I show that configuration

samhopealpha · ‎08-10-2017

Hi Everybody,

I am going to create an adhoc conference with Internal CA

But CUCM still showing the CMS registration "unknown" state

By following the guide (section 4: Setting up escalated ad hoc calls)
https://www.cisco.com/c/dam/en/us/td/docs/conferencing/ciscoMeetingServer/Deployment_Guide/Version-2-2/Cisco-Meeting-Server-2-2-Deployments-with-CUCM.pdf

Version
CUCM 11.5
CMS 2.2.5
SX20 ce 8.3.2
mx800 ce 8.3.2
Cisco TelePresence DX70 ce 8.3.2

The endpoints are all updated to ce 8.3.2
Rendezvous call is tested successfully
The SIP trunk is TLS already between CUCM and CMS.

acano> webadmin
Enabled : true
TLS listening interface : a
TLS listening port : 443
Key file : webadmin.key
Certificate file : webadmin.crt
CA Bundle file : cacert.pem
HTTP redirect : Enabled
STATUS : webadmin running
acano>
acano>
acano>
acano> callbridge
Listening interfaces : a
Preferred interface : a
Key file : callbridge.key
Certificate file : callbridge.crt
Address : none
CA Bundle file : cacert.pem
acano>

In CUCM,

HTTP inferface info
Override sip trunk destination as http address: <Tried checked and unchecked>
username : <tried the username with admin role and API role>
HTTPS port: 443

Anybody know what's the problem why CMS cannot register to CUCM?

Thanks in advance

Sam

Oleg Serstjuk · ‎08-10-2017

Your SIP trunk security profile, do you have the correct FQDN of the CMS server in this field X.509 Subject Name?

samhopealpha · ‎08-11-2017

Don't know is it correct or not ...

if Rendezvous call is tested successfully, the SIP trunk and X.509 subject name should be fine

but the conference bridge (CMS) cannot register to CUCM

Jaime Valencia · ‎08-10-2017

I show that configuration here:

https://youtu.be/FFcGHWb718c

HTH

java

if this helps, please rate

samhopealpha · ‎08-11-2017

Thanks for sharing the link

i have followed the instruction, but it seems failed...

and i found some error in CUCM, but no idea how to interrupt

msubby · ‎09-27-2017

Did you ever get anywhere with this? I am in the exact same point. My SIP Trunk is connected between CUCM and CMS but the Conference Bridge remains in a State of None and it doesn't show the IP address of the CMS in the CUCM, even though the SIP trunk is fully operational.

Zoltan Kelemen · ‎09-27-2017

1. Do you have a signed certificate assigned to your CMS webadmin? (i.e. not CMS self-signed)
2. Does your CUCM trust this certificate? (i.e. the issuing CA's root is added as a CallManger-trust certificate to all nodes?)

3. does the certificate have Client and Server authentication Extended Key usage set?

4. is the CB on CUCM configured with port used by the webadmin if not on 443?

5. Does the FQDN in the CB configuration appear as CN or SAN of the webadmin certificate?

iamnewborn · ‎10-02-2017

I'll answer for my case.

1. Do you have a signed certificate assigned to your CMS webadmin? (i.e. not CMS self-signed)

Yes.

2. Does your CUCM trust this certificate? (i.e. the issuing CA's root is added as a CallManger-trust certificate to all nodes?)

Yes, but are you sure that it must be in Callmanager-trust rather than in tomcat-trust?

3. does the certificate have Client and Server authentication Extended Key usage set?

Yes, both enabled:

Client Authentication (1.3.6.1.5.5.7.3.2)
Server Authentication (1.3.6.1.5.5.7.3.1)

4. is the CB on CUCM configured with port used by the webadmin if not on 443?

Yes, 445 port is defined.

5. Does the FQDN in the CB configuration appear as CN or SAN of the webadmin certificate?

Yes

Zoltan Kelemen · ‎10-02-2017

To answer your question, yes, I am quite certain.

To register CMS as a CFB resource, the CallManager service will be reaching out to the CMS with API commands (reminder, CMS API is run by the webadmin service on CMS). Tomcat does not act as a client here (thus it does not need totrust webadmin's certificate)

to investigate further, you can:

try packet capture on the webadmin interface. If it's a TLS issue, you should be able to see it
look at CallManager traces while the CFB has been reset
enable detailed API logs on CMS and look into the "log" file to see what is coming from CUCM / see if you can spot some errors

iamnewborn · ‎10-03-2017

Yes, you are right, it must be CallManager-trust, otherwise this trunk will not work.

I've re-uploaded the certificates and Conference Bridge now successfully registers to CMS.

Also note that we must upload Root CA/Intermediate CA certs to the CUCM. If they are missing, CUCM won't be able to trust to the CMS webadmin certificate issuer.

Farrukh ' · ‎02-21-2018

Hi ,

I have configured CMS only for ad-hoc conference, i have performed the below steps on CMS and CUCM(nothing more than this)

1. installed CMS 2.3
2. installed License
3. configure webadmin and callbridge (CA signed certs installed)
4. set TLS min version to 1.0 as CUCM is not 11.5 SU3
5. added root and intermediate root in certificate store as callmanage-trust in CUCM
6. create sip trunk with non secure sip security profile
7. configured conf bridge on CUCM

Last point to mention that CMS DNS entry is not added into DNS server yet, and i have created sip trunk with IP of CMS

still my conf bridge is not registering with CMS. did i miss anything?
I need your help, please help on this

Zoltan Kelemen · ‎02-21-2018

How did you add the CFbridge to CUCM?

CUCM will have to make a https connection to the webadmin (make sure you are connecting to the correct port) and will be comparing the hostname in the SIP trunk or CFB HTTP Interface destination with the contents of CN or SAN fields of the received certificate.

Since your CMS name is not yet in DNS, CUCM either can't resolve this address, or if you have entered an IP here, it will not be able to find the IP in the certificate of CMS webadmin. So first of all I would fix that problem if i were you.

Other than that it can always be helpful to take a packet capture to see if https traffic is working between CUCM and webadmin (also if TLS handshake is successful or not)
and a look onCMS side logs to see if you get anything from CUCM or not. perhaps the credentials for webadmin are incorrect or do not have API priviledges.

Farrukh ' · ‎02-21-2018

Hi,

CFB type is telepresence conductor and now i have added the DNS entry.

when i checked the logs on CMS it is showing that CUCM is accessing it but still not registered.

CMS credentials that i put on CFB has admin role and it supposed to work with this credentials.

Farrukh ' · ‎02-23-2018

Hi Zolten,

Issue got fixed and adhoc CFB is now registered after issue commands tls webadmin min-tls-version 1.0 & tls sip min-tls-version 1.0

thank you for your support and quick response

Adviser · ‎04-27-2018

Absolutely correct answer. Respect you.

CMS 2.2 ad hoc call not work