There are some settings on the Expressway regarding the number of auth attempts, etc. have you tried to increase those to see if that makes any difference ?
On Tue, Sep 15, 2015 at 10:45 AM, Ryan Huff <[email protected]> wrote: > I'll hav to sift through my logs and see if that is what my issue was. > Thanks for the follow through Brian. > > Thanks, > > Ryan > > ------------------------------ > Date: Tue, 15 Sep 2015 10:40:24 -0400 > Subject: Re: [cisco-voip] MRA (Collaboration Edge) Intrusion Protection > From: [email protected] > To: [email protected] > CC: [email protected]; [email protected] > > > We're actually on 8.6.1. > > I dug through the logs a bit more and found the same user also had an 8800 > series phone logged in via MRA. Doing some further searching, I found > someone who had the same issue logging into Jabber with an 8841 already > logged in via MRA. > > I had the user unplug their 8841 and they were able to login to Jabber > fine after this. > > It looks like I'll be reaching out to the feature preview folks to make > sure they know about this issue. > > Brian > > On Tue, Sep 15, 2015 at 8:20 AM, Kevin Przybylowski < > [email protected]> wrote: > > I almost upgraded our VCS servers to 8.6 last week and noticed a couple > reviews on CCO so I stuck with 8.5.3. I’ll give 8.6.1 a try in a few days. > > > > > > *From:* cisco-voip [mailto:[email protected]] *On Behalf > Of *Ryan Huff > *Sent:* Monday, September 14, 2015 4:00 PM > *To:* [email protected]; [email protected] > *Subject:* Re: [cisco-voip] MRA (Collaboration Edge) Intrusion Protection > > > Brian .... I had this issue this weekend in 8.6. My original issue was > the "no home uds cluster" but I had issues with the proxy protocol > violation. > Tac's response was go to 8.6.1 (released 9/11/15 ... yikes) or roll back > to 8.5 > Thanks, > Ryan > > > > -------- Original Message -------- > From: Brian Meade <[email protected]> > Sent: Monday, September 14, 2015 03:49 PM > To: [email protected] > Subject: [cisco-voip] MRA (Collaboration Edge) Intrusion Protection > > Is anyone else having issues with the "HTTP proxy protocol violation" > automated detection feature or Expressway? > > > > I've got over 10,000 hits on this built-in rule and it seems to be > blocking some legitimate logins via Jabber. > > > > It looks like this in the event log: > > 2015-09-11T21:05:09-04:00 sh[1195]: Event="Intrusion Protection" > Src-ip="X.X.X.X" Detail="Collaboration Edge HTTP Intrusion Protection > blocking X.X.X.X" Level="INFO" UTCTime="2015/09/12-01:05:09" > > 2015-09-11T21:05:09-04:00 traffic_server[24581]: Event="Sending HTTP > error response" Status="429" Reason="Unknown Status" Dst-ip="X.X.X.X" > Dst-port="52940" UTCTime="2015-09-12 01:05:09,151" > > > > It looks like this in the Jabber log: > > 2015-09-11 17:09:15,746 INFO [0x00000dc0] > [ls\src\http\BasicHttpClientImpl.cpp(399)] [csf.httpclient] > [csf::http::executeImpl] - *-----* HTTP response code 0 for request #2 to > https://myexpressway.client.com:8443/bG9naWNub3cuY29t/get_edge_config?service_name=_cisco-uds&service_name=_cuplogin > > 2015-09-11 17:09:15,746 ERROR [0x00000dc0] > [ls\src\http\BasicHttpClientImpl.cpp(404)] [csf.httpclient] > [csf::http::executeImpl] - There was an issue performing the call to > curl_easy_perform for request #2: CONNECTION_TIMEOUT_ERROR > > > > It looks like this in the detailed expressway logging: > > 2015-09-11T11:12:06-04:00 atlitexpe1 UTCTime="2015-09-11 15:12:06,146" > Event="System Configuration Changed" Node="[email protected]" > PID="<0.3251.0>" Detail="xconfiguration fail2banJailStatus uuid > 12f52e25-4df6-4fd3-9697-621d9de3a796 jail: http-ce-intrusion total_fails - > changed from: 202411 to: 202416" > > > > > > Anyone else seeing issues like this? This particular user also has an > 8841 at home. Is there a limit to number of MRA connections behind a > single public IP? > > > > Thanks, > > Brian Meade > > > > _______________________________________________ > cisco-voip mailing list > [email protected] > https://puck.nether.net/mailman/listinfo/cisco-voip > >
_______________________________________________ cisco-voip mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-voip
