Cisco TelePresence Video Communication Server Service manual

Cisco TelePresence
Video Communication
Server
Administrator Guide
D14049.10
April 2011
Software version: X6.1

Contents
Contents
Contents 2
About the Cisco TelePresence Video Communication Server (VCS) 16
VCS base applications 16
VCS Control 16
VCS Expressway™ 16
Standard features 17
Optional features 17
FindMe™ 18
Device Provisioning 18
Dual Network Interfaces 18
About this guide 19
Typographical conventions 19
Installation and initial configuration 19
Using the web interface 20
Required fields 20
How page navigation is shown in this guide 20
Supported browsers 20
Using the command line interface (CLI) 21
Command types 21
Web page features and layout 22
What’s new in this version? 24
Session management 24
Client certificate-based authentication 24
Automatic updating of CRLs (certificate revocation lists) 24
Cisco AM GW available on VCS Expressway 24
Movi ClearPath provisioning 24
Improved cluster set-up process 24
Presence configuration 24
Overview and status information 25
Status overview 25
System information 26
Cisco VCS Administrator Guide (X6.1) Page 2 of 401

Contents
Ethernet status 27
IP status 28
Resource usage 29
Active administrator sessions 29
Active user sessions 29
Registration status 29
Registrations by device 29
Registrations by alias 30
Registration history 31
Registration details 32
Call status 32
Call status 32
Call history 33
Call summary 34
Call details 34
Call media details 34
Search history 35
About searches 35
Search history list 35
Search details 36
Local Zone status 36
Zone status 37
Link status 37
Pipe status 37
Policy service status 38
TURN relays status 38
Presence 39
Presence publishers 39
Presence presentities 39
Presence subscribers 40
OCS Relay status 40
Provisioning status 41
Provisioning server 41
Cisco VCS Administrator Guide (X6.1) Page 3 of 401

Contents
Phone book server 41
Warnings 41
Hardware status 42
Event Log 42
Configuration Log 43
VCS unit front panel 44
Network and system settings 45
Configuring IP settings 45
Configuring Ethernet settings 46
Configuring DNS settings 46
Configuring Quality of Service settings 47
Configuring system name and access settings 48
Configuring SNMP settings 51
Configuring time zone and NTP server settings 52
Configuring the Login page 53
Configuring external manager settings 53
Configuring logging levels 54
Event Log levels 54
Remote logging 55
Protocols 56
About H.323 56
Using the VCS as an H.323 gatekeeper 56
H.323 endpoint registration 56
About SIP 56
VCS as a SIP registrar 57
VCS as a SIP proxy server 58
Proxying registration requests 58
VCS as a SIP Presence Server 59
H.323 configuration 59
SIP configuration 60
Configuring SIP domains 62
Configuring SIP and H.323 interworking 62
Searching by protocol 62
Cisco VCS Administrator Guide (X6.1) Page 4 of 401

Contents
Enabling SIP endpoints to dial H.323 numbers 63
Registration control 64
About registrations 64
Finding a VCS with which to register 64
Registrations on a VCS Expressway 64
MCU, gateway and Content Server registration 65
Configuring registration restriction policy 65
Registering aliases 66
H.323 66
SIP 67
Attempts to register using an existing alias 67
Blocking registrations 67
Removing existing registrations 67
Re-registrations 67
About Allow and Deny Lists 68
Configuring the registration Allow List 68
Configuring the registration Deny List 69
Device authentication 70
About device authentication 70
Authentication Policy 70
Authentication mechanism 70
Authentication Policy configuration options 71
Zone-level Authentication Policy 71
Subzone-level Authentication Policy 73
SIP authentication trust 74
Device authentication configuration 75
Authentication database 75
Endpoint credentials used for authentication 75
Device authentication using LDAP 75
Authentication process 75
LDAP server settings 76
Device LDAP schemas 77
Authentication using a local database 78
Cisco VCS Administrator Guide (X6.1) Page 5 of 401

Contents
Authenticating with external systems 78
Zones and neighbors 79
About your video communications network 79
Example network diagram 79
Structuring your dial plan 80
Flat dial plan 80
Structured dial plan 80
Hierarchical dial plan 80
About the Local Zone and subzones 81
Bandwidth management 81
Local Zone searches 81
About zones 82
Default Zone 82
Zone configuration 82
Configuring neighbor zones 83
Configuring traversal client zones 86
Configuring traversal server zones 88
Configuring ENUM zones 91
Configuring DNS zones 92
Zone configuration: advanced settings 93
Zone configuration: pre-configured profile settings 98
TLS certificate verification of neighbor systems 99
Clustering and peers 100
About clusters 100
About the configuration master 101
Secure communication between peers 101
Alternates 101
Setting up a cluster 101
Maintaining a cluster 102
Cluster name 102
Cluster pre-shared key 102
Setting configuration for the cluster 102
Adding and removing peers from a cluster 102
Cisco VCS Administrator Guide (X6.1) Page 6 of 401

Contents
Changing the master peer 102
Monitoring the status of the cluster 103
Configuration that is not replicated across a cluster 103
Troubleshooting cluster replication problems 104
Managing clusters and peers 105
Sharing registrations across peers 105
Sharing bandwidth across peers 105
Cluster upgrades and downgrades 106
Cluster backup and restore 106
Clustering and FindMe 106
Clustering and Presence 107
Clustering and TMS 107
About the Cluster Subzone 107
Neighboring the local VCS to another VCS cluster 108
TMS Agent replication status 109
Dial plan and call processing 110
Call routing process 110
How the VCS determines the destination of a call 110
About the VCS's directory service 112
About hop counts 112
Configuring hop counts 112
About transforms and search rules 112
Transforms 113
Search rules 113
Dial plan configuration 113
About the fallback alias 114
About pre-search transforms 115
Pre-search transform process 115
Configuring pre-search transforms 115
Search and zone transform process 117
Configuring search rules 118
Example searches and transforms 120
Filter queries to a zone without transforming 121
Cisco VCS Administrator Guide (X6.1) Page 7 of 401

Contents
Always query a zone with original alias (no transforms) 121
Query a zone for a transformed alias 122
Query a zone for original and transformed alias 123
Query a zone for two or more transformed aliases 124
Stripping @domain for dialing to H.323 numbers 125
Transforms for alphanumeric H.323 ID dial strings 127
Allowing calls to IP addresses only if they come from known zones 129
Configuring policy services 129
About Call Policy 131
Configuring Call Policy 131
Configuring Call Policy rules using the web interface 133
Configuring Call Policy using a CPL script 134
Configuring VCS to use the Cisco TelePresence Advanced Media Gateway 135
Configuring the VCS 135
Usage features and limitations 135
Configuring Cisco AM GW policy rules 136
Dialable address formats 137
Dialing by IP address 138
Dialing by H.323 ID or E.164 alias 138
Dialing by H.323 or SIP URI 138
Dialing by ENUM 138
IP dialing 139
Calls to unknown IP addresses 139
About URI dialing 140
URI dialing without DNS 140
URI dialing via DNS 141
URI resolution process using DNS 141
URI dialing via DNS for outgoing calls 142
URI dialing via DNS for incoming calls 144
URI dialing and firewall traversal 146
About ENUM dialing 146
ENUM dialing process 146
Enabling ENUM dialing 147
Cisco VCS Administrator Guide (X6.1) Page 8 of 401

Contents
ENUM dialing for outgoing calls 147
Zone configuration for ENUM dialing 149
ENUM dialing for incoming calls 150
Configuring DNS servers for ENUM and URI dialing 151
Configuring a zone for incoming calls only 151
Call signaling configuration 152
Identifying calls 153
Disconnecting calls 154
Disconnecting a call using the web interface 154
Disconnecting a call using the CLI 154
Limitations when disconnecting SIP calls 154
Bandwidth control 156
About bandwidth control 156
Example network deployment 156
Bandwidth configuration 157
About downspeeding 158
About subzones 158
Default links between subzones 158
About the Traversal Subzone 158
About the Default Subzone 159
Configuring subzones 159
Configuring subzone membership rules 160
Applying bandwidth limitations to subzones 162
Links and pipes 163
Configuring links 163
Default links 164
Configuring pipes 164
Applying pipes to links 165
Bandwidth control examples 166
Firewall traversal 169
About firewall traversal 169
Expressway solution 169
How does it work? 169
Cisco VCS Administrator Guide (X6.1) Page 9 of 401

Contents
VCS as a firewall traversal client 170
VCS as a firewall traversal server 170
Configuring traversal server zones 170
Configuring other traversal server features 170
Quick guide to VCS traversal client - server configuration 170
Firewall traversal protocols and ports 172
Expressway process 172
H.323 firewall traversal protocols 172
SIP firewall traversal protocols 172
Ports for initial connections from traversal clients 172
Default port summary 173
TURN ports 173
Ports for connections out to the public internet 174
Firewall traversal and authentication 174
Authentication and NTP 176
Firewall traversal and Dual Network Interfaces 176
Firewall configuration 176
Configuring traversal for endpoints 176
Configuring traversal server ports 177
About ICE and TURN services 178
About ICE 178
About TURN 178
TURNrelay server 178
Configuring TURN services 179
TURN relay status information 180
Applications 181
Conference Factory 181
Conference creation process 181
About Presence 182
Presence Server 183
Presence User Agent (PUA) 183
Configuring Presence 184
OCS Relay 186
Cisco VCS Administrator Guide (X6.1) Page 10 of 401

Contents
Configuring a connection between the VCS and the OCS 186
About FindMe™ 187
How are devices specified? 187
FindMe process overview 187
Who must do what before FindMe can be used? 188
Recommendations when deploying FindMe 188
Example 188
Configuring FindMe 188
Searching for FindMe users 190
About provisioning (Starter Pack) 191
Starter Pack 191
Device authentication 191
Phone book support 191
Configuring provisioning 191
Maintenance 193
About upgrading software components 193
VCS software components 193
Prerequisites 193
Backing up before upgrading 194
Upgrading and option keys 194
Installing and rebooting 194
Upgrade procedure 194
Upgrading using secure copy (SCP/PSCP) 195
Option keys 196
Adding option keys using the web interface 196
Adding option keys using the CLI 197
About security certificates 197
Managing security certificates 197
CRL management 198
Certificate-based authentication configuration 199
Client certificate testing 201
Advanced account security 202
Prerequisites 202
Cisco VCS Administrator Guide (X6.1) Page 11 of 401

Contents
VCS functionality: changes and limitations 203
Configuring language settings 203
Changing the language 203
Installing language packs 204
About login accounts 204
Account authentication 204
Administrator accounts 204
User accounts 205
Root accounts 205
Configuring login account authentication 205
Account authentication using LDAP 205
Login history 207
Root account 207
Resetting an administrator or root password 208
Resetting user account passwords 208
Configuring administrator accounts 209
Password strength 209
Configuring administrator groups 211
Configuring user accounts 211
Principal devices (Starter Pack only) 213
Configuring user groups 214
Backing up and restoring VCS data 215
Limitations 215
Creating a backup 216
Restoring a previous backup 216
Creating a system snapshot 217
Incident reporting 217
Incident reporting warning: privacy-protected personal data 217
Sending incident reports automatically 218
Sending incident reports manually 218
Viewing incident reports 218
Incident report details 219
Checking the effect of a pattern 219
Cisco VCS Administrator Guide (X6.1) Page 12 of 401

Contents
Locating an alias 220
Port usage 220
Local VCS inbound ports 221
Local VCS outbound ports 221
Remote listening ports 221
Restarting 222
Restarting using the web interface 222
Rebooting 222
Rebooting using the web interface 223
Shutting down 223
Shutting down using the web interface 223
Shutting down using the CLI 223
Reference material 224
Software version history 225
X6 225
X5.2 226
X5.1 227
X5 230
X4 232
About Event Log levels 234
Event Log format 234
Administrator and FindMe user events 234
Message details field 235
Events and levels 237
CPL reference 244
CPL address-switch node 244
otherwise 246
not-present 246
location 247
rule-switch 247
proxy 248
reject 248
Unsupported CPL elements 248
Cisco VCS Administrator Guide (X6.1) Page 13 of 401

Contents
CPL examples 249
LDAP configuration for device authentication 256
Downloading the H.350 schemas 256
Configuring a Microsoft Active Directory LDAP server 256
Configuring an OpenLDAP server 258
DNS configuration examples 261
Verifying the SRV record 261
Microsoft DNS server 261
BIND 8 & 9 261
Changing the default SSH key 262
Default SSH key warnings 262
Standalone VCS 262
Clustered VCS 262
Restoring default configuration 263
Configuration items reset by DefaultValuesSet level 3 263
Configuration items reset by DefaultValuesSet level 2 264
Password encryption 266
Maximum length of passwords 266
Pattern matching variables 267
Port reference 269
Regular expressions 275
Supported characters 277
Case sensitivity 277
TMS Agent 278
FindMe 278
Device Provisioning 278
TMS Agent account passwords 278
TMS Agent passwords 279
TMS Agent LDAP and replication accounts 279
VCSs managed by TMS 279
VCSs not managed by TMS 279
What are traversal calls? 281
Warnings list 282
Cisco VCS Administrator Guide (X6.1) Page 14 of 401

Contents
Command reference — xConfiguration 287
xConfiguration commands 287
Command reference — xCommand 351
xCommand commands 351
Command reference — xStatus 372
xStatus elements 372
About policy services 387
Policy service request parameters 387
Policy service responses 388
Bibliography 389
Glossary 392
Legal notices 400
Intellectual property rights 400
Copyright notice 400
Patent information 400
Disclaimers and notices 401
Cisco VCS Administrator Guide (X6.1) Page 15 of 401

About the Cisco TelePresence Video Communication Server (VCS)
About the Cisco TelePresence Video
Communication Server (VCS)
The Cisco TelePresence Video Communication Server (VCS) enhances the video experience and
provides seamless communication between SIP and H.323 devices utilizing IETF and ITU standards.
The VCS is the center of the video communication network, and connects all H.323 and SIP
endpoints, infrastructure, and management devices. It provides unrivaled scalability and redundancy
to video communications, and is integral to Cisco interoperability with unified communications and
Voice over IP systems.
The VCS can be deployed with either the Control application or the Expressway™ application, with
various optional packages including FindMe™, Dual Network Interfaces and Device Provisioning.
VCS base applications
The VCS is available with alternative base applications as described below.
VCS Control
The VCS Control provides internal video control and administration for all SIP and H.323 devices. It is
normally deployed within your wide area network with endpoints that are behind the same firewalls or
NAT devices. The VCS Control replaces the need to have separate H.323 gatekeeper, SIP registrar
and H.323 - SIP gateway servers.
VCS Expressway™
The VCS Expressway provides standards-based firewall traversal for SIP and H.323 devices allowing
secure firewall traversal of any firewall or NAT device. As well as all the functionality of a VCS
Control, it also provides registration of traversal-enabled devices and can act as a standards-based
TURN server.
The VCS Expressway is normally deployed outside of your firewall or within the DMZ.
Cisco VCS Administrator Guide (X6.1) Page 16 of 401

About the Cisco TelePresence Video Communication Server (VCS)
Standard features
The VCS has the following standard features:
n2500 endpoint registrations
nH.323 gatekeeper
nSIP Proxy/Registrar
nSIP Presence Server
nSIP Presence User Agent
nSIP and H.323 support, including SIP/H.323 gatewaying
nIPv4 and IPv6 support, including IPv4/IPv6 gatewaying
nQoS tagging
nBandwidth management on both a per-call and a total usage basis, configurable separately for calls
within the local subzones and to external systems and zones
nAutomatic downspeeding option for calls that exceed the available bandwidth
nURI and ENUM dialing via DNS, enabling global connectivity
nUp to 500 non-traversal calls
nUp to 100 traversal calls
n1000 external zones with up to 2000 matches
n1000 subzones and supporting up to 3000 membership rules
nFlexible zone configuration with prefix, suffix and regex support
nCan function as a standalone VCS or be neighbored with other systems such as VCSs, Border
Controllers, gatekeepers and SIP proxies
nn+1 redundancy, can be part of a cluster of up to 6 VCSs for increased capacity and redundancy
nIntelligent Route Director for single number dialing and network failover facilities
nOptional endpoint authentication
nControl over which endpoints are allowed to register
nCall Policy (also known as Administrator Policy) including support for CPL
nCan be managed with Cisco TelePresence Management Suite (TMS) 12.5 or later
nAD authentication for administrators of the VCS
nPre-configured defaults for:
lCisco Unified Communications Manager neighbor zones
lCisco TelePresence Advanced Media Gateway
lMicrosoft Office Communications Server (OCS) 2007 neighbor zones
lNortel Communication Server neighbor zones
nEmbedded setup wizard using a serial port for initial configuration
nSystem administration using a web interface or RS-232, Telnet, SSH, and HTTPS
Optional features
The following features are available on the VCS by the purchase and installation of the appropriate
option key:
Cisco VCS Administrator Guide (X6.1) Page 17 of 401

About the Cisco TelePresence Video Communication Server (VCS)
FindMe™
A unique industry solution that gives individual video users a single alias on which they can be
contacted regardless of location. Users have the ability to log on to a Web-based interface and control
where and how they are contacted. The FindMe feature also includes support for Microsoft Office
Communications Server (OCS) 2007, enabling FindMe aliases to register as Microsoft Office
Communicator (MOC) clients, and MOC clients to view the presence status of FindMe aliases.
Device Provisioning
The Device Provisioning option key allows VCS to provision endpoints with configuration information
on request and to supply endpoints with phone book information. (Endpoints including Movi v2.0 or
later, and E20 v2.1 or later can request to be provisioned.) All configuration and phone book
information is managed in TMS, and distributed to the clients through the TMS Agent running on the
VCS. The TMS Agent on the VCS also provides TMS with the provisioned client’s status.
There is no configuration associated with Device Provisioning on the VCS – it is either on or off,
depending on whether or not the option key is installed. See the TMS documentation and the
Provisioning deployment guide [26].
Dual Network Interfaces
Enables the LAN 2 Ethernet port on the VCS Expressway, allowing you to have a secondary IP
address for your VCS.
This option also includes support for deployments where a VCS Expressway is located behind a static
NAT device, allowing it to have separate public and private IP addresses.
This configuration is intended for high-security deployments where the VCS Expressway is located in
a DMZ between two separate firewalls on separate network segments.
Cisco VCS Administrator Guide (X6.1) Page 18 of 401

About the Cisco TelePresence Video Communication Server (VCS)
About this guide
This Administrator Guide is provided to help you make the best use of your VCS.
Your approach to this documentation depends on what you want to do and how much you already
know. The Administrator Guide has been divided into several sections, providing conceptual,
configuration and reference information about the various features and capabilities of the VCS.
This Administrator Guide describes a fully equipped version of the VCS. Your version may not have all
the described extensions installed.
Our main objective with this Administrator Guide is to address your goals and needs. Please let us
know how well we succeeded!
Typographical conventions
Most configuration tasks on the VCS can be performed by using either the web interface or a
command line interface (CLI).
This guide mainly describes how to use the web interface. Some VCS features are only available
through the CLI and these are described as appropriate, including the relevant CLI command.
In this guide, instructions for performing a task using the web interface are shown in the format:
nMenu > Submenu
followed by the Name of the page that you will be taken to.
Where command line interface (CLI) commands are included, they are shown in the format:
nxConfiguration <Element> <SubElement>
nxCommand <Command>
Installation and initial configuration
Full installation and initial configuration instructions for the VCS are contained in the VCS Getting
Started Guide [28].
Cisco VCS Administrator Guide (X6.1) Page 19 of 401

About the Cisco TelePresence Video Communication Server (VCS)
Using the web interface
Configuration of the VCS is normally carried out through the web interface.
To use the web interface:
1. Open a browser window and in the address bar type either:
lthe IP address of the system
lthe FQDN of the system
2. Click Administrator Login.
3. Enter a valid administrator Username and Password and click Login (see the Login accounts
section for details on setting up administrator accounts). You are presented with the Overview
page.
Note that when logging in using the VCS web interface, you may receive a warning message regarding
the VCS's security certificate. This can safely be ignored.
Acommand line interface is also available.
Required fields
All mandatory fields on web pages are indicated by a red star .
How page navigation is shown in this guide
Instructions for navigating the web interface are shown in the format Menu option 1 > Menu option
2followed by the Name of the page that you are taken to in order to perform a task.
Supported browsers
The VCS web interface is designed for use with Internet Explorer 6 or later, and Firefox 2 or later. It
may work with Opera and Safari, but you could encounter unexpected behavior.
Javascript and cookies must be enabled to use the VCS web interface.
Cisco VCS Administrator Guide (X6.1) Page 20 of 401