Generate Mobile & Remote Access configuration for Jabber and Webex App: UC domain, DNS SRV, cert SANs, CUCM cluster wiring, and a ready jabber-config.xml snippet.
Mobile & Remote Access lets Jabber and Webex App register to CUCM from the public internet without a VPN. The hard part isn't Expressway — it's DNS, certs, and CUCM service discovery. Feed in your UC domain and CUCM cluster, and this tool emits every record, SAN, and config snippet you need.
Set inputs, click Generate MRA config.
Internal + external SRV records.
SANs that must be on C, E, and CUCM.
Cluster discovery + service profile.
UC traversal + domain config.
jabber-config.xml + Webex discovery.
MRA service discovery is entirely DNS-driven. The client (Jabber or Webex App) starts by looking up _collab-edge._tls.<uc-domain> externally. If it finds that, it's "off-prem" and connects to Expressway-E. When internal, the client looks up _cisco-uds._tcp.<uc-domain> which points directly to CUCM. Both records must match your UC domain (not the edge domain) — a common mistake is pointing _collab-edge at the wrong domain and clients silently fall back to on-prem mode and fail.
Cert SANs are the second-biggest trap. The Expressway-E public cert must carry collab-edge.<uc-domain> as a SAN even though the record lives at _collab-edge._tls — Expressway enforces this for security. Some public CAs (notably GoDaddy) do not sign certs with underscore-SANs but the SRV target FQDN doesn't have underscores, so this isn't the blocker people think it is. The blocker is cluster member FQDNs: every node FQDN in the C and E clusters must be on their respective certs.
OAuth vs SSO: OAuth tokens (introduced in CUCM 11.5) let clients re-use refresh tokens without re-authenticating for up to 60 days. SSO (SAML) layers on top — auth happens at IdP instead of CUCM. Use both in production. Basic auth (clients send password on every connection) is deprecated and should not be used for MRA. Check CUCM > System > Enterprise Parameters > SSO and Refresh Token Expiry Timer.
No — UC domain is independent. Many orgs use uc.company.com to keep it isolated.
No. External clients cannot validate self-signed. Must use public CA.
Only for UCM calling (calling to CUCM). Webex Calling users don't need MRA.
Supported. IM&P server must be reachable via its FQDN from Expressway-C; client gets it via service profile.
Recommended: internal DNS resolves UC domain to CUCM; external DNS resolves _collab-edge to Expressway-E public IP.
200 users.
2000 users, DR site.
10k users, 3 regions.
Our UC Modernization Sprint handles full MRA bring-up: Expressway pair, DNS, certs, CUCM wiring, and pilot rollout.