Cisco TelePresence Service manual

Cisco TelePresence
Video Communication
Server
Administrator Guide
X7.2
January 2015

Cisco VCS Administrator Guide (X7.2) Page 2 of 498
Contents
Introduction 10
About the Cisco TelePresence Video Communication Server (VCS) 11
VCS base applications 12
Standard features 13
Optional features 14
Installation and initial configuration 15
About this guide 16
Typographical conventions 16
Using the web interface 17
Using the command line interface (CLI) 18
Web page features and layout 19
What’s new in this version? 21
Controlled SIP TLS connections to the Default Zone 21
Device authentication 21
Enhanced account security 21
System security enhancements 22
Zone and subzone media encryption policy 22
Call processing 22
Improved interworking flow control 22
Enhanced diagnostics 23
Other enhancements and usability improvements 23
Overview and status information 24
Status overview 25
System information 26
Ethernet status 27
IP status 28
Resource usage 29
Active sessions 30
Active administrator sessions 30
Active user sessions 30
Login history 30
Registration status 31
Call status 33
Disconnecting calls 34
B2BUA calls 34
Search history 35
Search details 36
Local Zone status 37
Zone status 38
Bandwidth 39
Link status 39
Pipe status 39
Policy service status 40
TURN relays status 41
Presence 42
Presence publishers 42
Presence presentities 42

Cisco VCS Administrator Guide (X7.2) Page 3 of 498
Presence subscribers 43
OCS Relay status 44
OCS/Lync B2BUA 45
OCS/Lync user status 45
OCS/Lync B2BUA status 45
TMS Provisioning Extension service status 46
Provisioning Server status 46
User records provided by TMSProvisioning Extension services 47
FindMe records provided by TMS Provisioning Extension services 48
Phone book records provided by TMS Provisioning Extension services 48
Provisioned devices 49
Checking provisioned data 49
Alarms 51
Logs 52
Event Log 52
Configuration Log 53
Network Log 54
Hardware status 56
VCS unit front panel 56
Network and system settings 57
Network settings 58
Configuring IP settings 58
Configuring Ethernet settings 60
Configuring DNS settings 60
Configuring Quality of Service settings 62
Configuring firewall rules 62
Network services 66
Configuring system name and access settings 66
Configuring SNMP settings 70
Configuring time settings 71
Other settings 74
Configuring the Login page 74
Configuring external manager settings 74
Configuring TMS Provisioning Extension services 75
Protocols 78
About H.323 79
Using the VCS as an H.323 gatekeeper 79
H.323 endpoint registration 79
H.323 configuration 79
About SIP 81
VCS as a SIP registrar 81
VCS as a SIP proxy server 82
Proxying registration requests 83
VCS as a SIP Presence Server 83
SIP configuration 83
Configuring SIP domains 86
Configuring SIP and H.323 interworking 88
Registration control 89

Cisco VCS Administrator Guide (X7.2) Page 4 of 498
About registrations 90
Finding a VCS with which to register 90
Registrations on a VCS Expressway 90
MCU, gateway and Content Server registration 91
Configuring registration restriction policy 91
Registering aliases 92
About Allow and Deny Lists 95
Configuring the registration Allow List 95
Configuring the registration Deny List 96
Device authentication 97
About device authentication 98
Configuring VCS authentication policy 99
Controlling system behavior for authenticated and non-authenticated devices 100
Authentication policy configuration options 101
SIP authentication trust 104
Device provisioning and authentication policy 105
Presence and authentication policy 108
Hierarchical dial plans and authentication policy 109
Practical configuration of authentication policy 110
Configuring VCS authentication methods 111
Authentication using the local database 112
Using an H.350 directory service lookup via LDAP 114
Device authentication H.350 schemas 116
Using Active Directory database (direct) 116
Active Directory Service (ADS) configuration 118
Authenticating with external systems 121
Zones and neighbors 122
About your video communications network 123
Structuring your dial plan 124
Flat dial plan 124
Structured dial plan 124
Hierarchical dial plan 124
About the Local Zone and subzones 127
About zones 128
About the Default Zone 129
Configuring the Default Zone 129
Configuring Default Zone access rules 130
Media encryption policy 131
Zone configuration 132
Configuring neighbor zones 132
Configuring traversal client zones 135
Configuring traversal server zones 137
Configuring ENUM zones 140
Configuring DNS zones 140
Zone configuration: advanced settings 141
Zone configuration: pre-configured profile settings 146
TLS certificate verification of neighbor systems 147
Configuring a zone for incoming calls only 147

Cisco VCS Administrator Guide (X7.2) Page 5 of 498
Clustering and peers 148
About clusters 149
Resource usage within a cluster 151
Managing clusters and peers 152
Setting up a cluster 152
Maintaining a cluster 152
Peer-specific configuration 154
Sharing registrations across peers 155
Sharing bandwidth across peers 155
Cluster upgrades, backup and restore 156
Clustering and FindMe 156
Clustering and Presence 157
Clustering and TMS 157
About the Cluster Subzone 157
Neighboring the local VCS to another VCS cluster 158
TMS Agent replication status 159
Troubleshooting cluster replication problems 160
Dial plan and call processing 161
Call routing process 162
About the VCS's directory service 164
About hop counts 165
Dial plan configuration 166
About the fallback alias 166
About transforms and search rules 168
About pre-search transforms 169
Configuring pre-search transforms 169
Search and zone transform process 171
Configuring search rules 171
Example searches and transforms 175
Filter queries to a zone without transforming 175
Always query a zone with original alias (no transforms) 176
Query a zone for a transformed alias 176
Query a zone for original and transformed alias 177
Query a zone for two or more transformed aliases 178
Stripping @domain for dialing to H.323 numbers 179
Transforms for alphanumeric H.323 ID dial strings 181
Allowing calls to IP addresses only if they come from known zones 183
Configuring policy services 184
About Call Policy 186
Configuring Call Policy 186
Configuring Call Policy rules using the web interface 188
Configuring Call Policy using a CPL script 188
Configuring VCS to use the Cisco TelePresence Advanced Media Gateway 190
Configuring Cisco AM GW policy rules 191
Dialable address formats 193
Dialing by IP address 193
Dialing by H.323 ID or E.164 alias 193
Dialing by H.323 or SIP URI 193
Dialing by ENUM 194

Cisco VCS Administrator Guide (X7.2) Page 6 of 498
IP dialing 195
About URI dialing 197
URI dialing without DNS 197
URI dialing via DNS 198
URI resolution process using DNS 198
URI dialing via DNS for outgoing calls 199
URI dialing via DNS for incoming calls 201
URI dialing and firewall traversal 204
About ENUM dialing 205
ENUM dialing process 205
Enabling ENUM dialing 205
ENUM dialing for outgoing calls 206
Zone configuration for ENUM dialing 207
ENUM dialing for incoming calls 209
Configuring DNS servers for ENUM and URI dialing 210
Call signaling configuration 211
Identifying calls 212
Disconnecting calls 214
Bandwidth control 215
About bandwidth control 216
Bandwidth configuration 217
About downspeeding 217
About subzones 218
About the Traversal Subzone 218
About the Default Subzone 219
Configuring subzones 219
Configuring subzone membership rules 220
Applying bandwidth limitations to subzones 221
Links and pipes 223
Configuring links 223
Default links 223
Configuring pipes 224
Applying pipes to links 225
Bandwidth control examples 227
Firewall traversal 229
About firewall traversal 230
Configuring VCSs for firewall traversal 231
Configuring a traversal client and server 233
Firewall traversal protocols and ports 235
Firewall traversal and authentication 238
Authentication and NTP 239
Firewall configuration 240
Configuring Expressway and traversal endpoint communications 240
Configuring traversal server ports 241
About ICE and TURN services 242
About ICE 242
About TURN 242
Configuring TURN services 243

Cisco VCS Administrator Guide (X7.2) Page 7 of 498
Applications 244
Conference Factory 245
Presence 247
Presence Server 247
Presence User Agent (PUA) 248
Configuring Presence 249
OCS Relay 252
Microsoft OCS/Lync B2BUA (back-to-back user agent) 253
Configuring the Microsoft OCS/Lync B2BUA 254
Configuring the B2BUA's trusted hosts 256
Configuring transcoder policy rules 257
Configuring B2BUA transcoders 258
Restarting the B2BUA service 259
FindMe™ 260
User (FindMe) account configuration 260
How are devices specified? 260
FindMe process overview 261
Recommendations when deploying FindMe 261
Configuring FindMe 261
Searching for FindMe users 264
TMS provisioning 265
VCS Provisioning Server 266
Starter Pack provisioning 268
Configuring Starter Pack provisioning 268
Maintenance 269
About upgrading software components 270
Upgrade procedure 271
Upgrading using secure copy (SCP/PSCP) 272
Logging configuration 274
Event Log levels 274
Remote logging of events 274
Option keys 276
About security certificates 278
Trusted CA certificate 278
Managing the VCS's server certificate 279
CRL management 280
Certificate-based authentication configuration 282
Client certificate testing 283
Advanced account security 286
Configuring language settings 288
Changing the language 288
Installing language packs 288
About login accounts 289
Account authentication 289
Account types 289
Configuring login account authentication 290
Configuring remote account authentication using LDAP 291
Password security 293
Configuring administrator accounts 294

Cisco VCS Administrator Guide (X7.2) Page 8 of 498
Configuring administrator groups 295
Configuring user accounts 297
Configuring a user's principal devices 299
Configuring user groups 300
Resetting forgotten passwords 300
Root account 301
Backing up and restoring VCS data 303
Creating a backup 303
Restoring a previous backup 304
Diagnostics tools 306
Diagnostic logging 306
Creating a system snapshot 307
Configuring Network Log levels 308
Configuring Support Log levels 308
Incident reporting 309
Incident reporting caution: privacy-protected personal data 309
Sending incident reports automatically 309
Sending incident reports manually 310
Viewing incident reports 310
Incident report details 311
Checking the effect of a pattern 312
Locating an alias 313
Port usage 314
Local VCS inbound ports 314
Local VCS outbound ports 314
Remote listening ports 315
Network utilities 316
Ping 316
Traceroute 316
Tracepath 317
DNS lookup 317
Restarting 320
Rebooting 321
Shutting down 322
Developer resources 323
Debugging and system administration tools 323
Experimental menu 323
Reference material 324
Software version history 325
X7.1 325
X7 326
X6.1 328
X6 329
X5.2 330
X5.1 331
X5 334
X4 336
About Event Log levels 339
Event Log format 339
Administrator and FindMe user events 339

Cisco VCS Administrator Guide (X7.2) Page 9 of 498
Message details field 340
Events and levels 342
CPL reference 349
CPL address-switch node 349
otherwise 351
not-present 351
location 351
rule-switch 352
proxy 352
reject 353
Unsupported CPL elements 353
CPL examples 354
LDAP server configuration for device authentication 360
Downloading the H.350 schemas 360
Configuring a Microsoft Active Directory LDAP server 360
Configuring an OpenLDAP server 362
DNS configuration examples 365
Verifying the SRV record 365
Microsoft DNS server 365
BIND 8 & 9 365
Changing the default SSH key 367
Default SSH key alarms 367
Restoring default configuration 368
Password security 369
Pattern matching variables 370
Port reference 372
Regular expressions 378
Supported characters 380
TMS Agent (legacy) 381
TMS Agent passwords 383
What are traversal calls? 385
Alarms 386
Command reference — xConfiguration 403
Command reference — xCommand 456
Command reference — xStatus 470
About policy services 482
Flash status word reference table 484
Bibliography 485
Glossary 488
Accessibility notice 495
Legal notices 496
Intellectual property rights 496
Copyright notice 496
Patent information 497

Cisco VCS Administrator Guide (X7.2) Page 10 of 498
Introduction
This section provides an overview of the Cisco TelePresence Video Communication Server, including:
nAbout the Cisco TelePresence Video Communication Server
nBase applications
nStandard features
nOptional features
nAbout this guide
nUsing the web interface
nWhat’s new in this version?

Introduction
Cisco VCS Administrator Guide (X7.2) Page 11 of 498
About the Cisco TelePresence Video
Communication Server (VCS)
The Cisco TelePresence Video Communication Server (Cisco VCS) provides flexible and extensible media
and session management capabilities, enabling organizations to benefit from increased employee
productivity and enhanced communication with partners and customers.
The VCS delivers exceptional scalability and resiliency, secure communications, and simplified large-scale
provisioning and network administration by taking advantage of TelePresence Provisioning 2.0 capabilities.
This helps enable large-scale deployments quickly and easily across the organization in a cost-efficient
manner to bring high-quality telepresence services to the masses.
The VCS interworks seamlessly with Cisco Unified Communications Manager (Cisco Unified CM), bringing
rich telepresence services to organizations with Cisco UCM. It also offers interoperability with third-party
unified communications, IP telephony networks, and voice over IP (VoIP) systems.
The VCS is available as an appliance or as a virtualized application on VMware or similar virtual
environments, with additional support for Cisco Unified Computing System (Cisco UCS) platforms.
You can deploy the VCS as the VCS Control for use within an enterprise and as the VCS Expressway for
external communication. The VCS Expressway includes the features of the VCS Control, augmented with
highly secure firewall-traversal capability. An alternative solution, suited to small to medium-sized
businesses (SMBs), is the VCS Starter Pack Express. Optional packages that you can deploy include Cisco
TelePresence FindMe (FindMe), Device Provisioning, and Dual Network Interfaces (VCS Expressway only).

Introduction
Cisco VCS Administrator Guide (X7.2) Page 12 of 498
VCS base applications
The VCS is available with alternative base applications as described below.
VCS Control
VCS Control delivers any-to-any enterprise wide conference and session management and interworking
capabilities. It extends the reach of telepresence conferences by enabling interworking between Session
Initiation Protocol (SIP)- and H.323-compliant endpoints, interworking with third-party endpoints; it integrates
with the Cisco UCM and supports third-party IP private branch exchange (IP PBX) solutions. VCS Control
implements the tools required for creative session management, including definition of aspects such as
routing, dial plans, and bandwidth usage, while allowing organizations to define call-management
applications, customized to their requirements.
VCS Expressway™
The VCS Expressway deployed with the VCS Control enables smooth video communications easily and
securely outside the enterprise. It enables business-to-business video collaboration, improves the
productivity of remote and home-based workers, and enables service providers to provide video
communications to customers. The application performs securely through standards-based and secure

Introduction
Cisco VCS Administrator Guide (X7.2) Page 13 of 498
firewall traversal for all SIP and H.323 devices. As a result, organizations benefit from increased employee
productivity and enhanced communication with partners and customers.
It uses an intelligent framework that allows endpoints behind firewalls to discover paths through which they
can pass media, verify peer-to-peer connectivity through each of these paths, and then select the optimum
media connection path, eliminating the need to reconfigure enterprise firewalls.
The VCS Expressway is built for high reliability and scalability, supporting multivendor firewalls, and it can
traverse any number of firewalls regardless of SIP or H.323 protocol.
Standard features
The VCS has the following standard features:
n2500 endpoint registrations
nH.323 gatekeeper
nSIP Proxy/Registrar
nSIP Presence Server
nSIP Presence User Agent
nSIP and H.323 support, including SIP/H.323 interworking
nIPv4 and IPv6 support, including IPv4/IPv6 interworking
nQoS tagging
nBandwidth management on both a per-call and a total usage basis, configurable separately for calls within
the local subzones and to external systems and zones
nAutomatic downspeeding option for calls that exceed the available bandwidth
nURI and ENUM dialing via DNS, enabling global connectivity
nUp to 500 non-traversal calls
nUp to 100 traversal calls
n1000 external zones with up to 2000 matches
n1000 subzones and supporting up to 3000 membership rules
nFlexible zone configuration with prefix, suffix and regex support

Introduction
Cisco VCS Administrator Guide (X7.2) Page 14 of 498
nCan function as a standalone VCS or be neighbored with other systems such as VCSs, Border Controllers,
gatekeepers and SIP proxies
nn+1 redundancy, can be part of a cluster of up to 6 VCSs for increased capacity and redundancy
nIntelligent Route Director for single number dialing and network failover facilities
nOptional endpoint authentication (including AD authentication for Movi / Jabber Video clients)
nControl over which endpoints are allowed to register
nCall Policy (also known as Administrator Policy) including support for CPL
nCan be managed with Cisco TelePresence Management Suite (TMS) 12.6 or later
nAD authentication for administrators of the VCS
nPre-configured defaults for:
lCisco Unified Communications Manager neighbor zones
lCisco TelePresence Advanced Media Gateway
lMicrosoft Office Communications Server (OCS) 2007 / Lync neighbor zones
lNortel Communication Server neighbor zones
nEmbedded setup wizard using a serial port for initial configuration
nSystem administration using a web interface or RS-232, Telnet, SSH, and HTTPS
Optional features
The following features are available on the VCS by the purchase and installation of the appropriate option
key:
FindMe™
FindMe is a unique industry solution that gives individual video users a single alias on which they can be
contacted regardless of location. Users have the ability to log on to a web-based interface and control where
and how they are contacted. The FindMe feature also includes support for Microsoft Office Communications
Server (OCS) 2007 / Lync 2010, which enables FindMe aliases to register as Microsoft Office Communicator
(MOC) / Lync clients, and MOC / Lync clients to view the presence status of FindMe aliases.

Introduction
Cisco VCS Administrator Guide (X7.2) Page 15 of 498
Device Provisioning
The Device Provisioning option key allows VCS to provision endpoints with configuration information on
request and to supply endpoints with phone book information. (Endpoints including Movi / Jabber Video, E20,
and the EX and MX Series can request to be provisioned.) All configuration and phone book information is
managed in TMS. The data is then transferred to the VCS, from where it is distributed to endpoint clients
through the Provisioning Server running on the VCS.
See TMS provisioning and TMS Provisioning Extension deployment guide for more information about how to
configure provisioning.
Dual Network Interfaces
The Dual Network Interfaces option enables the LAN 2 Ethernet port on the VCS Expressway, allowing you
to have a secondary IP address for your VCS.
This option also includes support for deployments where a VCS Expressway is located behind a static NAT
device, allowing it to have separate public and private IP addresses.
This configuration is intended for high-security deployments where the VCS Expressway is located in a DMZ
between two separate firewalls on separate network segments.
Virtual appliance support
nThe VCS can run on VMware on Cisco UCS C200 M2, UCS C210 M2 or UCS B200 M2 servers.
See VCS Virtual machine deployment guide for more information about installing a VCS on VMware.
Installation and initial configuration
Full installation and initial configuration instructions for the VCS are contained in VCS Getting Started Guide.

Introduction
Cisco VCS Administrator Guide (X7.2) Page 16 of 498
About this guide
This Administrator Guide is provided to help you make the best use of your VCS.
Your approach to this documentation depends on what you want to do and how much you already know. The
Administrator Guide has been divided into several sections, providing conceptual, configuration and
reference information about the various features and capabilities of the VCS.
This Administrator Guide describes a fully equipped version of the VCS. Your version may not have all the
described extensions installed.
Our main objective with this Administrator Guide is to address your goals and needs. Please let us know how
well we succeeded!
Typographical conventions
Most configuration tasks on the VCS can be performed by using either the web interface or a command line
interface (CLI).
This guide mainly describes how to use the web interface. Some VCS features are only available through the
CLI and these are described as appropriate, including the relevant CLI command.
In this guide, instructions for performing a task using the web interface are shown in the format:
nMenu > Submenu
followed by the Name of the page that you will be taken to.
Where command line interface (CLI) commands are included, they are shown in the format:
nxConfiguration <Element> <SubElement>
nxCommand <Command>

Introduction
Cisco VCS Administrator Guide (X7.2) Page 17 of 498
Using the web interface
Configuration of the VCS is normally carried out through the web interface.
To use the web interface:
1. Open a browser window and in the address bar type either:
lthe IP address of the system
lthe FQDN of the system
2. Click Administrator Login.
(This step does not apply if the VCS is using the TMSProvisioning Extension services to provide user
account data.)
3. Enter a valid administrator Username and Password and click Login (see the Login accounts section for
details on setting up administrator accounts). You are presented with the Overview page.
Note that when logging in using the VCS web interface, you may receive a warning message regarding the
VCS's security certificate. This can safely be ignored.
Acommand line interface is also available.
Required fields
All mandatory fields on web pages are indicated by a red star .
Supported browsers
The VCS web interface is designed for use with Internet Explorer 7, 8 or 9, Firefox 3 or later, or Chrome. Later
versions of these browsers may also work, but are not officially supported. It may work with Opera and
Safari, but you could encounter unexpected behavior.
JavaScript and cookies must be enabled to use the VCS web interface.

Introduction
Cisco VCS Administrator Guide (X7.2) Page 18 of 498
Using the command line interface (CLI)
The VCS can be configured through a web interface or via a command line interface (CLI).
The CLI is available by default over SSH and through the serial port. Access using Telnet can also be
enabled. These settings are controlled on the System administration page.
To use the CLI:
1. Start an SSH or Telnet session.
2. Enter the IP address or FQDN of the VCS.
3. Log in with a username of admin and your system password.
4. You can now start using the CLI by typing the appropriate commands.
Command types
Commands are divided into the following groups:
nxStatus: these commands return information about the current status of the system. Information such as
current calls and registrations is available through this command group. See Command reference —
xStatus for a full list of xStatus commands.
nxConfiguration: these commands allow you to add and edit single items of data such as IP address
and zones. See Command reference — xConfiguration for a full list of xConfiguration commands.
nxCommand: these commands allow you to add and configure items and obtain information. See Command
reference — xCommand for a full list of xCommand commands.
nxHistory: these commands provide historical information about calls and registrations.
nxFeedback: these commands provide information about events as they happen, such as calls and
registrations.
Note that:
nTyping an xConfiguration path into the CLI returns a list of values currently configured for that element
(and sub-elements where applicable).
nTyping an xConfiguration path into the CLI followed by a ? returns information about the usage for that
element and sub-elements.
nTyping an xCommand command into the CLI with or without a ? returns information about the usage of that
command.

Introduction
Cisco VCS Administrator Guide (X7.2) Page 19 of 498
Web page features and layout
This section describes the features that can be found on the VCS web interface pages.
The elements included in the example web pages shown here are described in the table below.
Page
element
Description
Page name
and location
Every page shows the page name and the menu path to that page. Each part of the menu
path is a link; clicking on any of the higher level menu items takes you to that page.
System
alarm
This icon appears on the top right corner of every page when there is a system alarm in
place. Click on this icon to go to the Alarms page which gives information about the alarm
and its suggested resolution.
Help This icon appears on the top right corner of every page. Clicking on this icon opens a new
browser window with help specific to the page you are viewing. It gives an overview of the
purpose of the page, and introduces any concepts configured from the page.
Log out This icon appears on the top right corner of every page. Clicking on this icon ends your
administrator session.
Field level
information
An information box appears on the configuration pages whenever you either click on the
Information icon or click inside a field. This box gives you information about the particular
field, including where applicable the valid ranges and default value. To close the
information box, click on the X at its top right corner.

Introduction
Cisco VCS Administrator Guide (X7.2) Page 20 of 498
Page
element
Description
Information
bar
The VCS provides you with feedback in certain situations, for example when settings
have been saved or when you need to take further action. This feedback is given in a
yellow information bar at the top of the page.
Sorting
columns
Click on column headings to sort the information in ascending and descending order.
Select All
and
Unselect All
Use these buttons to select and unselect all items in the list.
Mandatory
field
Indicates an input field that must be completed.
Peer-specific
configuration
item
†When a VCS is part of a cluster, most items of configuration are applied to all peers in a
cluster. However, items indicated with a †must be specified separately on each cluster
peer.
Status On configuration pages, this section shows you the current status of the items you are
configuring. Note that some configuration changes require a restart to take effect, so if you
have changed the configuration but not yet restarted this shows the existing (unchanged)
status.
System
Information
The name of the user currently logged in and their access privileges, the system name (or
LAN 1 IPv4 address if no system name is configured), local system time, currently
selected language, hardware serial number and VCS software version are shown at the
bottom of the page.
Note that you cannot change configuration settings if your administrator account has read-only privileges.