DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYLAND Joint Interoperability Test Command (JTE) 13 Jun 14

Transcription

1 DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYLAND IN REPLY REFER TO: Joint Interoperability Test Command (JTE) 13 Jun 14 MEMORANDUM FOR DISTRIBUTION Revision 6 SUBJECT: Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 References: (a) Department of Defense Instruction , "DoD Unified Capabilities (UC)," 9 December 2010 (b) DoD CIO, Memorandum, "Interim Guidance for Interoperability of Information Technology (IT) and National Security Systems (NSS)," 27 March 2012 (c) through (e), see Enclosure 1 1. Certification Authority. References (a) and (b) establish the Joint Interoperability Test Command (JITC) as the Joint Interoperability Certification Authority for the UC products. 2. Conditions of Certification. The Cisco ESC 8; hereinafter referred to as the System Under Test (SUT), meets the critical requirements of the Unified Capabilities Requirements (UCR), Reference (c), and is certified for joint use as an ESC in Type 1, 2, and 3 environments and as a Local Session Controller (LSC) with the conditions described in Table 1. This certification expires upon changes that affect interoperability, but no later than three years from the date of the UC Approved Products List (APL) memorandum. None. Condition Table 1. Conditions UCR Waivers Conditions of Fielding The SUT video end instruments include H.323 proprietary ROUTINE only end instruments depicted in Table 4. Additionally the SUT includes a Jabber client that offers video and voice; however, the Jabber client is certified for audio only as a soft phone and for XMPP IM&P as an XMPP client. Open Test Discrepancies Per the vendor's LoC, the SUT does not display weighted Terminal Coupling Loss (TCLw) and equipment impairment factor in their call detail record (CDR). Operational Impact Remarks Minor See note 1. Per the vendor's LoC, the does not fully meet separate video and voice ASAC counts. Minor See note 1. The SUT does not properly handle signaling events when setting up an inter-switch V.150 secure call with Avaya Communication Manager (CM) 6.0. Per the vendor's LoC, the SUT proprietary video EI does not provide the ability to enable or disable the transmission destination unreachable msg. Minor See note 2. Minor See note 1.

2 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 Table 1. Conditions (continued) Condition Per the vendor's LoC, the SUT fails to immediately divert all precedence above routine calls placed to ROEIs. The SUT diverts only when the ROEI is busy if it is idle it will offer the call and divert if not answered. Video calls between SUT H.323 PEIs (C90/EX90/SX20) and other UC video endpoints drop at approximately 30 minutes. The SUT fails to answer with correct payload number per RFC Instead, of responding to the V payload numbers in an SDP, offer the SUT always responds with payload number of 118 and 120 for State Signaling Events (SSE) and Simple Packet Relay Transport (SPRT) respectively which prevents successful secure call attempts. Operational Impact Remarks Minor See note 1. Minor See note 2. Minor See note 2. Per the vendor's LoC, the SUT does not support an AS-SIP ESC to EI signaling interface. Minor See note 2. Per the vendor s LoC, the SUT supports Primary Rate Interface requirement to be in compliance with ANSI T and T1.619a-1994 with following exception, NFAS is not supported. Minor See note 1. Per the vendor s LoC, the SUT does not support Public Key Infrastructure Requirement IA Minor See note 3. Per the vendor s LoC, the SUT does not support Confidentiality requirement IA Minor See note 3. The SUT 9951/9971 voice/video SIP ROEIs do not fully support inter-enclave hold feature while video enabled. Per the vendor s LoC, the SUT does not support a persistent TLS connection between AEIs and the enclave fronted SBC because the SUT does not support AEIs. Per the vendor s LoC, the SUT video conferencing system does not support all required audio codecs. The SUT does not support the G audio codec. Minor See note 4. Minor See note 2. Minor See note 1. Per the vendor s LoC, the SUT partially complies to the EDS gateway requirements per SCM Minor See note 5. When the SUT MCU 5320 places an outbound video call to other SUT C90 and SX20 video endpoints in either environment 1 or environment 2, the call drops at exactly 15 minutes. Minor See note 2. The SUT is not able to establish two-way video calls to the Vidyo UCCS or Polycom RMX/Group Series. Minor See note 2. Per the vendor s LoC, the SUT does not correctly respond to stream errors. Instead of responding with a stream error and closing the stream, the server terminates the connection non-gracefully. Per the vendor s LoC, the SUT does not generate a new Client-to-Server Stream. Server reuses the old stream ID instead of generating a new stream ID. Minor See note 2. Minor See note 2. Per the vendor s LoC, the SUT does not include empty element in its advertisement of the SASL. Minor See note 6. Per the vendor s LoC, the SUT does not fully comply with SASL failure requirements. The SUT does not comply with requirements IM , IM , and IM Per the vendor s LoC, the SUT does not fully meet deleting a roster item requirement. The SUT does not comply with requirements IM and IM Per the vendor s LoC, the SUT partially complies with rules for Server Processing of Outbound Subscription Requests. The SUT does not comply with requirement IM Server sends presence type unsubscribed with status Not Found. Per the vendor s LoC, the SUT partially complies with the rules for server processing of outbound subscription cancellation. The SUT partially complies with requirement IM Upon receiving the outbound subscription cancellation, the contact s server does not send a presence stanza of type unavailable from all of the contacts online resources to the user. Per the vendor s LoC, the SUT partially complies with the rules for server processing of inbound unsubscribe. The SUT partially complies with requirement IM Minor See note 2. Minor See note 2. Minor See note 2. Minor See note 1. Minor See note 1. Per the vendor s LoC, the SUT does not comply with server generation of inbound presence probe. Minor See note 2. The SUT Unified Presence Server establishes SASL external authentication with the incorrect domain name. The SUT does not comply to the requirements in XMPP Extension XEP-0045 (multi-user chat). The SUT does not host or participate in multi-user chat/chat rooms as required by the reference. Minor See note 2. Minor See note 2. The SUT Jabber Video Client when calling the Polycom Group series video EI has 1-way audio. Minor See note 7. The SUT does not support Local RTS Database (LRDB). Minor See note 1. The SUT does not support Master RTS Database (MRDB). Minor See note 1. 2

3 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 Table 1. Conditions (continued) NOTES: 1. DISA has adjudicated this discrepancy as minor and stated the intent to change this requirement in the next version of the UCR. 2. DISA has accepted the vendor s POA&M and has adjudicated this discrepancy as minor. 3. DISA has adjudicated this discrepancy as minor and stated the intent to remove this requirement from the UCR and apply it to a DoD STIG. 4. DISA has accepted the vendor s POA&M and has adjudicated this discrepancy as minor. In addition, the 9951/9971 voice/video SIP ROEI is not covered under this certification. 5. This discrepancy applies only to the SUT configured as an ESC. DISA has accepted the vendor s POA&M and has adjudicated this discrepancy as minor. 6. DISA has adjudicated this discrepancy as minor. 7. DISA has adjudicated this discrepancy as minor with the condition of fielding that Jabber client is certified for audio only as a soft phone and for XMPP IM&P as an XMPP client. LEGEND: AEI AS-SIP End Instrument PEI Proprietary End Instrument ANSI American National Standards Institute POA&M Plan of Action and Milestones ASAC Assured Services Admission Control RFC Request for Comments AS-SIP Assured Services Session Initiation Protocol ROEI ROUTINE Only End Instrument CUPS Cisco Unified Presence Server SASL Simple Authentication and Security Layer DISA Defense Information System Agency SBC Session Border Controller DN Directory Number SDP Session Description Protocol EDS Enterprise Directory Services SIP Session Initiation Protocol EI End Instrument SUT System Under Test ESC Enterprise Session Controller STIG Security Technical Implementation Guide ID identification TLS Transport Layer Security IM/P Instant Messaging/Presence UC Unified Capabilities LoC Letter of Compliance UCCS Unified Capabilities Conference Server MCU Multipoint Control Unit UCR Unified Capabilities NFAS Non Facility Associated Signaling XMPP Extensible Messaging and Presence Protocol 3. Interoperability Status. Table 2 provides the SUT interface interoperability status and Table 3 provides the Capability Requirements (CR) and Functional Requirements (FR) status. Table 4 provides the UC APL product summary. Interface Table 2. Interface Status Threshold CR/FR Requirements Status (See note.) Network Management Interfaces 10BaseT (R) 4, 6, 9, 13, 16, 20, 21, 23, 24 Certified 100BaseT (R) 4, 6, 9, 13, 16, 20, 21, 23, 24 Certified 1000BaseT (C) 4, 6, 9, 13, 16, 20, 21, 23, 24 Certified 10BaseT (R) 100BaseT (R) 1000BaseT (R) 2-wire analog (R) ISDN BRI (C) 1, 5, 6, 7, 8, 10, 11, 13, 14, 15, 17, 18, 19, 20, 21, 22, 23, 24, 25 1, 5, 6, 7, 8, 10, 11, 13, 14, 15, 17, 18, 19, 20, 21, 22, 23, 24, 25 1, 5, 6, 7, 8, 10, 11, 13, 14, 15, 17, 18, 19, 20, 21, 22, 23, 24, 25 1, 8, 15, 17, 19, 20, 21, 22, 23 1, 8, 15, 17, 19, 20, 21, 22, 23 Network Interfaces (Line and Trunk) Certified Certified Certified Certified Not Tested Remarks The SUT met the critical CRs and FRs for the IEEE 802.3i interface. The SUT met the critical CRs and FRs for the IEEE 802.3u interface. The SUT met the critical CRs and FRs for the IEEE 802.3ab interface. The SUT met the critical CRs and FRs for the IEEE 802.3i interface with the SUT PEIs and softphones. The SUT met the critical CRs and FRs for the IEEE 802.3u interface with the SUT PEIs and softphones. The SUT met the critical CRs and FRs for the IEEE 802.3ab interface with the SUT PEIs and softphones. The SUT met the critical CRs and FRs for the 2-wire analog interface with the SUT 2-wire secure and non-secure analog instruments. The SUT offers this interface; however, it was not tested because it does not support Assured Services and is not required for an ESC. 3

4 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 10BaseT (C) 100BaseT (C) Interface 1000BaseT (C) ISDN T1 PRI (ANSI T1.619a) (R) Table 2. Interface Status Threshold CR/FR Requirements Status (See note.) Legacy Interfaces (External) 2, 3, 5, 6, 7, 8, 11, 13, 18, 20, 21, 23, 24, 25 2, 3, 5, 6, 7, 8, 11, 13, 18, 20, 21, 23, 24, 25 2, 3, 5, 6, 7, 8, 11, 13, 18, 20, 21, 23, 24, 25 Certified Certified Certified 3, 9, 12, 14, 22, 20, 21, 23 Certified ISDN T1 PRI NI-2 (R) 3, 9, 12, 14, 22, 20, 21, 23 Certified Remarks The SUT met the critical CRs/FRs for IEEE 802.3i for the AS- SIP trunk. The SUT met the critical CRs/FRs for IEEE 802.3u for the AS- SIP trunk. The SUT met the critical CRs/FRs for IEEE 802.3ab for the AS-SIP trunk. The SUT met the critical CRs/FRs. This interface provides legacy DSN and TELEPORT connectivity. The SUT met the critical CRs/FRs. This interface provides PSTN connectivity. T1 CCS7 (ANSI T1.619a) (C) 3, 9, 12, 14, 20, 21, 22, 23 Not Tested The SUT does not support this conditional interface. T1 CAS (C) 3, 9, 12, 14, 20, 21, 22, 23 Certified The SUT met threshold CRs/FRs for DTMF. E1 PRI (ITU-T Q.955.3) (C) 3, 9, 12, 14, 20, 21, 22, 23 Certified The SUT met the critical CRs/FRs. This interface provides OCONUS MLPP connectivity in ETSI-compliant countries. E1 PRI (ITU-T Q.931) (C) 3, 9, 12, 14, 20, 21, 22, 23 Certified The SUT met the critical CRs/FRs. This interface provides OCONUS connectivity in ETSI-compliant countries. NOTE: The SUT high-level CR and FR ID numbers depicted in the Threshold CRs/FRs column can be cross-referenced in Table 3. These high-level CR/FR requirements refer to a detailed list of requirements provided in Enclosure 3. LEGEND: 10BaseT 10 Mbps Ethernet 100BaseT 100 Mbps Ethernet ISDN Integrated Services Digital Network 1000BaseT 1000 Mbps Ethernet ITU-T International Telecommunication Union - ANSI American National Standards Institute Telecommunication Standardization Sector AS-SIP Assured Services Session Initiation Protocol Mbps Megabits per second BRI Basic Rate Interface MLPP Multi-Level Precedence and Preemption C Conditional NI-2 National ISDN Standard 2 CAS Channel Associated Signaling OCONUS Outside the Continental United States CCS7 Common Channel Signaling Number 7 PEI Proprietary End Instrument CR Capability Requirement PRI Primary Rate Interface DSN Defense Switched Network PSTN Public Switched Telephone Network DTMF Dual Tone Multi-Frequency Q.931 Signaling Standard for ISDN E1 European Basic Multiplex Rate (2.048 Mbps) Q ISDN Signaling Standard for E1 MLPP ESC Enterprise Session Controller R Required ETSI European Telecommunications Standards Institute SS7 Signaling System 7 FR Functional Requirement T1 Digital Transmission Link Level 1 (1.544 Mbps) ID Identification T1.619a SS7 and ISDN MLPP Signaling Standard for T1 IEEE Institute of Electrical and Electronics Engineers CR/FR ID Table 3. SUT Capability Requirements and Functional Requirements Status UCR Requirement (High-Level) (See note 1.) UCR 2013 Reference Status 1 Voice Features and Capabilities (R) 2.2 Partially Met (See note 2.) 2 Assured Services Admission Control (R) 2.3 Met 3 Signaling Protocols (R) 2.4 Met 4 Registration and Authentication (R) 2.5 Met 5 SC and SS Failover and Recovery (R) 2.6 Met 6 Product Interface (R) 2.7 Met 7 Product Physical, Quality, and Environmental Factors (R) 2.8 Met 8 End Instruments (including tones and announcements) (R) 2.9 Partially Met (See note 2.) 9 Session Controller (R) 2.10 Met 10 AS-SIP Gateways (C) 2.11 Partially Met (See note 2.) 4

5 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 CR/FR ID Table 3. SUT Capability Requirements and Functional Requirements Status UCR Requirement (High-Level) (See note 1.) UCR 2013 Reference Status 11 Enterprise UC Services (R) 2.12 Partially Met (See notes 2 and 3.) 12 Call Connection Agent (R) 2.14 Met 13 CCA Interaction with Network Appliances and Functions (R) 2.15 Met 14 Media Gateway (R) 2.16 Met 15 Worldwide Numbering & Dialing Plan (R) 2.18 Met 16 Management of Network Devices (R) 2.19 Partially Met (See note 2.) 17 V Modem Relay Secure Phone Support (R) 2.20 Partially Met (See note 2.) 18 Requirements for Supporting AS-SIP Based Ethernet Devices for Voic Systems (C) 2.21 Not Tested 19 Local Attendant Console Features (O) 2.22 Not Tested 20 MSC and SSC (O) 2.23 Not Tested (See note 4.) 21 MSC, SSC, and Dynamic ASAC Requirements in Support of Bandwidthconstrained links (O) 2.24 Not Tested (See note 4.) 22 Other UC Voice (R) 2.25 Partially Met (See note 2.) 23 Information Assurance Requirements (R) 4 Partially Met (See notes 2 and 5.) 24 IPv6 Requirements (R) 5 Partially Met (See note 2.) 25 Assured-Services (AS) Session Initiation Protocol (SIP) (AS-SIP 2013) (R) AS-SIP Partially Met (See note 2.) NOTES: 1. The annotation of required refers to a high-level requirement category. The applicability of each sub-requirement is provided in Enclosure The SUT met the requirements with the exceptions noted in Table 1. DISA adjudicated these exceptions as minor. 3. These requirements apply specifically to an Enterprise Session Controller. 4. This optional requirement applies specifically to a Local Session Controller. 5. Security is tested by DISA-led Information Assurance test teams and the results published in a separate report, Reference (e). LEGEND: AS-SIP Assured Services Session Initiation Protocol O Optional C Conditional R Required CCA Call Connection Agent SC Session Controller CR Capability Requirement SS Softswitch DISA Defense Information System Agency SUT System Under Test FR Functional Requirement UC Unified Capabilities ID Identification UCR Unified Capabilities Requirements IPv6 Internet Protocol version 6 Table 4. UC APL Product Summary Product Identification Product Name Cisco Enterprise Session Controller (ESC) 8 Software Release 8 UC Product Type(s) Enterprise Session Controller (ESC) or Local Session Controller Product Description Enterprise Session Controller for Type 1, 2, and 3 Environments or as a Local Session Controller Product Components (See note 1.) Component Name (See notes 2 and 3.) Version Remarks Unified Communications Manager Cisco Unified Communications Manager 8.6 Session Management Edition Cisco Session Management Edition 8.6 Unified Communications Manager Cisco Unified Communications Manager 8.6 Cisco Unity Connection Cisco Unity Connection 8.6 Cisco Unified Presence Server Cisco Unified Presence Server 8.6 Cisco Webex Meeting Server Cisco Webex Meeting Server 2.0 Cisco Meeting Place Servers Cisco Meeting Place Servers 8.6 5

6 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 Table 4. UC APL Product Summary (continued) Product Components (See note 1.) Component Name (See notes 2 and 3.) Version Remarks E911 management system RedSky E911 Management System See note 4. Interworking Gateway IWG on 3925 ISR G2, IWG on 3925E ISR G2, IWG on 3945 ISR G2, IWG on 3945E ISR G2 IOS 15.2(4)M5 Session Border Controller SBC on 3925 ISR G2, SBC on 3925E ISR G2, SBC on 3945 ISR G2, SBC on 3945E ISR G2 IOS 15.2(4)M5 Session Border Controller SBC on ISR 4451-X Router IOS-XE 3.11 Session Border Controller SBC on ASR 1002, SBC on ASR 1002-X, SBC on ASR 1004, SBC on ASR 1006 IOS-XE 3.11 Voice Gateway 2901 ISR G2, 2911 ISR G2, 2921 ISR G2, 2951 ISR G2, 3925 ISR G2, 3925E ISR G2, 3945 ISR G2, 3945E ISR G2 IOS 15.2(4)M5 Analog Voice Gateway VG350 Analog Voice Gateway IOS 15.2(4)M5 Jabber Cisco Jabber for Windows 9.2 See note 5. IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone IP Phone Unified IP Phone 7906G IP Phone Unified IP Phone 7911G IP Phone Unified IP Phone 7931G IP Phone Unified IP Phone 7941G IP Phone Unified IP Phone 7941G-GE IP Phone Unified IP Phone 7942G IP Phone Unified IP Phone 7945G IP Phone Unified IP Phone 7961G IP Phone Unified IP Phone 7961G-GE IP Phone Unified IP Phone 7962G IP Phone Unified IP Phone 7965G IP Phone Unified IP Phone 7970G IP Phone Unified IP Phone 7971G IP Phone Unified IP Phone 7975G IP Phone Unified IP Phone Expansion Module 7915 Not Applicable IP Phone Unified IP Phone Expansion Module 7916 Not Applicable IP Conference Phone IP Conference Station IP Phone Unified IP Phone IP Phone Unified IP Phone See note 6. IP Phone Unified IP Phone See note 6. IP Phone Expansion Module Unified IP Color Key Expansion Module Not Applicable Secure Phone CIS Secure DTD-7965-TSGB Secure Phone CIS Secure DTD-7962-TSG Secure Phone CIS Secure DTD-7962-T Secure Phone Telecore AE Video Teleconference TelePresence Video Communication Server (VCS) X

7 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 Table 4. UC APL Product Summary (continued) Product Components (See note 1.) Component Name (See note 2.) Version Remarks Video Teleconference TelePresence QuickSet C20 TC7.1.1 Video Teleconference TelePresence Codec C40, TelePresence Codec C60, TelePresence Codec C90 TC7.1.1 Video Teleconference TelePresence EX60, TelePresence EX90 TC7.1.1 Video Teleconference TelePresence MX200, TelePresence MX300 TC7.1.1 Video Teleconference TelePresence SX20 QuickSet, TelePresence MX300 G2 TC7.1.1 Video Teleconference TelePresence 5300 MCU 4.4(1.68) Common Access Card/Single signon solution OpenAM Common Access Card support for WebEx Meeting Server Cisco ASA 8.4(3) NOTES: 1. The detailed component and subcomponent list is provided in Enclosure Components bolded and underlined were tested by JITC. The other components in the family series were not tested but are also certified for joint use. JITC certifies those additional components because they utilize the same software and similar hardware and JITC analysis determined them to be functionally identical for interoperability certification purposes. 3. A comprehensive list of supported hardware configurations can be found by selecting the "Cisco Unified Communications on the Cisco Unified Computing System" link at the following URL: 4. The SUT is certified with any RedSky E911 Management system or other E911 Management system listed on the UC APL and certified with the Cisco UCM. E911 management is not required for an LSC. 5. Jabber client is certified for audio only as a soft phone and for XMPP IM&P as an XMPP client. 6. The SUT 9951/9971 voice/video SIP ROEIs do not fully support inter-enclave hold feature while video enabled. DISA has accepted the vendor s POA&M and has adjudicated this discrepancy as minor. In addition, the 9951/9971 voice/video SIP ROEI is not covered under this certification. LEGEND: APL Approved Products List MCU Multipoint Conference Unit DISA Defense Information System Agency POA&M Plan of Action and Milestones G2 Generation 2 ROEI ROUTINE Only End Instrument IP Internet Protocol SBC Session Border Controller ISR Integrated Services Router SIP Session Initiation Protocol IWG Interworking Gateway UC Unified Capabilities JITC Joint Interoperability Test Command UCM Unified Communications Manager 4. Test Details. This certification is based on interoperability testing, DISA adjudication of open test discrepancy reports (TDRs), review of the vendor s Letters of Compliance (LoC), and DISA Certifying Authority (CA) Recommendation for inclusion on the UC APL. Testing was conducted under UCCO Tracking Number from 11 July through 5 August 2011 on the SUT as an LSC. Additional testing of the LSC under UCCO Tracking Number was conducted for Desktop Reviews and documented in extensions to the original certification. Testing was conducted from 7 April through 9 May 2014 on the Cisco UCM as an ESC. The data from the LSC test is included in this certification. The test procedures derived from the UCR Reference (c) using test procedures derived from Reference (d) were used to validate the deltas between a Local Session Controller (LSC) and an ESC. Review of the vendor s LoC was completed on 7 April DISA adjudication of outstanding TDRs was completed on 10 June Information Assurance testing was conducted by DISA-led Information Assurance test teams and the results are published in a separate report, Reference (e). Enclosure 2 documents the test results and describes the tested network and system configurations. Enclosure 3 provides a detailed list of the interface, capability, and functional requirements. 5. Additional Information. JITC distributes interoperability information via the JITC Electronic Report Distribution (ERD) system, which uses Sensitive but Unclassified IP Data (formerly known as NIPRNet) . Interoperability status information is available via the JITC System Tracking Program (STP). STP is accessible by.mil/.gov users at 7

8 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Enterprise Session Controller (ESC) 8 Test reports, lessons learned, and related testing documents and references are on the JITC Joint Interoperability Tool (JIT) at Due to the sensitivity of the information, the Information Assurance Accreditation Package (IAAP) that contains the approved configuration and deployment guide must be requested directly from the Unified Capabilities Certification Office (UCCO), disa.meade.ns.list.unifiedcapabilities-certification-office@mail.mil. All associated information is available on the DISA UCCO website located at 6. Point of Contact (POC). The JITC point of contact is Capt Jonathan Kim, commercial telephone (520) , DSN telephone , FAX DSN ; address jonathan.s.kim.mil@mail.mil; mailing address Joint Interoperability Test Command, ATTN: JTE (Capt Jonathan Kim) P.O. Box 12798, Fort Huachuca, AZ The UCCO tracking number for the SUT is FOR THE COMMANDER: 3 Enclosures a/s for RIC HARRISON Chief Networks/Communications and UC Portfolio Distribution (electronic mail): DoD CIO Joint Staff J-6, JCS USD(AT&L) ISG Secretariat, DISA, JTA U.S. Strategic Command, J665 US Navy, OPNAV N2/N6FP12 US Army, DA-OSA, CIO/G-6 ASA(ALT), SAIS-IOQ US Air Force, A3CNN/A6CNN US Marine Corps, MARCORSYSCOM, SIAT, A&CE Division US Coast Guard, CG-64 DISA/TEMC DIA, Office of the Acquisition Executive NSG Interoperability Assessment Team DOT&E, Netcentric Systems and Naval Warfare Medical Health Systems, JMIS IV&V HQUSAISEC, AMSEL-IE-IS UCCO 8

9 ADDITIONAL REFERENCES (c) Office of the Department of Defense Chief Information Officer, Department of Defense Unified Capabilities Requirements 2013, Errata 1, 1 July 2013 (d) Joint Interoperability Test Command, Enterprise Session Controller (ESC) Test Procedures for Unified Capabilities Requirements (UCR) 2013, Draft (e) Joint Interoperability Test Command, Information Assurance (IA) Findings Summary For Cisco ESC 8 (Tracking Number ), Draft Enclosure 1

10 CERTIFICATION SUMMARY 1. SYSTEM AND REQUIREMENTS IDENTIFICATION. The Cisco Enterprise Session Controller (ESC) 8 is hereinafter referred to as the System Under Test (SUT). Table 2-1 depicts the SUT identifying information and requirements source. Table 2-1. System and Requirements Identification System Identification Sponsor Headquarters United States Army Information Systems Engineering Command (HQUSAISEC) Sponsor Point of Contact Mr. Jordan R. Silk, USAISEC ELIE-ISE-ES, Building 53301, Fort Huachuca, Arizona 85613, jordan.r.silk.civ@mail.mil Vendor Point of Contact Cisco Systems Global Certification Team (GCT), Kit Creek Road, Research Triangle Park, North Carolina 27709, certteam@cisco.com System Name Cisco Enterprise Session Controller (ESC) 8 Increment and/or Version 8 Product Category Enterprise Session Controller (ESC) and Local Session Controller (LSC) System Background Tracking Previous certifications None. UCCO ID System Tracking Program ID 4931 Requirements Source Unified Capabilities Requirements Unified Capabilities Requirements 2013, Errata 1 Remarks Test Organization(s) LEGEND: Joint Interoperability Test Command, Fort Huachuca, Arizona ID Identification UCCO Unified Capabilities Connection Office 2. SYSTEM DESCRIPTION. The Enterprise UC Services Architecture consists of ESC Core Infrastructure products at a centralized Master Site location and Edge Infrastructure products at Department of Defense (DoD) Components Base/Post/Camp/Station (B/P/C/S) locations. The ESC Core Infrastructure is composed of centralized ESC components, an ESC-fronting SBC, Enterprise Hosted UC Services and Enterprise Required Ancillary Equipment (RAE). The Edge Infrastructure consists of End Instruments (EIs), Media Gateways (MGs), Enclave-fronting Session Border Controllers (SBCs), local survivable call processing appliances (for Environments 1 and 2) and local RAE. The geographic region that encompasses the centralized ESC location together with all of the served DoD Components B/P/C/S locations is referred to as the Enterprise Services Area (ESA). The ESC provides an integrated management framework that enables the centralized configuration, provisioning, administration, management, and monitoring of all Centralized Enterprise Services Infrastructure components and all Edge Infrastructure components within the ESA. Reliable and redundant systems at all levels of the Enterprise Unified Capabilities (UC) Services architecture ensure the high availability needed to meet the requirements of the warfighter and operational user. The ESC provides centralized, integrated voice, video and data session management on behalf of served Internet Protocol (IP) EIs that are located at different enclaves (i.e., B/P/C/S locations) within the served geographic region. A full suite of Enterprise Hosted UC Services are collocated with the ESC. The Hosted UC Services include the following: Enclosure 2

11 Centralized voice and video session management. Centralized voice and video conferencing. Unified messaging. Integrated E911 Call Management. Extensible Messaging and Presence Protocol (XMPP) Instant Messaging (IM)/Chat/Presence federation. Service portability. Integrated Enterprise Directory Services. The Session Controller (SC) is a software-based call processing product that provides voice and video services to Internet Protocol (IP) telephones and media processing devices within a service domain. An SC extends signaling and session (call) control services to allow sessions to be established with users outside a given service domain via an IP-based long-haul network or via gateways to non-ip networks. The SC software and functions may be distributed physically among several high-availability server platforms with redundant call management modules and subscriber tables to provide robustness. Different types of SCs can be deployed, depending upon the service environment. These types are Local, Enterprise, and Master and Subtended. Local SCs (LSCs) are physically located at the Base/Post/Camp/Station (B/P/C/S) where the EIs they serve are located. The SUT is certified as an ESC in the Type 1, Type 2, and Type 3 environments. The SUT is also certified as an LSC. The SUT is composed of the following components: Cisco Unified Communications Manager (UCM), Cisco UCM Session Management Edition (SME), SM-SRE- 910-K9 Server, Cisco Unity Connection (CUXN), Cisco Unified Presence Server (CUPS), Cisco Jabber, Cisco Webex Meeting Server (CWMS), Cisco MeetingPlace Server (CMPS), E911, Interworking Gateway (IWG) on 3945 Integrated Services Router (ISR) Generation 2 (G2), IWG on 4451-X Router, Interworking Gateway (IWG) on ASR 1002 Router, Session Border Controller (SBC) on 3945 ISR G2, SBC on ISR 4451-X Router, SBC on ASR 1002 Router, SBC General, Voice Gateways, telephones, Video Teleconference (VTC) devices, OpenAM, and the Cisco Adaptive Security Appliance (ASA). Cisco UCM. The UCM provides VoIP call processing, call admission control, messaging, identification, authentication, and security services to users. The publisher and subscribers are installed as virtual machines within the SUT. Cisco SME. The SME provides for a simplified Enterprise Management approach for routing calls among multiple UCM clusters. SME allows a hierarchical approach for deploying multiple clusters in the ESC and interconnecting them back into a centralized call routing/call control solution. SM-SRE-910-K9 Server. The SM-SRE-910-K9 is a branch-office infrastructure platform that combines computing, networking, storage access, virtualization, and unified management into a cohesive system that is part of the UCM Cluster. Configured in the SUT as subscriber nodes, these boxes offer scalability, load balancing, and redundancy in case the primary UCM Manager fails. Supports up to 300 users and 400 phones. 2-2

12 CUXN. The CUXN provides voic and Unified Messaging. Users can access CUXN with multiple methods including a phone interface, web interface, and visual voic (Jabber Applications). The CUXN supports full Unified Messaging for voic to delivery by integrating with Microsoft Exchange through Exchange Web Services (EWS). CUPS. CUPS provides IM and Presence using native XMPP clients, capable of integrating with a SIP Simple environment for interoperability. CUPS support a distributed cluster model. Multiple nodes of CUPS provide intra-domain federation and scale seamlessly through full XMPP inter-domain federation. Cisco Jabber for Windows. Provides the main workspace application for the ESC. It enhances productivity by unifying presence, instant messaging, video, voice, voice messaging, desktop sharing, and conferencing capabilities securely into one client on your desktop. Cisco Jabber for Windows delivers secure, clear, and reliable communications. It offers flexible deployment models, is built on open standards, and integrates with commonly used desktop applications. The Jabber client is certified for audio only as a soft phone and for XMPP IM&P as an XMPP client. CWMS. The CWMS provides a secure, fully virtualized, behind-the-firewall conferencing solution that combines audio, video, and web conferencing in a single solution. CMPS. The CMPS provides on-premise voice conferencing for pre-set and ad-hoc audio conferencing. E911. E911 management system requirements are met via the RedSky E911 Management System. The SUT is certified with any RedSky E911 Management System or any other E911 Management system listed on the Approved Products List (APL) and certified with the SUT. E911 Management is not required for an LSC. IWG on 3945 ISR G2. The IWG deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the Unified Capabilities architecture. The Cisco IWG is an integrated Cisco Internetworking Operating System (IOS) Software application that runs on the Cisco 3945 Series Integrated Services Routers. The IWG can be deployed in pairs to provide high availability by using Hot Standby Routing Protocol (HSRP). IWG on 4451-X Router. The IWG deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the UC architecture. The Cisco IWG is an integrated Cisco IOS Software application that runs on the Cisco 4451-X Series Routers. The IWG can be deployed in pairs to provide high availability by using HSRP. IWG on ASR 1002 Router. The IWG deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the UC architecture. The Cisco IWG is an integrated Cisco IOS Software application that runs 2-3

13 on the Cisco ASR 1002 Series Routers. The IWG can be deployed in pairs to provide high availability by using HSRP. SBC on 3945 ISR G2. The SBC deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the UC architecture. The Cisco SBC is an integrated Cisco IOS Software application that runs on the Cisco 3945 Series ISRs. The Cisco SBC can be deployed in pairs to provide high availability by using HSRP. SBC on ISR 4451-X Router. The SBC deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the UC architecture. The Cisco SBC is an integrated Cisco IOS XE Software application that runs on the Cisco ISR 4451 Routers. Cisco SBC can be deployed in pairs to provide high availability by using HSRP. SBC on ASR 1002 Router. The SBC deployment as part of the ESC provides critical SIP message normalization functionality that allows for interoperability between components within the UC architecture. The Cisco SBC is an integrated Cisco IOS XE Software application that runs on the Cisco ASR 1002 Routers. The Cisco SBC can be deployed in pairs to provide high availability by using HSRP. SBC General. The Cisco Unified Border Element (CUBE) can be deployed to provide both IWG functions and SBC functions in a single chassis when deployed with the Cisco ESC. This capability is available in IOS and IOS XE software on all IWG and SBC platforms. All Cisco SBCs and IWGs can be deployed in pairs to provide high availability by using HSRP. Voice Gateways 2901, 2911, 2921, 2951, 3925, 3925E, 3945, 3945E ISR G2. These voice gateways provide connectivity to traditional TDM components to the VoIP network. They host both analog interfaces and Digital Transmission Link Level 1 (T1)/European Basic Multiplex Rate (E1) trunk circuits. The following is a list of sub-components and description for each voice gateway: SM-NM-ADPTR Service Module (SM) to Network Module (NM) Adapter NM-HD-1V 1-Slot IP Communications Voice/FAX Network Module NM-HD-2V 2-Slot IP Communications Voice/FAX Network Module NM-HDV2 (NM for High Density Digital Voice [HDV] Second Generation) IP Communications High-Density Digital Voice or Fax Network Module, with no onboard T1/E1 controllers and one Voice Interface Card (VIC)/ Voice/WAN Interface Card (VWIC) slot. NM-HD-2VE 2-Slot IP Communications Enhanced Voice/FAX Network Module NM-HDV2-1T1/E1 IP Communications High-Density Digital Voice NM with 1 T1/E1 NM-HDV2-2T1/E1 IP Communications High-Density Digital Voice NM with 2 T1/E1 VIC3-2FXS/DID VIC, 2-port Foreign Exchange Station (FXS). Connects to a telephone or fax using Registered Jack (RJ)11, or to a Private Branch Exchange (PBX) or key set that emulates a telephone. VIC3-2FXS-E/DID VIC, 2-port enhanced FXS. Connects to a telephone or fax using RJ11, or to a PBX or key set that emulates a telephone. 2-4

14 VIC3-4FXS/DID The high-density Cisco 4-Port FXS/DID VIC can support up to four FXS ports for directly connecting phones or fax machines, or it can be used to connect up to four DID analog trunks. VWIC2-1MFT-T1/E1 Second Generation Voice/WAN Interface Card 1-port RJ-48, Multiflex Trunk T1/E1. VWIC2-2MFT-T1/E1 Second Generation Voice/WAN Interface Card 2-port RJ-48, Multiflex Trunk T1/E1. VWIC3-1MFT-T1/E1 Third Generation Voice/WAN Interface Card 1-port RJ-48, Multiflex Trunk T1/E1. VWIC3-2MFT-T1/E1 Third Generation Voice/WAN Interface Card 2-port RJ-48, Multiflex Trunk T1/E1. VWIC3-4MFT-T1/E1 Third Generation Voice/WAN Interface Card 4-port RJ-48, Multiflex Trunk T1/E1. EVM-HD-8FXS/DID - The 8-port FXS/DID extension module supports eight FXS or direct inward dialing (DID) ports. EM3-HDA-8FXS 8-port voice/fax expansion module FXS PVDM3-16, PVDM3-32, PVDM3-64, PVDM3-128, PVDM3-192, PVDM3-256 Voice/Fax DSP Modules VG350 Analog Voice Gateway. The VG350 is a voice gateway that services only analog end points such as phones and fax. It uses an RJ-21 cable with Amphenol 50-pin connector to attach to a breakout panel for up to 160 individual RJ-11 connections to end points. An optional T1 VWIC3 can be installed to provide a T1 synchronized timing source, which allows analog DSCD devices to be used with the VG350. IP Phone 6900 Series. The 6901, 6911, 6921, 6941, 6945, and 6961 IP phones are programmed from the UCM Cluster, and the features are selected for the individual user from the UCM Application. IP Phone 7800 Series. The 7821, 7841 and 7861 IP phones are programmed from the UCM Cluster, and the features are selected for the individual user from the UCM Application. IP Phone 7900 Series. The 7906G, 7911G, 7931G, 7941G, 7941G-GE, 7942G, 7945G, 7961G, 7961G-GE, 7962G, 7965 and 7970G, 7971G, 7975G IP phones are programmed from the UCM Cluster, and the features are selected for the individual user from the UCM Application. Unified IP Phone Expansion Module 7915, IP Phone line expansion module for the 7900 series phones, with a maximum of two per phone. IP Phone The 8831 conference phone is programmed from the UCM Cluster as a ROUTINE Only End Instrument (ROEI), and the features are selected for the individual user from the UCM Application. Unified IP Phone The Unified IP Phone 8961 is programmed from the UCM Cluster as a ROEI, and the features are selected for the individual user from the UCM Application. 2-5

15 Unified IP Phone 9900 Series. The 9951 and 9971 IP phones are programmed from the UCM Cluster as a ROEI, and the features are selected for the individual user from the UCM Application. The 9951/9971 voice/video SIP ROEI are not covered under this certification Unified IP Color Key Expansion Module. IP Phone Expansion Module for the Unified IP Phone 9900 Series and Unified IP Phone 8961, with a maximum of two per phone. CIS Secure DTD-7965-TSGB is a CNSS (TSG6) Approved Cisco 7965G Unified IP Phone. Approved for use in SCIF and SAPF environments, the DTD-7965-TSGB also allows the onhook security features to be engaged while in a call providing enhanced Hold and Mute security. CIS Secure DTD-7962-TSG-01 is a CNSS (TSG6) Approved Cisco 7962G Unified IP Phone. Approved for use in SCIF and SAPF environments, the DTD-7965-TSGB also allows the onhook security features to be engaged while in a call providing enhanced Hold and Mute security. CIS Secure DTD-7962-T2 is a TEMPEST Certified and CNSS (TSG6) Approved Cisco 7962G Unified IP Phone. It is a full-featured, IPv6, SCCP and SIP capable IP phone. It also includes CNSS approved TSG6 security features for Positive Disconnect On-Hook Security. Telecore 2151 is a TEMPEST certified, NTSWG qualified IP Phone with dual 1000MB SFP fiber and 10/100/1000MB STP Network connections, as well as 10/100/1000MB STP PC connections for shared access. The phone is capable of voice and voice communications across two IP networks from a single handset. TelePresence Video Communication Server (VCS). The VCS provides advanced telepresence applications and session management to all standards-compliant telepresence end instruments, infrastructure, and management solutions. VCS provides H.323 gatekeeper services, enabling interoperability between H.323 telepresence devices, and allows H.323-capable devices to have their calls interworked across an AS-SIP trunk. VCS is a critical part of Cisco's unified callcontrol solution and is also critical for interoperability with third-party unified communications and IP telephony networks and voice-over-ip (VoIP) solutions. VCS can be deployed as an appliance or a virtual machine. TelePresence QuickSet C20. This proprietary ROUTINE only Video End Instrument provides assured service, high definition voice and video calling capabilities up to 1080p. It supports the G.711, G.722, G.722.1, and 64-bit MPEG4 AAC-LD audio codecs as well as the H.261, H.263, H.263+, H.263++, and H.264 video codecs. TelePresence Codec C40, C60, C90. These proprietary ROUTINE only Video End Instruments provide assured service, high definition voice and video calling capabilities up to 1080p. They support the G.711, G.722, G.722.1, and 64- and 128-bit MPEG4 AAC-LD audio codecs as well as the H.261, H.263, H.263+, H.263++, and H.264 video codecs. TelePresence EX60, EX90. These proprietary Video End Instruments provide assured service, high definition voice and video calling capabilities up to 1080p. They support the G.711, G.722, 2-6

16 G.722.1, and 64- and 128-bit MPEG4 AAC-LD audio codecs as well as the H.261, H.263, H.263+, H.263++, and H.264 video codecs. TelePresence MX200, MX300. These proprietary ROUTINE only Video End Instruments provide assured service, high definition voice and video calling capabilities up to 1080p. They support the G.711, G.722, G.722.1, and 64- and 128-bit MPEG4 AAC-LD audio codecs as well as the H.261, H.263, H.263+, H.263++, and H.264 video codecs. TelePresence SX20 QuickSet, MX300 G2. This proprietary ROUTINE only Video End Instrument provides assured service, high definition voice and video calling capabilities up to 1080p. It supports the G.711, G.722, G.722.1, and 64-bit MPEG4 AAC-LD audio codecs as well as the H.263, H.263+, H.263++, and H.264 video codecs. TelePresence 5300 MCU. The Cisco TelePresence MCU 5310 and 5320 are clusterable, entrylevel MCUs that can scale as video usage accelerates. They utilize Universal Port technology to customize media streams, ensuring that standard and high definition endpoints receive the best possible experience. OpenAM. OpenAM provides core identity services to simplify the implementation of transparent single sign-on (SSO) as a security component in a network infrastructure. OpenAM provides the foundation for integrating diverse web applications that might typically operate against a disparate set of identity repositories and are hosted on a variety of platforms such as web and application servers. ASA. The ASA component is included in the solution to provide Common Access Card (CAC) support for the Cisco WebEx Meeting Server. 3. OPERATIONAL ARCHITECTURE. The UC architecture is a two-level network hierarchy consisting of Defense Information Systems Network (DISN) backbone switches and Service/Agency installation switches. The Department of Defense (DoD) Chief Information Officer (CIO) and Joint Staff policy and subscriber mission requirements determine which type of switch can be used at a particular location. The UC architecture, therefore, consists of several categories of switches. Figure 2-1 depicts the notional operational UC architecture in which the SUT may be used, Figure 2-2 depicts the ESC functional model, and Figure 2-3 depicts the LSC functional model. 4. TEST CONFIGURATION. The test team tested the SUT at JITC, Fort Huachuca, Arizona in a manner and configuration similar to that of a notional operational environment. Testing of the system s required functions and features was conducted using the test configurations depicted in Figures 2-4 and 2-5. Figure 2-4 depicts the SUT in the ESC test configuration. Figure 2-5 depicts the SUT in the LSC test configuration. Information Assurance testing used the same configuration. 5. METHODOLOGY. Testing was conducted using ESC requirements derived from the Unified Capabilities Requirements (UCR) 2013, Errata 1, Reference (c), and Session Controller test procedures, Reference (d). Any discrepancies noted were documented in Test Discrepancy 2-7

17 Reports (TDRs). The vendor submitted Plan of Action and Milestones (POA&M) as required. The TDRs were adjudicated by DISA as minor. Any new discrepancy noted in the operational environment will be evaluated for impact on the existing certification. These discrepancies will be adjudicated to the satisfaction of DISA via a vendor POA&M, which will address all new critical TDRs within 120 days of identification. LEGEND: DCO Defense Connection Online DISA Defense Information Systems Agency DISN Defense Information Systems Network DoD Department of Defense EI End Instrument IAP Internet Access Point IM Instant Messaging IP Internet Protocol ISP Internet Service Provider LAN Local Area Network MCEP Multi Carrier Entry Point NETOPS PKI PSTN QoS SBC SC SS STEP UC VVoIP XMPP Network Operations Public Key Infrastructure Public Switched Telephone Network Quality of Service Session Border Controller Session Controller Softswitch Standardized Tactical Entry Point Unified Capabilities Voice and Video over IP Extensible Messaging and Presence Protocol Figure 2-1. Notional UC Network Architecture 2-8

18 LEGEND: AR Aggregation Router B/P/C/S Base/Post/Camp/Station CE-R Customer Edge Router DISN Defense Information Systems Network DoD Department of Defense DSN Defense Switched Network EO End Office F1SC F2SC IAP IP ISP PSTN SBC Failover Type 1 Session Controller Failover Type 2 Session Controller Internet Access Point Internet Protocol Internet Service Provider Public Switched Telephone Network Session Border Controller Figure 2-2. Enterprise Unified Capabilities Services Architecture 2-9

19 LEGEND: AEI AS-SIP End Instrument ASAC Assured Services Admission Control ASLAN Assured Services Local Area Network AS-SIP Assured Services Session Initiation Protocol B2BUA Back-to-Back User Agent CAS Channel Associated Signaling CCA Call Connection Agent CCS7 Common Channel Signaling 7 DoD Department of Defense EO End Office ISDN Integrated Services Digital Network IWF Interworking Function LSC Local Session Controller MFSS Multifunction Softswitch MG Media Gateway MGC PBX PEI PRI PSTN SBC SC SG SIP SMEO SS TDM UC WAN Media Gateway Controller Private Branch Exchange Proprietary End Instrument Primary Rate Interface Public Switched Telephone Network Session Border Controller Session Controller Signaling Gateway Session Initiation Protocol Small End Office Softswitch Time Division Multiplexing Unified Capabilities Wide Area Network Figure 2-3. LSC Functional Reference Model 2-10

20 NOTES: 1. The ASLAN is not part of the SUT. 2. The following IP phones were previously tested for shared access and are certified for shared access under this certification: 7821, 7841, 7861, 7941G, 7941G-GE, 7961G, 7942G, 7962G, 7945G, 7965G, 7970G, 7971G, 7975G, 7915, 7916, 7911G, 6911, 6921, 6941, 6945, 6961, and 7931, and Telecore The following IP phones do not support shared access: 6901, 7906G. The following IP phones were not tested for shared access and are not certified for shared access under this certification: 8831, 8691, and 89/9900 KEM. LEGEND: ASA Adaptive Security Appliance LSC Local Session Controller ASLAN Assured Services Local Area Network MCU Multipoint Control Unit CAS Channel Associated Signaling PRI Primary Rate Interface CUPS Cisco Unified Presence Server PSTN Public Switched Telephone Network DMZ Demilitarized Zone RAE Required Ancillary Equipment DSN Defense Switched Network RADIUS Remote Authentication Dial-In User Service E1 European Basic Multiplex Rate SBC Session Border Controller EI End Instrument SME Session Management Edition ESC Enterprise Session Controller SRE Service Ready Engine G2 Generation 2 SUT System Under Test IP Internet Protocol T1 Digital Transmission Link Level 1 ISR Integrated Services Router UCM Unified Communications Manager IWG Interworking Gateway VCS Video Communications Server KEM Key Expansion Module WAN Wide Area Network Figure 2-4. SUT ESC Test Configuration 2-11

21 Figure 2-5. SUT LSC Test Configuration 2-12