Cisco TelePresence Service manual

Cisco TelePresence
Video Communication
Server
Administrator Guide
X7.2
January 2015

Cisco VCS Administrator Guide (X7.2) Page 2 of 498
Contents
Introduction 10
About the Cisco TelePresence Video Communication Server (VCS) 11
VCS base applications 12
Standard features 13
Optional features 14
Installation and initial configuration 15
About this guide 16
Typographical conventions 16
Using the web interface 17
Using the command line interface (CLI) 18
Web page features and layout 19
What’s new in this version? 21
Controlled SIP TLS connections to the Default Zone 21
Device authentication 21
Enhanced account security 21
System security enhancements 22
Zone and subzone media encryption policy 22
Call processing 22
Improved interworking flow control 22
Enhanced diagnostics 23
Other enhancements and usability improvements 23
Overview and status information 24
Status overview 25
System information 26
Ethernet status 27
IP status 28
Resource usage 29
Active sessions 30
Active administrator sessions 30
Active user sessions 30
Login history 30
Registration status 31
Call status 33
Disconnecting calls 34
B2BUA calls 34
Search history 35
Search details 36
Local Zone status 37
Zone status 38
Bandwidth 39
Link status 39
Pipe status 39
Policy service status 40
TURN relays status 41
Presence 42
Presence publishers 42
Presence presentities 42

Cisco VCS Administrator Guide (X7.2) Page 3 of 498
Presence subscribers 43
OCS Relay status 44
OCS/Lync B2BUA 45
OCS/Lync user status 45
OCS/Lync B2BUA status 45
TMS Provisioning Extension service status 46
Provisioning Server status 46
User records provided by TMSProvisioning Extension services 47
FindMe records provided by TMS Provisioning Extension services 48
Phone book records provided by TMS Provisioning Extension services 48
Provisioned devices 49
Checking provisioned data 49
Alarms 51
Logs 52
Event Log 52
Configuration Log 53
Network Log 54
Hardware status 56
VCS unit front panel 56
Network and system settings 57
Network settings 58
Configuring IP settings 58
Configuring Ethernet settings 60
Configuring DNS settings 60
Configuring Quality of Service settings 62
Configuring firewall rules 62
Network services 66
Configuring system name and access settings 66
Configuring SNMP settings 70
Configuring time settings 71
Other settings 74
Configuring the Login page 74
Configuring external manager settings 74
Configuring TMS Provisioning Extension services 75
Protocols 78
About H.323 79
Using the VCS as an H.323 gatekeeper 79
H.323 endpoint registration 79
H.323 configuration 79
About SIP 81
VCS as a SIP registrar 81
VCS as a SIP proxy server 82
Proxying registration requests 83
VCS as a SIP Presence Server 83
SIP configuration 83
Configuring SIP domains 86
Configuring SIP and H.323 interworking 88
Registration control 89

Cisco VCS Administrator Guide (X7.2) Page 4 of 498
About registrations 90
Finding a VCS with which to register 90
Registrations on a VCS Expressway 90
MCU, gateway and Content Server registration 91
Configuring registration restriction policy 91
Registering aliases 92
About Allow and Deny Lists 95
Configuring the registration Allow List 95
Configuring the registration Deny List 96
Device authentication 97
About device authentication 98
Configuring VCS authentication policy 99
Controlling system behavior for authenticated and non-authenticated devices 100
Authentication policy configuration options 101
SIP authentication trust 104
Device provisioning and authentication policy 105
Presence and authentication policy 108
Hierarchical dial plans and authentication policy 109
Practical configuration of authentication policy 110
Configuring VCS authentication methods 111
Authentication using the local database 112
Using an H.350 directory service lookup via LDAP 114
Device authentication H.350 schemas 116
Using Active Directory database (direct) 116
Active Directory Service (ADS) configuration 118
Authenticating with external systems 121
Zones and neighbors 122
About your video communications network 123
Structuring your dial plan 124
Flat dial plan 124
Structured dial plan 124
Hierarchical dial plan 124
About the Local Zone and subzones 127
About zones 128
About the Default Zone 129
Configuring the Default Zone 129
Configuring Default Zone access rules 130
Media encryption policy 131
Zone configuration 132
Configuring neighbor zones 132
Configuring traversal client zones 135
Configuring traversal server zones 137
Configuring ENUM zones 140
Configuring DNS zones 140
Zone configuration: advanced settings 141
Zone configuration: pre-configured profile settings 146
TLS certificate verification of neighbor systems 147
Configuring a zone for incoming calls only 147

Cisco VCS Administrator Guide (X7.2) Page 5 of 498
Clustering and peers 148
About clusters 149
Resource usage within a cluster 151
Managing clusters and peers 152
Setting up a cluster 152
Maintaining a cluster 152
Peer-specific configuration 154
Sharing registrations across peers 155
Sharing bandwidth across peers 155
Cluster upgrades, backup and restore 156
Clustering and FindMe 156
Clustering and Presence 157
Clustering and TMS 157
About the Cluster Subzone 157
Neighboring the local VCS to another VCS cluster 158
TMS Agent replication status 159
Troubleshooting cluster replication problems 160
Dial plan and call processing 161
Call routing process 162
About the VCS's directory service 164
About hop counts 165
Dial plan configuration 166
About the fallback alias 166
About transforms and search rules 168
About pre-search transforms 169
Configuring pre-search transforms 169
Search and zone transform process 171
Configuring search rules 171
Example searches and transforms 175
Filter queries to a zone without transforming 175
Always query a zone with original alias (no transforms) 176
Query a zone for a transformed alias 176
Query a zone for original and transformed alias 177
Query a zone for two or more transformed aliases 178
Stripping @domain for dialing to H.323 numbers 179
Transforms for alphanumeric H.323 ID dial strings 181
Allowing calls to IP addresses only if they come from known zones 183
Configuring policy services 184
About Call Policy 186
Configuring Call Policy 186
Configuring Call Policy rules using the web interface 188
Configuring Call Policy using a CPL script 188
Configuring VCS to use the Cisco TelePresence Advanced Media Gateway 190
Configuring Cisco AM GW policy rules 191
Dialable address formats 193
Dialing by IP address 193
Dialing by H.323 ID or E.164 alias 193
Dialing by H.323 or SIP URI 193
Dialing by ENUM 194

Cisco VCS Administrator Guide (X7.2) Page 6 of 498
IP dialing 195
About URI dialing 197
URI dialing without DNS 197
URI dialing via DNS 198
URI resolution process using DNS 198
URI dialing via DNS for outgoing calls 199
URI dialing via DNS for incoming calls 201
URI dialing and firewall traversal 204
About ENUM dialing 205
ENUM dialing process 205
Enabling ENUM dialing 205
ENUM dialing for outgoing calls 206
Zone configuration for ENUM dialing 207
ENUM dialing for incoming calls 209
Configuring DNS servers for ENUM and URI dialing 210
Call signaling configuration 211
Identifying calls 212
Disconnecting calls 214
Bandwidth control 215
About bandwidth control 216
Bandwidth configuration 217
About downspeeding 217
About subzones 218
About the Traversal Subzone 218
About the Default Subzone 219
Configuring subzones 219
Configuring subzone membership rules 220
Applying bandwidth limitations to subzones 221
Links and pipes 223
Configuring links 223
Default links 223
Configuring pipes 224
Applying pipes to links 225
Bandwidth control examples 227
Firewall traversal 229
About firewall traversal 230
Configuring VCSs for firewall traversal 231
Configuring a traversal client and server 233
Firewall traversal protocols and ports 235
Firewall traversal and authentication 238
Authentication and NTP 239
Firewall configuration 240
Configuring Expressway and traversal endpoint communications 240
Configuring traversal server ports 241
About ICE and TURN services 242
About ICE 242
About TURN 242
Configuring TURN services 243

Cisco VCS Administrator Guide (X7.2) Page 7 of 498
Applications 244
Conference Factory 245
Presence 247
Presence Server 247
Presence User Agent (PUA) 248
Configuring Presence 249
OCS Relay 252
Microsoft OCS/Lync B2BUA (back-to-back user agent) 253
Configuring the Microsoft OCS/Lync B2BUA 254
Configuring the B2BUA's trusted hosts 256
Configuring transcoder policy rules 257
Configuring B2BUA transcoders 258
Restarting the B2BUA service 259
FindMe™ 260
User (FindMe) account configuration 260
How are devices specified? 260
FindMe process overview 261
Recommendations when deploying FindMe 261
Configuring FindMe 261
Searching for FindMe users 264
TMS provisioning 265
VCS Provisioning Server 266
Starter Pack provisioning 268
Configuring Starter Pack provisioning 268
Maintenance 269
About upgrading software components 270
Upgrade procedure 271
Upgrading using secure copy (SCP/PSCP) 272
Logging configuration 274
Event Log levels 274
Remote logging of events 274
Option keys 276
About security certificates 278
Trusted CA certificate 278
Managing the VCS's server certificate 279
CRL management 280
Certificate-based authentication configuration 282
Client certificate testing 283
Advanced account security 286
Configuring language settings 288
Changing the language 288
Installing language packs 288
About login accounts 289
Account authentication 289
Account types 289
Configuring login account authentication 290
Configuring remote account authentication using LDAP 291
Password security 293
Configuring administrator accounts 294

Cisco VCS Administrator Guide (X7.2) Page 8 of 498
Configuring administrator groups 295
Configuring user accounts 297
Configuring a user's principal devices 299
Configuring user groups 300
Resetting forgotten passwords 300
Root account 301
Backing up and restoring VCS data 303
Creating a backup 303
Restoring a previous backup 304
Diagnostics tools 306
Diagnostic logging 306
Creating a system snapshot 307
Configuring Network Log levels 308
Configuring Support Log levels 308
Incident reporting 309
Incident reporting caution: privacy-protected personal data 309
Sending incident reports automatically 309
Sending incident reports manually 310
Viewing incident reports 310
Incident report details 311
Checking the effect of a pattern 312
Locating an alias 313
Port usage 314
Local VCS inbound ports 314
Local VCS outbound ports 314
Remote listening ports 315
Network utilities 316
Ping 316
Traceroute 316
Tracepath 317
DNS lookup 317
Restarting 320
Rebooting 321
Shutting down 322
Developer resources 323
Debugging and system administration tools 323
Experimental menu 323
Reference material 324
Software version history 325
X7.1 325
X7 326
X6.1 328
X6 329
X5.2 330
X5.1 331
X5 334
X4 336
About Event Log levels 339
Event Log format 339
Administrator and FindMe user events 339

Cisco VCS Administrator Guide (X7.2) Page 9 of 498
Message details field 340
Events and levels 342
CPL reference 349
CPL address-switch node 349
otherwise 351
not-present 351
location 351
rule-switch 352
proxy 352
reject 353
Unsupported CPL elements 353
CPL examples 354
LDAP server configuration for device authentication 360
Downloading the H.350 schemas 360
Configuring a Microsoft Active Directory LDAP server 360
Configuring an OpenLDAP server 362
DNS configuration examples 365
Verifying the SRV record 365
Microsoft DNS server 365
BIND 8 & 9 365
Changing the default SSH key 367
Default SSH key alarms 367
Restoring default configuration 368
Password security 369
Pattern matching variables 370
Port reference 372
Regular expressions 378
Supported characters 380
TMS Agent (legacy) 381
TMS Agent passwords 383
What are traversal calls? 385
Alarms 386
Command reference — xConfiguration 403
Command reference — xCommand 456
Command reference — xStatus 470
About policy services 482
Flash status word reference table 484
Bibliography 485
Glossary 488
Accessibility notice 495
Legal notices 496
Intellectual property rights 496
Copyright notice 496
Patent information 497

Cisco VCS Administrator Guide (X7.2) Page 10 of 498
Introduction
This section provides an overview of the Cisco TelePresence Video Communication Server, including:
nAbout the Cisco TelePresence Video Communication Server
nBase applications
nStandard features
nOptional features
nAbout this guide
nUsing the web interface
nWhat’s new in this version?