ASBCE and Remote Workers - Possible Reverse Proxy or DNS Issue?

[dsm600rr]

Hello all,

So I have my ASBCE configured per the "IP Office SIP Phones with ASBCE R11.1 FP1" Document.

I currently have an Active working SIP Trunk on the ASBCE as well.

Internally, I can hit the PBX from the FQDN:

Also, Internally the IX Workplace App Works.

I have confirmed that outside my network, a nslookup / dnschecker resolved to the public IP of my ASBCE and internally nslookup resolves to my IPO

Outside my network, I cannot get the the IPO with the FQDN with a Web Browser.

Outside my network, on cellular data, IX Workplace just hangs however never logs in (no green check) - however never shows an error.

I have my Internal DNS Server on the IPO, however on my ASBCE I only have 8.8.8.8 / 8.8.4.4 - does this need to include my Internal DNS Server as well on the ASBCE?

When I run a tracesbc, as soon as I log into the IX Workplace on my phone on cellular data I see data to start rolling in in regards to TLS Handshake however not seeing any errors here either:

ASBCE Trace on port 5061

Thoughts on trouble shooting?

ACSS

 

[G van Hamburg]

When you restart the SBCE application, do you also see TLS messages between A1 and IPO? And what about the logs on the sbce. Anything usefull in the incidents? For resolving the IPO IP, you need the internal dns. The client on wifi or 4G will use the carriers dns to resolve to the B1.

Freelance Certified Avaya Aura Engineer

 

[G van Hamburg]

And I’d suggest you use the reverse proxy to only allow the 46xxsettings.tx, 46xxspecial.txt, /tpkt/mtcti/ for presence, the IPO root certificate and maybe upgrade files for hard phones.

Freelance Certified Avaya Aura Engineer

 

[dsm600rr]

G van Hamburg: "When you restart the SBCE application, do you also see TLS messages between A1 and IPO?" -

When I select "Restart Application" on the SBCE, below is what I can see:

"Anything usefull in the incidents?"

See Below - lots of errors like this:

"For resolving the IPO IP, you need the internal dns."

Would I update the DNS here?

When I do so, it seems to update it on both Internal and External Interfaces and "Diagnostics" Fails of course on the public interface:

"And I’d suggest you use the reverse proxy to only allow the 46xxsettings.tx, 46xxspecial.txt, /tpkt/mtcti/ for presence, the IPO root certificate and maybe upgrade files for hard phones. "

Like so?

HTTPS

HTTP

ACSS

 

[dsm600rr]

On Cellular data only, I can now reach

https://FQDN/46xxsettings.txt

ACSS