How does it work? The "+" Dialing feature is normally use after having the E164 (Globalization) configuration applied to your incoming calls on Call Manager. When E164 is applied now you can go a look at the Directory on your phone and you will be able to see the numbers showing up the full E164 format as the following +1 212 509 5252. Important Same way as when configure Globalization and Localization we need to apply this configuration for the 3 type of calls we have. Local(Subscribe), National and International. Scenarios: - We have an IP-Phone with DN=5353 with External Phone Number Mask as (212 509 5353). Phone is going to call from Directory: Local=  +1212 509 5252 (Pattern \+1[2-9]xx[2-9]xxxxxx ) National= +1415 888 3232 (Pattern \+1[2-9]xx[2-9]xxxxxx ) International= +1 011 506 2575 9898 (Pattern \+.! ) Configuration Phone= 5353 (2125095353) PT= Internal CSS= Internal-PT|local-PT|International-PT 1- We need to configure a "Route-Pattern" that the phone can access via "CSS" and "PT" to be able to match the called number. The Route Pattern will look as the following (For Local and LD calls) The Route Pattern will look as the following (For International) Note= The Route list will be the same as it should contain the Route Group where the Destination (Gateway) should be included. 2-  Now is time to configure the "Called Party Xformation Patterns" that we will use to match the outgoing calls. 2.1- Three Partitions (Local,National,International) 2.2- Three Called Party Xformation Patterns (Local,Nationa,International) 2.3- One Calling Search Space (This one is going to be apply on the Destination End-point (Gateway) under outbound calls) Xformation Patterns on Call Manager Call Routing > Transformations>Transformation Pattern>Called Party Transformation Pattern. "Local" Called Party Xformation Pattern "Long Distance" Called Party Xformation Pattern "International" Called Party Xformation Pattern 3- Now we should just go to the "Calling Search Space: created on step 2 and include the 3 Partitions for each Xformation Pattern created.  4- Apply the "Calling Search Space" to the Gateway where the calls are going to send to the PSTN. (Save>Apply Config>Reset)   Results Local Calling=2125095353 Called= 5095252 Long Distance Calling=2125095353 Called= 14158883232 International Calling=2125095353 Called= 01150625759898 Regards, Gerson Fabian Morales Marin (gersomor)   ... View more

  What is E164? E.164 defines a general format for international telephone numbers. The international public telecommunication numbering plan, that defines a numbering plan for the world-wide public switched telephone network (PSTN) and some otherdata networks. Example: +1 212 509 9268 Understading the flow on Call Manager When Call Manager receives the call from the PSTN,this call is normally Tag with the call type which can be Subscribe(local),National or International and this Tag will be used by Call Manager to properly apply the E164 format base on the Type of number. It is important to remember when the CUCM receives the call, the Gateway becomes the " Originator " End-Point and the IP-Phone becomes the " Destination " End-Point Note= The IP-Phone will invoke the Calling party transformation pattern.   Recreation: In this example we will be making a call from a Cell-Phone located in New York to a Call Manager also located in New York. Calling Number=   509 5353 Called number= 212 509 9268 How do we want this to work? 1- While phone is ringing we want the phone to show up only the last "7" digits 5095353 ( Localization ) 2- When the call has ended and we look at the Directory we want it to show the E164 format +12125095353( Globalization ) Configuration on Call Manager 1- We need to confirm the Device Pool associated to the ingress Gateway.   2- Before making any change create a "Calling Search Space" and "Partition" that will be use on the "Calling Party Xformation configuration" Calling Search Space and Partition. Creating a Calling Party Transformation Pattern Call Routing > Transformations>Transformation Pattern>Calling Party Transformation Pattern. 3- Now that we have the Xformation pattern configured; we can apply the change on the Device Pool of the Gateway or directly on the Gateway. Calling type Configuration National Number= It will be the format number that will be shown if the call is made for example from another estate. International Number= This parameter will add the "+" sign in fronT of the calling number sent by the PSTN. Unknown Number= This is related to numbers that are not set by the PSTN (Private). Subscriber Number= This parameter refers to the "Local" numbers on the same are code. Note= Apply the calling "Xformation CSS" on the Device Pool. 4- Now we can apply the configuration on the Destination device that can either be applied on the " Device Pool " configuration or at the " Phone " itself. Phone Configuration Device Pool Option Phone Option Phone option on CUCM version 9.X or above. Note= If you want to use the Phone option make sure to un-check the box to use the Device Pool Calling Part Xformation CSS. Call Flow Summary: 1- Cell Phone (509 5353) on the PSTN calls (212 509 9268). 2- Gateway receives the call and uses its Device Pool configuration to match the "Call Type" and "Calling Xformation CSS" 3- Phone receives the call and matches the "Calling Party Xformation CSS" configured either on the Device Pool or on the IP-Phone. Results: While Ringing ( Number localized ) From 5095353 Missed/Recived Calls Directory ( Number Globalized ) +12125093535 Calling out using "+ Dialing" This Configuration example will help you to apply the Globalization and Normalization configuration on your Call Manager for all incoming calls; in the other hand if you want the users to be able to dial-out from the Directory numbers showing up E164 format please refer to the next DOC  " + Dialing " on the link below. https://supportforums.cisco.com/document/13136301/plus-dialing-call-manager-after-globalization-configuration-example Regards, Gerson Fabian Morales Marin (gersomor)                                                                 ... View more

  Configuration Topology Voice Gateway C3845 -----MGCP-----Call Manager 11.0.1.20000-2 Call Manager= 192.168.213.75 Voice Gateway Configuration Configure PRI on the Voice Gateway Refer to link https://supportforums.cisco.com/document/13130021/basic-t1-pri-configuration-lab-recreation-service-provider-and-branch   1- Enable MGCP protocol. 2- Add the call-agent ip address (Call Manager's IP) CUCM-3845B(config)#mgcp call-agent 192.168.213.75 service-type mgcp CUCM-3845B(config)#CCM-manager config Server 192.168.213.75 CUCM-3845B(config)#mgcp dtmf-relay voip codec all mode <mode> cisco         Set mgcp dtmf-relay mode to be cisco disabled    Set mgcp dtmf-relay mode to be disabled nse           Set mgcp dtmf-relay mode to be nse nte-ca       Set mgcp dtmf-relay mode to be nte-ca nte-gw       Set mgcp dtmf-relay mode to be nte-gw out-of-band  Set mgcp dtmf-relay mode to be out-of-band NSE= NSE  based DTMF-Relay method uses payload type (PT) = 100 by default. This  method is also Cisco proprietary. Again, DTMF-Relay mechanism is not  carried out in SDP messages and is not negotiated. Each GW uses its  local configuration to make the decision of DTMF-Relay method and PT  value. Thus both ends should be configured with the same parameters for  the setup to work. This method also can't be considered as GW-Controlled  or CA-Controlled since negotiation isn't present, neither directly nor  through CA. NTE-CA= MGCP  RTP-NTE has two implementations, which are Call Agent (CA) Controlled  and Gateway (GW) Controlled. In CA-controlled mode, CA will negotiate  DTMF relay capabilities on behalf of the gateways (SDP messages are sent  to CA). This is required in a setup where the other GW/Endpoint is  non-MGCP. After negotiation, CA instructs the MGCP gateway to use the  negotiated PT values. NTE-GW= This  is the other implementation of MGCP RTP-NTE. In GW-controlled mode, GWs  negotiate DTMF transmission and RTP PT values by exchanging capability  information in SDP messages. This transmission is transparent to the CA  (Call Agent). This would work in a setup where both GWs are running MGCP  and connected to the same CUCM. OUT-OF-BAND = In  OOB method, DTMF events will be signaled to CUCM using MGCP protocol  messages. To be more specific MGCP NTFY messages will be sent to CA.  After any digit is received by MGCP GW and signaled to CUCM, CUCM will  send RQNT message to the GW. This message will ask the GW to monitor the  events of DTMF Digits, Fax-Relay (FXR), and T.38 Relay CUCM-3845B(config)#ccm-manager mgcp CUCM-3845B(config)#ccm-manager redundant-host  <1st backup> <2nd backup>   Note: If exist secondary servers that we can use as backup add the command above. CUCM-3845B(config)#ccm-manager switchback ?   graceful        Graceful switchback   immediate      Immediate switchback   never              Never switchback   schedule-time  Scheduled time (next 24 hours) switchback   uptime-delay   Up time delay switchback   Not specified ( default) – Means no switchback Graceful -- Switches back after last active call ends. Immediate -- Switches back as soon as TCP link to primary is established. Verify MGCP configuration on Voice Gateway Show ccm-manager 3- Go to the Interface Serial generated for the PRI and make sure to have the command isdn bind-l3 ccm-manager 4- Go to the Controller T1 1/0 and make sure to have the command pri-group timeslots 1-24 service mgcp MGCP commands Summary CUCM-3845B(config)# CUCM-3845B(config)#mgcp call-agent 192.168.213.75 service-type mgcp version 0.1 CUCM-3845B(config)#CCM-manager config Server 192.168.213.75 CUCM-3845B(config)#mgcp dtmf-relay voip codec all mode out-of-band CUCM-3845B(config)#ccm-manager mgcp CUCM-3845B(config)#ccm-manager redundant-host  <1st backup> <2nd backup> CUCM-3845B(config)#ccm-manager switchback graceful CUCM-3845B(config)#controller t1 1/0 CUCM-3845B(config-controller)#pri-group timeslots 1-24 service mgcp CUCM-3845B(config)#interface Serial1/0:23 CUCM-3845B(config-if)#isdn bind-l3 ccm-manager   At this point our MGCP configuration is done on the Voice Gateway. Let's move to Call Manager. On Call Manager 1- Go to Cisco Unified Administration >Device >Add New >(select your Voice Gateway model) > Click next > Protocol MGCP> Next.   Note: Make sure to use the correct " Domain name " compose by the hostname of the router and the domain. Verify the correct host name using the "show ccm-manager" command. 2- Add the correct " Slots, VICs and Endpoints ". Verification on your Voice Gateway 1- Run " show inventory " and verify the slots and cards available. We are going to use " NM-HDV2-2T1/E1 " on Slot 1 base on our available cards. 3- Add the correct card information on Call Manager. 4- Verify that the correct T1-PRI on the Voice Gateway match with the results on Call Manager. Make sure to click save every time you select something. In my example I configured only controller T1 1/0 reason why it is the only UP . 5- Now go to the 1/0 port and select " Digital PRI" and click next. 6- Apply your configuration and how you want it to work with Call Manager. 7- Click Save>Apply configuration >reset. Results At this point your T1-PRI should be registered on Call Manager. Show Commands Show commands show ccm-manager show ccm-manager backhaul show ccm-manager hosts show controllers t1 show mgcp statistic Related links http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/68240-mgcp-gtwy-reg-failure.html http://www.cisco.com/c/en/us/support/docs/voice/media-gateway-control-protocol-mgcp/23966-mgcp-pri-cm.html Thanks for checking. regards, Gerson Fabian Morales Marin (gersomor)         ... View more

  Configuring T1-PRI example What is a PRI? The Primary Rate Interface (PRI) is a telecommunications interface standard used on an Integrated Services Digital Network (ISDN) for carrying multiple DS0 voice and data transmissions between the network and a user. PRI is the standard for providing telecommunication services to offices.   Topology Lab Service-Provider Router -------T1-PRI-----Voice Gateway Service Provider configuration 1- Enable the T1 Controller Service-Provider(config)# Service-Provider(config)#card type t1 0 2 Service-Provider(config)#isdn switch-type primary-ni 2- Enable clocking. Clocking will be provided by the Service Provider to the Branch Router. Service-Provider(config)#network-clock-participate wic 2 3- Configure the Controller Service-Provider#controller t1 0/2/0 Service-Provider(config-controller)#pri-group timeslots 1-3 This command "pri-group timeslots 1-3"give us the available channels that this T1 will be using to send calls to the Branch Router. Service-Provider(config-controller)#linecode b8zs Service-Provide(config-controller)r#framing esf Service-Provider(config-controller)#clock source Internal  This command "clock source Internal" set the clocking as Internal which in basic words will provide the clocking reference to the Branch. Service-Provider#no shutdown   4- At this point interface serial 0/2/0:23 should be created so lets go ahead and configure it. Service-Provider(config)#interface Serial0/2/0:23 Service-Provider(config-if)#isdn switch-type primary-ni Service-Provider(config-if)#isdn protocol-emulate network This command"isdn protocol-emulate network"will verify that this interface will be acting as the Service-Provider providing all services needed to complete the connection Branch Configuration (Configuration that we do see) Pretty much the configuration looks the same with the only difference that on the highlighted commands above we will see some little changes. 1- Enable the T1 Controller Branch(config)# Branch(config)#card type t1 0 2 Branch(config)#isdn switch-type primary-ni 2- Enable clocking. UC520(config)#network-clock-participate wic 2 Branch(config)#network-clock-select 1 t1 0/2/0 3- Configure the Controller Branch(config)#controller t1 0/2/0 Branch(config-controller)#pri-group timeslots 1-3 Branch(config-controller)#linecode b8zs Branch(config-controller)#framing esf Branch(config-controller)#clock source line       Branch(config-controller)#no shutdown 4- At this point interface serial 0/2/0:23 should be created so lets go ahead and configure it. Branchconfig)#interface Serial0/2/0:23 Branch(config-if)#isdn switch-type primary-ni Branch(config-if)#isdn protocol-emulate user Important: Take a look at the highlighted words were actually make the difference between being a service provider or a Branch receiving the service . Verify if the PRI status is now UP Command show isdn status     Some other commands: show controller t1 show voice-port x/x/x:23 debug isdn q921 Troubleshooting http://www.cisco.com/c/en/us/support/docs/wan/t1-e1-t3-e3/8131-T1-pri.html regards, Gerson Fabian Morales Marin (gersomor)   ... View more

  What is a Media Resource? A media resource is a software-based or hardware-based entity that performs media processing functions on the data streams to which it is connected. Media processing functions include mixing multiple streams to create one output stream (conferencing), passing the stream from one connection to another (media termination point), converting the data stream from one compression type to another (transcoding), streaming music to callers on hold (music on hold), echo cancellation, signaling, voice termination from a TDM circuit (coding/decoding), packetization of a stream, streaming audio (annunciation), and so forth. The software-based resources are provided by the Unified CM IP Voice Media Streaming Service (IP VMS). Digital signal processor (DSP) cards provide both software and hardware based resources. Link= http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/8x/uc8x/media.html   Transcoder A transcoder is a device that converts an input stream from one codec into an output stream that uses a different codec. Universal-Transcoder Transcoding between any two non-G.711 codecs is called universal transcoding and requires Universal Cisco IOS transcoders. Universal transcoding is supported starting with Cisco IOS Release 12.4.20T. Universal transcoding has a lower DSP density than traditional transcoding. Note= DSP resources are required to perform transcoding. Those DSP resources can be located in the voice modules and the hardware platforms for transcoding that are listed in the following sections.  http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/media.html#67911 Configuration: 1-Go to your Cisco IOS router and enable DSP services and enable SCCP. Commands: 1-conf t 2-(config)#sccp 3-(config)#voice-card 0 4-(config-voicecard)#dsp services dspfarm 5-(config-voicecard)#exit At this point our DSP services are ready to be used and we can now proceed with the Xcoder configuration. DSP Calculator http://www.cisco.com/web/applicat/dsprecal/dsp_calc.html   2- Make sure to have your Network configuration clear; what I am trying to say is to actually have a good understanding about how Call Manager is communicating with the IOS Router that we are working on.   Example: If you have a Call flow as the following: Router(Fa0/1)---------------Call Manager -Make sure to use the Fast Ethernet 0/1 on the SCCP bind command; however if you are using for example a SVI vlan to manage your Voice communication make sure to use it instead. In my example I am using SV1 (192.168.20.1) to manage all voice traffic so I will be binding my SCCP using this Interface. Router SVI vlan 20= 192.168.20.1 Call Manager= 10.10.10.200 Commands in order: Branch(config)#sccp local vlan20 Branch(config)#sccp ccm 10.10.10.200 identifier 1 priority 1 version 7.0 Branch(config)#sccp Branch(config)#sccp ccm group 1 Branch(config-sccp-ccm)#bind interface vlan20 Branch(config-sccp-ccm)#associate ccm 1 priority 1 -At his point we are ready to configure our HW-Media Resources. Let's do it. Media Resources Configuration Transcoder (Xcoder) configuration - In order to configure the Hardware Transcoder we need to follow these steps: 1- Create a dspfarm profile <#> transcoder 2-  Add the codec's that you want to add to it (normally you will want all) 3- Select how many sessions you want it to support. 4- Associate the application to SCCP protocol. 5- No shutdown command. 6- Go ahead and associate this profile to the  "sccp ccm group 1" create above. Branch(config)#sccp ccm group 1 Router1(config-sccp-ccm)#associate profile 1 register transcode Note= Make sure to use the same name transcode to successfully register it to CUCM. 7- Go to Call Manager > Cisco Unidied CM Administration > Media Resources >Transcoder> New> Cisco IOS Enhanced Media Termination Point. Note= Make sure to use the same name used when associated the profile to the sccm group. -At this point your HW-Base transcoder should be ready to work with Call Manager. Universal Transcoder configuration -The Universal Transcoder gets configure the same way with the only difference that when you create the profile you just need to add universal at the end.   Go ahead and associate this profile to the  "sccp ccm group 1" create above. Branch(config)#sccp ccm group 1 Router1(config-sccp-ccm)#associate profile 3 register universal   Conference Bridge (CFB) configuration A conference bridge is a resource that joins multiple participants into a single call (audio or video). 1-This HW-Base Media Resource is configured the same way as the Transcoder; the only change that needs to be made is in the profile when adding it. Go ahead and associate this profile to the  "sccp ccm group 1" create above. Branch(config)#sccp ccm group 1 Branch(config-sccp-ccm)#associate profile 2 register conference  Go to Call Manager > Cisco Unidied CM Administration > Media Resources >Conference Bridge>New> Cisco IOS Enhanced Conference Bridge. Note: Make sure to use the same name conference.   At this point and if you followed the steps above you should be able to have your HW-Base Media Resources register to Call Manager without issues and ready to work. Make sure to have the IP Voice Media Steaming Application enable on Call Manager to have them successfully working. Show run on the IOS Router should look as the following: HW-MTP configuration A Media Termination Point software device allows Cisco Unified Communications Manager to relay calls that are routed through SIP or H.323 endpoints or gateways. Link= http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/112148-mtp-config.html 1- Configure the IOS MTP using the commands below same as the CFB  and Xcoder above. Branch(config)#dspfarm profile 4 transcoder   Branch(config-dspfarm-profile)#codec pass-through   Branch(config-dspfarm-profile)#codec g722-64   Branch(config-dspfarm-profile)#codec g711ulaw   Branch(config-dspfarm-profile)#codec g711alaw   Branch(config-dspfarm-profile)#codec g729ar8   Branch(config-dspfarm-profile)#codec g729abr8   Branch(config-dspfarm-profile)#codec pass-through   Branch(config-dspfarm-profile)#maximum sessions 2   Branch(config-dspfarm-profile)#associate application SCCP   Branch(config-dspfarm-profile)#no shutdown 2- Associate the profile into the  "sccp ccm group" created. sccp ccm group 1  bind interface Vlan20  associate ccm 1 priority 1  associate profile 4 register HW-MTP 3- Configure the Call Manager MTP using the same register name above. Commands Summary 1- Enable DSPs on the Router Branch(config)#sccp Branch(config)#voice-card 0 Branch(config-voicecard)#dsp services dspfarm 2- Bind the SCCP ccm group with the interface,SVI or loopback pointing to CUCM. Branch(config)#sccp local FastEthernet 0/1 Branch(config)#sccp ccm 10.1.1.201 identifier 1 priority 1 version 4.1 Branch(config)#sccp 3- Associate the profile with the sccp ccm group Branch(config)#sccp ccm group 1 Branch(config-sccp-ccm)#bind interface FastEthernet0/1 Branch(config-sccp-ccm)#associate ccm 1 priority 1 Branch(config-sccp-ccm)#associate profile 1 register <name use on Call Manager> 4- Create the HW-Resources name them and enable the codec. Router1(config)#dspfarm profile 1 <transcoder,conference,mtp> Branch(config-dspfarm-profile)#codec g711ulaw Branch(config-dspfarm-profile)#codec g711alaw Branch(config-dspfarm-profile)#codec g729ar8 Branch(config-dspfarm-profile)#codec g729abr8 Branch(config-dspfarm-profile)#codec g729r8 Branch(config-dspfarm-profile)#codec pass-through Branch(config-dspfarm-profile)#maximum sessions 6 Branch(config-dspfarm-profile)#associate application SCCP Branch(config-dspfarm-profile)#no shutdown Media Resources status show dspfarm all   Verification Commands 1. show running-config 2. show sccp ccm group [group-number] 3. show dspfarm profile [profile-number] 4. show dspfarm all 5. show sccp 6. show sccp connections 7. show media resource status 8. Show dspfarm dsp all 9. Show dspfarm profile 10. show voice dsp show dspfarm all   Related links: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/8x/uc8x/media.html http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/91863-trans-conf-iosgw-ccm.html SRND http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/media.html#67911   I hope that this little document can help you to understand a little better how to configure the HW-Base Media Resources and associate them with Call Manager.   Regards, Gerson Fabian Morales Marin (gersomor)                 ... View more

  This document will cover a basic SIP TLS configuration between Call Manager and a CUBE router when at the end of the configuration RTP will travel using SIP port 5061 over TLS. -What is TLS? Transport Layer Security (TLS), is a widely used method of securing network traffic. Topology: Router (Branch) ---TLS-----CUCM CUCM= 10.10.10.200 Router= 192.168.10.1   Configuration on Router: Note: Highlighted information can be customized by you. 1- Generate RSA key on the gateway as shown below: Branch(config)#crypto key generate rsa modulus 4096 label Branch_CA % The key modulus size is 4096 bits % Generating 4096 bit RSA keys, keys will be non-exportable... [OK] (elapsed time was 137 seconds)   2- Configure a Trust-point on the gateway Branch(config)#crypto pki trustpoint Branch_CA Branch(ca-trustpoint)#revocation-check none Branch(ca-trustpoint)#serial-number none Branch(ca-trustpoint)#ip-address none Branch(ca-trustpoint)#fqdn none Branch(ca-trustpoint)#rsakeypair Branch_CA (Same name used in the trust-point) Branch(ca-trustpoint)#subject-name cn=Branch,dc=gerx24,ou=TAC,o=CISCO,l=RICHARDSON,st=TEXAS,c=US Branch(ca-trustpoint)#crypto pki trustpoint Branch_CA Branch(ca-trustpoint)#enrollment terminal pem   3- Generate the CSR that will be sent to the signer. Branch(config)#crypto pki enroll Branch_CA % Start certificate enrollment .. % The subject name in the certificate will include: cn=Branch,dc=gerx24,ou=TAC,o=CISCO,l=RICHARDSON,st=TEXAS,c=US % The fully-qualified domain name will not be included in the certificate Display Certificate Request to terminal? [yes/no]: yes Certificate Request follows:   -----BEGIN CERTIFICATE REQUEST----- MIIE3zCCAscCAQAweTELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRFWEFTMRMwEQYD VQQHEwpSSUNIQVJEU09OMQ4wDAYDVQQKEwVDSVNDTzEMMAoGA1UECxMDVEFDMRYw FAYKCZImiZPyLGQBGRYGZ2VyeDI0MQ8wDQYDVQQDEwZCcmFuY2gwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQCzysZo72WhwVsGvwcVjRgy8TkjYVlf486G 9BbDPliFGXak9v0Zc5Xb9OzFTuLYF+iK4AZGfnpONVJwE2zUZSA/i6jXs8IJACYo Kjv3BgPuGhVbExL+RiuUn/t2GH376fbJU9LnRvnu3eoYmytoo6LmCzOgDbHPdsmu 88+tbJ5GM9h6WPGxoJCxKFvtbKW8UtoGWfEz7nd2x3iR3x1OYfMZiHJ1wYpn7ibE Bo4OXzvBR+c1IKC7YPRDzu9pmczfbJYu0Gz964KFWtU4PnsFxghJf+rMV2HWsn3d E2OEDYOTLlO8OHOotsK1T4QNKZtjPRceodFweJyeQZoQvn4SVnA6ztzsiFRAmaFb ksOnKxc4GJiYGHPK97YYDowiFXk2W22rSQ+E5sdUqmGnr50ZmHSlFN7gnhilSEtM cED/jn9LaX4XQIlTA4imkW8oJVXP3w1pb0wwpyUcAMQl5X9kH1Xkp+jVwGpsi61k /Q396XrSKZBG7J9PxO3epSG6QAVCbm/8M+OLstN3Ck2VKY2hE+AVvn6ia5MHE/B1 EX40BHseqoz278dgvRSfh8wX5GQaCRgZOPwuW5bGQrsi3QYomQImannMmbX6AF1g IDm3v/IA9qcntSNt+NvNt08L6BSithTMt2/jiQS6d+g6hhn9PxU6pOuDyYZf3UK7 2X2Tez+/7wIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAw DQYJKoZIhvcNAQEFBQADggIBAA64RRLRQGIV0g0YjwSjdr7gvO4bm1uyHDMYxx/1 IMocFFJ8l+wUA4QNOGPvhrVuVJpcNXTYVkdolsBI+EQLE9gdT2uToko1LOg06BGd dq4Jvxl/oN3UcGVUlL8N7flDCApv2vTpdc/Id619XfWtQsU5oRKQ5fCKBBZ0zyiT 9LXET6WbPcHOlVomE2cdC2AGgVNnDW78Hdb3k5ppubiQAjf/fXF6uRPwQ7ITx83j kcazFsOrSw+y2KibbsjG0/rlR6vm5hOmqqjkz+Ap/qzEZSZKpzuiTw1rxaHZbmNe zcqlSqTcjcBQlNscW92+VpdxBrqWJamyiVXCbwbaULLgu1nTqXn2DGaBMMoj+FhY gsM1tz79XMFTwsX5g/me5AlbAS8fASyUAI5bVOvZM/uC2I59xVH2fbQYodIVxzHU YvCivbT8JKT5ioi/1EeLtnQhG0zWBcoTD343F9iqXJCfxdMTtr79UpIBqHzqTfhi 7TX9iJa+KsJzM+B/O1Wj7cej3hu5RYPD80uoDj0pBo0bkX45GBaR/b6XvU5v7+hP WaF6zN4KYunXkzdPuZkIWbNE7xzy/qEL3MfAHNEgzZn+GASTRYg3P7xSmpMLsWxv VRage/uiPJqHr4IGynce4r8B2S5QGltZdA6U8EsowUzpLm8d06gpC/cLcgp2BvZr 0kB8 -----END CERTIFICATE REQUEST----- ---End - This line not part of the certificate request--- Redisplay enrollment request? [yes/no]: no -Verify your certificate using the certificate decoder below https://certlogik.com/decoder/ Notice that the "Subject" information matches with the router information also included in the Trust-point. 4- A this point you are ready to send this CSR to the CA-Signer. 5- The CA-Signer will send to you normally 3 certificates Root, Intermediate and Router certificate that need to be uploaded to the router and and Call Manager. Installing Certificates 1- When you receive 3 certificates and you have not use any root certificate before signed by your CA-Signer you need to create a Trust-point dedicated  for this certificate. No RSA is needed for this one. Root certificate Branch(config)#crypto pki trustpoint Branch_Root_CA Branch(ca-trustpoint)#revocation-check none Branch(ca-trustpoint)#enrollment terminal Branch(ca-trustpoint)#crypto pki authenticate Branch_Root_CA ******* Paste the Root certificate in here ***** Enter the base 64 encoded CA certificate. End with a blank line or the word "quit" on a line by itself -----BEGIN CERTIFICATE----- MIIDgTCCAmmgAwIBAgIQTHuIiTtqcqtDW2Z0XhW2yzANBgkqhkiG9w0BAQsFADBH MRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xGTAX BgNVBAMTEEFELUNPTlRST0xMRVItQ0EwHhcNMTYwMjA1MDE0NDA4WhcNMjYwMjA1 MDE1NDA2WjBHMRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYF Y2lzY28xGTAXBgNVBAMTEEFELUNPTlRST0xMRVItQ0EwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDPCU77fFdFiq+UeKYYyZU8JJKDcq3Z0r6pMgU2bKZ1 YaO+Pa90v0/CCslpzZU/8lPraX9bVGvD0hTD955MMyGMxyFNzljSWXH710TI+ykT S+6feJd527lIE0oJGKK9T+FitXeZ+nauP+AJQ0j6DV5qMpnEL84u89wdSvhn6jag wWlMujuoeKa2mRLWElXhpFgPL6jqr0+NcvDZScs4AS3OdXtrpBHU3jRUIiBTFawX HxeonDSWxs4KVkKPBQCIRUtrAYfnctA63I65csUtS7KyZxXf8hfsbS7r6mzKbG63 QHdjGL+QDZkZo1IoK83kTcDLdRpe8213rl+EERGj/3xVAgMBAAGjaTBnMBMGCSsG AQQBgjcUAgQGHgQAQwBBMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/ MB0GA1UdDgQWBBQ/HjH8zeBaq5QnVb1KzoA+oRaR/zAQBgkrBgEEAYI3FQEEAwIB ADANBgkqhkiG9w0BAQsFAAOCAQEAf/I1rZn5HB1ncYcHHZkITOSFmYlxO42dmzRy +58hZ+rbuwFbmW34cwgE1tjFeaa1Pm7sEK/7CdKcISR/owxjHBEHIuCqW3B9D7rt APW4Vz8nQSthPJRx/xy+qebz/4wL7qPsAJzd2yNKdV8ribv3odSFlZco6aQUcOFn 5g1qzrTabF9oOPfvhZ3YLXWNSBLDVW2oK9RItwN3L1kDEZHk9Igg0hsiM69HoGiM +z5noTHV5i3Z0ytj2o3JtOv0Q1pOsXph2IrRbCxi1R7Q+A1FFace4L3yEAJH7wkW Lo4+2/+RoF1fr5KUu90HsGwIZR0iex3UQVRHIIABGyWAXOmWng== -----END CERTIFICATE----- Certificate has the following attributes:        Fingerprint MD5: 45374A62 C94B9CA6 621A86B5 7CA274EC       Fingerprint SHA1: FFB820FB 8F53ABDE 5B656469 6275823B 3B15402D % Do you accept this certificate? [yes/no]: yes Trustpoint CA certificate accepted. % Certificate successfully imported -Notice that I used a Windows server to sign the certificate. Signer "AD-CONTROLLER-CA" verify it using the link https://certlogik.com/decoder/   2- At this point it is time to import the Intermediate and Router certificate using the original Trust-point used to generate the CSR. Intermediate certificate Branch(config)#crypto pki authentincate  Branch_CA Enter the base 64 encoded CA certificate. End with a blank line or the word "quit" on a line by itself -----BEGIN CERTIFICATE----- MIIDgTCCAmmgAwIBAgIQTHuIiTtqcqtDW2Z0XhW2yzANBgkqhkiG9w0BAQsFADBH MRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xGTAX BgNVBAMTEEFELUNPTlRST0xMRVItQ0EwHhcNMTYwMjA1MDE0NDA4WhcNMjYwMjA1 MDE1NDA2WjBHMRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYF Y2lzY28xGTAXBgNVBAMTEEFELUNPTlRST0xMRVItQ0EwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDPCU77fFdFiq+UeKYYyZU8JJKDcq3Z0r6pMgU2bKZ1 YaO+Pa90v0/CCslpzZU/8lPraX9bVGvD0hTD955MMyGMxyFNzljSWXH710TI+ykT S+6feJd527lIE0oJGKK9T+FitXeZ+nauP+AJQ0j6DV5qMpnEL84u89wdSvhn6jag wWlMujuoeKa2mRLWElXhpFgPL6jqr0+NcvDZScs4AS3OdXtrpBHU3jRUIiBTFawX HxeonDSWxs4KVkKPBQCIRUtrAYfnctA63I65csUtS7KyZxXf8hfsbS7r6mzKbG63 QHdjGL+QDZkZo1IoK83kTcDLdRpe8213rl+EERGj/3xVAgMBAAGjaTBnMBMGCSsG AQQBgjcUAgQGHgQAQwBBMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/ MB0GA1UdDgQWBBQ/HjH8zeBaq5QnVb1KzoA+oRaR/zAQBgkrBgEEAYI3FQEEAwIB ADANBgkqhkiG9w0BAQsFAAOCAQEAf/I1rZn5HB1ncYcHHZkITOSFmYlxO42dmzRy +58hZ+rbuwFbmW34cwgE1tjFeaa1Pm7sEK/7CdKcISR/owxjHBEHIuCqW3B9D7rt APW4Vz8nQSthPJRx/xy+qebz/4wL7qPsAJzd2yNKdV8ribv3odSFlZco6aQUcOFn 5g1qzrTabF9oOPfvhZ3YLXWNSBLDVW2oK9RItwN3L1kDEZHk9Igg0hsiM69HoGiM +z5noTHV5i3Z0ytj2o3JtOv0Q1pOsXph2IrRbCxi1R7Q+A1FFace4L3yEAJH7wkW Lo4+2/+RoF1fr5KUu90HsGwIZR0iex3UQVRHIIABGyWAXOmWng== -----END CERTIFICATE----- Certificate has the following attributes:        Fingerprint MD5: 45374A62 C94B9CA6 621A86B5 7CA274EC       Fingerprint SHA1: FFB820FB 8F53ABDE 5B656469 6275823B 3B15402D % Do you accept this certificate? [yes/no]: yes Trustpoint CA certificate accepted. % Certificate successfully imported   Router Certificate Branch(config)#crypto pki import Branch_CA certificate % The fully-qualified domain name will not be included in the certificate Enter the base 64 encoded certificate. End with a blank line or the word "quit" on a line by itself -----BEGIN CERTIFICATE----- MIIGMjCCBRqgAwIBAgIKPhxKEAAAAAAAMjANBgkqhkiG9w0BAQsFADBHMRMwEQYK CZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xGTAXBgNVBAMT EEFELUNPTlRST0xMRVItQ0EwHhcNMTYwNzI2MjI0NzA3WhcNMTcwNzI2MjI1NzA3 WjB5MQswCQYDVQQGEwJVUzEWMBQGCgmSJomT8ixkARkWBmdlcngyNDEOMAwGA1UE CBMFVEVYQVMxEzARBgNVBAcTClJJQ0hBUkRTT04xDjAMBgNVBAoTBUNJU0NPMQww CgYDVQQLEwNUQUMxDzANBgNVBAMTBkJyYW5jaDCCAiIwDQYJKoZIhvcNAQEBBQAD ggIPADCCAgoCggIBAMiNazjW/aww/ebuahP42f8MkPKQiHymwe/uDu2c756sTzjy 7L0jXkEU8rIjxUiOzG324QvxMbAgZveVqrXfiMbKFa62E/ewI8V8qvQ05jm9NBXp ZuwzowSJrg28zP9TDJ8Hoolg9u3nVGneGV4Cu+uUnY/xLaXhokMSkZBuUYYwC1Q+ kB+QMkHQ3w2GDyDWWlmC3zVqZBk6RiflRozYuJYOcYTUlylnMDJ21nfXitsk+59p bFeH2/p4vGsQrz2+9suA0eT+5vG+o3+2l7T+qJeCIHOkYYJhI3VHWgqjThhckZgE cB4d7GA0d/yCDWIVrDyK3exgvKiVMYQytpXKe46/5cKNkf+Ay4TdYcKQXg0toQFn QYNlA8ld0j0IKJtyYT9g4vdx27DYAIdm/aOYanzktE/L75ZLkI8GiFT/938wGsuV eeE7jvW85p3w+D2KlkNzNJcOQDyB2ph5/YKglXvmW01yiMDfTV8qJ00QBelZq4wL o8zoFtdQxITHjLUhgReUcKKalszIrMe4YuBVBt+p0pr3a7gKf7rwg40aSUHOVRJ8 b8vZKEj4Mc7ZQnTlxmRHo0esjD6VXqZ8dUKe2Y0/eFtF9QA0MS93m0IDuB0ZnDap 7npKW2cYdJ+cqCJhBFA6lSLu1sPsmFfYvf70fXGfKpcGrf4IQAv1rm3qp8BzAgMB AAGjggHsMIIB6DAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0OBBYEFLO3gMJUesMmMgXB Us3zj7B1htcbMB8GA1UdIwQYMBaAFD8eMfzN4FqrlCdVvUrOgD6hFpH/MIHSBgNV HR8EgcowgccwgcSggcGggb6GgbtsZGFwOi8vL0NOPUFELUNPTlRST0xMRVItQ0Es Q049QUQtQ09OVFJPTExFUixDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1jaXNjbyxEQz1sYWI/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERp c3RyaWJ1dGlvblBvaW50MIHABggrBgEFBQcBAQSBszCBsDCBrQYIKwYBBQUHMAKG gaBsZGFwOi8vL0NOPUFELUNPTlRST0xMRVItQ0EsQ049QUlBLENOPVB1YmxpYyUy MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9 Y2lzY28sREM9bGFiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0 aWZpY2F0aW9uQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUAA4IBAQCPTtYDG2V9hg1f n7xQU8UgImvIbwlBvniss6jmrqZhrkC9+rIcEuED6lapoPsC7+vwRW9NT+oPXGpY Qcaj2w08osr3uLT05OuDRDD3kzR9G7eQbT0PgA7EJiR5sZI9gnvxrqRBLW+5Flfh YYDeowWfWNjZVc9WKJArDY4eHfqs+EvXw8mpkFnFUVlUCb4g9CqMk3dSLLJ6o+D/ rnFtfNN8eXfbXVd7a+PMJv3If/wccmfnvGLb6uqXFDqqVU5/uWVW/NtQNU7REps/ F5DaKIGSdsDs6vein2xOAiNbz5NQbqRsusga5gS+SS2fpg92MnjWQi2nRbor/UKQ nvAG/yEX -----END CERTIFICATE----- % Router Certificate successfully imported   Note: The Intermediate certificate procedure will be done only if you get an intermediate certificate otherwise you need to do only the authenticate with the "root certificate" and the import with the "router certificate" and you can use the same Trust-point so you do not need to create a single one for the Root certificate.   6- At this point the Router should have the "Root" and "Router" certificate signed by the same CA-Signer and we need to include under the Sip-ua the command that will allow the trust-point to be use to authenticate the root certificate Branch(config)#sip Branch(config)#sip-ua Branch(config-sip-ua)#crypto signaling remote-addr 10.10.10.0 /24 trustpoint Branch_CA   Call Manager 7- Go to Call Manager and generate a Call Manager CSR. 7.1 -->Send the CSR to the signer (They will give us the ROOT and the Call Manager). 7.2 -->Upload the ROOT certificate as Call Manager-Trust and the Call Manager as "Call Manager". 7.3-->Restart Cisco Call Manager. 7.4-->Make sure CUCM is in mix mode and that the Subject name on the "Security Profile" configured on the trunk  is the one from the router. Enable mix mode on CUCM with the CLI command  "utils ctl set cluster mix mode" **** If you use the same "SIGNER" for both Router and Call Manager you need to upload just the Call Manager certificate to the Router *******   8- Create a new Trust-point on the router for Call Manager Branch(config)#crypto pki trustpoint Branch_CUCM Branch(ca-trustpoint)#revocation-check none Branch(ca-trustpoint)#enrollment terminal Branch(ca-trustpoint)#crypto pki authenticate Branch_CUCM   *Use the authenticate command to upload the Call Manager signed certificate*   9- On the dial-peer going to CUCM add the command " session transport tcp tls " dial-peer voice 1 voip  description "Connection_to_SP"  destination-pattern 80..$  no modem passthrough  session protocol sipv2  session target ipv4:10.10.50.1 session transport tcp tls  voice-class sip options-keepalive  dtmf-relay rtp-nte  codec g711ulaw  no vad 10- Verify the SIP TLS communication enabling the " SIP Options" on the SIP Profile and adding to the dial-peer the command " voice-class sip options-keepalive "   Output should be as the following: From Router: Jul 26 23:33:05.036: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg: Sent: OPTIONS sip:10.10.10.200:5061 SIP/2.0 Via: SIP/2.0 /TLS 192.168.10.1: 5061 ;branch=z9hG4bK252194D From: <sip:192.168.10.1>;tag=1EFB1858-1601 To: <sip:10.10.10.200> Date: Tue, 26 Jul 2016 23:33:05 GMT Call-ID: 22AD67EA-52C011E6-B680F81C-B2621099@192.168.10.1 User-Agent: Cisco-SIPGateway/IOS-12.x Max-Forwards: 70 CSeq: 101 OPTIONS Contact: <sip:192.168.10.1:5061;transport=tls> Content-Length: 0 Received from rom Call Manager: Jul 26 23:33:05.040: //9229/000000000000/SIP/Msg/ccsipDisplayMsg: Received: SIP/2.0 200 OK Via: SIP/2.0/ TLS 192.168.10.1: 5061 ;branch=z9hG4bK252194D From: <sip:192.168.10.1>;tag=1EFB1858-1601 To: <sip:10.10.10.200>;tag=508105887 Date: Wed, 27 Jul 2016 00:05:16 GMT Call-ID: 22AD67EA-52C011E6-B680F81C-B2621099@192.168.10.1 CSeq: 101 OPTIONS Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY Content-Length: 0 Verify the open connections on the Router with the command: Branch#show tcp brief all TCB       Local Address               Foreign Address             (state) 8AD8D670  192.168.10.1.24793          10.10.50.1.5061             ESTAB 8914E630  10.198.28.189.22            10.225.133.72.58079         ESTAB 89738680  192.168.10.1. 5061            10.10.10.200.48417          ESTAB 89A82D0C  10.198.28.189.22            10.225.133.72.52039         ESTAB 88EC520C  192.168.10.1.5061           10.10.50.1.18791            ESTAB CUCM= 10.10.10.200 Router= 192.168.10.1 Troubleshooting debugs: debug crypto pki api debug crypto pki callbacks debug crypto pki messages debug crypto pki transactions debug ssl openssl errors debug ssl openssl msg debug ssl openssl states debug ip tcp transactions debug ccsip verbose   Related links http://www.cisco.com/c/en/us/support/docs/interfaces-modules/catalyst-6500-series-ssl-services-module/63485-paste-cert-key.html http://www.cisco.com/c/en/us/support/docs/interfaces-modules/catalyst-6500-series-ssl-services-module/63485-paste-cert-key.html http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-border-element/100446-cube-sip-tls.html regards, Gerson Fabian Morales Marin (gersomor)     ... View more

  -RTMT is a really good application that can be downloaded from the Cisco Unified CM Administration page on Call Manager that allows you to monitor the performance of your Call Manager server. How to download it? Go to Cisco Unified CM Administration > Application >Plugins > Find> (Base on your platform whether is Windows or Linux go ahead and select Download to get it on your PC). Operating System Support You can install Unified RTMT on a computer that is running one of the following operating systems: Windows XP Windows Vista Windows 7 Windows 8 Linux with KDE or GNOME client http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/11_0_1/RTMT/CUCM_BK_CC660A6B_00_cisco-unified-rtmt-administration-1101/CUCM_BK_CC660A6B_00_cisco-unified-rtmt-administration-1101_chapter_01.html#CUCM_RF_O5664E1B_00 Alerts  1- Receive an alert from a SIP Trunk when a certain amount of  active calls (configurable) is reached on the trunk. -Go to RTMT > System > Performance > (Select the CUCM node) > Cisco SIP > Call Active > (Select the trunk) > Add a counter > left click on the counter and then right click > Set Alert/Properties > Put a description > next> Configure your Threshold > next > Save.   2- Receive an alert when a certain percentage of phones get unregistered/dropped. -Go to RTMT > System > Alert Central > Voice/Video >  Select NumberOfRegisteredPhonesDropped > Right click > Set Alert/Properties > Put a description > Configure the Threshold > Next > Save.   3-Receive and alert if a SIP Trunk or PRI line goes down. * For SIP Trunk - Enable SIP Options on the SIP Profile associated to the profile in used by the SIP trunk. Go to Device> Device Settings>Sip Profile> find your profile and scroll all way down to "Sip Options Ping" and enable it. On the destination dial-peer wether is a CUBE or a different gateway/Application the keep-alive options/Sip Options need to be configure. Example on the incoming dial-peer. -When the SIP Trunk goes out of service  a syslog message is generated on the syslog viewer on RTMT. - At the same time an alert is generated on "Alert Central Tab" which shows "Syslog severity match found".  -To view syslogs: Open RTMT >> Syslog viewer >> Select the server>> and view the messages in Syslog.   Configure alerts on specific strings: Tools -> Alert Central -> System -> SyslogStringMatchFound -> Right click and go to "Set Alert / Properties". In the string section add the following string "SIPTrunkOOS". This can generate an email which will also sent to Operations Manager.   * For PRI Line: - Go to  RTMT >System > Performance > Open Performance Monitoring > Select the server where the PRI is registered to. -Right-click the counter and change the following and then save the Alert:  > severity = Critical > Enabled Alert = checked > Threshold = Under 1 - Go the Alert Central and then to the "Custom" Tab on the top, our alert is homed there. ++To test this you may shut down the respective interface serial x/x/x:23 ++   4- Receive an Alert for high utilization and hardware failure. *Hardware failure -Go to RTMT > System > Alert Central > System > Right click > Set Alert/Properties > Enable Alert and select the server.   *High Utilization Go to RTMT > System> Performance > Select the CUCM node) > Memory > (You can select % Mem Used, % VM used) > Add a counter >  Left click on the counter and then right click > Set Alert/Properties > Put a description > next > Configure your Threshold > next > Save. Related link: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/11_0_1/RTMT/CUCM_BK_CC660A6B_00_cisco-unified-rtmt-administration-1101/CUCM_BK_CC660A6B_00_cisco-unified-rtmt-administration-1101_chapter_0111.html#CUCM_RF_V709BB94_00   5-Configure Alerts to be sent to your corporate/personal email Before configuration make sure to use a functional mail server in a domain, such as an Exchange server, with the Simple Mail Transfer Protocoll (SMTP) following the correct format mail.xyz.com   Configuration: 1- Choose System > Tools > Alert > Config Email Server.   2- Enter the hostname of the mail server in the Mail Server field, and enter the port number in the Port field. 3- Enter the e-mail ID that you would like to get the mails from.   4-Click OK. E-mails are sent to e-mail address configured. Now, the recipient e-mail addresses is configured in the Alerts section. You will see this in the next section.   I hope this guide can help you with your concerns about how setting up alerts on RTMT.   regards, Gerson Fabian Morales Marin (gersomor)     ... View more

    WINDOWS SERVER Windows server initial configuration to support (AD and DNS resolution(FQDN)) -In this example I will use Windows Server 2008 Enterprise R2.   2-When the installation of Windows Server  completes go ahead and proceed with the following steps: 1-Go to Start> 2-Control Panel (You can press Windows button + Pause button on the keypad)> 3-Now on System go ahead and click on "Change Settings" ++Under Computer name Tab click "Change" ++Type the desire name that you would be using for the server. I used the following name: Computer name= Win-Server +++After making this change windows will ask you to reboot the PC, please "skip" this step for now and go ahead and change the IP of your PC to the desire IP that you will use for the server+++  ++++++ Now you can REBOOT your computer for changes to take effect ++++++ 4-When server comes back go to Server Manager > Roles > Add Roles > Next. -Under Select Server Roles select "Active Directory Domain Services" +++Click next> Install; at this point Active directory services would be installing on the Server+++ 5- After getting the services installed you will need to enable the fully functional domain controller from (dcpromo.exe)        +++++++++Go to start and type dcpromo and click enter+++++++++ Now you will start the activation of the domain services on your server go ahead and click next. +++Continue activating the services by clicking on next> and now select where it says "create a new domain in a new forest" and next +++ Now you would be creating the domain that you will use  (This is used for FQDN functionality). I will use "gerson.com"  click next and select Forest functional level to "Windows server 2008 R2" ++++Now Click next and select DNS server and click next. You will get a warning just select yes and continue++++ ++++ Continue with the activation clicking next> now you will need to type a password for the Administrator account and click next > next ++++ ++++ The activation will continue and in a few minutes your server would be ready to use "Active Directory and DNS" ++++ +++++++Activation of domain service is complete now click finish+++++++   6- When the server comes back now we have Domain Services and DNS fully functional. Lets configure a short-cut to get the services that we need to accomplish the integration of Jabber with Call Manager. (AD and FQDN) -Now go to start and type "mmc" and press enter; this will access the console root from where we would be able to select the services that we will be using. Go to File> Add/Remove Snap-in... Now Select: -Active Directory and Computers. -DNS.        ++++ Move them to the right by clicking on "Add" and then Ok ++++ Now you will be able to have your customized Console root to access services. You can go back to file> save as > and save it on  your desktop for future access.  DNS Configuration (FQDN) DNS configuration to support FQDN resolution for Call Manager and CUPS Deployment: Windows Server= 192.168.205.13/24 Call Manager= 192.168.205.11 Hostname= CUCM-PUB01 IM&Presence server= 192.168.213.99 Hostname= CUPS-P01 1- Now having the Windows Server fully functional lets go to DNS and click "+" then on WIN-Server click "+" go to Forward Lookup Zones > click the domain name (gerson.com) at this point on the right side of the console root you would be able to see some files that are added by default. 2- After selection the domain in our example (gerson.com) go to the right where default files are located and right click >New Host (A or AAAA)...... ++Fill out the information with the following parameters: -Name= <hostname> -Ip_address= The desire IP address that you want to use for the host. -Make sure to select "Create associated pointer (PTR) record" ++Click Add Host <Call Manager FQDN configuration> <IM&Presence Server FQDN configuration> +++For new zones (Subnets) you can go to Reverse Lookup Zones and add a new zone by a right click > New Zone>++ Reverse Lookup Zones Normal DNS queries are forward lookup queries, they request the IP address that corresponds to a fully qualified domain name. A reverse lookup is the opposite of a forward lookup: It returns the fully qualified domain name of a host based on its IP address. New Zone is configured when FQDN is used. "The Active Directory Installation wizard does not automatically add a reverse lookup zone and PTR resource records, because it is possible that another server, such as the parent server, controls the reverse lookup zone. You might want to add a reverse lookup zone to your server if no other server controls the reverse lookup zone for the hosts listed in your forward lookup zone. Reverse lookup zones and PTR resource records are not necessary for Active Directory to work, but you need them if you want clients to be able to resolve FQDNs from IP addresses. Also, PTR resource records are commonly used by some applications to verify the identities of clients."   ++ At this point we will be good with DNS resolution and FQDN resolution.+++++ Configure "FQDN" and "DNS" on CLI Configuring DNS and Hostname on  CUCM/IM&Presence server over CLI. 1-Open a SSH  session for both servers: Commands +Command to configure DNS server: admin:  set network dns primary < DNS server ip> +Command to configure  hostname: admin: set network hostname <hostname> +Command to configure domain: admin: set network domain <domain>  (example gerson.com)  Note= After making those changes reboot the servers. To verify the changes after the reboot you can run the following command: admin: show network eth0 details CUPS Server verification CUCM Server verfication   Configuring FQDN (Fully qualify Domain Name) on Call Manager. Link= https://supportforums.cisco.com/document/12927561/how-change-your-call-manager-server-ip-use-fqdn (This explanation if from the link above made by myself using different information (hostnames and IP; however use it only as a guide) 1- Go to System > Server (Modify the IP with the FQDN) FQDN= ( Hostname + domain ) 2 - Access the "CLI" on the PUB and configure the correct hostname using the following command "set network hostname <hostname>" Note= This command regenerates the certificates due the network change Note= Make sure DNS is already set for hostname resolution. Link= http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/install/10_0_1/ipchange/CUCM_BK_C3782AAB_00_change-ipaddress-hostname-100/CUCM_BK_C3782AAB_00_change-ipaddress-hostname-100_chapter_011.html#CUCM_TK_C1134AB2_00 3 - Reboot the server. Command "utils system restart" Note= Make sure to schedule a maintenance window or apply the change after business hours. 4 - When the server comes back on line go to the CLI and verify the n ew information using the following commands: 4.a "show myself" (This command will show us the correct hostname) **************************************** Machine Name    : PBCMPUB01 ----> New hostname account name    : admin privilege level : 4 command count   : disabled logging setting : disabled **************************************** 4.b "show network eth0 details" (This command will show us the correct domain name) ************************************************************************** Ethernet 0 DHCP         : disabled           Status     : up IP Address   : 132.158.245.200    IP Mask    : 255.255.255.000 Link Detected: yes                Mode       : Auto disabled, Full, 10000 Mbits/s Duplicate IP : no Queue Length : 1000               MTU        : 1500 MAC Address  : 00:50:56:aa:2b:db RX stats:   bytes   :    146277020   packets :       262474   errors :            0   dropped :            0   overrun :            0   mcast  :         6002 TX stats:   bytes   :     40968236   packets :       224571   errors :            0   dropped :            0   carrier :            0   colsns :            0   DNS Primary      : 132.158.49.2       Secondary  : 132.158.127.210 Options      : timeout:5 attempts:2 Domain       : cisco.test.com Gateway      : 132.158.245.254 on Ethernet 0 ************************************************************************** +++Notice that now we have the complete FQDN in use " PBCMPUB01.cisco.test.com "+++ -The last step will be check that the certificate shows up the correct information from the new parameters added above. 4.c "show web-security" [Version: V3   Serial Number: 75BC0A26FEDB173956069BF44B98 B99E   SignatureAlgorithm: SHA1withRSA (1.2.840.113549.1.1.5)   Issuer Name: L=Palm Bay, ST=Florida, CN= PBCMPUB01.cisco.test.com , OU=NSO, O=Cisco Corp, C=US   Validity From: Mon Aug 10 14:32:57 EDT 2015            To:   Sat Aug 08 14:32:56 EDT 2020   Subject Name: L=Palm Bay, ST=Florida, CN= PBCMPUB01.cisco.test.com , OU=NSO, O=Cisco Corp, C=US   Key: RSA (1.2.840.113549.1.1.1)     Key value: 3082010a028201010097d840ebce927a1f6c88cafe5d7afe2e633c3d844187d   [ Extension: KeyUsage (OID.2.5.29.15)      Critical: false      Usages: digitalSignature, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, Press <enter> for 1 line, <space> for one page, or <q> to quit   ]   [    Extension: ExtKeyUsageSyntax (OID.2.5.29.37)      Critical: false      Usage oids: 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2, 1.3.6.1.5.5.7.3.5,   ]   [      Extension: SubjectKeyIdentifier (OID.2.5.29.14)      Critical: false      keyID: 87b435fa1faa5f2cc3aadea9b0181b04b6786cdb   ]  Signature:   0000: 0d 7d 2a 94 c3 92 c9 9b 83 cd ba 07 73 e5 49 b7 [.}*.........s.I.]   0010: 6b 39 cc 93 5f 7d 70 61 76 cf e1 dd 6f f6 da 49 [k9.._}pav...o..I]   0020: 4d 5b 4b 1c e6 b4 c2 a3 91 61 3a 39 fa 3f d5 59 [M[K......a:9.?.Y]   0030: b0 ef c4 77 e5 35 b3 34 94 6a 3e f8 96 dc 6c b2 [...w.5.4.j>...l.]   0040: ff 8d 48 49 70 02 08 1c 27 44 56 1b 18 36 b9 8c [..HIp...'DV..6..]   0050: af 53 57 a3 83 6a 73 e9 a9 ff 1b 34 f7 72 37 bd [.SW..js....4.r7.]   0070: bf 18 6e 8c dd 1e 7b 2d 37 73 0c e7 58 87 b0 2f [..n...{-7s..X../]   0080: ab dd 7e e7 b4 c7 76 92 29 68 54 ad 4b 6e db 43 [..~...v.)hT.Kn.C]   0090: 83 a4 27 cb 30 22 44 03 94 c6 83 db b2 ab 60 9a [..'.0"D.......`.] Press <enter> for 1 line, <space> for one page, or <q> to quit  00b0: 0c 40 9e 23 a6 77 93 86 fc 7c a5 b1 29 92 49 cb [.@.#.w...|..).I.]   00c0: 84 ab 3a 18 39 6b 12 1e 34 2a 53 38 0c 70 b8 68 [..:.9k..4*S8.p.h]   00d0: 40 f9 4a 1e 63 f2 ac bc 67 4f 22 f6 06 07 58 e6 [@.J.c...gO"...X.]   00e0: 22 61 7b 64 8e 4a d1 c2 84 27 da b5 c9 7b e9 bf ["a{d.J...'...{..]   00f0: dc 4e 65 01 c5 28 7d f1 d0 c0 80 d3 c8 06 84 61 [.Ne..(}........a] ******************************************************** Certificate Information: Common Name: PBCMPUB01.cisco.test.com Organization: Cisco Corp Organization Unit: NSO Locality: Palm Bay State: Florida Country: US Valid From: August 10, 2015 Valid To: August 08, 2020 Issuer: PBCMPUB01.cisco.test.com, Cisco Corp Serial Number:75BC0A26FEDB173956069BF44B98B99E *********************************************************** Notice that the Serial Number must match.   Reference link =  https://supportforums.cisco.com/document/12927561/how-change-your-call-manager-server-ip-use-fqdn Configuring FQDN (Fully qualify Domain Name) on CUPS. 1-Go to System >Cluster Topology > Under "DefaultCUPSubcluster"  you will have your server's name/Ip click edit.   ++ Now you can go ahead and add/verify the complete FQDN that you are using on your server. +++ At this point your CUPS server would be ready for integration with Call Manager. Note= Before you can very this information and modify it, you have to integrate the IM&Presence server with Call Manager using the correct AXL user and password a long with the Call Manager security password to integrate it to the Cluster. Verifying FQDN resolution. -Make sure that the PC from were you are using the ping command has already the proper DNS IP address configured to reach out it. Call Manger= CUCM-PUB01.gerson.com IM&Presence server=  CUPS-P01.gerson.com Integration: CUCM and IM&Presence Integrating Call Manager with IM&Presence Server 1- Turn on "Cisco CTIManager Service" Serviceability> tools> Service Activation >Cisco CTIManager. 2- Create a "AXL-user", this user will be use also on CUPS Server. -Go to Cisco Unified CM Administrator> Uer Management> Application user > Add new . -Create User ID= CUPS_AXL (example) -Set up a password. (Important, save it) -Groups= Standard CCM Super Users. -Save   3-Go to the IM&Presence server and fill out the requested information.   4- Now is time to add the AXL user and password configured before in Call Manager. 5-On this step you need to put the "Security Password" from your Call Manager server use to add other servers example Subscribers. 6- Initial integration is complete now click on Home.   Service Activation: Make sure to activate services on CUPS. Go to Cisco Unified IM and Presence Serviceability > Tools> Service Activation. ++ At this point you should be able to verify connectivity between Call Manager and CUPS server. Go check connectivity go to System> CUCM Publisher. Configuring Call Manager to manage Cisco Jabber (Cisco Jabber Application) 1- Now on Call Manager go to CM Administration> User Management> User Settings> UC Service> Add New. -At this point and for our basic configuration we will be adding the following services: *-IM and Presence (Jabber) *-CTI (CTI control of phones) *- Directory Note= You can also configure Voicemail and other services on this page. Services: -IM and Presence Service CTI Service Directory Service 2- Now on Call Manager go to CM Administration> User Management> User Settings> Service Profile> Add New. -On this Page go ahead and select the UC services created above. Set those as primary. Directory Service using UDS (Cisco User Data Services) Important: Under Directory service make sure to have the following parameters check: -(x)Use UDS for Contact Resolution -(x)Use Logged On User Credential Directory Service using LDAP Note= In case you would like to use EDI instead of UDS you also have the option to integrate directory lookup through LDAP Server by configuring the LDAP parameters on the directory configuration. Notice that UDS service is unchecked and and Ldap user name, Search Space and password has been configured. 3- Now got to Device > Phone> Add New > Cisco Unified Client Services Framework. This CSF will need to have the following aspects: Phone configuration page: Device Name Phone Button Template Owner (Associate it to an user) SIP Profile Device Security Profile Line Configuration Page: DN PT CSS Allow Control of Device from CTI (Check) Users Associated with Line (Associate the line with the user) Note= The user that you use need to have the CSF associated. Go to User Management> End User> select the user and check Controlled Devices (Here you need to include the CSF configured)   4- At this point you should be able to see the End users that you have configured on the Call Manager data base (Local Users) or imported from LDAP (AD) server. Call Manager endusers: IM&Presence Server endusers:   5- At this point you will be able to download Cisco Jabber software for Windows. Link=  https://software.cisco.com/download/release.html?mdfid=284324806&catid=280789323&softwareid=284006014&release=11.6%280%29&relind=AVAILABLE&rellifecycle=&reltype=latest Integration: IM&Presence with CUCM Configuring CUPS server to use CTI. 1-Go to applications>legacy clients>settings and Set TFTP <CUCMIP> 2-Go to applications>legacy clients>CCMCIP Profile > New. -Primary CCMCIP Host and Secondary. Note= If you have only 1 host go ahead and add the same as secondary as it is required. (Call Manager Server's Ip) - Server Certificate Verification= Any Certificate. -Add users that will be managing CTI phones to the USer in Profile Cisco Jabber Configuring Cisco Jabber software. 1- When  you download the Cisco Jabber software and you try to log in, this software is going to give you a message saying that can not contact the server please add it manually going to "Advance Settings" ++ This could be the easiest  way to access and contact your IM&Presence server; however there is another way to make this happens without adding manually the IP address of the CUPS serve everything you try to log in to IM&Presence server to use Jabber. 1- Access your Windows Server. 2-Go to DNS> gerson.com and right click on the right. Here we are going to add a static route on the DNS for allow the PC to automatically get access to the server as long with Directory information over UDS. UDS -Performs the user queries against the UDS service on Communications Manager. EDI -Performs the user queries to the configured LDAP server. 3-When you do the right click go to Other New Records..  and Select Service Location (SRV) > Create Records... -Make sure Domain is fine -Service= _cisco-uds -Protocol= _tcp -Port= 8443 -Host offering this service= <Cucm-Server> ++ To verify DNS resolution for SRV type go ahead and access Command Prompt and do the following commands: C:\Users\Administrator>nslookup (enter key) > set type=srv > _cisco-uds._tcp.<domain> Using Cisco Jabber Software 1- Log in to Cisco Jabber using the user name (Local on Call Manager or Imported from Ldap server) to log in to jabber Software. -At this point you should be able to fully log in to Cisco Jabber and have access to the directory. CTI Calls Control phones over CTI 1- Go to the user on Call Manager and assign the following access control groups: -Standard CCM End Users -Standard CTI Enabled -Standard CTI Allow Control of Phones supporting Connected Xfer and conf -Standard CTI Allow Control of Phones supporting Rollover Mode -Standard CTI Allow Control of All Devices   -Now after adding those access controls to the user you should be ready to control the phone using CTI, go ahead and log out and log in into Jabber >Go to the little on the left bottom corner and select "use my phone for calls" ++At this point Jabber should be fully functional and you sould be able to make and received calls ++++ Incoming call (CTI): Outgoing Call (CTI): Outgoing call using CTI control   "Thank you very much for checking" When you feel like giving up, remember why you held on for so long in the first place ' Related links: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/10_5/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber/CJAB_BK_D6497E98_00_deployment-installation-guide-ciscojabber_chapter_01001.html  http://www.cisco.com/c/en/us/support/unified-communications/jabber-windows/products-installation-guides-list.html   Regards, Gerson Fabian Morales Marin (gersomor)                                                                                                                                             ... View more