Network Management

Troubleshoot Failed AXL Credentials

This article discusses frequent troubleshooting questions in connection with failed AXL credentials.

First published date

11/29/2018 10:48 PM

Last published date

11/13/2022 10:08 PM

Overview

When adding the CUCM, there is a feature for adding AXL credentials to allow VNQM to poll for SIP trunk monitoring. More information on the link below:
https://documentation.solarwinds.com/en/Success_Center/VNQM/Content/VNQM-GSG-Add-Call-Mgr-to-VNQM.htm

Product section

VoIP & Network Quality Manager

Cause

Resolution

To troubleshoot AXL credentials:

  1. Open a browser on your VoIP and Network Quality Manager server.

  2. Enter https://<ip address>:8443/axl/ in the address bar where <ip address> is the IP address of the call manager you are testing.

  3. If you receive a response similar to the following, confirm that you entered the correct AXL credentials in VoIP and Network Quality Manager:

    "Cisco CallManager: AXL Web Service The AXL Web Service is working and accepting requests. Use HTTP POST to send a request."
     

  4. If you receive no response, do one of the following:

  • Ensure that the AXL API is enabled on the call manager.
  • Ensure that you can connect to the call manager through your firewalls. 
  • ensue that the AXL logging is enabled on the Call-manager


 

Security Improvements - VNQM 2019.4 and later

As of VNQM 2019.4, the communication through AXL between VNQM and Cisco Unified Communications Manager (CallManager) changed due to security improvements. 

By default, your DNS server should resolve the CallManager domain name.

If the AXL test fails, while you add or edit a CallManager device, and if the issue is not resolved by your DNS server, you must update the hosts file on the Primary and Additional Polling Engines with the CallManager IP Address and domain name:
  1. Update the hosts file located in C:\Windows\System32\drivers\etc\hosts with the CallManager's IP address and domain name(need to reboot the poller server to make sure the changes applied).
  2. Go to the Advanced Configuration page > find SolarWinds.Orion.RemoteCertificateValidation.
  3. If all three options under SolarWinds.Orion.RemoteCertificateValidation are selected, install the Cisco CallManager security certificate on the Orion server through Start > Manage computer certificates > Action > All Tasks... > Import.
  4. Click Test to test AXL credentials.
The AXL test is successful.

NOTE: You may also try to unselect all three options to bypass the certificate validation.


 

If the above steps won't work perform the following:

  1. Traceroute Call manager and verify the path does not pass through devices with ACL (routers/switches/firewalls) that might block UDP or TCP port 8443 used for AXL communication

  2. Check on the Orion server the provided AXL credentials can communicate with the AXL API service
    curl -k -u (Username) (Password) -H "Content-type: text/xml;" [https://(IPAddress of the CUCM):8443/axl/services/AXLAPIService?wsdl > axl_output.txt See sample below:

3. Check error and should show SSL/TLS connection issue. If this error shows, Perform IIScrypto and make sure TLS 1.2 is enabled with the correct hashes.
4. Once done, Reboot the server and perform a test again. 


Deprecated SHA-1 Certificates on Windows operating systems:

Windows blocks SHA-1 signed TLS certificates effective January 1, 2017. (© 2017 Microsoft, available at https://blogs.windows.com, obtained on March 24, 2017.) You can find additional details about Windows Enforcement of SHA1 Certificates here (© 2017 Microsoft, available at https://social.technet.microsoft.com, obtained on March 24th, 2017).
 

  • To solve this issue, it's highly recommended to update SHA certificates on CallManager. 
  • SHA-1 deprecation is pushed out through Windows Update. As a temporary workaround, you can remove the relevant Windows Updates. Please keep in mind, this is a temporary solution only.
    • Windows 10: KB3163912
    • Windows 10 Version 1511: KB3172985
    • Windows 7 and Server 2008 R2: KB3170106 and KB3172605
    • Windows 8.1 and Server 2012 R2: KB3170106 and KB3172614

NOTE: The certificates on Cisco should also add the standalone hostname as a SAN attribute.

Check AXL and CUCM versions

If either CUCM or AXL versions are too far out of date, they will need to be upgraded to be fixed. Please note, just because CUCM or the IOS version is supported, does not necessarily mean the AXL version is supported as well. If either version is out of date, they will need to be upgraded.

Reference for AXL versions:
https://developer.cisco.com/docs/axl/#!versioning/axl-guidelines-beginning-with-unified-cm-100
(© 2021 <Cisco>, available at <https://developer.cisco.com>, obtained on <4/28/2021>)

Reference for supported Cisco IOS versions:
https://documentation.solarwinds.com/en/success_center/vnqm/content/vnqm-gsg-supported-vendors.htm


Disclaimer: Please note, any content posted here is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.