Goodbye MX200 and MX300. Hello Spark Room Kit and Room 55!

A few EoS/EoL announcements that you might need to be aware:

MX200G2:
https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-mx-series/eos-eol-notice-c51-739931.html?emailclick=CNSemail

MX300G2:
https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-mx-series/eos-eol-notice-c51-739932.html?emailclick=CNSemail

The recommended refresh will be Spark Room 55 or Spark Room Kit.

CE8.3:
https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-mx-series/eos-eol-notice-c51-739933.html?emailclick=CNSemail

You should start moving to CE 9.x, a lot of good stuff in the latest release:
https://www.cisco.com/c/dam/en/us/td/docs/telepresence/endpoint/software/ce9/release-notes/ce-software-release-notes-ce9.pdf

P40 camera related bundle:
https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-quick-set-series/eos-eol-notice-c51-739957.html?emailclick=CNSemail
https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-quick-set-series/eos-eol-notice-c51-739956.html?emailclick=CNSemail

Cisco Meeting Server (CMS) Part 3 - Integrating Core and Edge

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

In this post, we are going to deploy a single CMS Core and a single CMS Edge.

1. Certificate for Core and Edge.  Like our previous posts in Part 1 and Part 2, I am going to use self signed cert for simplicity.

CMS Core:
pki selfsigned core

CMS Edge:
pki selfsigned edge

2. Using WinSCP or other SCP / sFTP client, to download the CMS Core certificate, in my case it is core.crt.  Copy this Core certificate to Edge using your SCP client.

In CMS Edge, create the loadbalancer service module and config the certificate for authentication.  You will need to trust your Core certificate in Edge.  In my lab it is a single NIC Edge.

CMS Edge:
loadbalancer auth edge edge.key edge.crt core.crt
loadbalancer trunk edge a:4999
loadbalancer trunk public edge a:5222 lo:5222
loadbalancer enable edge

3. In CMS Core, you are required to create a trunk.  Similarly, copy the edge certificate to core, you will need to trust the edge certificate in core.  10.1.90.124 is the edge IP address.

CMS Core:
trunk create trunktoedge xmpp
trunk auth trunktoedge core.key core.crt edge.crt
trunk edge trunktoedge 10.1.90.124 4999
trunk enable trunktoedge

You can use the trunk debug trunktoedge (the tag name) to see whether the trunk is up on core.

4. There are a few service modules can be enabled on Edge.  If you want to enable SIP Edge, you will need the below command:

CMS Edge:
sipedge public a:5061
sipedge public-ip 1.2.3.4
sipedge private a:3061
sipedge certs sipedge.key sipedge.crt

5. Another service module on Edge is TURN.  To enable TURN, you will need the following command:

turn credentials admin admin xcloud-hk.com
turn listen a
turn public-ip 1.2.3.4
turn enable

From the web user interface, you can enter the details under "TURN Server settings".  TURN Server Address (Server) is the intenal server IP address that the Call Bridge will use to access the TURN server.  TURN Server Address (Clients) is the public IP address assigned to the TURN server that external clients will use to access the TURN server.

6.  Finally you can enable the webbridge module on Edge, it will allow internal and external participants to join a meeting with their WebRTC capable browser.

First of all, certificate again.

CMS Edge:
pki csr webbridge CN:webbridge.xcloud-hk.com
pki selfsigned webbridge

Copy your core CallBridge certificate to Edge, your webbridge service needs to trust your callbridge cert.  Then config the webbridge parameters:
webbridge listen a
webbridge certs webbridge.key webbridge.crt
webbridge trust callbridge.crt
webbridge http-redirect enable
webbridge enable

After configured, you can type "webbridge" to check your configured parameters.

Go to Configuration > General, enter your Guest account client URI, for example https://webbridge.xcloud-hk.com.  The Guest Account JID domain is your domain, in my case it is xcloud-hk.com

Depends on your DNS settings, you might need a few static entries on your edge, to resolve the xmpp SRV to your local loadbalancer FQDN.

dns add rr "loadbalancer.xcloud-hk.com. IN A 10.1.90.124"
dns add rr "_xmpp-server._tcp.xcloud-hk.com. 86400 IN SRV 0 5 5269 loadbalancer.xcloud-hk.com."
dns add rr "_xmpp-client_tcp.xcloud-hk.com. 86400 IN SRV 0 5 5222 loadbalancer.xcloud-hk.com."

After all these steps, you should be able to use webbridge to join a meeting with WebRTC.

In summary, we have covered the integration between core and edge in a single split deployment, and we can enable a few service modules on edge including SIP Edge, TURN and WebBridge, for different call scenarios especially for B2B calls.

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

Cisco Meeting Server (CMS) Part 2 - XMPP and CMA

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

In our previous post - Part 1 (http://pandaeatsbamboo.blogspot.hk/2016/08/making-your-first-call-to-cisco-meeting.html), we have set up the basics of CMS, and making our first call to CMS Space, as well as allowing multiparty video conference with CMS.  Now let's do something else.  XMPP is a service module that is running on CMS Core, one of its function is to allow Cisco Meeting App (CMA) to login and be one of the soft client running on PC / Mac / mobile devices.  We are going to go through a few steps and at the end of this post, you will be able to login your CMA and start to make calls.

Setting up XMPP in CMS Core

1. If you want to create a csr for your CA to sign, you can use the pki csr command.  In my lab I am using self sign cert to make it simple.

pki selfsigned xmpp

2. Configure xmpp interface, certs and domain.

xmpp listen a
xmpp certs xmpp.key xmpp.crt
xmpp domain uc.xcloud-hk.com
xmpp enable

You can check your configuration with the command xmpp status, or simply xmpp.

 

3. Add Callbridge to your XMPP.  You can give your callbridge a name / tag, it doesn't necessary the hostname / FQDN of your callbridge.

xmpp callbridge add cms



Remember the name of your callbridge that was entered and the secret.  If you forgot that, you can use this command to check.

xmpp callbridge list



4. Switch back to the web interface, under Configuration > General, under XMPP server settings, enter the domain, server address, call bridge name and secret that you have got from step #3.



5. Make sure you have the DNS A and SRV records are created in your internal DNS.

In my lab it is a Windows one.

Host record of my CMS core:


SRV record (_xmpp-client, _xmpp-server):






6. AD integration.  There is no option to create local users on CMS, this is my lab AD information that I've put in the CMS UI.



7. Get your Cisco Meeting App (CMA) from Cisco.com if you are testing with your Windows / Mac.  For mobile app you can download it from iTunes store / Google Play Store for free.

Sign in with your AD credential.  The format of the username will be username@domain



This is what you should expect after logging in:


After these steps, you are now able to login and use CMA as your client for calls.

Part 1 - Making your first call to CMS
Part 2 - XMPP and CMA
Part 3 - Integrating Core and Edge

Live streaming video from the Raspberry Pi with Camera v2

Just got my Raspberry Pi Camera v2, cannot wait to unbox and play with it.


I didn't get a good case to fit in the camera module, but it works.  :)


First of all you can start by taking a picture to make sure your camera is working fine:

raspistill -o image.jpg

To capture your first video, you can use the command raspivid:

raspivid -o video.h264

The video is in raw h.264 format.  It is fine to be played back by my omxplayer on the Raspberry, however if you want most of the other video players to play it, it will be better to convert the file into mp4.

sudo apt-get install gpac
MP4Box -fps 30 -add video.h264 video.mp4

For some application such as "motion", the motion detection and video streaming applications, it needs to recognised the video device as /dev/video0.  It is not the case by default for the Pi Camera.

To enable that, you need to run:

sudo modprobe bcm2835-v4l2

You can also put this command in /etc/rc.local so that the next reboot it will run automatically.

Motion is an open source motion detection and surveillance software which can help you to convert your Raspberry Pi into a home surveillance camera.  To start with, you can get the motion package:

sudo apt-get install motion

A few parameters under motion.conf that you can change, such as:

daemon on

which makes the motion run in background when you start the motion server.

You can also change the resolution in the conf file:
width 1280
height 720

change the following parameter to off so that you can access from host other than localhost:
stream_localhost off
webcontrol_localhost off

You can now access the stream via http::8081


And you will get a bunch of files in your home directory, make sure you have enough storage, if not probably you might need to do it off box to a NAS or whatever it is.  These files are created when motion is detected.



These are the links that I've used to aid my setup, listing all here for your reference:
http://www.instructables.com/id/Raspberry-Pi-as-low-cost-HD-surveillance-camera/?ALLSTEPS
http://www.makeuseof.com/tag/raspberry-pi-camera-module/
http://www.raspberrypi-spy.co.uk/2013/05/capturing-hd-video-with-the-pi-camera-module/

Precision 60 camera - Support SX20?

Precision 60 camera is a nice camera with good horizontal FoV:
http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-precision-cameras/datasheet-c78-734009.html

It is the widest FoV (80 degree) after the x2.5 camera has announced end of sales.  However it only support SX80, but NOT mid-range SX20.  So if you want to have a good horizontal FoV in a small room, you can either choose SX80 + P60, or MX200G2, because MX200G2 is using the 2.5x camera with 83 degree horizontal PoV.

MX200G2 datasheet:

http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-mx-series/data-sheet-c78-729734.html

SX10 - H.323 Support in CE8.2

Besides expanding portfolio supports in Cisco Spark room services (check here), another added feature in CE8.2 is the SX10 H.323 support.  Previously SX10 only supports SIP for registration, in CE8.2 it supports H.323 as well so now in line with the rest of the video endpoints.

CE8.2 - Cisco Spark on-boarding

SX10N is the first endpoint that is supported to register to Cisco Spark cloud service.  Starting from CE8.2, all the remaining SX, MX and DX endpoints are supported to register to Cisco Spark cloud.  There are some considerations that you need to take if you want to register the endpoints to the Spark cloud.  According to the release notes:
http://www.cisco.com/c/dam/en/us/td/docs/telepresence/endpoint/software/ce8/release-notes/ce-software-release-notes-ce8.pdf

So it means that SX10 and SX20 are supported only when using TRC6 remote, but not Touch 10.  On SX80 only directing pairing of Touch 10 is supported, but not network pairing.  This is something that people will possibly miss out if not reading the release notes carefully.

Expressway 8.8 - Video Endpoint registration

This is something that catches my attention in the release notes.  In the previous release, one of the major difference between VCS and Expressway is the ability to register video endpoints.  While VCS allows endpoint registrations, Expressway works together with UCM and all the endpoints are registered to UCM as single call control.  For UCM centric customers with 3rd party video endpoints, they will need to deploy a pair of VCS just for 3rd party video endpoints registration.

Now with Expressway 8.8, it allows endpoint registrations, which means you can have your DX, SX and MX endpoints register directly to Expressway.  It also allows 3rd party endpoint registration, however for this release, only SIP endpoints are supported.  H323 will be supported in future releases.

The licensing model for Expressway registrations will follow the UCM UCL / CUWL / Telepresence room systems licensing, instead of the VCS way.  It allows you to starts small with relatively less investment.  It also makes it easier for existing UCM customers to understand this new licensing model on Expressway.

Can you run Expressway alone without UCM for video centric deployment?  Technically you can, however you will lose advance UCM capability such as Jabber, Extension Mobility, SNR, Shared Line, Multiline, VM/UM, etc.  If you want to have these capabilities in your environment, registering these endpoints to the UCM is suggested, with Expressway as your collaboration edge for B2B, MRA, CMR Cloud, etc.

Release notes:
http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/release_note/Cisco-Expressway-Release-Note-X8-8.pdf

Page 22:


Page 70:


Related post:
Collaboration Edge - Step-by-Step integration guide with UCM:
http://pandaeatsbamboo.blogspot.com/2014/06/collaboration-edge-expressway-step-by.html

Multistream meetings - Layout

Multistream is a new feature introduced in CE 8.0.  This is the Cisco implementation of H.264 SVC.  This post is targeted to share with you the difference in the layout and user experience for pre-CE and post-CE 8 endpoints.

http://www.cisco.com/c/dam/en/us/td/docs/telepresence/endpoint/software/ce8/release-notes/ce-software-release-notes-ce8.pdf



This is the layout of a multi-party conference call on MX300G2 with CE 8 firmware.  The call is terminated on a mm820 telepresence server blade with multistream enabled.  It has a maximum 4 participants at the top when the remote end is sharing the presentation.  The number of additional participants are showed at the bottom right corner.





Comparing with this SX20 endpoint that is running TC 7.3.4 and you can spot the difference.  Presentation is occupying the majority of the screen, and the main video at the top is showing active speaker as the major portion, with tiny activepresence for non-active speaker at the bottom of the main video.  There is significant improvement of user experience with multistream enabled.

From the call statistics on the web interface, you will notice there are multiple incoming video instead of a single video from Telepresence Server.

IP dialling from Telepresence endpoints with UCM

The latest strategy / best practice for telepresence deployment is to register all the endpoints to UCM instead of VCS, and using Expressway C and E for B2B calls.  There are several feature gaps, for endpoints register to UCM and VCS, one of the most common ask is IP dialling.  In an ideal world we can make calls and receive calls with SIP URI, but there are still quite a lot of endpoints / users in the field using IP address dialling to make calls.  I have read a very good post from UC Guerrilla and I have tested option 1 which works quite well in my lab environment.  (My lab environment:  UCM 10.5 + Expressway 8.2)

http://www.ucguerrilla.com/2014/02/cisco-telepresence-endpoints-and-ip.html

For the end user who wants to make outgoing IP address dialling, they can make a call to URI ip@a.b.c.d where a.b.c.d is the IP address.

On UCM, you need to define the SIP route pattern beforehand.

Then what I need to do is to simply add a transform on the Expressway-C to remove the "ip@" suffix.  You also need to have a search rule to route the IP address to Expressway E then to the DNS Zone.  Try to make a call using IP dialling now!

Collaboration Edge - Expressway Step-by-Step guide

There are 4 reference guides that is useful for the setup.  You should cross reference each of those when it is needed.  The way I use it is as follow:

Cisco-Expressway-Basic-Configuration-Deployment-Guide-X8-1

Cisco-Expressway-Certificate-Creation-and-Use-Deployment-Guide-X8-1

Cisco-Expressway-SIP-Trunk-to-Unified-CM-Deployment-Guide-CUCM-8-9-and-X8-1

Mobile-Remote-Access-via-Expressway-Deployment-Guide-X8-1-1

The purpose of this post is to help you to setup Expressway-C and E with MRA features at one single place.  Hope you find it useful.

My environment:  UCM 10.5, CUP 10.5, Expressway 8.1

Basic Expressway Configuration

1.  First download the Expressway .ova from CCO.  Expressway C and E, as well as VCS-C and E are sharing the same base image, and use license file to determine the capability.

2.  Setting IP address for Expressway C and E.  In Expressway E I am using a dual-NIC deployment, and the advanced networking license comes for free so it is fine.  Remember to use the "xconfiguration ip route" or "xconfiguration routeadd" command to add host route back to your internal network, as your default route is pointing to your Internet service provider gateway.

3.  System > Administration to set the System Name

4.  System > DNS to set the System host name and domain name.  hostname.domain_name = FQDN of Expressway

5.  System > DNS to set Default DNS servers.  For Expressway-C it is configured with the internal DNS server and Expressway-E is configured with public DNS server.  This is important, because later on you will need your Expressway-C to resolve so internal SRV record to complete the Jabber and endpoint registration.

6.  System > Time to setup the NTP server

Certificate and CA 

In my lab I have created my own CA and sign the certificate for Exp-C, Exp-E, UCM tomcat and CUP tomcat.  

1.  Go to Maintenance > Security certificates > Server certificate to generate CSR

2.  The Common name is your Expressway FQDN, you don't need to fill up.  The Subject Alternative Name (SAN) should includes your domain name, both internal and external domain (e.g. pandaeatsbamboo.com, uc.pandaeatsbamboo.com).  For Expressway C you should include the chat node aliases in SAN.  You can find that under CUP admin page > Messaging > Group Chat Server Alias Mapping.  For Expressway E, you should include your collaboration edge SRV record.  So the SAN in your cert should look like this:

Expressway-C Subject Alternative Name:   DNS:expc.uc.pandaeatsbamboo.com, DNS:conference-2-StandAloneClusterda021.uc.pandaeatsbamboo.com, DNS:conference-3-StandAloneClusterda021.uc.pandaeatsbamboo.com

Expressway-E Subject Alternative Name:   DNS:expe.pandaeatsbamboo.com, DNS:_collab-edge._tls.pandaeatsbamboo.com, DNS:expe.uc.pandaeatsbamboo.com, DNS:pandaeatsbamboo.com, DNS:uc.pandaeatsbamboo.com, DNS:conference-2-StandAloneClusterda021.uc.pandaeatsbamboo.com, DNS:conference-3-StandAloneClusterda021.uc.pandaeatsbamboo.com

3.  Download your CSR

4.  If you have your CA in place, please skip the following steps.  In my lab I am using my MacBook with OpenSSL as the CA.  I have created several folders under /System/Library/OpenSSL

mkdir demoCA

cd demoCA

mkdir certs

mkdir newcerts

mkdir private

touch index.txt

echo 10 > serial

5. Copy /System/Library/OpenSSL/openssl.cnf to the demoCA directory, rename it to openssl_local.cfg

6. Modify openssl_local.cfg, under [CA_default] section, ensure the line "copy_extensions = copy" does not have a # at the beginning of the line.  Change "policy = policy_match" to "policy = policy_anything".  Change "dir = ./demoCA" to "dir = ."  Change "default_days = 365" to 3650 (10 years)

7. Generate private key for CA with the command:

 openssl genrsa -aes256 -out private/cakey.pem 4096

Enter your password to make sure you remember this, as you need this when you sign your cert.

8. Generate CA cert:

openssl req -new -x509 -days 3650 -key private/cakey.pem -config openssl_local.cfg -sha1 -extensions v3_ca -out cacert.pem

9. Enter the passphrase for the key, and enter the data requested.  Keep the CA cert cacert.pem and you will need this for Expressway and endpoints later on.

10. Copy the previously generated CSR from Expressway-C and E to the demoCA folder, and sign it with the command:

openssl ca -config openssl_local.cfg -cert cacert.pem -keyfile private/cakey.pem -in expc.csr -out certs/expc.pem -md sha1

11.  Upload the signed certificate - Expressway > Maintenance > Server certificate > Upload Server Certificate. 

12.  Upload your CA certificate if you are using your self-created OpenSSL CA - Expressway > Trusted CA certificate, choose the cacert.pem and upload. 

13.  Restart Expressway after certificate installation

Note: If you generate different certs with the same common name, you will get the error "openssl failed to update database.  TXT_DB error number 2".  If that is the case, modify your index.txt.attr file, change the unique_subject to no.

Configuring the traversal zone

1. Configure Expressway-C as traversal client zone, Expressway-E as traversal server zone.  Configuration > Zones > Zones

2. Click New, and fill in the fields.  Make sure the username and password is created in Exp-E under Configuration > authentication > local database.  Disable H.323 mode, and change the SIP TLS verify mode to "On".  Make sure Media encryption mode is "Force encrypted".  In Expressway-C, input FQDN instead of IP address in the Peer address field.  Make sure this FQDN is in Expressway-E SAN or Common name.

Expressway-C Traversal Zone configuration

Expressway-E Traversal Zone configuration

Configuring traversal zone search rules

Configuration > Dial Plan > Search Rules

Configuring DNS Zone

Configuration > Zones > Zones

Configuring DNS zone search rules

Configuration > Dial Plan > Search rules

Configuring external (unknown) IP address routing

Configuration > Dial Plan > Configuration

Configuration > Dial Plan > Search Rules

Configuring Unified CM for an Expressway trunk

1. UCM > System > Region information > Region.  Set "Maximum Session Bit Rate for Video Calls" to a suitable upper limit for the system say for 6000 kbps.

2. For the SIP profile that applies to phones, select the check box "Use Fully Qualified Domain in SIP Requests" and "Allow Presentation Sharing using BFCP".  

3. UCM > System > Security > SIP Trunk Security Profile, select Non Secure SIP Trunk Profile, checked the option "Accept Unsolicited Notification" and "Accept Replaces Header".  Change the port to something else other than 5060 and 5061, in my case I used 5062.

4.  Create the SIP trunk.  UCM > Device > Trunk > Add New.  Choose SIP Trunk as the Trunk Type, SIP as Device Protocol, None for Trunk Service Type.

5. Save your configuration and reset the trunk.

6. Configure the cluster FQDN on UCM.  UCM > System > Enterprise parameters, set the cluster fully qualified domain name to the same domain as the video network.

7. Call Routing > SIP Route Pattern > Add New.  In my lab I use the * wildcard to route everything in SIP URI format to Expressway via the Expressway trunk.

Configuring a neighbor zone on Expressway for Unified CM

Expressway-C > Configuration > Zones > Zones

Then you can create search rules back to Unified CM based on your dial plan.

Create your jabber-config.xml

This is my sample jabber-config.xml

<?xml version="1.0" encoding="utf-8"?>

<config version="1.0">

<Client>

  <CachePasswordMobile>true</CachePasswordMobile>

</Client>

<Directory>

  <DirectoryServerType>BDI</DirectoryServerType>

  <BDIPhotoUriSubstitutionEnabled>True</BDIPhotoUriSubstitutionEnabled>

  <BDIPhotoUriSubstitutionToken>sAMAccountName</BDIPhotoUriSubstitutionToken>

  <BDIPhotoUriWithToken>http://10.1.90.51/jabber/sAMAccountName.jpg

      </BDIPhotoUriWithToken>

  <BDIPrimaryServerName>10.1.90.10</BDIPrimaryServerName>

  <BDIPresenceDomain>uc.pandaeatsbamboo.com</BDIPresenceDomain>

  <BDIServerPort1>389</BDIServerPort1>

  <BDISearchBase1>OU=Cisco,DC=uc,DC=xcloud-hk,DC=com</BDISearchBase1>

</Directory>

<Policies>

    <EnableSIPURIDialling>true</EnableSIPURIDialling>

</Policies>

</config>

This allows SIP URI Dialing, and BDI for non-Windows domain users such as Jabber on iPhone, iPad, Android, Mac users, etc.

Configuring Expressway-C for Mobile and Remote Access (MRA)

1. Configuration > Unified Communications > Configuration

2. Configuration > Domains 

3.  Discover UCM and CUP on Expressway-C.  First of all, make sure you have replaced the tomcat cert on UCM and CUP.  Generate CSR on UCM and CUP on Unified Operating System Administration > Security > Certificate Management > Generate CSR.  Under Certificate Purpose drop down box, choose tomcat.  Click generate and download the CSR.  Sign the certificate with your CA, in my case I used my OpenSSL CA that created in prior steps.  Click "Upload Certificate / Certificate chain", choose "tomcat-trust" and upload your CA cert (e.g. cacert.pem) and click upload.  Then Upload your signed tomcat cert using similar steps, but this time choose "tomcat" instead of tomcat-trust.  Restart tomcat after you upload the cert.  Do the same thing for your subscribers as well.  Repeat the same steps for CUP.

4. Discover your UCM and CUP, make sure TLS verify mode is on.  Since TLS verify is on, you need to use FQDN instead of IP address, and this FQDN should includes in your tomcat cert common name or SAN.  (Probably you need to sign your CallManager cert and upload your CA as CallManager-trust in order to get the TLS verify mode to work)

5.  New zones and search rules are automatically generated after discovery

Configuring Expressway-E for Mobile and Remote Access (MRA)

1. Configuration > Unified Communications > Configuration to enable mobile and remote access, similar to what you have done on Exp-C

2. Check Status > Unified Communications, make sure all Unified Communications Services are Active.

Configuring Service Discovery on Public DNS

Service: _collab-edge

Protocol: _tls

Priority: 10

Weight: 10

Port number: 8443

Host: expe.pandaeatsbamboo.com

Service: _sips

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 5061

Host: expe.pandaeatsbamboo.com

Service: _sips

Protocol: _tls

Priority: 10

Weight: 10

Port number: 5061

Host: expe.pandaeatsbamboo.com 

Service: _sip

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 5060

Host: expe.pandaeatsbamboo.com  

Service: _sip

Protocol: _udp

Priority: 10

Weight: 10

Port number: 5060

Host: expe.pandaeatsbamboo.com   

Service: _sip

Protocol: _tls

Priority: 10

Weight: 10

Port number: 5061

Host: expe.pandaeatsbamboo.com   

Service: _h323ls

Protocol: _udp

Priority: 10

Weight: 10

Port number: 1719

Host: expe.pandaeatsbamboo.com    

Service: _h323cs

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 1720

Host: expe.pandaeatsbamboo.com    

Service: _h323rs

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 1719

Host: expe.pandaeatsbamboo.com  

Configuring Service Discovery on Internal DNS server

Domain:  pandaeatsbamboo.com (not uc.pandaeatsbamboo.com)

Service: _cisco-uds

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 8443

Host: ucm1.uc.pandaeatsbamboo.com   

Domain:  pandaeatsbamboo.com (not uc.pandaeatsbamboo.com)

Service: _cuplogin

Protocol: _tcp

Priority: 10

Weight: 10

Port number: 8443

Host: cup1.uc.pandaeatsbamboo.com   

If your internal domain name (e.g. uc.pandaeatsbamboo.com) is different from external domain name (e.g. pandaeatsbamboo.com), you still need to make sure the above SRV record are under the root domain but only resolvable internally.  You should not able to query the cuplogin and cisco-uds SRV record in public internet, otherwise the _collab-edge SRV record will not work and your Jabber MRA will not work.

Configure Voicemail and Jabber Photo web server access

To allow your Jabber to access voicemail, and the web server which contains the Jabber profile picture, you can configure the "HTTP server allow list" on Expressway-C:

MRA using Jabber

Download Jabber on iPhone / iPad via App Store and Jabber on Android via Google Play and give it a try!

To register EX via Expressway to UCM from Internet

Make sure you are using TC 7.1 onwards, and upload your OpenSSL CA cert to the unit.  From the EX web interface, Configuration > Security > CAs > Add Certificate Authority, upload your cacert.pem file and reload the unit.

After reload, use the touch panel to run the Provisioning wizard, and choose the option Cisco UCM via Expressway.  Enter your credential and it will work.  Make sure on UCM you have created your device already and you have associated your users to your phone devices.  On UCM you can see your EX is registered, and the IP address instead of your device internet IP address, it is your Expressway-C IP address.

That's all!  This is a long post but I hope it helps!