Home cluster settings when enabling ILS

[Alexander M Popov]

All,

I have a question with regards to our wish to enable ILS. I will try to lay out our environment and explain the challenge.

We have 4 regional CUCM clusters that is currently being upgraded from 8.x and 9.x to 10.5.

AD sync is set up on all locations towards the same AD, I see after our first cluster was upgraded that all users synchronized is marked as home cluster, even though they do not use any services from that cluster but a different one.

My concern is how to proceed to ensure that only correct users are enabled for home cluster at each cluster to not have any issues when we enable ILS.

Have been trying to find documentation on this but only found how to enable ILS, nothing about ensuring home cluster settings.

I hope my explanation make sense and that someone out there can give me some advice or point me in the direction of some documentation.

Thank you,

Alex

[Jaime Valencia]

That's a manual process, as far as CUCM is concerned, it enabled them all as local users because you synced them, if they're not, you'll need to go and manually adjust that.

There's no tool or anything else on CUCM to make sure the checkbox is on the "right" cluster.

[Alexander M Popov]

Do you have any idea if I break to much if I first run a bulk job on all users removing the home cluster then run a new bulk to enable on only the ones i want to have?

If i do this out of buisness hours, will it break something for the users?

thanks for your support!

[Ayodeji Okanlawon]

No it will not. 

[Alexander M Popov]

I just now found a way to do it:

Using bulk job i Generate User Import that includes home cluster settings and enabled for IM&P

Then in excell, i filter out all that is enabled for IM&P and then for the users that is left i run a bulk job to remove the check box for Home Cluster.

I think this is the lowest risk and easiest way to clean up.

What do you think?

-alex

[Fred Nielsen (ePlus)]

Good approach.  A slight spin to get the data out with a little more filtering is a direct SQL query, the following CLI query is quick and should return userid's of those who meet the following conditions:

• have home cluster set (probably by default)
• do not have IM&P enable set 
• have no associated phone devices built on the system

run sql select userid from enduser u left join enduserdevicemap m on u.pkid=m.fkenduser where islocaluser='t' and enablecups='f' and fkenduser is null order by userid

[carlnewton]

This query is great! so thanks for that :)

is there any way to change the default on version 9.1?

why you would want home cluster set to be on by default I don't know, seems like a silly default to me!

[Ayodeji Okanlawon]

Carl

There is no way to do that on cucm9.1. This is one of the issues on this version. It's well documented. 

[Nikolay.Ralchev]

Hi Fred,

Can you help with the opposite scenario? I would like to run a query to list all users with associated devies but "home cluster" uchecked. We have found that we have some misconfired users and i would like to find an easier way to list them using this approach.

Here is the criteria

have home cluster unchecked
do not have IM&P enable set
Users with associated phone devices

Thanks in advance!

[Roger Kallberg]

For the first two parts this would likely help you out.

run sql select userid from enduser where (islocaluser = 'f' and enablecups = 'f')

However I'm not 100% sure on the first item.

[Ayodeji Okanlawon]

I am surprised this is happening in CUCM 10.5.

Here is a bug that described this behavior and it shouldn't happen in CUCM 10

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuj59364

Symptom:
Pre 10.0 CUCM release, when the users are synced from LDAP, the home cluster is enabled by default but after the upgrade to CUCM 10.0 when the new users are synced from LDAP the home cluster is not enabled.

Conditions:
Upgrade to CUCM 10.0.

Workaround:
Customers are required to modify/add to their existing LDAP sync agreement and add a Feature Group Template which has the Home cluster enabled.

I would open a TAC case and reference this bug.

[Alexander M Popov]

Hi.

Let me clarify one thing.

Currently, only our cluster that was on 9.1 have been upgraded to 10.5 and I did see the home-cluster check on all users already in 9.1. What you are saying is that future users that is synced now that we are on 10.5 will not get that checkbox automatically? unless I configure a feature group that is.

Thanks for your support!

[VIVIEN MAHONEY]

One other note that might help others. Instead of syncing all AD accounts to all clusters, we apply an LDAP filter to the user directory sync so that we only import users in the countries supported by that cluster.  We have a second sync for admin accounts based on global group membership so that these import to all clusters.