Cisco VCS X6.1 and MS Lync 2010 over TLS

[Evgeniy.Glazkov]

Hello all!

I have a problem integrating CiscoVCS(X6.1) and Lync 2010.

I could not setup VCS Control to Lync connection over TLS, but I done it with TCP.

If I try TLS, there are Event="Outbound TLS Negotiation Error", Detail="bad packet length" records in the VCS Control event log.

Both VCS and Lync certificates are from same trusted CA with their FQDNs  as the subject names, and both VCS and Lync FQDNs with PTRs are in DNS. Of course, VCS and Lync FQDNs, which is subjects of certificates, used in VCS zone peer and Lync trusted app destination host.

Calls to VCS is from IP of the Lync FEP. We don`t use any HLB and Directors. Also, VCS is standalone, without any balancers or clustering.

Signaling from Lync is done, but as I see, VCS cannot send any data back.

Lync is on Server 2008 R2 x64

Thanks for any suggestions!

[ryquinla]

I don't know the root cause as to what causes the VCS to not send a full list of ciphers.

The procedure I outlined above does correct the behavior though.

[Evgeniy.Glazkov]

Thank you, I will try it!

[Martin Koch · Accepted solution]

In reflection of the c20 post, which software image do you run on the VCS?

with:

 s42700x6_1_0.tar.gz     21-Apr-2011 12:39  266M  


or without:
 s42701x6_1_0.tar.gz     21-Apr-2011 12:43  266M  

encryption?

[Evgeniy.Glazkov]

Hello, Martin!

I am use s42701... Can you tell, where described, that this software version don`t support encription?

Can I replace software with s42700, or it will not work?

Thanks!

[Martin Koch]

Hi Evgeniy!

To be on the save side, I would recommend talking to your Cisco representative.

In general the update should either start or stop during the validation of the release key.

So in theory you shall not be able to harm your VCS when you try.

Again, I would say it should fail due to the NC key.

If you are able to upgrade, always double check the laws and regulations in your region.

[Evgeniy.Glazkov]

Ok, thank you, Martin!

[ryquinla]

If you have s42701 running you won't be able to upgrate to a 00 or s42700 build. The crypto and non crypto software is tied to the release keys.

In any case the fact that you're on a NC build should not matter. Even as it stands with the NC build the VCS is capable of offering up a TLS connection.

If you're having trouble with the procedure I sent earlier please call TAC and work with them.

Regards