Hi William,
I will try to answer on some of these questions
1. When a Movi client is connecting to the VCS Control (Internal) my understanding is that the Default Zone is handling the initial Subcribe message and that it is recommended that the Default Zone's authentication policy is set to "Do not check credentials". The idea is that the TMS agent will handle authentication at this point (for provisioning). Is this accurate?
That is correct , it basically means that device authentication is not enabled and provisioning request is challenged by the provisioning server.
If however the VCS is set to ‘Check credentials’ where the provisioning request is challenged by VCS – the usernames and passwords on VCS must be in sync with the provisioning usernames and passwords.
2. Now, if I were to create a membership rule that places Movi clients into a specific local subzone, what would be the requirements for Authentication Policy for the local subzone? Should it still be "Do not check credentials"? Also, would the Default Zone still be used for the provisioning step? Meaning, that both the Default Zone and the Movi local subzone would need the same authentication policies.
The authentication policy for the local subzone will be ignored and only the policy on that specific local subzone will be taken into account.
And no, it should not be "Do not check credentials" because what will happen is that Movi will sign in successfully but the presence status change will fail.
The reason behind this is that once authenticated with username and password against the provisioning db the Movi will receive all the provisioning configuration and will successfully register. However the publish message will get 403 because it has not been authenticated.
3. When a Movi client is connecting to the VCS Expressway, how does the Expressway know to push the subscribe message to the VCS Control? I saw a mention of search rules in one of the guides, but it wasn't clear how the expressway knows to forward the provisioning request. What is used? Where is it set?
It does know by the search rules, so if it has searched for 'AnyAlias in the LocalZone' , hasn’t found it and then it will continue searching for the same alias towards traversal zone , usually the VCS with the provisioning db.
4. Again, with authentication my understanding from the VCS X6 release notes is that the Default Zone on the VCS Expressway is configured with "Do Not Check Credentials" and the Traversal Client Zone on the VCS Control is also configured for "Do Not Check Credentials". The idea (from my understanding) is to get the TMS agent on the VCS Control to do the authentication. Is this an accurate understanding?
Basically - yes, but even if you have had set on the Expressway's DZ "Check credentials" they should match the u/p from the provisioning database.
Another think you have to pay attention for is if you have set "Treat As Authenticated" on the DZ that will lead to registering with whatever password given that the Subzone is set to either "Do Not Check Credentials or Treat As Authenticated".
Here were are talking for non proxied registration. Same behavior is valid also for Control - if you set the DZ to "Treat As Authenticated" and the Subzone to DoNotCheck Credentials or "Do Not Check Credentials or Treat As Authenticated" this will result to registering with whatever password.
5. Where does the Movi actually register in this case? The Expressway or the Control?
If the sip domain you are registering to exist on the Expressway then the Movi will register to the Expressway , if it does not then the registration will be proxied to the Control and the Movi registration will be in the traversal subzone on the control
6. If #5 is the Expressway, what considerations are needed if the Expressway has a local subzone membership rule for Movi clients? Does it need to have "Do not check credentials" as well?
It depends if you are using authentication database for the Expressway (local or remote) which btw I would recommend.
As if i haven't asked enough, I am wondering what happens if one were to use the Active Directory Direct method for authenticating Movi clients. My read on this method is that the whole approach to authentication policies change. Instead of "Do not check credentials" you want to "Check credentials" (along with some other configs related to NTLM authentication).
That is correct , this will force the VCS to check credentials before forwarding to the provisioning server.
In the VCS Device Authentication Deployment Guide it says that the "Default Zone" should be configured to "Check credentials". What isn't clear is what does this mean when you have a VCS Expressway and a VCS Control. I am going to guess that it means the following:
(a) VCS Expressway
Default Zone: "Do not check credentials"
(b) VCS Control
Traversal Client Zone: "Do not check credentials"
Default Zone: "Check credentials"
1. Is the above accurate? Or would I also need to check credentials on the Traversal client zone?
2. What if I were to have membership rules pointing the Movi client to a subzone?
What I would do is:
(a) VCS Expressway
Default Zone: "Check Credentials"
Default Subzone: "Check Credentials"
(b) VCS Control
Traversal Client Zone: "Do not check credentials"
Default Zone: "Do not check Credentials"
Default Subzone: "Treat as Authenticated"
But again it is up to the particular requirements
