Preferred Architecture and Design. Sergio Aguilera Consulting Systems Engineer

Transcription

1

2 Preferred Architecture and Design Sergio Aguilera Consulting Systems Engineer

3 Agenda Join me on Spark What is the Collaboration Preferred Architecture? Preferred Architecture Sub-Systems Call Control Bandwidth Management Conferencing Collaboration Edge Core Applications Simplified Sizing Key Takeaways and Q&A

4

5

6 What is Preferred Architecture?

7 Collaboration Preferred Architecture Strategy Preferred Architecture provides prescriptive design guidance that simplifies and drives design consistency for Cisco Collaboration deployments The Preferred Architecture is divided into five sub-systems o o Makes the overall architecture easier to understand Allows products to be categorised based on function Sub-Systems: Call Control Bandwidth Management Conferencing Edge Services Applications Endpoints

8 Collaboration Solutions Design Guidance Available at Preferred Architecture Overview Solution Reference Network Design (SRND) Cisco Validated Design (CVD) Pre-Sales Process Design Overview Document Targeted to Pre-Sales What with some of the Why! Pre-Sales Process Detailed Design Guidance What and Why. Reference outside the scope of PA Post-Sales process Detailed Deployment Guidance Targeted to Post-Sales What, Why, and How! Process Driven Guide

9 Call Control

10 Headquarters Prime Collaboration TelePresence Deployment Management Suite Expressway-E CUBE Cisco WebEx Prime Licensing Manager Unity Connection Applications DMZ Mobile/Teleworker Instant Message and Presence Unified Communications Manager Expressway-C Internet Call Control TelePresence Server Conductor Integrated / Aggregated Services Router ISDN Video Gateway PSTN Third-Party Solution Integrated Services Router Conferencing Collab Edge MPLS WAN Remote Site Endpoints

11 Call Control Cisco Unified Communications Manager The Heart of Cisco Collaboration CLOUD HYBRID ON PREMISES IM / Presence Voice Video Cisco Unified Communications Manager (CUCM) Content Sharing Design Objectives Centralised Call Processing Centralised IM&P Services Consolidated Endpoint Registration Common feature set across endpoints Central Dial Plan Authority High Availability and Redundancy

12 Call Control with IM&P Cluster Design TFTP Pair MoH Pair Publisher CUCM Cluster Subscriber Pair #1 Primary Subscriber Pair #2 Primary Secondary Secondary DB Sync SIP CTI/QBE SOAP API XML CUCM IM&P Cluster Sub-Cluster #1 Publisher Subscriber Sub-Cluster #2 Publisher Subscriber Sub-Cluster #3 Design Objectives Call Processing and IM&P with 1:1 Redundancy Single TFTP Subscriber Pair Single MoH Subscriber Pair Subscriber Pair #8 Up to 21 Nodes Primary Secondary Publisher Subscriber Up to 6 Nodes

13 Dial Plan

14 What is a Dial Plan About? Design Objectives Endpoint Addressing Dialing Habits Call Routing Directory Integration Class of Services (CoS) - Restrictions Directory Mobile User Input Mapping (Transformations) Call Routing Voic Restrictions

15 Endpoint Addressing DN: DN: SIP URI: tracy@company.com.au Publisher TFTP Pair Subscriber Pair #1 Primary Secondary Subscriber Pair #2 MoH Pair Primary Secondary Design Objectives Use fully qualified E.164 Number with leading + as Directory Numbers (DN) Provision up to five (5) alphanumeric SIP URIs as aliases to primary DN DN: XXXX SIP URI: mel-mx800@company.com.au mel-carlton@company.com.au CUCM Cluster

16 Dialing Habits Numbering Example Site +E.164 Abbr. Intra- Site 1 Abbr. Inter- Site 2 Call Park 3 CMR (Conferencing) 4 CBR XXXX 6XXXX 86XXXX 4XXX 88XXXXX BNE XXXX 7XXXX 87XXXX 4XXX 88XXXXX MEL XXXX 3XXXX 83XXXX 4XXX 88XXXXX 1. Abbreviated Intra-site Site specific short dial plan mapping to +E Abbreviated Inter-site Use Intra-Site Code + Abbr. Intra-site Number 3. Call Park Single (Global) call park range 4. Conferencing Single (Global) CMR range

17 CUCM Call Routing Logic CUCM matches the most specific pattern Longest-match logic Directory Numbers (DNs) act as a route pattern that matches a single number For more information on CUCM routing logic, refer to the Collaboration SRND: Route Patterns User Dials 1200 User Dials peter@company.com.au User Dials XXX 12XX *.com company.com.au DNs 65872

18 Route / SIP Pattern Example User dials a DN or URI Cisco Unified CM selects the best pattern match (SIP) Route Pattern Route List 1 st Choice 2 nd Choice start with the 1 st RG an continue to hunt through the Route List Route Group 1 Top down or circular Route Group 2 Top down or circular Trunks or Gateways within the Route Group are selected based on a top down or circular rotation SIP Trunk SIP Trunk PSTN Gateway PSTN Gateway

19 Directory Integration Design Objectives Integrate into organisation's corporate LDAP directory to enable: o o o User Provisioning User Authentication Contact Source Jabber Manage User Parameters o o o o User ID First Name & Last Name Telephone Number (E.164 format) SIP URI

20 Directory Integration User Synchronisation

21 Class of Service (CoS) Design Objectives Classes of Service (CoS) are used to control access to Services Minimise number of differentiated Classes of Service (CoS) Define CoS in CUCM using: o o Partitions Calling Search Spaces (CSS)

22 SIP Trunking

23 SIP Trunks Why are they important? Unity Connection Applications CUCM Call Control Conductor TelePresence Server CUBE Expressway-E Expressway-C DMZ Internet PSTN Mobile/Teleworker Third-Party Solution SIP Trunks are used to communicate with other components in PA, such as: Cisco Unity Connection (CUC) Voic Application Conductor Conferencing CUBE SIP PSTN Gateway Expressway B2B Calls External Video Gateways ISDN Video Gateway Collab Edge Conferencing SIP TDM

24 SIP Trunk Recommendations Design Objectives Minimise number of SIP profiles o o Consider default profiles first Provision SIP profile per group of equivalent trunks Recommended SIP profile settings: o o o Set Use Fully Qualified Domain Name in SIP Requests on all trunks Enable SIP OPTIONS Ping for real-time status monitoring Enable Best Effort Early Offer Support

25 Use of FQDN in SIP Requests Example INVITE RPID: INVITE RPID: ( Fully Qualified turned on) -or- INVITE RPID: ( Fully Qualified turned off) Bob Alice 180 Ringing RPID: ( Fully Qualified turned on) -or- 180 Ringing RPID: ( Fully Qualified turned off) 180 Ringing RPID: bob@company.com.au

26 Bandwidth Management

27 Evolution of Collaboration Landscape On-premise UC Services Central Site Call Control 1. Fixed, Hardware-Based Endpoints 2. Managed networks QoScapable Managed WAN MPLS VPN DMVPN Cloud Services Internet B2B B2C 1. Mobile, Software-Based Endpoints 2. Unmanaged networks Remote Sites Home/Mobile Users

28 Bandwidth Management Design Objectives Profiling and Prioritisation Smart Media Techniques Admission Control LTRF1 LTRF1 Encoder P5 P5 P1 P1... P2 P3 P4 P2 P ? Decoder OOS (P4) ACK LTRF1 Encoder Decoder... LTRF Repair-P... R1 R FEC R1 R2 FEC Consolidate mechanisms to identify and classify collaboration media Simplify policies for Queuing and Scheduling Use Media Resilience to reduce impact of packet loss Apply Rate Adaptation to reduce network congestion Build a Self-Regulating system supporting supporting Opportunistic Video Use Call Admission Control (CAC) as last option

29 Bandwidth Management Smart Media Techniques Media Adaptation and Resilience Implementation (MARI) Goals Make network congestion less likely to occur Recover more efficiently from packet loss Mechanisms Media Resilience Encoder Packet Pacing Gradual Decoder Refresh (GDR) LTRF with Repair FEC Optimise use of available network resources Rate Adaptation ClearPath Whitepaper - SRND Bandwidth Management Section -

30 Bandwidth Management Traffic Flow Identification Cisco Jabber Example UDP Ports DSCP Jabber classification based on UDP port ranges and ACL s: 17xxx 20xxx EF o Audio streams of all calls (voiceonly and video) marked EF 21xxx 24xxx 5061 ACL AF42 CS3 Ingress Policy 1 o Video streams of Jabber video calls marked AF42 Clients enabled for RTCP to avoid lip-sync issues

31 Bandwidth Management Queuing and Prioritisation Audio of IP Phones Audio of Video Audio of Jabber Video of Video Video of Jabber EF EF EF EF AF41 AF42 AF42 WRED thresholds (i.e., drop AF42 first) AF41 WRED thresholds (i.e., drop AF41 last) PQ Video CBWFQ other queues BW Assigned to LLQ Classes Audio/EF is mapped to the priority queue o Includes audio streams from video endpoints and Jabber clients (voiceonly and video calls) Video streams of video calls (AF41) and video streams of Jabber calls (AF42) are mapped to the same CBWFQ WRED is configured on the video queue: o o min-max thresholds for AF42: ~10% - ~30% of queue limit min-max thresholds for AF41: ~45% - 100% of queue limit

32 Conferencing

33 Headquarters Prime Collaboration Deployment TelePresence Management Suite Expressway-E CUBE Cisco WebEx Prime Licensing Manager Unity Connection Applications DMZ Mobile/Teleworker Instant Message and Presence Unified Communications Manager Expressway-C Internet Call Control TelePresence Server Conductor Integrated / Aggregated Services Router ISDN Video Gateway PSTN Third-Party Solution Integrated Services Router Conferencing Collab Edge MPLS WAN Remote Site Endpoints

34 Conferencing Design Objectives Flexible Architectures to support various conference types such as: Ad-hoc (Instant), Rendezvous (Permanent) and Scheduled Dynamic Optimisation of conferencing resources leveraging TelePresence Conductor and TelePresence Server Simplified Conferencing Experience leveraging TelePresence Management Suite (TMS) Resiliency High Availability (HA) for all conferencing components

35 TelePresence Server Platforms TelePresence Server on VMWare (TRC & Specs Based) TelePresence Server on VMWare Appliances Blade 8-core MM410v Rack-Mount MM310 1 to 10 ports at 720p 1 to 54 ports at 720p 1 to 12 ports at 720p 1 to 24 ports at 720p per cluster MM820 30vCPU MM410v Blade Server MM320 1 to 60 ports at 720p per blade 1 to 120 ports at 720p per cluster 1 to 20 ports at 720p 1 to 24 ports at 720p 1 to 48 ports at 720p per cluster 1 to 54 ports at 720p per blade 1 to 432 ports at 720p per chassis Note: For simplicity, only capacity for 720p is shown. TS is capable of many other resolutions and frame rates with differing limits on capacity. All numbers represent remotely managed mode (Conductor required) capability. See release notes for further detail.

36 Telepresence Server Multistream User Experience Dual Screen Systems Provides People + People Experience Single Screen System Supports Active Presence Experience Without Multistream Without Multistream With Multistream With Multistream

37 TelePresence Conductor What is it used for? Conference Virtualisation Resource management for greater scale Intelligent bridge selection and Automatic Cascading for large conferences Centralised Conference provisioning and administration Shared multipoint resources Allows multipoint resources to be shared for ad-hoc, rendezvous and scheduled conferences Optimised Resource Management Central point of management for all conferencing needs

38 Conductor and CUCM How Does The Model Change? Conference Bridge in UCM configuration Emulates MCU API, looks like MCU to UCM Utilises B2BUA Accepts SIP Signalling Uses Multiple IP addresses (65 Max.) Management IP Location specific IPs IP address for Instant Meetings IP address for Personal CMR Added Conductor SIP trunk in UCM configuration Individual bridges

39 TelePresence Management Suite (TMS) Cisco TMS Core Platform TelePresence Management Suite Core Platform (TMS) o Scheduling o Phonebooks TelePresence Management Suite Provisioning Extension (TMSPE) o Smart Scheduler o Personal Meeting Room Provisioning TelePresence Management Suite Extension for Microsoft Exchange (TMSXE) o Schedule Meetings via Microsoft Outlook

40 TelePresence Management Suite (TMS) Architecture TMSXE Active Nodes TMS/TMSPE TMS in active/passive mode Scheduling request Exchange Servers SQL Active Directory Network Load Balancer Single virtual IP address address for management External SQL Server used by both TMS nodes TMSPE is co-resident with TMS TMSXE must be deployed separately TMSXE TMS/TMSPE Passive Nodes

41 TelePresence Multiparty Licensing Overview TelePresence Conductor All Multiparty Licenses TMS/PE Conductor centrally manages licenses for all TelePresence Servers (TS) o Screen Licenses no longer required on individual TelePresence Servers Two types of multiparty licenses are supported: o o Personal Multiparty (PMP) Shared Multiparty (SMP) Can be used for Room-Based Systems or Sharing amongst users TelePresence Servers All resources available for any meeting TMS-PE provides license provisioning interface Ad-hoc (Instant), Rendezvous (Permanent) or Scheduled conferences with unlimited participants (up to TS capacity) Benefits: o o Full access to all TS resources Simplify TS deployment Minimum Requirements: Conductor 4.0 (posted 2 nd Sept 15) TMS 15.0 (posted 2 nd July 15) TMSPE 1.5 (posted 3 rd Sept 15) TS 4.2 (posted 28 th August 15)

42 Call Flow Ad-hoc (Instant) Conference Endpoint creates an instant conference requesting to join three participants Unified CM initiates an instant conference on Conductor TelePresence Conductor creates the conference on a TelePresence Server Unified CM routes the call(s) to TelePresence Conductor TelePresence Conductor routes the call(s) to the TelePresence Server hosting the relevant conference Other Participants Host Unified CM (UCM) Conductor TelePresence Server (TS) Instant conference request Instant conference initiated by UCM Conductor creates conference on TS UCM routes call(s) to Conductor Conductor routes call(s) to TS

43 Call Flow Rendezvous (Permanent) Conference Endpoint dials a permanent conference alias (URI or DN) Unified CM matches the dialed string to a (SIP) route pattern or route string Unified CM routes the call to TelePresence Conductor via SIP trunk TelePresence Conductor matches the called number to an alias and creates a conference on TS TelePresence Conductor routes the call to the TelePresence Server Host Unified CM (UCM) Conductor TelePresence Server (TS) Alias matched Alias matched on Conductor Participants Dial conference alias (URI or DN) UCM routes call to Conductor Conductor creates conference on TS Conductor routes call to TS Dial conference alias UCM routes call to Conductor Conductor routes call to TS Dial conference alias UCM routes call to Conductor Conductor routes call to TS

44 Call Flow Scheduled Conference User schedules conference using Smart Scheduler. User is notified of the meeting details TMS uses APIs to create a conference on Conductor at the time requested Conductor uses APIs to create a conference on the chosen TS User dials the alias or Conductor dials out to the user Unified CM routes call to Conductor (dial-in, OBTP) or Conductor dials out to the user via Unified CM

45 Collaboration Meeting Rooms (CMRs)

46 Collaboration Meeting Rooms Deployment Options + Cisco CMR Premises Cisco CMR Hybrid Cisco CMR Cloud Cisco TelePresence video infrastructure on premises at customer data centre Cisco TelePresence video infrastructure on premises plus Cisco WebEx meeting applications Hosted by a Cisco WebEx meeting application

47 CMR Premises Architecture CUCM Requirements: Conductor 4.0 (posted 2 nd Sept 15) TMS 15.0 (posted 2 nd July 15) TMSPE 1.5 (posted 3 rd Sept 15) TS 4.2 (posted 28 th August 15) TelePresence Conductor Cisco TMS Conductor provisioning API utlisised for conference setup and configuration Easy provisioning and configuration of Personal Collaboration Meeting Rooms (CMRs) via TMSPE Instant and Personal TelePresence Server Pool Scheduled TelePresence Server Pool SIP Media+Content HTTP(s) Personalise CMR on Self-Care Portal Each CMR has an associated video address (DN or URI) that is integrated into CUCM s dial plan

48 Personal CMR Provisioning CMR Template Configuration on TMS This template will be created on Conductor by TMS Service Preference on Conductor for this template PMP or SMP Alias generated from AD username Number generated from AD telephone number Note: CMR Template configuration cannot be modified from Conductor UI.

49 Personal CMR Customisation

50 CMR Hybrid Architecture Unified CM Integrate on-premise video with WebEx participants Conductor Expressway-C Expressway-E Internet Require a certificate signed by a trusted Root Certificate Authority on Expressway-E Cisco TMS Supports WebEx, PSTN or TSP audio options TelePresence Server Pool SIP Media+Content HTTP(s) Supports Scheduled or Non-Scheduled Conferences Cisco Collaboration Meeting Rooms (CMR) Hybrid Configuration Guide

51 CMR Cloud Architecture Unified CM Conference Resources and Infrastructure reside in WebEx Cloud Expressway-C Expressway-E Internet Requires on-premise CUCM for call control and Expressway for B2B calls Each CMR has an associated video address (DN or URI) and URL SIP Media+Content Supports WebEx, PSTN or TSP audio options Cisco Collaboration Meeting Rooms (CMR) Cloud Deployment Guide

52 Choosing the Right Option Guidance for Conferencing Focused Customers Cloud On-Prem 1 2 Multiparty Licensing 3 WebEx or Spark customer Greenfield conferencing CMR Cloud Interop including Skype for Business (S4B) CMR Premises or Hybrid Customers Ad-hoc escalation Multistream, Active Control and Triple Screen Support Rich Skype for Business (S4B) conferencing interoperability Public Sector: JITC and FIPS Certifiations Scalable on premise Audio and Video conferencing Spark & WebEx Conferencing TP Server (Multiparty Licensing) Acano + CUWL (Optional)

53

54

55 Collaboration Edge

56 Headquarters Prime Collaboration TelePresence Deployment Management Suite Expressway-E CUBE Cisco WebEx Prime Licensing Manager Unity Connection Applications DMZ Mobile/Teleworker Instant Message and Presence Unified Communications Manager Expressway-C Internet Call Control TelePresence Server Conductor Integrated / Aggregated Services Router ISDN Video Gateway PSTN Third-Party Solution Integrated Services Router Conferencing Collab Edge MPLS WAN Remote Site Endpoints

57 Cisco Collaboration Edge Architecture Components Cisco Expressway o o o Business-to-Business (B2B) Mobile and Remote Access (MRA) External IM&P Federation (XMPP) Gateways o SIP-based PSTN Connectivity Cisco Unified Border Element (CUBE) o o TDM-Based PSTN Connectivity Integrated Services Router (ISR) ISDN Video Gateway ISDN 3241 and MSE 8321 (Blade) Expressway-E CUBE Integrated/Aggregated Services Router Collab Edge DMZ Expressway-C ISDN Video Gateway Cisco WebEx Internet PSTN MPLS WAN Mobile/Teleworker Third-Party Solution Integrated Services Router Remote Site

58 Business-to-Business Communications

59 Expressway Firewall Traversal Basics Enterprise Network DMZ Outside Network Unified CM Expressway-C Firewall Expressway-E Firewall Internet Signaling Media 1. Expressway-E is the traversal server installed in DMZ. Expressway-C is the traversal client installed inside the enterprise network. 2. Expressway-C initiates traversal connections outbound through the firewall to specific ports on Expressway-E with secure login credentials. 3. Once the connection has been established, Expressway-C sends keep-alive packets to Expressway-E to maintain the connection 4. When Expressway-E receives an incoming call, it issues an incoming call request to Expressway-C. 5. Expressway-C then routes the call to Unified CM to reach the called user or endpoint 6. The call is established and media traverses the firewall securely over an existing traversal connection

60 B2B Calls Flow Example SIP-to-SIP Calls DNS Hierarchy Expressway-C CUCM Forward SIP Invite to companyb.com.au using IP address received via DNS Remote Edge 1 Expressway-E Calls user_y@companyb.com.au Sends SIP 200 OK Internet user_x@companya.com.au COMPANY A COMPANY B Remote Edge 2 Note: 1 Traversal Server 2 Traversal Client user_y@companyb.com.au

61 B2B Calls Media Encryption Encryption Modes: o o o o Applies to Neighbour, DNS, Traversal and Default Zones* on Expressway-C and Expressway-E Force encrypted Force unencrypted Auto: Dependent on endpoint request Best Effort: will fall back to unencrypted if encryption is not available Expressway-C Expressway-E SIP: Media encryption mode can be configured H.323: Does not work with forced encrypted or force unencrypted o Separate H.323 from SIP traversal zones if force encrypted is to be configured * For Expressway zone type descriptions, refer to the Zones and Neighbours section of the Cisco Expressway Administrator Guide

62 B2B Call Media Encryption Example Mixed Encryption Settings Expressway-C Expressway-E CM Neighbor Zone TLS Traversal Client Zone TLS Traversal Server Zone TLS Best Effort Force encr Force encr Inbound zone Default Zone Not configurable Auto Outbound zone DNS Zone Not configurable Best Effort TLS/SRTP TLS/SRTP TCP/RTP Internet Best Effort and Force Encrypted will engage B2BUA on Expressway-C and Expressway-E Third media leg between Expressway-E and Remote Edge falls back to unencrypted since Remote edge does not support encryption Lock icon shows closed only if all the call legs are encrypted with the exception of the Remote Edge to endpoint call leg RTP Remote Edge

63 Mobile and Remote Access

64 Mobile and Remote Access (MRA) Overview Secure VPN-Less access for Jabber Clients and Hardware-Based Endpoints Inside firewall (Intranet) CUCM DMZ Outside firewall (Public Internet) 78xx / 88xx IP Phones DX Endpoints EX Endpoints Collaboration Services CUCM IM&P Expressway-C Expressway-E Internet Jabber Desktop Jabber Mobile Unity Connection Conferencing MX Endpoints SX Endpoints Mobile Users. Teleworkers

65 MRA Split DNS SRV Record Requirements _collab-edge record needs to be available in public DNS Multiple SRV records (and Expressway-E hosts) should be deployed for HA A GEO DNS service can be used to provide unique DNS responses by geographic region _collab-edge._tls.example.co.nz SRV expwy1.example.co.nz _collab-edge._tls.example.co.nz SRV expwy2.example.co.nz _cisco-uds record needs to be available only in internal DNS _cisco-uds._tcp.example.co.nz SRV ucm1.example.co.nz. _cisco-uds._tcp.example.co.nz SRV ucm2.example.co.nz.

66 MRA Jabber Service Discovery Example Inside firewall (Intranet) CUCM DMZ Outside firewall (Public Internet) DNS SRV lookup _cisco-uds._tcp.example.co.nz Not Found Collaboration Services Public DNS DNS SRV lookup _collab-edge._tls.example.co.nz CUCM IM&P Expressway-C Unity Connection Expressway-E expwyakl.example.co.nz Conferencing TLS Handshake, trusted certificate verification HTTPS: get_edge_config?service_name=_ciscouds&service_name=_cuplogin

67 Voice and Video Gateways

68 Voice and Video Gateways Portfolio ISR 4451-X ISR 4431 ASR 1004/6 RP2 ISR-4K (4321, 4331) ISR Series ISR-G2 (3925, 3945) 3900 E-Series ISR-G2 (3925E, 3945E) ASR 1001-X ASR 1002-X CSR1000v (vcube) SIP-Only (CUBE) Voice Gateways 2900 Series ISR-G2 (2901, 2911, 2921, 2951) TelePresence ISDN GW MSE /1861 ISR Analog, Digital and SIP (CUBE) Voice Gateways TelePresence ISDN GW 3241 TelePresence ISDN Gateways

69 Voice and Video Gateways Recommendations Deployment Best Practices TelePresence Video Gateways o Deploy dedicated ISDN Video Gateways ISR / ASR (CUBE) DMZ ISR / ASR Router ISDN Video Gateway Central Site Internet PSTN MPLS WAN Third-Party Solution ISR Router Remote Site PSTN Connectivity o o o Central Site TDM-Based Deploy ISR router with ISDN Primary Rate (PRI) modules Central Site SIP Trunk-Based Deploy ISR or ASR router in DMZ and enable Cisco Unified Border Element (CUBE) functionality Remote Sites Deploy ISR router with Analog or ISDN Basic / Primary (BRI/PRI) Rate modules

70 Core Applications

71 Headquarters Prime Collaboration Deployment TelePresence Management Suite Expressway-E CUBE Cisco WebEx Prime Licensing Manager Unity Connection Applications DMZ Mobile/Teleworker Instant Message and Presence Unified Communications Manager Expressway-C Internet Call Control TelePresence Server Conductor Integrated / Aggregated Services Router ISDN Video Gateway PSTN Third-Party Solution Integrated Services Router Conferencing Collab Edge MPLS WAN Remote Site Endpoints

72 Core Applications Key Benefits» Cisco Unity Connection enables voic and unified messaging across a wide-range of end-user platforms» Cisco Prime Collaboration Deployment (PCD) eases deployment of new infrastructure components, enabling faster initial setup» Cisco Prime Licensing Manager (PLM) single tool to enable license workflows and manage licensing for collaboration infrastructure components.

73 Core Applications Cisco Unity Connection (CUC) Architecture Overview Unified CM SIP Unity Connection Publisher Subscriber Directory synchronisation Directory LDAP Mailbox synchronization Microsoft Exchange Voic access Via TUI, VUI or Visual Voic access to voic (Single Inbox) Messaging (On-Premise or Cloud-Based) Redundant Unity Connection nodes SIP Trunk integration to Unified CM Integrations to directory and » LDAP Directory» Microsoft Exchange Voic Access via o o o Telephone User Interface (TUI) Voice User Interface (VUI) Visual Voic access to voic (Single Inbox / Unified Messaging (UM)) SIP TUI, VUI or REST/HTTPS (SMTP/HTTPS)

74 Core Applications Prime Collaboration Deployment VMWare EXSi host CM_Pub VM CM_Sub VM CM_Sub VM IM&P_Pub VM IM&P_Sub VM IM&P_Sub VM UCXN_Pub VM UCXN_Sub VM Design Objectives Simplify CUCM, CUCM IM&P and CUC deployments by enabling automated, unattended installation of server nodes Facilitate configuration of common network and security settings..iso.iso.iso Prime Collaboration Deployment (PCD) x x x x

75 Core Applications Prime Licensing Manager (PLM) Architecture Overview Unified CM Unity Connection Cisco Prime License Manager (PLM) enables license fulfilment: Publisher Publisher» Electronic [requires Internet connectivity] OR» Manual license file request Licenses received (over the network or via ) Cisco.com Prime License Manager Licenses applied to system and propagated to synchronised application instances.

76 Simplified Sizing

77 Preferred Architecture (PA) Simplified Sizing The Cisco Preferred Architecture for Enterprise Collaboration Cisco Validated Design (CVD) presents some examples that simplify the sizing process Refer to the latest Enterprise Collaboration CVD at

78 Traditional Sizing for Cisco Collaboration Collaboration Sizing Tool (CST)

79 PA Simplified Sizing vs Collaboration Sizing Tool Deployment within the PA Sizing Assumptions? Use PA Simplified Sizing Use Collaboration Sizing Tool

80 Key Takeaways The Collaboration Preferred Architecture (PA) helps Customers and Partners understand the overall Collaboration Architecture and its components The Collaboration Preferred Architecture (PA) provides general design best practices and follows a modular, prescriptive approach to simplify deployments The Collaboration Preferred Architecture (PA) provides simplified sizing options for typical deployments and is built to scale. For deployments outside of the Preferred Architecture (PA), refer to the Collaboration Solution Reference Network Design (SRND) guide. For detailed deployment guidance ( the how ), refer to the Enterprise Collaboration Cisco Validated Design (CVD).

81 Continue the Conversation using Cisco Spark Sign up free for Cisco Spark at Download the application from ios App Store, Google Play Store, or from Visit or use the QR Code to join the CLMEL16 BRKCOL-2101 Spark room and continue the conversation

82 Collaboration Track at Cisco Live MELBOURNE Track Session ID Date Time Title Video BRKEVT th March :30 AM Designing for Video in Every Workspace BRKUCC th March :30 PM Enabling Federation and External Collaboration with Expressway BRKUCC th March :30 AM Directories Services and Single Sign-On for Collaboration BRKCOL th March :50 PM Enabling Quality of Service with Cisco SDN BRKUCC th March :45 AM Upgrading and Migrating to Cisco Unified Communications Manager BRKUCC th March :50 PM Jabber Everywhere Deploying the Best Experience Unified Communications BRKCOL th March :30 AM Preferred Architecture and Design BRKUCC th March :30 AM Leveraging SIP to Simplify Dial Plans Both Inside and Outside the Enterprise BRKUCC th March :00 PM Deploying SIP Trunks with Cisco Unified Border Element (CUBE/vCUBE) Enterprise BRKUCC th March :30 PM Securing Unified Communications and Certificate Deep Dive BRKUCC th March :00 PM Troubleshooting Jabber Like a TAC Engineer BRKCOL th March :30 AM Cisco Unified Communications and Microsoft Integrations BRKCCT th March :00 PM Designing Cisco Contact Centres for Medium to Large Enterprises Contact Centre BRKCCT th March :50 PM Designing and Deploying Contact Centre Express BRKCCT th March :30 PM Customising your Contact Centre with Finesse and CUIC BRKCCT th March :30 PM Recording and Video Enabling the Contact Centre BRKUCC th March :00 PM Introduction to Collaboration Anywhere BRKUCC th March :30 PM Cisco Collaboration Enabling Workspace Transformation BRKCOL th March :30 PM Evolution of Collaboration Protocols Collaboration BRKUCC th March :50 PM Designing Collaboration Meeting Rooms BRKUCC th March :45 AM Accelerate and Assure Collaboration Deployments with Cisco Prime Collaboration BRKCOL th March :00 PM Understanding Cisco and Apple Integration BRKUCC th March :30 PM Understanding Cisco Cloud and Hybrid Collaboration Cloud BRKCOL th March :50 PM Cloud Based Unified Communications for Small Business BRKCOL th March :30 PM Deploying Hybrid Conferencing and Cloud Connected Audio

83 Q & A

84 Complete Your Online Session Evaluation Give us your feedback and receive a Cisco 2016 T-Shirt by completing the Overall Event Survey and 5 Session Evaluations. Directly from your mobile device on the Cisco Live Mobile App By visiting the Cisco Live Mobile Site Visit any Cisco Live Internet Station located throughout the venue T-Shirts can be collected Friday 11 March at Registration Learn online with Cisco Live! Visit us online after the conference for full access to session videos and presentations.

85 Thank you

86

87 Appendix

88 Call Control Multi-Cluster Considerations

89 Multi-Cluster Scenario Publisher CUCM Subscriber Pair Cluster #1 CUCM IM&P Subscriber Publisher Publisher CUCM Subscriber Pair Design Objectives Multi-Cluster model is based on multiple iterations of the Centralised Call Processing Model Consider Multiple Clusters due to the following: Administrational Separation Geographic Footprint Publisher CUCM Subscriber Pair Cluster #2 CUCM IM&P Subscriber Publisher SIP ILS CUCM IM&P Subscriber Publisher XMPP Cluster #N Deploy SIP Trunk Full Mesh to avoid session traversal through individual clusters Leverage Inter-cluster Lookup Service (ILS) for SIP URI Replication Directory Number (DN) replication via Global Dial Plan Replication (GDPR)

90 Call Control Call Routing

91 Local Route Group (LRG) LRG introduced with Unified CM 7.0 Concept: move the site specific egress gateway selection policy from the route pattern to the calling devices device pool Standard Local Route Group used as placeholder in route list definition Dynamically replaced with route group configured on calling device s device pool when routing the call Allows for site un-specific route patterns route pattern count reduction Restriction pre 10.0: we only have single LRG What if we want to use LRG based egress GW selection, but e.g. need to differentiate between emergency calls and regular PSTN calls?

92 Call Control Base Configuration

93 FQDN Processnode References All nodes of a cluster are managed under System/Server Options: IP address Hostname (no domain) Fully Qualified Domain Name (FQDN, includes DNS domain portion) Processnode references exposed to external entities Endpoint configuration files (Unified CM groups for registration) UDS service discovery...

94 FQDN Processnode References Why not IP addresses? IP address processnode references are used by Jabber to build HTTPS URLs to accesss services Certificate validation during TLS connection setup Validity: validity period Trust: direct (imported into trust store) or indirect (certificate issued from trusted CA) Identity: subject of the certificate (or subject alternate name) needs to match the intended communication peer Final identity check fails if host connects to an IP address, because cert subjects (typically) are domain names Certificates with IP address subject alternate name not an option CA validation of IP addresses questionable Incorrect treatment of IP address SANs by some browsers IP address processnode references cause Jabber certificate validation to fail

95 FQDN Processnode References Why not Hostnames? Exposed hostnames need to get fully qualified by clients Which domain should be used? Presence domain? Domain learned by client via DHCP? What if the customer has site with multiple DNS domains? domain learned by client via DHCP: cbr.company.com.au DNS domain of Unified CM cluster: uc-cluster.company.com.au Problem: client uses wrong FQDN to connect to servers

96 FQDN Processnode References FQDN is the best solution Pros: Solves certificate validation problems Solves multi-domain problems Cons: Creates DNS dependency DNS becomes critical foundation service for UC Recommendation: set server names (Unified CM admin GUI under System/Server) to FQDNs!

97 Enterprise Parameters Recommended Settings Global settings determining fundamental behaviour of CUCM Identification Cluster ID: unique cluster identification Service URLs: make sure that URLs refer to FQDNs Call Routing URI Lookup Policy: RFC 3261 URI case sensitivity set to Case Insensitive Organisation Top Level Domain (OTLD): routing of numeric SIP URIs set to main domain, e.g. company.com.au Cluster Fully Qualified Domain Name (CFQDN): routing of numeric SIP URIs space separated list of all Unified CM nodes in the cluster Wildcarded if all cluster members are in same domain/zone (example: *.uscluster.company.com.au)

98 Always Set CFQDN and OTLD Set OTLD to match single(!) corporate domain name Make sure to set the CFQDN to match host names of all cluster nodes DNS naming structure might help e.g.: *.anz-cluster.company.com.au for pub. anz-cluster.company.com.au, sub1.anzcluster.company.com.au, Keep in mind that fallback routing based on RHS is implemented for: Alpha URIs not found locally Numeric URIs with RHS = OTLD not found in numeric lookup

99 Call Control DNS Requirements

100 DNS Requirements Jabber certificate validation requires DNS for UC services Recommendation: Enable DNS forward (A record) and reverse (PTR record) lookup for all UC servers Potentially zone per cluster: pub.anz-uc.example.org tftp1.anz-uc.example.org tftp2.anz-uc.example.org sub1a.anz-uc.example.org sub1b.anz-uc.example.org Dedicated zone for cluster simplifies configuration of cluster fully qualified domain name (CFQDN): *.anz-uc.example.org

101 DNS for UDS Based Service Discovery DNS SRV records are required for Jabber service discovery On-prem service discovery looks for _cisco-uds._tcp.company.com.au Recommendation: SRV record for each Unified CM subscriber Best load balancing of initial UDS requests during registration DNS SRV load balancing only used for intial UDS request. Further UDS requests are load balanced by Jabber over all UDS nodes in cluster learned from UDS Example: _cisco-uds._tcp.company.com.au IN SRV sub1a.anz-uc.company.com.au _cisco-uds._tcp.company.com.au IN SRV sub1b.anz-uc.company.com.au _cisco-uds._tcp.company.com.au IN SRV sub2a.anz-uc.company.com.au _cisco-uds._tcp.company.com.au IN SRV sub2b.anz-uc.company.com.au

102 Call Control Certificate Management

103 Certificate Requirements Base Concepts Certificate exchange part of TLS connection setup Certifcate Validity: expiration date, signature valid? Certificate Trust: is the signing entity trusted? Self-signed certs: import cert into trust store Issuing CA trusted Identity: does the certificate identity match the identity of the intended communication peer? Serial Signature Issuer Subject Validity Subject Public Key

104 Jabber Certificate Validation Required Certificates Unified CM IM&P: Tomcat, XMPP Unified CM: Tomcat, CallManager Unity Connection: Tomcat WebEx Meetings Server: Tomcat Options: Users ignore certificate validation pop-ups and accept certs invalidates security concepts Install above certificates in the Enterprise Trust store of all clients Use CA (public/private) issued certificates: only trust with CA has to be established

105 Certificate Recommendations CA issued certificates simplify the deployment With self-signed certificates to establish trust all certificates have to be cross-imported or deployed to clients via GPO Use multi-server certificates to minimise the management overhead Private CA avoids policy constraints of public CAs; e.g. single certificate per FQDN

106 Bandwidth Management

107 Bandwidth Management Traffic Flow Identification CUCM Service Parameters and SIP Profile Configuration System Service Parameters Cisco CallManager Service Device Device Settings SIP Profile

108 Conferencing

109 Conductor Platforms Variant Conductor Clustering Capacity TAC Support Free TelePresence Conductor [Essentials] (VM only) 1 x standalone TS NO (Use communities & forums) Mid-Market TelePresence Conductor [Select] (VM only) (up to 2) 30 x standalone or clustered TS (50 Call sessions) YES Full TelePresence Conductor (VM only) (up to 3) 30 x standalone or clustered TS (2400 Call sessions) YES Ability to upgrade from Free Conductor -> Midmarket Conductor -> Full Conductor Same software shared across all variants. Option keys used to differentiate types of Conductor.

110 TelePresence Conductor Configuration Concepts Conductor Conf. Alias Service Preference Conf. Bridge Pool Conf. Bridge Unified CM Route Pattern Route List/MRGL Route Group/MRG Conference Bridge Conductor Virtual IP Address Location Conference Alias Conference Template (not needed for instant conferences) Service Preference (can be used in multiple Conference Templates) #1 Pool TS TS (can be used in multiple SP s) #2 Pool TS TS TS TS Prioritised

111 Conductor Clustering Unified CM Media Resource Group Media Bridge1 Instant Conductor 1 Conductor Media Bridge2 Trunk IP1 Trunk IP Permanent Trunk Conductor IP addresses per Conductor server Up to 3 nodes in a cluster Up to 30 bridges per cluster Max RTT of 30 ms between cluster nodes

112 Conductor Clustering Unified CM Media Resource Group Media Bridge1 Instant Conductor 1 Conductor Media Bridge IP addresses per Conductor server Trunk IP1 Trunk IP2 Permanent Trunk Conductor Up to 3 nodes in a cluster Up to 30 bridges per cluster Max RTT of 30 ms between cluster nodes

113 Conductor Instant Conference Configuration Unified CM Conductor Template MRGL Service Preference Pool MRG Endpoint Media Bridge Location TelePresence TelePresence Server Servers

114 Conductor Permanent Conference Configuration SIP Route Pattern Route Pattern Unified CM Alias Conductor Route List Template Route Group Service Preference Endpoint SIP Trunk Location Pool TelePresence TelePresence Server Servers

115 Mobile and Remote Access

116 MRA Protocol Workload Summary Inside firewall (Intranet) DMZ Outside firewall (Public Internet) Protocol Security Service Collaboration Services CUCM Internet SIP TLS Session Establishment Register, Invite, etc. RTP SRTP Media Audio, Video and Content Sharing CUCM IM&P Expressway-C Unity Connection Conferencing Expressway-E HTTPS TLS Logon, Provisioning/Configuration, Contact Search, Visual Voic XMPP TLS Instant Messaging, Presence

117 MRA Global Deployment Topology & Geo DNS expwy.us.example.com DNS SRV lookup _collab-edge._tls.example.com Geo DNS US Europe Asia expwy.uk.example.com expwy.jp.example.com SIP Trunk SIP Line Expressway edge access Expressway Traversal SME global aggregation US SME EU SME Asia SME Unified CM regional clusters CBR RTP PAR LON TKY BGL DFW AMS HKG

118 Voice and Video Gateways

119 Centralised IP PSTN Access With Local GW As Backup Calling Search Space Partition CBRInternational PSTNInternational Device Pool LRG_PSTN1 LRG_PSTN2 CBRPhone CUBE_AUS_PSTN GW_CBR_PSTN CUBE1 Device Pool set to CBRPhone MELPhone CUBE_AUS_PSTN GW_MEL_PSTN Route Pattern \+! Route List RL_PSTN Phone in CBR PSTNInternational LRG_PSTN_1 Calling Search Space LRG_PSTN_2 Partition MELInternational PSTNInternational Device Pool set to MELPhone Route Group GW_CBR_PSTN GW_MEL_PSTN Trunk Trunk_To_CBR_GW Trunk_To_MEL_GW CBR_GW MEL_GW Phone in MEL First choice for CBR users Backup for CBR users First choice for MEL users Backup for MEL users

120 Core Applications

121 Cisco Unity Connection Design Considerations Sub X Pub Unity Connection Cluster Deployment (publisher + subscriber)» Nodes: Must be the same OVA size and integrate to the same Unified CM cluster.» Connectivity: Maximum RTT = 150 ms. For every 50 voice messaging ports 7 Mbps of bandwidth is required. Unified CM Integration» Dual SIP trunks, route group with Top Down algorithm for call routing: Unity Connection subscriber 1st (primary), publisher 2nd (backup).» Visual Voic UC Service: Set the Unity Connection publisher as the primary voic service and subscriber as the secondary service within the UC service profile. Capacity Planning» Reserve 20% of total system ports for dial out/non-answering operations (message notification, MWI, etc.)

122 Alternatively use Prime Collaboration Deployment Core Applications Deployment Overview 1. Provision the Unity Connection Cluster Deploy two node cluster for high availability» Determine OVA configuration size (based on number of users) and network and security parameters for each node (hostname, IP address/mask, default gateway, DNS, NTP, username/password, etc.).» Deploy/install publisher, add subscriber details under cluster configuration, then deploy the subscriber. 2. Configure Unified CM for Unity Connection Integration Configure SIP trunks, call routing, and voic settings for integration to Unity Connection cluster.» Configure two SIP trunks (one per Unity Connection node) and call routing constructs (Route Pattern/List/ Group).» Configure voic constructs (Voic Pilot number, MWI on/off, Voic Profile). Refer to the CVD 3. Unity Connection Base Configuration Configure Unity Connection to enable Unified CM integration, user provisioning, and voic capabilities.» Configure phone systems settings, ports (port codec, port groups), and call routing to enable integration with Unified CM.» Enable directory sync with Active Directory and configure templates for user provisioning of mailboxes and self enrollment.

123 Core Applications Deployment Overview Refer to the CVD 4. Enable Single Inbox Unified messaging feature enabling synchronisation of voice messages in Unity Connection with user s Microsoft Exchange mailbox.» Configure Unified Messaging Services account and role in Active Directory/Exchange, and configure Unity Connection settings (SMTP, authentication method/protocol, and user enablement).» Install ViewMail for Outlook (available at Cisco.com), configure account and Unity Connection server. 5. Enable Visual Voic Provide visual access to voic boxes for listing and playing messages» Configure appropriate Unity Connection settings: Class of service (CoS) and API options settings» On Unified CM configure voic UC service for each Unity Connection node and add the services to a UC Service Profile. 6. Voic in SRST Mode Configure branch ISRs with SRST to route calls to Unity Connection voic system via PSTN when IP WAN is down.» Configure call forward no answer/busy and POTS dial-peer to route calls via the PSTN to Unity Connection.» Ensure Redirected Dialed Number Information Service (RDNIS) is configured and carrier propagates so that callers are directed to the appropriate voic box rather than the automated attendant prompt. 7. HTTPS Interworking of two or more Unity Connection Clusters Configure HTTPS networking to enable directory information sharing and message exchange between multiple clusters.

124 Simplified Sizing

125 Simplified Sizing Additional Tools Virtual Machine Placement Tool (VMPT)

126 Simplified Sizing Additional Tools Cisco UC Virtualisation DocWiki

127 Simplified Sizing Additional Tools Collaboration Design Zone Cisco Collaboration Solutions Design Guidance: Cisco Collaboration Systems 10.x Solution Reference Network Designs (SRND)» Cisco Collaboration Systems 11.0 Solution Reference Network Designs (SRND) Cisco Enterprise Preferred Architecture: Cisco Preferred Architecture for Enterprise Collaboration, Design Overview» Cisco Preferred Architecture for Enterprise Collaboration, CVD

128 Q & A

129 Complete Your Online Session Evaluation Give us your feedback and receive a Cisco 2016 T-Shirt by completing the Overall Event Survey and 5 Session Evaluations. Directly from your mobile device on the Cisco Live Mobile App By visiting the Cisco Live Mobile Site Visit any Cisco Live Internet Station located throughout the venue T-Shirts can be collected Friday 11 March at Registration Learn online with Cisco Live! Visit us online after the conference for full access to session videos and presentations.

130 Thank you

131