Jason, Still a great post even 10 years later. @Jason Burns  I know this is an old post but I wanted to clarify something. The documentation for setting up Phone SSL VPN states that if using a 3rd Party CA to sign the ASA cert (Public CA like Entrust or Digicert for example)  that its required to upload the signed ASA cert AND the full Public CA chain to the CUCM  Phone-VPN Trust store.   https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115945-config-sslvpn-ip-phones-00.html You must copy the full certificate chain from the ASA to the CUCM and include all intermediate and root certificates. If the CUCM does not include the full chain, the phones do not have the necessary certificates to authenticate and will fail the SSL VPN handshake.   However; as Jason states in his article, the phone doesn't actually download any certs to itself, but only the Hash value of the cert(s) found in the CUCM Phone-VPN Trust store.  This would imply that the phone doesn't really validate the full chain of trust from Signed_ASA_Cert->IntermediatePublicCA->RootPublicCA, but only compares the Hash of the presented signed ASA cert with it's previously downloaded Hash value.   Can anyone confirm either or both of the two statements? The documentation is incorrect in stating it's required that the CA root cert(s) in addition to the ASA signed cert be uploaded to the Phone-VPN Trust My current customer running phone SSL VPN did not upload the full CA root chain and its been working fine for years. My understanding of the process was correct in that the phone does NOT actually download the full Phone-VPN Trust certs from CUCM, just the Hash value of the Cert in its config file. Thanks ... View more

Dan,  Great article. One thought, Announcements need to be uploaded to each server just like MoH files right ? If so, might want to edit the note to remind users to do this.   Plus as I recall the method for uploading the announcement on another CUCM server after it's created it not straightforward. You end up editing the announcement on the other CUCM nodes and repeating the upload process.  It's different than the MoH file process and may confuse some folks.   If CUCM can't find the Announcement or if there is a codec mis-match or any other issue that would prevent the announcement from playing, will the call routing still work as expected and the caller will just hear silence for a few seconds and then the call will continue to route ? ... View more

Thanks, this is awesome and works great. Question: is there a way to format the output to make it comma delimited ? I did a pretty good job of copying the output from the SSH session, , saving in a text file and importing it into excel using the "space" as a delimiter.  This worked pretty well but messed up where some of our skill names had spaces. Still saved me a ton of time.  Thanks for sharing. ... View more

following up on the 2016 v2 version of the vmtools fix. I found that I still need to put the OS into permissive mode in order to get the vmtools to properly update.  Is this expected ? scenario ESXi 6 Build fresh UCCX 11.0.1  (OS is in enforcing mode as default) Patch to UCCX 11.0.1 SU1 (vm tools are 8384 I didn't check the version after the initial install , I assume provided by the install media) vCenter shows the tools running but outdated Apply the  ciscouccx.VMwareTools2016V2.cop.sgn file Reboot Mount the VMtools media in vCenter and issue the utils vmtools refresh command Tools look like they are installing correctly, server reboots Server comes up, vmware tools are reported as not running / not installed Change os to permissive with utils os secure permissive reboot when server comes back up , repeat the vmtools install server reboots Now the tools are updated and running If the os permissive step is required, comments/questions I suggest updating the release notes for the vmtools patch to call this out. Does the OS need to stay in permissive mode ? Thanks ... View more

I'd recommend looking at the voice class URI command to match your inbound CUCM dialpeer. Also shown are some of the other newer commands added in recent IOS versions (e164 pattern map and server groups) Example below: voice class uri FromCUCM1 sip  !! CUCMCluster1 server IP addresses  host ipv4:10.xx.xx.01  ! CUCM Server #1  host ipv4:10.xx.xx.02  ! CUCM Server #2  host ipv4:10.xx.xx.03  ! CUCM Server #3 voice class server-group 1100  description CUCMCluster1 Servers - Preference selection low to high (0 to 5)  ipv4 10.xx.xx.01 port 5060 preference 1  !! example CUCM SUB1  ipv4 10.xx.xx.02 port 5060 preference 3  !! example CUCM SUB2  ipv4 10.xx.xx.03 port 5060 preference 5  !! example CUCM PUB   voice class e164-pattern-map 1100   description Calls to CUCMCluster1 - 4 digit dial plan   e164 ^[2-8]...$ !  -------  CUCM Inbound ------------- no dial-peer voice 1000 voip dial-peer voice 1000 voip  description Inbound From CUCMCluster1 - This Gateway <== CUCM  session protocol sipv2  incoming uri via FromCUCM1  voice-class codec 1    voice-class sip bind control source-interface GigabitEthernet x/y/z  voice-class sip bind media source-interface GigabitEthernet x/y/z  dtmf-relay rtp-nte sip-kpml  no vad  !  -------  CUCM Outbound ------------- no dial-peer voice 1100 voip dial-peer voice 1100 voip  description Outbound to CUCMCluster1 - This Gateway ==> CUCM  session protocol sipv2  session transport tcp  session server-group 1100  destination e164-pattern-map 1100  voice-class codec 1    voice-class sip bind control source-interface GigabitEthernet x/y/z  voice-class sip bind media source-interface GigabitEthernet x/y/z  dtmf-relay rtp-nte sip-kpml  ip qos dscp cs3 signaling  no vad ... View more

Question on the release of the version-2 VMware tools file (ciscouccx.VMwareTools2016V2.cop.sgn) Is there a readme doc for it ? If so, can it be posted somewhere ? What has changed since the first version ?  Should the new one be re-applied to servers that had the first version applied ? Thanks. PS.  Thanks for staring this blog post ! ... View more

Can the phone firmware be updated over the VPN connection or does the phone need to be brought into the corporate network for firmware updates.  Specifically 7942/62 devices. (updated)  Assume that an Alternate TFTP is correctly set on the phone. ... View more

Another possible error.  Is this paragraph correct under the Type-B phones, with dialing rule ?  It seems to describe the default KPML function.  The diagram following this paragraph seems correct for dialing rules but the text preceding the diagram doesn't seem correct. "Type B SIP Phones: Dial Rules Cisco Type B SIP Phones offer functionality based SIP INVITE Message. Every key the end user presses triggers an individual SIP message. The first event is communicated with a SIP INVITE, but subsequent messages use SIP NOTIFY messages. The SIP NOTIFY messages send KPML events corresponding to any buttons or soft keys pressed by the use" ... View more

I think there is an error in this article with the diagrams. I think the diagram titled "Type A SIP Phone : Dial Rule" is incorrect.  It shows a 7971 phone which is a Type B.  I think the diagram should be moved further down into the type b section  and titled something like "type b phone no dial rules" ... View more

I'm also having this same issue with Firefox 42.0 and Media Sense 10.5.1 SU2. Windows 8.1  64 bit  (FF is 32 bit) I'd rather not use the Java player.  Is there a resolution ? Error Message: "The video could not be loaded, either because the server or network failed or because the format is not supported." ... View more

Question. Is the telco sending you a blank (non existent) calling number or actually sending the string "<NULL>" as the calling number?   I've tested this successfully when the calling number is simply not provided. I haven't run into a case where the telco is sending some text string. ... View more

Just ran into this myself. Can delete log files via RTMT by downloading and deleting or via CLI CLI:  file list activelog /cuic/logs/jmx/* file delete activelog  /cuic/logs/jmx/* noconfirm They are huge files.  I don't think the high and low watermark settings will remove them Need to do it before the disk fills up and the server crashes.  Then you need TAC's help. ... View more