected to a domain that you specify in the AnyConnect client profile. If so, the application initiates the VPN to ensure connectivity to the UC infrastructure. All applications on the device including Cisco Jabber can take advantage of this feature.
Note | Connect On Demand supports only certificate-authenticated connections. |
The following options are available with this feature:
-
Always Connect — Apple iOS always attempts to initiate a VPN connection for domains in this list.
-
Connect If Needed — Apple iOS attempts to initiate a VPN connection to the domains in the list only if it cannot resolve the address using DNS.
-
Never Connect — Apple iOS never attempts to initiate a VPN connection to domains in this list.
Apple plans to remove the Always Connect option in the near future. After the Always Connect option is removed, users can select the Connect If Needed option. In some cases, Cisco Jabber users may have issues when using the Connect If Needed option. For example, if the hostname for the Cisco Unified Communications Manager is resolvable outside the corporate network, iOS will not trigger a VPN connection. The user can work around this issue by manually launching Cisco AnyConnect Secure Mobility Client before making a call.
Step 1 | Use the ASDM profile editor, iPCU, or MDM software to open the AnyConnect client profile. |
Step 2 | In the
AnyConnect client profile, under the Connect if Needed section, enter your list
of on-demand domains.
The domain list can include wild-card options (for example, cucm.cisco.com, cisco.com, and *.webex.com). |
Set Up Automatic VPN Access on Cisco Unified Communications Manager
-
The mobile device must be set up for on-demand access to VPN with certificate-based authentication. For assistance with setting up VPN access, contact the providers of your VPN client and head end.
-
For requirements for Cisco AnyConnect Secure Mobility Client and Cisco Adaptive Security Appliance, see the Software Requirements topic.
-
For information about setting up Cisco AnyConnect, see the Cisco AnyConnect VPN Client Maintain and Operate Guides.
Step 1 | Identify a URL
that will cause the client to launch VPN on Demand.
|
Step 2 | Open the Cisco Unified CM Administration interface. |
Step 3 | Navigate to the device page for the user. |
Step 4 | In the
Product Specific Configuration Layout section, in
the
On-Demand VPN URL field, enter the URL that you
identified and used in
Cisco AnyConnect in Step 1.
The URL must be a domain name only, without a protocol or path. |
Step 5 | Select
Save.
When Cisco Jabber opens, it initiates a DNS query to the URL (for example, ccm-sjc-111.cisco.com). If this URL matches the On-Demand domain list entry that you defined in this procedure (for example, cisco.com), Cisco Jabber indirectly initiates the AnyConnect VPN connection. |
What to Do Next
-
Test this feature.
-
Enter this URL into the Internet browser on the iOS device and verify that VPN launches automatically. You should see a VPN icon in the status bar.
-
Verify that the iOS device can connect to the corporate network using VPN. For example, access a web page on your corporate intranet. If the iOS device cannot connect, contact the provider of your VPN technology.
-
Verify with your IT department that your VPN does not restrict access to certain types of traffic (for example, if the administrator set the system to allow only email and calendar traffic).
-
-
Verify that you set up the client to connect directly to the corporate network.
AnyConnect Documentation Reference
For detailed information on AnyConnect requirements and deployments review the documentation for your release at the following: http://www.cisco.com/c/en/us/support/security/anyconnect-secure-mobility-client/products-user-guide-list.html
Session Parameters
Datagram Transport Layer Security (DTLS) — DTLS is an SSL protocol that provides a data path that prevents latency and data loss.
Auto Reconnect — Auto reconnect, or session persistence, lets Cisco AnyConnect Secure Mobility Client recover from session disruptions and re-establish sessions.
Session Persistence — This parameter allows the VPN session to recover from service disruptions and re-establish the connection.
Idle Timeout — Idle timeout defines a period of time after which ASA terminates secure connections, if no communication activity occurs.
Dead-Peer Detection (DTD) — DTD ensures that ASA and Cisco AnyConnect Secure Mobility Client can quickly detect failed connections.
Set ASA Session Parameters
Cisco recommends that you set up the ASA session parameters as follows to optimize the end user experience for Cisco AnyConnect Secure Mobility Client.
Step 1 | Set up Cisco AnyConnect to use DTLS.
For more information, see the Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections topic in the Configuring AnyConnect Features Using ASDM chapter of the Cisco AnyConnect VPN Client Administrator Guide, Version 2.0. |
Step 2 | Set up session persistence (auto-reconnect).
For more information, see the Configuring Auto Reconnect topic in the Configuring AnyConnect Features chapter (Release 2.5) or Configuring VPN Access chapter (releases 3.0 or 3.1) of the Cisco AnyConnect Secure Mobility Client Administrator Guide for your release. |
Step 3 | Set the idle timeout value.
For more information, see the vpn-idle-timeout section of the Cisco ASA 5580 Adaptive Security Appliance Command Reference for your release |
Step 4 | Set up Dead Peer Detection (DPD).
For more information, see the Enabling and Adjusting Dead Peer Detection topic of the Configuring VPN chapter of the Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6. |