Cisco Meeting Server (CMS) Part 3 - Integrating Core and Edge

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

In this post, we are going to deploy a single CMS Core and a single CMS Edge.

1. Certificate for Core and Edge.  Like our previous posts in Part 1 and Part 2, I am going to use self signed cert for simplicity.

CMS Core:
pki selfsigned core

CMS Edge:
pki selfsigned edge

2. Using WinSCP or other SCP / sFTP client, to download the CMS Core certificate, in my case it is core.crt.  Copy this Core certificate to Edge using your SCP client.

In CMS Edge, create the loadbalancer service module and config the certificate for authentication.  You will need to trust your Core certificate in Edge.  In my lab it is a single NIC Edge.

CMS Edge:
loadbalancer auth edge edge.key edge.crt core.crt
loadbalancer trunk edge a:4999
loadbalancer trunk public edge a:5222 lo:5222
loadbalancer enable edge

3. In CMS Core, you are required to create a trunk.  Similarly, copy the edge certificate to core, you will need to trust the edge certificate in core.  10.1.90.124 is the edge IP address.

CMS Core:
trunk create trunktoedge xmpp
trunk auth trunktoedge core.key core.crt edge.crt
trunk edge trunktoedge 10.1.90.124 4999
trunk enable trunktoedge

You can use the trunk debug trunktoedge (the tag name) to see whether the trunk is up on core.

4. There are a few service modules can be enabled on Edge.  If you want to enable SIP Edge, you will need the below command:

CMS Edge:
sipedge public a:5061
sipedge public-ip 1.2.3.4
sipedge private a:3061
sipedge certs sipedge.key sipedge.crt

5. Another service module on Edge is TURN.  To enable TURN, you will need the following command:

turn credentials admin admin xcloud-hk.com
turn listen a
turn public-ip 1.2.3.4
turn enable

From the web user interface, you can enter the details under "TURN Server settings".  TURN Server Address (Server) is the intenal server IP address that the Call Bridge will use to access the TURN server.  TURN Server Address (Clients) is the public IP address assigned to the TURN server that external clients will use to access the TURN server.

6.  Finally you can enable the webbridge module on Edge, it will allow internal and external participants to join a meeting with their WebRTC capable browser.

First of all, certificate again.

CMS Edge:
pki csr webbridge CN:webbridge.xcloud-hk.com
pki selfsigned webbridge

Copy your core CallBridge certificate to Edge, your webbridge service needs to trust your callbridge cert.  Then config the webbridge parameters:
webbridge listen a
webbridge certs webbridge.key webbridge.crt
webbridge trust callbridge.crt
webbridge http-redirect enable
webbridge enable

After configured, you can type "webbridge" to check your configured parameters.

Go to Configuration > General, enter your Guest account client URI, for example https://webbridge.xcloud-hk.com.  The Guest Account JID domain is your domain, in my case it is xcloud-hk.com

Depends on your DNS settings, you might need a few static entries on your edge, to resolve the xmpp SRV to your local loadbalancer FQDN.

dns add rr "loadbalancer.xcloud-hk.com. IN A 10.1.90.124"
dns add rr "_xmpp-server._tcp.xcloud-hk.com. 86400 IN SRV 0 5 5269 loadbalancer.xcloud-hk.com."
dns add rr "_xmpp-client_tcp.xcloud-hk.com. 86400 IN SRV 0 5 5222 loadbalancer.xcloud-hk.com."

After all these steps, you should be able to use webbridge to join a meeting with WebRTC.

In summary, we have covered the integration between core and edge in a single split deployment, and we can enable a few service modules on edge including SIP Edge, TURN and WebBridge, for different call scenarios especially for B2B calls.

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

Cisco Meeting Server (CMS) Part 2 - XMPP and CMA

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

In our previous post - Part 1 (http://pandaeatsbamboo.blogspot.hk/2016/08/making-your-first-call-to-cisco-meeting.html), we have set up the basics of CMS, and making our first call to CMS Space, as well as allowing multiparty video conference with CMS.  Now let's do something else.  XMPP is a service module that is running on CMS Core, one of its function is to allow Cisco Meeting App (CMA) to login and be one of the soft client running on PC / Mac / mobile devices.  We are going to go through a few steps and at the end of this post, you will be able to login your CMA and start to make calls.

Setting up XMPP in CMS Core

1. If you want to create a csr for your CA to sign, you can use the pki csr command.  In my lab I am using self sign cert to make it simple.

pki selfsigned xmpp

2. Configure xmpp interface, certs and domain.

xmpp listen a
xmpp certs xmpp.key xmpp.crt
xmpp domain uc.xcloud-hk.com
xmpp enable

You can check your configuration with the command xmpp status, or simply xmpp.

 

3. Add Callbridge to your XMPP.  You can give your callbridge a name / tag, it doesn't necessary the hostname / FQDN of your callbridge.

xmpp callbridge add cms



Remember the name of your callbridge that was entered and the secret.  If you forgot that, you can use this command to check.

xmpp callbridge list



4. Switch back to the web interface, under Configuration > General, under XMPP server settings, enter the domain, server address, call bridge name and secret that you have got from step #3.



5. Make sure you have the DNS A and SRV records are created in your internal DNS.

In my lab it is a Windows one.

Host record of my CMS core:


SRV record (_xmpp-client, _xmpp-server):






6. AD integration.  There is no option to create local users on CMS, this is my lab AD information that I've put in the CMS UI.



7. Get your Cisco Meeting App (CMA) from Cisco.com if you are testing with your Windows / Mac.  For mobile app you can download it from iTunes store / Google Play Store for free.

Sign in with your AD credential.  The format of the username will be username@domain



This is what you should expect after logging in:


After these steps, you are now able to login and use CMA as your client for calls.

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

New Wireless phone 8821 is now available

After a prolonged wait, the next generation of 7925 is released.  A few things noted from the datasheet, including hardened design with IP67 and MIL-STD-810G compliant, security enhancement by supporting SHA2 and SCEP, and better wireless radio by supporting 11ac.

8821 datasheet:
http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/wireless-ip-phone-8821/datasheet-c78-737346.html?cachemode=refresh

8821-EX datasheet:
http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/wireless-ip-phone-8821-ex/datasheet-c78-737347.html?cachemode=refresh

CSR 11.5 documentation is now live!

Documents are all here:
http://www.cisco.com/c/en/us/support/unified-communications/collaboration-systems-release-11-5/model.html

Updated Compatibility matrix
http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/uc_system/unified/communications/system/Compatibility/CSR-Compatibility-Matrix-InteractiveHTML.html

Old phones will not be supported in UCM 11.5

This is something that caught my attention.  Unlike the previous release, in UCM 11.5 it is going to remove some of the old phones support.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/11_5_1/cucm_b_release-notes-cucm-imp-1151/cucm_b_release-notes-cucm-imp-1151_chapter_010.html

Deprecated Endpoints
As of Cisco Unified Communications Manager Firmware Release 11.5, the following phones are not supported:

• Cisco IP Phone 12 SP+ and related models
• Cisco IP Phone 30 VIP and related models
• Cisco Unified IP Phone 7902
• Cisco Unified IP Phone 7905
• Cisco Unified IP Phone 7910
• Cisco Unified IP Phone 7910SW
• Cisco Unified IP Phone 7912
• Cisco Unified Wireless IP Phone 7920
• Cisco Unified IP Conference Station 7935

If you use any of these phone models on an older release of Cisco Unified Communications Manager and you upgrade to Release 11.5, the phone will not work after the upgrade completes.

CUCILync 10.6(2) now supports Skype For Business!

In the release notes, now support S4B 2015 32-bit edition:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucilync/10_6/CUCI_BK_CE922F5E_00_cucilync_10-6_releasenotes/release_notes.html#CUCI_RF_N256FFA5_00

Reserving 1 physical CPU core for Unity Connection?

Starting from VMWare ESXi 5.5 and Unity Connection 10.5.2, you no longer need to reserve 1 CPU core for Unity Connection.  Please see the URL and text below:

http://docwiki.cisco.com/wiki/Virtualization_for_Cisco_Unity_Connection

Quote:
"VMWare release 5.1 and older, requires reserving one physical core per physical server - see co-residency policy. With VMWare release 5.5 and later and Unity Connection release 10.5.2 and later while utilizing the latency sensitivity feature, you may remove the requirement of dedicated one physical core per physical server. This requires the Unity Connection VM Latency Sensitivity to be set to 'High' while at least one other VMs is set to 'Normal'. Recommend every VM to be set to 'Normal' except for Unity Connection VMs."

CUCM and CUC Publisher Rebuilt

The CUCM and CUC Publisher in my lab was crashed due to a disk failure.  Luckily my subscribers are in different LUN, and at least I don't need to rebuild the whole cluster.  This is what I have done and I want to share my experience and hiccup during the rebuilt in this post.

UCM Publisher Rebuilt

For UCM I am following this guide and it is a well written one.  This is what I have done based on the guide.

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/116946-technote-product-00.html

1. Gather Cluster Data on Subscriber

2 commands – show network cluster and show version active to get the existing cluster info

2. Stop DB Replication on all subscribers

This is important, you will not want the new publisher sync the NEW database with your existing one in subscriber.  You want the other way round, so stop the dbreplication service.

3. Install the new CUCM Publisher with the same hostname, IP address, domain name, security passphrase, exact UCM version and installed COP files

Install it with a bootable media.

4. Update Processnode Values on the Publisher

I am running 10.5(2), therefore I need to issue the command "utils diaster_recovery prepare restore pub_from_sub" command on the new publisher CLI before adding nodes to System > Server

Retrieve the node list from the existing subscriber – run sql select name,description,nodeid from processnode

Go the the Publisher UCM Admin Page, add the node after you receive the node list.

5. Reboot Publisher

Using the command "utils system restart"

6. Verify Cluster Authentication

Do it on publisher after it restarts, make sure the cluster in the "authenticated" state.

7. Perform a new backup

Add a Backup Device, I am using a linux machine to store the backup.

Start a manual backup

8. Publisher Restore from the Subscriber DB

I have encountered an issue during restore with the error message -  "Unable to send network request to master agent.  This may be due to Master or Local Agent being down".

I have tried a few things

- Regenerate ipsec cert and restart DRF master and local agent – it doesn't work

Solution

• Remove cup1 and cup2 in Server list on publisher UCM admin page.  Then it works.  DRF requires all host up and running in the server list.  One of my CUP node is not responding (due to my disk LUN failure)

Check the Publisher node check box (UCM1) and choose the subscriber DB from which restoration takes place, in my case UCM2, then click Restore.

9. Restore Status

When the restoration reaches the CCMDB component, the status text shows "Restoring Publisher from Subscriber Backup"

10. Run a Sanity Check on the Publisher DB

These 2 SQL statements will give you a gut feeling if the DB restore works or not.

11. Reboot the Cluster after restore

12. Verify Replication Setup

13. Post Restore

Activate services and install device packs

CUC Publisher Rebuilt

Steps for CUC Publisher Rebuilt are similar.

1. Gather Cluster Data

2. Stop Replication on All Subscribers

3. Install the CUC Publisher

4. Update Processnode Values on the Publisher

5. Reboot the Publisher Node

6. Verify Cluster Authentication

7. To Connect the Subscriber Server to the New Connection Cluster, and Replicate Data and Messages to the Publisher Server

This step is different.  We are not using DRS to do the DB restore.  Run the command "utils cuc cluster renegotiate" on subscriber

The publisher server will automatically restarts.

"show cuc cluster status" on subscriber to verify new cluster has been configured correctly.

Good luck!

CWMS 2.0 Step-by-Step Installation Guide

Here comes the CWMS 2.0 step-by-step installation guide I have screen captured in my lab.  Due to lab resource constraint I don't have IRP in my lab, this guide will cover admin node, media node installation as well as UCM integration in a step-by-step manner.

1. To install CWMS 2.0, you can first deploy the CWMS ova file via vCenter.  You can choose your desired sizing configuration.  In my case I have chosen 250 users configuration and firstly install the "Admin" node.  

2.  Enter the network configuration details for your CWMS Admin node.

3.  Once the OVA file is deployed, you can check the VM console via vCenter.

4.  Once the CWMS admin node deployment is completed, you can access the URL provided at the bottom of the screen to start the configuration wizard with a web browser.

5. Choose the language that you desired for your deployment.

6. In my case this is a newly deployed system.

7. Click Next.

8. Choose "Install a primary system"

9. Choose Automatic if you want to deploy the media virtual machine automatically by the admin node via vCenter.

10. Enter your vCenter information so that CWMS admin node can help you deploy media node and optionally IRP node.

11. Choose your host, datastore and VM port group.

12. Enter the FQDN of the media node that you are going to deployed.  I have already added the host record in my internal DNS server, so no IP address is needed to fill in.

13.  Optionally enable IRP if you want to allow external access to your CWMS.  In my case I will not install it for now.

14.  This is an additional IP address that is needed for WebEx site and admin access.  It must be on the same subnet as the admin node VM.

15.  Create DNS records for WebEx site and admin URL, forward map to the private VIP address.

16.  Click Next.

17.  The CWMS media node deployment will start.  Check your vCenter status.

18.  Check the deployment status on web deployment wizard and VM console.  Click Next.

19.  It will check the system against the hardware resources that you have.  In my lab I don't have enough CPU speed, but since it is a lab I will ignore it for now.

20.  Your admin node and media node is now ready.  Click Continue.

21. Configure your email server.

22.  Configure timezone and Locale.

23. Click Confirm.

24. Create admin account and create new password.

25.  Login with your new admin account.

26.  Congratulations!  You have basic setup completed.  Now let's work on the integration part.

27.  This is the CWMS system dashboard.  Click Users.

28. Choose Directory Integration.  Add CUCM server.  Provide UCM credentials.

29.  Click Enable LDAP Authentication if this is what you want.

30. You should now get all your users imported to CWMS!  Next thing we will work on the voice integration part.  Firstly put the system into maintenance mode.

31. Go to Settings > Audio.  Click Continue.

32.  Note the SIP configuration, click Continue.

33.  Add UCM address and ports information. 

34.  Click Continue.

35. Configure the dial-in number.  In my lab the number is 8567.

36.  Okay!  So basically the CWMS part is done.  Let's move to UCM.  Create 2 SIP Trunk Security profiles as below.

37.  Create 2 SIP trunks to CWMS load balancing and application point.  Reset trunk after create.

38.  Create Route pattern to route the call in number to CWMS via the Load Balance Point SIP trunk.

39.  Create SIP Route Pattern with IP address routing via the CWMS Application point SIP trunk. 

40.  Click Continue to turn off the system maintenance mode and the system will be automatically restart.

Done!  Try to make a call to your call in number and you can listen to the CWMS voice prompt!  Try to schedule / attend a meeting and see how it works!

Evernote helps you remember everything and get organized effortlessly. Download Evernote.