Cisco TelePresence Service manual

Cisco TelePresence
Video Communication
Server
Administrator Guide
Software version: X7.1
D14049.12
March 2012

Cisco VCS Administrator Guide (X7.1) Page 2 of 479
Contents
Introduction 12
About the Cisco TelePresence Video Communication Server (VCS) 13
VCS base applications 13
Standard features 14
Optional features 15
Installation and initial configuration 16
About this guide 17
Typographical conventions 17
Using the web interface 18
Using the command line interface (CLI) 19
Web page features and layout 20
What’s new in this version? 22
TMS Provisioning Extension support 22
Call processing 22
Virtual appliance support 22
Other enhancements and usability improvements 22
Overview and status information 23
Status overview 24
System information 25
Ethernet status 26
IP status 27
Resource usage 28
Clustered VCS systems 28
Active sessions 29
Active administrator sessions 29
Active user sessions 29
Registration status 30
Registrations by device 30
Registrations by alias 31
Registration history 31
Registration details 32
Call status 33
Current calls 33
Call history 34
Call summary 35
B2BUA calls 35
Search history 37
About searches 37
Search history list 37
Search details 38
Local Zone status 39
Zone status 40
Bandwidth 41
Link status 41
Pipe status 41
Policy service status 42
TURN relays status 43

Cisco VCS Administrator Guide (X7.1) Page 3 of 479
Presence 44
Presence publishers 44
Presence presentities 44
Presence subscribers 45
OCS Relay status 46
OCS/Lync B2BUA 47
OCS/Lync user status 47
OCS/Lync B2BUA status 47
TMS Provisioning Extension service status 48
Provisioning Server status 48
User records provided by TMSProvisioning Extension services 49
FindMe records provided by TMS Provisioning Extension services 50
Phone book records provided by TMS Provisioning Extension services 51
Provisioned devices 51
Checking provisioned data 51
Alarms 53
Logs 54
Event Log 54
Configuration Log 55
Network Log 56
Hardware status 58
VCS unit front panel 58
Network and system settings 59
Network settings 60
Configuring IP settings 60
Configuring Ethernet settings 62
Configuring DNS settings 62
Configuring Quality of Service settings 64
Network services 65
Configuring system name and access settings 65
Configuring SNMP settings 67
Time 68
Other settings 71
Configuring the Login page 71
Configuring external manager settings 71
Configuring TMS Provisioning Extension services 72
Configuring logging levels 74
Protocols 76
About H.323 77
Using the VCS as an H.323 gatekeeper 77
H.323 endpoint registration 77
H.323 configuration 77
About SIP 79
VCS as a SIP registrar 79
VCS as a SIP proxy server 80
Proxying registration requests 80
VCS as a SIP Presence Server 81
SIP configuration 81
Configuring SIP domains 84

Cisco VCS Administrator Guide (X7.1) Page 4 of 479
Configuring SIP and H.323 interworking 85
Searching by protocol 85
Enabling SIP endpoints to dial H.323 numbers 85
Registration control 87
About registrations 88
Finding a VCS with which to register 88
Registrations on a VCS Expressway 88
MCU, gateway and Content Server registration 89
Configuring registration restriction policy 89
Registering aliases 90
About Allow and Deny Lists 93
Configuring the registration Allow List 93
Configuring the registration Deny List 94
Device authentication 95
About device authentication 96
Authentication Policy 96
Authentication mechanism 97
Authentication Policy configuration options 99
Zone-level Authentication Policy 99
Subzone-level Authentication Policy 101
SIP authentication trust 102
Device authentication configuration 103
Authentication database 103
Endpoint credentials used for authentication 103
Device authentication using LDAP 104
Authentication process 104
LDAP server settings 104
Device LDAP schemas 106
Authentication using a local database 107
Credentials managed within TMS 107
Starter Pack 107
Authentication using Active Directory Service 108
Movi authentication using an Active Directory Service 108
Active Directory Service (ADS) configuration 109
Authenticating with external systems 112
Zones and neighbors 113
About your video communications network 114
Example network diagram 114
Structuring your dial plan 115
Flat dial plan 115
Structured dial plan 115
Hierarchical dial plan 115
About the Local Zone and subzones 117
Bandwidth management 117
Local Zone searches 117
About zones 118
Default Zone 118
Zone configuration 119
Configuring neighbor zones 119

Cisco VCS Administrator Guide (X7.1) Page 5 of 479
Configuring traversal client zones 122
Configuring traversal server zones 124
Configuring ENUM zones 126
Configuring DNS zones 127
Zone configuration: advanced settings 128
Zone configuration: pre-configured profile settings 133
TLS certificate verification of neighbor systems 133
Configuring a zone for incoming calls only 134
Clustering and peers 135
About clusters 136
Resource usage within a cluster 138
Example deployment 138
Managing clusters and peers 139
Setting up a cluster 139
Maintaining a cluster 139
Peer-specific configuration 141
Sharing registrations across peers 142
Sharing bandwidth across peers 142
Cluster upgrades and downgrades 143
Cluster backup and restore 143
Clustering and FindMe 143
Clustering and Presence 144
Clustering and TMS 144
About the Cluster Subzone 145
Neighboring the local VCS to another VCS cluster 145
TMS Agent replication status 146
Troubleshooting cluster replication problems 147
Dial plan and call processing 148
Call routing process 149
About the VCS's directory service 151
About hop counts 152
Configuring hop counts 152
Dial plan configuration 153
About the fallback alias 153
About transforms and search rules 155
Transforms 155
Search rules 155
About pre-search transforms 156
Configuring pre-search transforms 156
Search and zone transform process 158
Configuring search rules 159
Example searches and transforms 162
Filter queries to a zone without transforming 162
Always query a zone with original alias (no transforms) 163
Query a zone for a transformed alias 163
Query a zone for original and transformed alias 164
Query a zone for two or more transformed aliases 165
Stripping @domain for dialing to H.323 numbers 166
Transforms for alphanumeric H.323 ID dial strings 168

Cisco VCS Administrator Guide (X7.1) Page 6 of 479
Allowing calls to IP addresses only if they come from known zones 170
Configuring policy services 171
About Call Policy 172
Configuring Call Policy 172
Configuring Call Policy rules using the web interface 174
Configuring Call Policy using a CPL script 174
Configuring VCS to use the Cisco TelePresence Advanced Media Gateway 176
Configuring the VCS 176
Usage features and limitations 176
Configuring Cisco AM GW policy rules 177
Dialable address formats 179
Dialing by IP address 179
Dialing by H.323 ID or E.164 alias 179
Dialing by H.323 or SIP URI 179
Dialing by ENUM 180
IP dialing 181
Calls to unknown IP addresses 181
About URI dialing 183
URI dialing without DNS 183
URI dialing via DNS 184
URI resolution process using DNS 184
URI dialing via DNS for outgoing calls 186
URI dialing via DNS for incoming calls 187
URI dialing and firewall traversal 190
About ENUM dialing 191
ENUM dialing process 191
Enabling ENUM dialing 191
ENUM dialing for outgoing calls 192
Zone configuration for ENUM dialing 193
ENUM dialing for incoming calls 195
Configuring DNS servers for ENUM and URI dialing 196
Call signaling configuration 198
Identifying calls 199
Disconnecting calls 201
Disconnecting a call using the web interface 201
Disconnecting a call using the CLI 201
Limitations when disconnecting SIP calls 201
Bandwidth control 202
About bandwidth control 203
Example network deployment 203
Bandwidth configuration 205
About downspeeding 205
About subzones 206
Default links between subzones 206
About the Traversal Subzone 206
About the Default Subzone 207
Configuring subzones 207
Configuring subzone membership rules 208
Applying bandwidth limitations to subzones 209
Links and pipes 212

Cisco VCS Administrator Guide (X7.1) Page 7 of 479
Configuring links 212
Default links 212
Configuring pipes 213
Applying pipes to links 214
Bandwidth control examples 216
Firewall traversal 218
About firewall traversal 219
Expressway solution 219
How does it work? 219
VCS as a firewall traversal client 219
VCS as a firewall traversal server 220
Configuring a traversal client and server 221
Firewall traversal protocols and ports 222
Expressway process 222
H.323 firewall traversal protocols 222
SIP firewall traversal protocols 222
Ports for initial connections from traversal clients 223
Default port summary 223
TURN ports 224
Ports for connections out to the public internet 224
Firewall traversal and authentication 225
Authentication and NTP 226
Firewall traversal and Dual Network Interfaces 227
Firewall configuration 228
Configuring traversal for endpoints 228
Configuring traversal server ports 229
About ICE and TURN services 230
About ICE 230
About TURN 230
Configuring TURN services 231
Applications 232
Conference Factory 233
Conference creation process 233
Presence 235
Presence Server 235
Presence User Agent (PUA) 236
Configuring Presence 237
OCS Relay 240
Configuring a connection between the VCS and the OCS 240
Microsoft OCS/Lync B2BUA (back-to-back user agent) 241
Usage features and limitations 241
Configuring the Microsoft OCS/Lync B2BUA 242
Configuring the B2BUA's trusted hosts 244
Configuring transcoder policy rules 245
Configuring B2BUA transcoders 246
Restarting the B2BUA service 247
FindMe™ 248
User (FindMe) account configuration 248
How are devices specified? 248

Cisco VCS Administrator Guide (X7.1) Page 8 of 479
FindMe process overview 249
Recommendations when deploying FindMe 249
Configuring FindMe 249
Searching for FindMe users 252
TMS provisioning 253
VCS Provisioning Server 254
Starter Pack provisioning 256
Configuring Starter Pack provisioning 256
Maintenance 258
About upgrading software components 259
VCS software components 259
Prerequisites 259
Backing up before upgrading 259
Upgrading and option keys 260
Installing and rebooting 260
Upgrade procedure 260
Upgrading using secure copy (SCP/PSCP) 261
Option keys 263
Adding option keys using the web interface 264
Adding option keys using the CLI 264
About security certificates 265
Managing security certificates 265
CRL management 266
Certificate-based authentication configuration 267
Client certificate testing 269
Advanced account security 271
Prerequisites 271
VCS functionality: changes and limitations 271
Configuring language settings 273
Changing the language 273
Installing language packs 273
About login accounts 274
Account authentication 274
Administrator accounts 274
User accounts 274
Root accounts 275
Configuring login account authentication 275
Account authentication using LDAP 275
Login history 277
Root account 277
Resetting an administrator or root password 278
Resetting user account passwords 278
Configuring administrator accounts 279
Password security 280
Configuring administrator groups 281
Configuring user accounts 281
Configuring a user's principal devices 284
Configuring user groups 284
Backing up and restoring VCS data 286
Creating a backup 286

Cisco VCS Administrator Guide (X7.1) Page 9 of 479
Restoring a previous backup 287
Diagnostics tools 288
Diagnostic logging 288
Creating a system snapshot 289
Configuring Network Log levels 290
Configuring Support Log levels 290
Incident reporting 291
Incident reporting caution: privacy-protected personal data 291
Sending incident reports automatically 291
Sending incident reports manually 292
Viewing incident reports 292
Incident report details 293
Checking the effect of a pattern 294
Locating an alias 295
Port usage 296
Local VCS inbound ports 296
Local VCS outbound ports 296
Remote listening ports 297
Network utilities 298
Ping 298
Traceroute 298
DNS lookup 299
Restarting 301
Restarting using the web interface 301
Rebooting 302
Rebooting using the web interface 302
Shutting down 303
Shutting down using the web interface 303
Shutting down using the CLI 303
Developer resources 304
Debugging and system administration tools 304
Experimental menu 304
Reference material 305
Software version history 306
X7 306
X6.1 308
X6 309
X5.2 310
X5.1 311
X5 314
X4 317
About Event Log levels 319
Event Log format 319
Administrator and FindMe user events 319
Message details field 320
Events and levels 322
CPL reference 329
CPL address-switch node 329
otherwise 331
not-present 331

Cisco VCS Administrator Guide (X7.1) Page 10 of 479
location 331
rule-switch 332
proxy 332
reject 333
Unsupported CPL elements 333
CPL examples 334
LDAP configuration for device authentication 340
Downloading the H.350 schemas 340
Configuring a Microsoft Active Directory LDAP server 340
Configuring an OpenLDAP server 342
DNS configuration examples 345
Verifying the SRV record 345
Microsoft DNS server 345
BIND 8 & 9 345
Changing the default SSH key 347
Default SSH key alarms 347
Restoring default configuration 348
Configuration items reset by DefaultValuesSet level 3 348
Configuration items reset by DefaultValuesSet level 2 349
Password encryption 351
Maximum length of passwords 351
Pattern matching variables 353
Port reference 355
Regular expressions 360
Supported characters 363
Case sensitivity 363
TMS Agent (legacy) 364
FindMe 364
Device Provisioning 365
TMS Agent account passwords 365
TMS Agent passwords 366
TMS Agent LDAP and replication accounts 366
VCSs managed by TMS 366
VCSs not managed by TMS 366
What are traversal calls? 368
Alarms list 369
Alarms summary 369
Command reference — xConfiguration 383
xConfiguration commands 383
Command reference — xCommand 438
xCommand commands 438
Command reference — xStatus 454
xStatus elements 454
About policy services 466
Policy service request parameters 466
Policy service responses 467
Cryptography support 467
Flash status word reference table 468
Bibliography 469
Glossary 471
Legal notices 478

Cisco VCS Administrator Guide (X7.1) Page 11 of 479
Intellectual property rights 478
Copyright notice 478
Patent information 478

Cisco VCS Administrator Guide (X7.1) Page 12 of 479
Introduction
This section provides an overview of the Cisco TelePresence Video Communication Server, including:
nAbout the Cisco TelePresence Video Communication Server
nBase applications
nStandard features
nOptional features
nAbout this guide
nUsing the web interface
nWhat’s new in this version?

Introduction
Cisco VCS Administrator Guide (X7.1) Page 13 of 479
About the Cisco TelePresence Video
Communication Server (VCS)
The Cisco TelePresence Video Communication Server (VCS) enhances the video experience and provides
seamless communication between SIP and H.323 devices utilizing IETF and ITU standards. The VCS is the
center of the video communication network, and connects all H.323 and SIP endpoints, infrastructure, and
management devices. It provides unrivaled scalability and redundancy to video communications, and is
integral to Cisco interoperability with unified communications and Voice over IP systems.
The VCS can be deployed with either the Control application or the Expressway™ application, with various
optional packages including FindMe™, Dual Network Interfaces and Device Provisioning.
VCS base applications
The VCS is available with alternative base applications as described below.
VCS Control
The VCS Control provides internal video control and administration for all SIP and H.323 devices. It is
normally deployed within your wide area network with endpoints that are behind the same firewalls or NAT
devices. The VCS Control replaces the need to have separate H.323 gatekeeper, SIP registrar and H.323 -
SIP gateway servers.
VCS Expressway™
The VCS Expressway provides standards-based firewall traversal for SIP and H.323 devices allowing
secure firewall traversal of any firewall or NAT device. As well as all the functionality of a VCS Control, it
also provides registration of traversal-enabled devices and can act as a standards-based TURN server.
The VCS Expressway is normally deployed outside of your firewall or within the DMZ.

Introduction
Cisco VCS Administrator Guide (X7.1) Page 14 of 479
Standard features
The VCS has the following standard features:
n2500 endpoint registrations
nH.323 gatekeeper
nSIP Proxy/Registrar
nSIP Presence Server
nSIP Presence User Agent
nSIP and H.323 support, including SIP/H.323 interworking
nIPv4 and IPv6 support, including IPv4/IPv6 interworking
nQoS tagging
nBandwidth management on both a per-call and a total usage basis, configurable separately for calls within
the local subzones and to external systems and zones
nAutomatic downspeeding option for calls that exceed the available bandwidth
nURI and ENUM dialing via DNS, enabling global connectivity
nUp to 500 non-traversal calls
nUp to 100 traversal calls
n1000 external zones with up to 2000 matches
n1000 subzones and supporting up to 3000 membership rules
nFlexible zone configuration with prefix, suffix and regex support
nCan function as a standalone VCS or be neighbored with other systems such as VCSs, Border Controllers,
gatekeepers and SIP proxies
nn+1 redundancy, can be part of a cluster of up to 6 VCSs for increased capacity and redundancy
nIntelligent Route Director for single number dialing and network failover facilities
nOptional endpoint authentication (including AD authentication for Movi clients)
nControl over which endpoints are allowed to register
nCall Policy (also known as Administrator Policy) including support for CPL
nCan be managed with Cisco TelePresence Management Suite (TMS) 12.6 or later

Introduction
Cisco VCS Administrator Guide (X7.1) Page 15 of 479
nAD authentication for administrators of the VCS
nPre-configured defaults for:
lCisco Unified Communications Manager neighbor zones
lCisco TelePresence Advanced Media Gateway
lMicrosoft Office Communications Server (OCS) 2007 / Lync neighbor zones
lNortel Communication Server neighbor zones
nEmbedded setup wizard using a serial port for initial configuration
nSystem administration using a web interface or RS-232, Telnet, SSH, and HTTPS
Optional features
The following features are available on the VCS by the purchase and installation of the appropriate option
key:
FindMe™
FindMe is a unique industry solution that gives individual video users a single alias on which they can be
contacted regardless of location. Users have the ability to log on to a web-based interface and control where
and how they are contacted. The FindMe feature also includes support for Microsoft Office Communications
Server (OCS) 2007 / Lync 2010, which enables FindMe aliases to register as Microsoft Office Communicator
(MOC) / Lync clients, and MOC / Lync clients to view the presence status of FindMe aliases.
Device Provisioning
The Device Provisioning option key allows VCS to provision endpoints with configuration information on
request and to supply endpoints with phone book information. (Endpoints including Movi v2.0 or later, and
E20 v2.1 or later can request to be provisioned.) All configuration and phone book information is managed in
TMS. The data is then transferred to the VCS, from where it is distributed to endpoint clients through the
Provisioning Server running on the VCS.

Introduction
Cisco VCS Administrator Guide (X7.1) Page 16 of 479
See TMS provisioning and Provisioning deployment guide for more information about how to configure
provisioning.
Dual Network Interfaces
The Dual Network Interfaces option enables the LAN 2 Ethernet port on the VCS Expressway, allowing you
to have a secondary IP address for your VCS.
This option also includes support for deployments where a VCS Expressway is located behind a static NAT
device, allowing it to have separate public and private IP addresses.
This configuration is intended for high-security deployments where the VCS Expressway is located in a DMZ
between two separate firewalls on separate network segments.
Virtual appliance support
nThe VCS can run on VMware on Cisco UCS C200 M2 and UCS C210 M2 servers.
Installation and initial configuration
Full installation and initial configuration instructions for the VCS are contained in VCS Getting Started Guide.

Introduction
Cisco VCS Administrator Guide (X7.1) Page 17 of 479
About this guide
This Administrator Guide is provided to help you make the best use of your VCS.
Your approach to this documentation depends on what you want to do and how much you already know. The
Administrator Guide has been divided into several sections, providing conceptual, configuration and
reference information about the various features and capabilities of the VCS.
This Administrator Guide describes a fully equipped version of the VCS. Your version may not have all the
described extensions installed.
Our main objective with this Administrator Guide is to address your goals and needs. Please let us know how
well we succeeded!
Typographical conventions
Most configuration tasks on the VCS can be performed by using either the web interface or a command line
interface (CLI).
This guide mainly describes how to use the web interface. Some VCS features are only available through the
CLI and these are described as appropriate, including the relevant CLI command.
In this guide, instructions for performing a task using the web interface are shown in the format:
nMenu > Submenu
followed by the Name of the page that you will be taken to.
Where command line interface (CLI) commands are included, they are shown in the format:
nxConfiguration <Element> <SubElement>
nxCommand <Command>

Introduction
Cisco VCS Administrator Guide (X7.1) Page 18 of 479
Using the web interface
Configuration of the VCS is normally carried out through the web interface.
To use the web interface:
1. Open a browser window and in the address bar type either:
lthe IP address of the system
lthe FQDN of the system
2. Click Administrator Login.
(This step does not apply if the VCS is using the TMSProvisioning Extension services to provide user
account data.)
3. Enter a valid administrator Username and Password and click Login (see the Login accounts section for
details on setting up administrator accounts). You are presented with the Overview page.
Note that when logging in using the VCS web interface, you may receive a warning message regarding the
VCS's security certificate. This can safely be ignored.
Acommand line interface is also available.
Required fields
All mandatory fields on web pages are indicated by a red star .
Supported browsers
The VCS web interface is designed for use with Internet Explorer 7, 8 or 9, Firefox 3 or later, or Chrome. Later
versions of these browsers may also work, but are not officially supported. It may work with Opera and
Safari, but you could encounter unexpected behavior.
JavaScript and cookies must be enabled to use the VCS web interface.

Introduction
Cisco VCS Administrator Guide (X7.1) Page 19 of 479
Using the command line interface (CLI)
The VCS can be configured through a web interface or via a command line interface (CLI).
The CLI is available by default over SSH and through the serial port. Access using Telnet can also be
enabled. These settings are controlled on the System administration page.
To use the CLI:
1. Start an SSH or Telnet session.
2. Enter the IP address or FQDN of the VCS.
3. Log in with a username of admin and your system password.
4. You can now start using the CLI by typing the appropriate commands.
Command types
Commands are divided into the following groups:
nxStatus: these commands return information about the current status of the system. Information such as
current calls and registrations is available through this command group. See Command reference —
xStatus for a full list of xStatus commands.
nxConfiguration: these commands allow you to add and edit single items of data such as IP address
and zones. See Command reference — xConfiguration for a full list of xConfiguration commands.
nxCommand: these commands allow you to add and configure items and obtain information. See Command
reference — xCommand for a full list of xCommand commands.
nxHistory: these commands provide historical information about calls and registrations.
nxFeedback: these commands provide information about events as they happen, such as calls and
registrations.
Note that:
nTyping an xConfiguration path into the CLI returns a list of values currently configured for that element
(and sub-elements where applicable).
nTyping an xConfiguration path into the CLI followed by a ? returns information about the usage for that
element and sub-elements.
nTyping an xCommand command into the CLI with or without a ? returns information about the usage of that
command.

Introduction
Cisco VCS Administrator Guide (X7.1) Page 20 of 479
Web page features and layout
This section describes the features that can be found on the VCS web interface pages.
The elements included in the example web pages shown here are described in the table below.
Page
element
Description
Page name
and location
Every page shows the page name and the menu path to that page. Each part of the menu
path is a link; clicking on any of the higher level menu items takes you to that page.
System
alarm
This icon appears on the top right corner of every page when there is a system alarm in
place. Click on this icon to go to the Alarms page which gives information about the alarm
and its suggested resolution.
Help This icon appears on the top right corner of every page. Clicking on this icon opens a new
browser window with help specific to the page you are viewing. It gives an overview of the
purpose of the page, and introduces any concepts configured from the page.
Log out This icon appears on the top right corner of every page. Clicking on this icon ends your
administrator session.
Field level
information
An information box appears on the configuration pages whenever you either click on the
Information icon or click inside a field. This box gives you information about the particular
field, including where applicable the valid ranges and default value. To close the
information box, click on the X at its top right corner.