Mobile Supervisor on iPhone

My environment:  Mobile Supervisor for iPhone 2.0.2.0, UCCX 8.0

Just one quick note, if you want to use the Mobile Supervisor client on iPhone, you need to specify the IP address and port number in iPhone Settings > Supervisor.  The port number is 12028.

Using CAD integrated browser for SocialMiner

My environment: UCCX 8.0.2 on Windows 7, SocialMiner 8.5

Just wanna share some experience with you that how to get it works. The problem I had is, when I used the Windows 7 IE 8 to browse the SocialMiner page, it works fine. However when I used the CAD integrated browser to browse SocialMiner page, it shows the error "This version of Internet Explorer is not supported. Internet Explorer 8 or later is required"

When I visit the page: http://www.quirksmode.org/js/detect.html, it detected that the integrated browser running is IE 7 instead of IE 8. This is because for compatibility purposes, the WebBrowser control is running IE 7 standard mode instead of IE 8:

http://blogs.msdn.com/b/ie/archive/2009/03/10/more-ie8-extensibility-improvements.aspx

The changes I have made is, based on the above link, under FEATURE_BROWSER_EMULATION, add a new dword named "agent.exe", with the value decimal 8888 to force IE 8 standard mode. For Windows 7 64-bit, the path is different:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

After making the changes, restart the computer then you will see SocialMiner page shown in the CAD integrated browser!

Please be aware this is for lab settings only, changing the above values may have support issue!

CME + CUE integration

My environment:  CME and CUE 7.0


CUE can be configured to integrate with CME and UCM, in this post I will give you an example on how to create integration between CME and CUE.  Make sure you have the correct license, as integrating with CME and UCM requires different licenses.


Sample Configuration for CME+CUE integration

On CME side

interface in1/0

     ip unnumbered gi0/0.502

     service-module ip address 1.2.3.253 255.255.255.0

     service-module ip default-gateway 1.2.3.254

ip route 1.2.3.253 255.255.255.255 in1/0

dial-peer voice 4050 voip

     destination-pattern 4050

     session protocol sipv2

     session target ipv4:1.2.3.253

     dtmf-relay sip-notify

     codec g711ulaw

     no vad

telephony-service

     voicemail 4050

ephone-dn 11

     call-forward busy 4050

     call-forward noan 4050 time 10

ephone 14

     number 8000....

     mwi on

ephone 15

     number 8001....

     mwi off

On CUE side

ccn application voicemail

     max session 4

ccn trigger sip phonenumber 4050

     application voicemail

     enabled

     maxsession 4

Done!  You can try to either call in the voicemail pilot or press the envelop button see if you can hear the prompt.  Next step is to create the user in CUE then you can leave a message.

Some other commands that you will find it useful during the integration.

Factory Reset CUE

On CUE

offline

restore factory default

Other commands

CME:     service-module in1/0 session

CUE:     show software license

CUE:     software install clean url ftp://1.2.3.4/xxx.pkg

Cisco Videoscape

A few interesting Videoscape video to share:

Cisco at CES 2011 - Videoscape Demo

Cisco Videoscape Demo - CES 2011

Cisco Videoscape All Together

cBarge and Privacy on CME

My environment:  CME 7.0

Barge (SIP)
- use built-in bridge
- max 3 parties
- for SIP shared line only

cBarge (SCCP and SIP)
- SCCP octo-line
- SIP shared line

Privacy
- SCCP octo-line and SIP shared line
- enabled by default

Privacy on Hold
- disabled by default

cBarge Configuration (SCCP)
! Enabling cBarge Softkey
ephone-template  1
softkeys remote-in-use  CBarge Newcall

ephone  1
ephone-template 1
button  1:1

! Create IOS conference bridge
sccp local gi0/0.502
sccp ccm 1.1.1.254 id 1 ver 7.0
sccp

sccp group ccm group 1
     associate ccm 1 pri 1
     associate profile 1 register CME-CFB

dspfarm profile 1 conference
     codec g711ulaw
     max session 4
     associate application SCCP
     no shut

telephony-service
     sdspfarm unit 4
     sdspfarm tag 1 CME-CFB
     conference hardware

Privacy and Privacy on Hold
! System Level
telephony-service
     privacy
     privacy-on-hold

! Phone Level
ephone 1
     privacy on
     privacy-button

Show Command
sh sdspfarm unit all
sh sccp
sh dspfarm dsp all

Note
- When privacy on hold is enabled globally, when the phone enabled privacy (the privacy button is on), you can't see the phone is on hold on the shared line.  If you disable the privacy on hold, then even the privacy button is on, you can see the phone is on hold.

Shared Line and Overlay DNs on CME

When you have started to work on CME, you will find that there are several types of shared DNs that is possible which allow great flexibility to fit your customer needs.  In this post I will lay out 3 scenarios with configuration and expected result, so that you can get better understanding on how it works.

My environment:  CME 7.0

Scenario 1 - one ephone DN for multiple ephone

ephone-dn 1 dual-line
     number 4001

ephone 1
     button 1:1

ephone 2
     button 1:1

- When receive a call to 4001, both ephone 1 and 2 will ring. 
- ephone 1 answers call, ephone 2 in remote in use state
- another incoming call will go to ephone 1 second channel
- yet another incoming call - will busy out, the call will not roll over to ephone 2
- ephone 2 can't use that line for outgoing call

Scenario 2 - 2 ephone-dn with same number with preference

ephone-dn 1 dual-line
     number 4001
     preference 1

ephone-dn 2 dual-line
     number 4001
     no huntstop
     huntstop channel

ephone 1
     button 1:1

ephone 2
     button 1:2

- ephone-dn 2 is preferred to ring when somebody calls 4001
- no huntstop on ephone-dn means it continues to search for another ephone-dn with the same number, so the call will roll over to ephone 1 when ephone-dn with at least 1 channel occupied, because of the huntstop channel command

Scenario 3 - 2 ephone-dn overlays to the same button

ephone-dn 1 dual-line
     number 4001
     preference 1

ephone-dn 2 dual-line
     number 4001
     no huntstop
     huntstop channel

ephone 1
     button 1o1,2

ephone 2
     button 1o1,2

- Both phones will ring.  Say for example ephone 1 answers the call, ephone 2 still able to receive new incoming calls to 4001, and make call using the line 4001
- When ephone 1 answers the call, a new call to 4001 coming in and ephone 2 will ring, without showing call waiting on ephone 1
- If you want call waiting, then use "c" instead of "o"

Tricks of integrating XenDesktop DDC with VMWare vCenter

My environment:  VMWare vCenter 4.1 on Windows 2008 server, ESXi 4.1, Citrix XenDesktop DDC 4

Citrix XenDesktop is the VDI products from Citrix, and it is flexible that the desktop client VM can run on Citrix XenServer and VMWare ESXi.  You can choose your preferred hypervisor for your client VMs.  In my testing I am using ESXi as the hypervisor for the client VMs. 

Integration is needed between Citrix DDC and VMWare vCenter because you need to know which VMs on your ESXi server hosting the client VMs.  During my integration work I have got the following error message in the Create Desktop Group wizard in DDC:

‘Invalid Address – The hosting infrastructure could not be reached at the specified address.’

The workaround is to allow both HTTP and HTTPS for SDK access on vCenter, to do this you can:

1. Edit C:\ProgramData\VMware\VMware VirtualCenter\proxy.xml with your wordpad, and change the access mode of /sdk from httpsWithRedirect to httpAndHttps

<e id="5">
      <_type>vim.ProxyService.LocalServiceSpec</_type>
      <accessMode>httpAndHttps</accessMode>
      <port>8085</port>
      <serverNamespace>/sdk</serverNamespace>
    </e>

2. In DDC, when you are creating integration with vCenter, you can use the URL http://1.2.3.4/sdk where 1.2.3.4 is your vCenter IP address.  You can now allow HTTP access to your vCenter SDK.

Have fun!

How to run Cisco Mobile 8.1 over SSLVPN over 3G

My environment: AnyConnect 2.4.4009 on iPhone, Cisco Mobile 8.1 on iPhone, ASA Software 8.2.3

During my test I have learnt a few tricks that want to share with you guys who want to test / play / deploy it.

1. Setup the TCT device on UCM base on the admin guide here.

2. When you setup the Cisco Mobile, no matter 8.0 or 8.1, when you configure the directory settings, you need to enter port 389 although the field is optional and you are running on default LDAP port.  Otherwise the apps will close by itself!!

3. I have encountered weird problem that my Cisco Mobile registered to UCM, but it can’t make or receive any calls.  The call is either fail to setup, without ring back tone or second call fail.  To solve it, check if you have turned on SIP inspection on ASA.  To turn it off:

policy-map global_policy
class inspection_default
no inspect sip

Good Luck!

VPN Phone for Cisco UC

My environment:  UCM 8.0.3, ASA Software 8.2.3
VPN phone is one of the alternatives to extend the UC capabilities to remote workers.  I have both 79xx and 99xx phones in my lab, however even though I upgrade the 99xx firmware to 9.1(1)SR1, the VPN feature isn’t working and seems 99xx will only work with UCM 8.5.  The 79xx phones work fine.
Configuring ASA SSL VPN with self-sign CA
1. Generate RSA key for certificate
crypto key generate rsa label sslvpnkeypair
2. Create trustpoint for self-signed cert
crypto ca trustpoint localtrust
enrollment self
fqdn sslvpn.panda.com
subject-name CN=sslvpn.panda.com
keypair sslvpnkeypair
crypto ca enroll localtrust noconfirm
ssl trust-point localtrust outside
3. Download Cisco_Manufacturing_CA.pem and CAPF.pem from UCM Certification Management.  Import it to ASA via the following command:
crypto ca trustpoint CiscoMfgCert
enrollment terminal
crl configure
crypto ca trustpoint CAPF
enrollment terminal
crl configure

crypto ca authentication CiscoMfgCert

! Enter the text content in the Cisco_Manufaturing_CA.pem cert

crypto ca authentication CAPF

! Enter the text content in the CAPF cert

4. Copy AnyConnect image to flash, then specify the image location

webvpn
svc image disk0:/anyconnect-win-2.0.0343-k9.pkg 1
5. Enable AnyConnect Access
webvpn
enable outsidesvc enable
6. Create Group Policy
ip local pool SSLClientPool 192.168.25.1-192.168.25.50 mask 255.255.255.0
group-policy SSLCLientPolicy internal
group-policy SSLCLientPolicy attributes
dns-server value 1.1.1.1
vpn-tunnel-protocol svc
default-domain value panda.com
address-pools value SSLClientPool
6. Configure ACL bypass
sysopt connection permit-vpn
7. Create a connection profile and tunnel group for client connections
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
default-group-policy SSLCLientPolicy
tunnel-group SSLClientProfile webvpn-attributes
group-alias SSLVPNClient enable
webvpn
tunnel-group-list enable
8. Configure NAT Exemption, say for example 192.168.50.5 is the UCM that you want the client in the pool 192.168.25.0 can access.
access-list no_nat extended permit ip host 192.168.50.5 192.168.25.0 255.255.255.0
nat (inside) 0 access-list no_nat
9. Adding remote access users
username vpnphone password pandavpn
username vpnphone attributes
service-type remote-access
10.  Encryption algorithm
ssl encryption aes128-sha1
ssl trust-point localtrust outside

More detail information about the ASA configuration, check out here.


VPN Phone Configuration
1. From ASA, export the self sign CA cert
crypto ca export localtrust identity-certificate
Copy and paste the text and name the file with extension .pem
2. Create a Group URL.  This is needed in the later steps of VPN phone configuration on UCM.
tunnel-group sslgroup webvpn-attributes
group-url https://1.2.3.4/vpnphone
3. Upload CA cert to UCM.  From UCM OS admin page, choose Security > Certificate Management.  Click Upload Certificate, and choose Phone-VPN-trust from the certificate name dropdown box.  Upload the certificate you’ve exported from ASA.
4. UCM Admin page > Advanced Features > VPN > VPN Gateway, enter the VPN Group URL.  Move the certificate from the truststore to your location.
5. Advanced Features > VPN > VPN Group, choose the VPN Gateway you’ve created in step 4.
6. Advanced Features > VPN > VPN Profile, choose the preferred authentication method.
7. Device > Device Settings > Common Phone Profile.  Create a new phone profile and assign VPN Group and VPN profile to the phone profile
8. Apply the Common Phone Profile to the phone you want to allow remote VPN access.
9. For 79xx phone, go to Security Configuration > VPN Configuration > Enabled.
10. You will be prompt for username and password.  You can now bring the phone home and test it!

Nexus 1000v Setup and Configuration

My environment:  Nexus1000v.4.0.4.SV1.3b, VMWare ESXi 4.1, vCenter 4.1

Nexus 1000v consists of VSM (control plane) and VEM (data plane).  VSM can run as a VM or in a standalone appliance.  In my setup I run it as a VM on one of my ESXi hosts.  The Nexus1000v software comes with both VSM and VEM within a zip file.

1. To install the VSM, locate the .ova file in the VSM folder.  In your vSphere client, click File > “Deploy OVF template”

2. During the deployment, you need to provide the following information:

• Control VLAN ID
• Packet VLAN ID
• Domain ID
• Management IP address

3. You can use the same vlan for control, packet and management, and do not place data traffic on this VLAN.  The wizard is quite straight forward so the details will not be covered here.

4. Next step is to create Nexus 1000v plug-in.  Browse the page http://vsm-ip-address and download the cisco_nexus1000v_extension.xml file

5. In vSphere Client, Plug-Ins menu, choose “Manage Plug-Ins”.  Click “Register Plug-In” and import the XML file downloaded from the VSM page.

6. Then connect your VSM to the vCenter

conf t

svs connection VC

protocol vmware-vim

remote ip address 1.2.3.4

vmware dvs datacenter-name panda-DC

connect

7. Then you can create system port-profile and data port-profile. 

port-profile type ethernet system-uplink
  vmware port-group
  switchport mode trunk
  switchport trunk allowed vlan all
  no shutdown
  system vlan 2010
  state enabled

port-profile type vethernet cciev-server
  vmware port-group
  switchport mode access
  switchport access vlan 100
  no shutdown
  state enabled

8. Next step is to install VEM, the easiest way is to do it via VMWare Update Manager.  In vSphere client > Update Manager > Patch Repository, click “Import Patch”, then choose the VEM module in the Nexus 1000v VEM folder.

9. Then create a new baseline.  Under Baseline and Groups, click create baselines.  Choose VEM under extensions. 

10.  You can now apply the baseline to the host.  In vSphere Client > Hosts and Clusters, choose the host you want to install VEM.  Click the Update Manager tab which is usually the last tab.  Click “Attach” to attach the baseline you’ve just created, then click Remediate to apply.

11.  Now the final step is to add the host to the Nexus 1000v switch.  Under Inventory > Networking, choose the Nexus 1000v switch and right click, click “Add host”.  Apply the system port-profile to the vmnic and apply appropriate data port profile to the VMs.

12.  After adding, you can type the command “show interface virtual” and “show module” on VSM to verify your work.