Cisco TelePresence Service manual

Cisco TelePresence
Video Communication
Server
Administrator Guide
Software version: X7.1
D14049.12
March 2012

Cisco VCS Administrator Guide (X7.1) Page 2 of 479
Contents
Introduction 12
About the Cisco TelePresence Video Communication Server (VCS) 13
VCS base applications 13
Standard features 14
Optional features 15
Installation and initial configuration 16
About this guide 17
Typographical conventions 17
Using the web interface 18
Using the command line interface (CLI) 19
Web page features and layout 20
What’s new in this version? 22
TMS Provisioning Extension support 22
Call processing 22
Virtual appliance support 22
Other enhancements and usability improvements 22
Overview and status information 23
Status overview 24
System information 25
Ethernet status 26
IP status 27
Resource usage 28
Clustered VCS systems 28
Active sessions 29
Active administrator sessions 29
Active user sessions 29
Registration status 30
Registrations by device 30
Registrations by alias 31
Registration history 31
Registration details 32
Call status 33
Current calls 33
Call history 34
Call summary 35
B2BUA calls 35
Search history 37
About searches 37
Search history list 37
Search details 38
Local Zone status 39
Zone status 40
Bandwidth 41
Link status 41
Pipe status 41
Policy service status 42
TURN relays status 43

Cisco VCS Administrator Guide (X7.1) Page 3 of 479
Presence 44
Presence publishers 44
Presence presentities 44
Presence subscribers 45
OCS Relay status 46
OCS/Lync B2BUA 47
OCS/Lync user status 47
OCS/Lync B2BUA status 47
TMS Provisioning Extension service status 48
Provisioning Server status 48
User records provided by TMSProvisioning Extension services 49
FindMe records provided by TMS Provisioning Extension services 50
Phone book records provided by TMS Provisioning Extension services 51
Provisioned devices 51
Checking provisioned data 51
Alarms 53
Logs 54
Event Log 54
Configuration Log 55
Network Log 56
Hardware status 58
VCS unit front panel 58
Network and system settings 59
Network settings 60
Configuring IP settings 60
Configuring Ethernet settings 62
Configuring DNS settings 62
Configuring Quality of Service settings 64
Network services 65
Configuring system name and access settings 65
Configuring SNMP settings 67
Time 68
Other settings 71
Configuring the Login page 71
Configuring external manager settings 71
Configuring TMS Provisioning Extension services 72
Configuring logging levels 74
Protocols 76
About H.323 77
Using the VCS as an H.323 gatekeeper 77
H.323 endpoint registration 77
H.323 configuration 77
About SIP 79
VCS as a SIP registrar 79
VCS as a SIP proxy server 80
Proxying registration requests 80
VCS as a SIP Presence Server 81
SIP configuration 81
Configuring SIP domains 84

Cisco VCS Administrator Guide (X7.1) Page 4 of 479
Configuring SIP and H.323 interworking 85
Searching by protocol 85
Enabling SIP endpoints to dial H.323 numbers 85
Registration control 87
About registrations 88
Finding a VCS with which to register 88
Registrations on a VCS Expressway 88
MCU, gateway and Content Server registration 89
Configuring registration restriction policy 89
Registering aliases 90
About Allow and Deny Lists 93
Configuring the registration Allow List 93
Configuring the registration Deny List 94
Device authentication 95
About device authentication 96
Authentication Policy 96
Authentication mechanism 97
Authentication Policy configuration options 99
Zone-level Authentication Policy 99
Subzone-level Authentication Policy 101
SIP authentication trust 102
Device authentication configuration 103
Authentication database 103
Endpoint credentials used for authentication 103
Device authentication using LDAP 104
Authentication process 104
LDAP server settings 104
Device LDAP schemas 106
Authentication using a local database 107
Credentials managed within TMS 107
Starter Pack 107
Authentication using Active Directory Service 108
Movi authentication using an Active Directory Service 108
Active Directory Service (ADS) configuration 109
Authenticating with external systems 112
Zones and neighbors 113
About your video communications network 114
Example network diagram 114
Structuring your dial plan 115
Flat dial plan 115
Structured dial plan 115
Hierarchical dial plan 115
About the Local Zone and subzones 117
Bandwidth management 117
Local Zone searches 117
About zones 118
Default Zone 118
Zone configuration 119
Configuring neighbor zones 119

Cisco VCS Administrator Guide (X7.1) Page 5 of 479
Configuring traversal client zones 122
Configuring traversal server zones 124
Configuring ENUM zones 126
Configuring DNS zones 127
Zone configuration: advanced settings 128
Zone configuration: pre-configured profile settings 133
TLS certificate verification of neighbor systems 133
Configuring a zone for incoming calls only 134
Clustering and peers 135
About clusters 136
Resource usage within a cluster 138
Example deployment 138
Managing clusters and peers 139
Setting up a cluster 139
Maintaining a cluster 139
Peer-specific configuration 141
Sharing registrations across peers 142
Sharing bandwidth across peers 142
Cluster upgrades and downgrades 143
Cluster backup and restore 143
Clustering and FindMe 143
Clustering and Presence 144
Clustering and TMS 144
About the Cluster Subzone 145
Neighboring the local VCS to another VCS cluster 145
TMS Agent replication status 146
Troubleshooting cluster replication problems 147
Dial plan and call processing 148
Call routing process 149
About the VCS's directory service 151
About hop counts 152
Configuring hop counts 152
Dial plan configuration 153
About the fallback alias 153
About transforms and search rules 155
Transforms 155
Search rules 155
About pre-search transforms 156
Configuring pre-search transforms 156
Search and zone transform process 158
Configuring search rules 159
Example searches and transforms 162
Filter queries to a zone without transforming 162
Always query a zone with original alias (no transforms) 163
Query a zone for a transformed alias 163
Query a zone for original and transformed alias 164
Query a zone for two or more transformed aliases 165
Stripping @domain for dialing to H.323 numbers 166
Transforms for alphanumeric H.323 ID dial strings 168

Cisco VCS Administrator Guide (X7.1) Page 6 of 479
Allowing calls to IP addresses only if they come from known zones 170
Configuring policy services 171
About Call Policy 172
Configuring Call Policy 172
Configuring Call Policy rules using the web interface 174
Configuring Call Policy using a CPL script 174
Configuring VCS to use the Cisco TelePresence Advanced Media Gateway 176
Configuring the VCS 176
Usage features and limitations 176
Configuring Cisco AM GW policy rules 177
Dialable address formats 179
Dialing by IP address 179
Dialing by H.323 ID or E.164 alias 179
Dialing by H.323 or SIP URI 179
Dialing by ENUM 180
IP dialing 181
Calls to unknown IP addresses 181
About URI dialing 183
URI dialing without DNS 183
URI dialing via DNS 184
URI resolution process using DNS 184
URI dialing via DNS for outgoing calls 186
URI dialing via DNS for incoming calls 187
URI dialing and firewall traversal 190
About ENUM dialing 191
ENUM dialing process 191
Enabling ENUM dialing 191
ENUM dialing for outgoing calls 192
Zone configuration for ENUM dialing 193
ENUM dialing for incoming calls 195
Configuring DNS servers for ENUM and URI dialing 196
Call signaling configuration 198
Identifying calls 199
Disconnecting calls 201
Disconnecting a call using the web interface 201
Disconnecting a call using the CLI 201
Limitations when disconnecting SIP calls 201
Bandwidth control 202
About bandwidth control 203
Example network deployment 203
Bandwidth configuration 205
About downspeeding 205
About subzones 206
Default links between subzones 206
About the Traversal Subzone 206
About the Default Subzone 207
Configuring subzones 207
Configuring subzone membership rules 208
Applying bandwidth limitations to subzones 209
Links and pipes 212

Cisco VCS Administrator Guide (X7.1) Page 7 of 479
Configuring links 212
Default links 212
Configuring pipes 213
Applying pipes to links 214
Bandwidth control examples 216
Firewall traversal 218
About firewall traversal 219
Expressway solution 219
How does it work? 219
VCS as a firewall traversal client 219
VCS as a firewall traversal server 220
Configuring a traversal client and server 221
Firewall traversal protocols and ports 222
Expressway process 222
H.323 firewall traversal protocols 222
SIP firewall traversal protocols 222
Ports for initial connections from traversal clients 223
Default port summary 223
TURN ports 224
Ports for connections out to the public internet 224
Firewall traversal and authentication 225
Authentication and NTP 226
Firewall traversal and Dual Network Interfaces 227
Firewall configuration 228
Configuring traversal for endpoints 228
Configuring traversal server ports 229
About ICE and TURN services 230
About ICE 230
About TURN 230
Configuring TURN services 231
Applications 232
Conference Factory 233
Conference creation process 233
Presence 235
Presence Server 235
Presence User Agent (PUA) 236
Configuring Presence 237
OCS Relay 240
Configuring a connection between the VCS and the OCS 240
Microsoft OCS/Lync B2BUA (back-to-back user agent) 241
Usage features and limitations 241
Configuring the Microsoft OCS/Lync B2BUA 242
Configuring the B2BUA's trusted hosts 244
Configuring transcoder policy rules 245
Configuring B2BUA transcoders 246
Restarting the B2BUA service 247
FindMe™ 248
User (FindMe) account configuration 248
How are devices specified? 248

Cisco VCS Administrator Guide (X7.1) Page 8 of 479
FindMe process overview 249
Recommendations when deploying FindMe 249
Configuring FindMe 249
Searching for FindMe users 252
TMS provisioning 253
VCS Provisioning Server 254
Starter Pack provisioning 256
Configuring Starter Pack provisioning 256
Maintenance 258
About upgrading software components 259
VCS software components 259
Prerequisites 259
Backing up before upgrading 259
Upgrading and option keys 260
Installing and rebooting 260
Upgrade procedure 260
Upgrading using secure copy (SCP/PSCP) 261
Option keys 263
Adding option keys using the web interface 264
Adding option keys using the CLI 264
About security certificates 265
Managing security certificates 265
CRL management 266
Certificate-based authentication configuration 267
Client certificate testing 269
Advanced account security 271
Prerequisites 271
VCS functionality: changes and limitations 271
Configuring language settings 273
Changing the language 273
Installing language packs 273
About login accounts 274
Account authentication 274
Administrator accounts 274
User accounts 274
Root accounts 275
Configuring login account authentication 275
Account authentication using LDAP 275
Login history 277
Root account 277
Resetting an administrator or root password 278
Resetting user account passwords 278
Configuring administrator accounts 279
Password security 280
Configuring administrator groups 281
Configuring user accounts 281
Configuring a user's principal devices 284
Configuring user groups 284
Backing up and restoring VCS data 286
Creating a backup 286

Cisco VCS Administrator Guide (X7.1) Page 9 of 479
Restoring a previous backup 287
Diagnostics tools 288
Diagnostic logging 288
Creating a system snapshot 289
Configuring Network Log levels 290
Configuring Support Log levels 290
Incident reporting 291
Incident reporting caution: privacy-protected personal data 291
Sending incident reports automatically 291
Sending incident reports manually 292
Viewing incident reports 292
Incident report details 293
Checking the effect of a pattern 294
Locating an alias 295
Port usage 296
Local VCS inbound ports 296
Local VCS outbound ports 296
Remote listening ports 297
Network utilities 298
Ping 298
Traceroute 298
DNS lookup 299
Restarting 301
Restarting using the web interface 301
Rebooting 302
Rebooting using the web interface 302
Shutting down 303
Shutting down using the web interface 303
Shutting down using the CLI 303
Developer resources 304
Debugging and system administration tools 304
Experimental menu 304
Reference material 305
Software version history 306
X7 306
X6.1 308
X6 309
X5.2 310
X5.1 311
X5 314
X4 317
About Event Log levels 319
Event Log format 319
Administrator and FindMe user events 319
Message details field 320
Events and levels 322
CPL reference 329
CPL address-switch node 329
otherwise 331
not-present 331

Cisco VCS Administrator Guide (X7.1) Page 10 of 479
location 331
rule-switch 332
proxy 332
reject 333
Unsupported CPL elements 333
CPL examples 334
LDAP configuration for device authentication 340
Downloading the H.350 schemas 340
Configuring a Microsoft Active Directory LDAP server 340
Configuring an OpenLDAP server 342
DNS configuration examples 345
Verifying the SRV record 345
Microsoft DNS server 345
BIND 8 & 9 345
Changing the default SSH key 347
Default SSH key alarms 347
Restoring default configuration 348
Configuration items reset by DefaultValuesSet level 3 348
Configuration items reset by DefaultValuesSet level 2 349
Password encryption 351
Maximum length of passwords 351
Pattern matching variables 353
Port reference 355
Regular expressions 360
Supported characters 363
Case sensitivity 363
TMS Agent (legacy) 364
FindMe 364
Device Provisioning 365
TMS Agent account passwords 365
TMS Agent passwords 366
TMS Agent LDAP and replication accounts 366
VCSs managed by TMS 366
VCSs not managed by TMS 366
What are traversal calls? 368
Alarms list 369
Alarms summary 369
Command reference — xConfiguration 383
xConfiguration commands 383
Command reference — xCommand 438
xCommand commands 438
Command reference — xStatus 454
xStatus elements 454
About policy services 466
Policy service request parameters 466
Policy service responses 467
Cryptography support 467
Flash status word reference table 468
Bibliography 469
Glossary 471
Legal notices 478