Scopia TIP Gateway. Deployment Guide. Version 8.2. For Solution

Transcription

1 Scopia TIP Gateway Deployment Guide Version 8.2 For Solution

2 RADVISION Ltd. All intellectual property rights in this publication are owned by RADVISION Ltd and are protected by United States copyright laws, other applicable copyright laws and international treaty provisions. RADVISION Ltd retains all rights not expressly granted. All product and company names herein may be trademarks of their registered owners. This publication is RADVISION confidential. No part of this publication may be reproduced in any form whatsoever or used to make any derivative work without prior written approval by RADVISION Ltd. No representation of warranties for fitness for any purpose other than what is specifically mentioned in this guide is made either by RADVISION Ltd or its agents. RADVISION Ltd reserves the right to revise this publication and make changes without obligation to notify any person of such revisions or changes. RADVISION Ltd may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time. If there is any software on removable media described in this publication, it is furnished under a license agreement included with the product as a separate document. If you are unable to locate a copy, please contact RADVISION Ltd and a copy will be provided to you. Unless otherwise indicated, RADVISION registered trademarks are registered in the United States and other territories. All registered trademarks recognized. For further information contact RADVISION or your local distributor or reseller. Deployment Guide for Scopia TIP Gateway Version 8.2, July 10, Deployment Guide for Scopia TIP Gateway Version 8.2 Notices 2

3 Table of Contents Chapter 1: About Scopia TIP Gateway Technical Specifications... 7 Chapter 2: Planning your TIP Gateway Deployment Planning your Topology for the TIP Gateway...9 Creating Dial Plans for Cisco Telepresence...10 Ports to Open on the Scopia TIP Gateway Chapter 3: Preparing the Scopia TIP Gateway Setup Checking Site Suitability Unpacking the Device...13 Inspecting for Damage...14 Verifying Rack Suitability...15 Choosing the Type of Rack Making Space for the Scopia TIP Gateway...15 Chapter 4: Setting up the Scopia TIP Gateway Mounting the Scopia TIP Gateway onto the Rack Using a Shelf...18 Locating a Shelf in the Rack...18 Checking the Accessories Required for Mounting Attaching Brackets to the Scopia TIP Gateway...20 Marking the Location of the Device-fixing Cage Nuts Removing the Cage Nut Screws Mounting the Device-fixing Cage Nuts Mounting the Scopia TIP Gateway onto the Shelf...23 Connecting Cables to the Device Configuring the Device IP Addresses...25 Verifying the Scopia TIP Gateway Installation Deployment Guide for Scopia TIP Gateway Version 8.2 Table of Contents 3

4 Chapter 5: Configuring your Scopia Solution for Interoperability with Cisco Telepresence Verifying the CUCM Settings for Scopia Management Configuring Ports on the Scopia TIP Gateway...31 Limiting TCP Port Range for H.245 on the Scopia TIP Gateway...32 Configuring RTP/RTCP/SRTP Ports on the Scopia TIP Gateway...33 Configuring UDP Port for RAS on the Scopia TIP Gateway Configuring TCP Port for Q.931 on the Scopia TIP Gateway Configuring the Scopia TIP Gateway in Scopia Management Adding a gateway in Scopia Management Configuring the Scopia TIP Gateway in Scopia Management Configuring Cisco Telepresence in Scopia Management Adding the CUCM to Scopia Management...41 Adding the CTMS to Scopia Management Retrieving the CTMS Prefix for Scopia Management...44 Retrieving CTMS Routing Information for Scopia Management Adding Cisco Telepresence Systems (CTS) in Scopia Management...46 Configuring Scopia Elite MCU for Cisco Telepresence...48 Enabling H.264 Presentation in Scopia Elite MCU Defining Allowed Bandwidth in the MCU...49 Selecting the MCU Presentation Resolution Chapter 6: Securing Your Video Network Using TLS Planning the Required Certificates for TLS...52 Generating the Certificate Signing Request for Scopia Management Uploading Scopia Management Certificates into Scopia Management...60 Generating the Certificate Signing Request for the Scopia TIP Gateway Uploading Certificates for the TIP Gateway Uploading Certificates for Other Devices Enabling Encryption with Scopia TIP Gateway Enabling the TLS Connection in Scopia Management...72 Chapter 7: Performing Maintenance Procedures Upgrading the Software File of a Video Device Restoring the Previous Software Version of a Network Device Deployment Guide for Scopia TIP Gateway Version 8.2 Table of Contents 4

5 Downgrading your Scopia TIP Gateway Changing the IP Address of your Gateway Deployment Guide for Scopia TIP Gateway Version 8.2 Table of Contents 5

6 Chapter 1 About Scopia TIP Gateway The Scopia TIP Gateway allows organizations to connect Cisco telepresence rooms directly to a Scopia Elite MCU conference and view all three screens of the Cisco telepresence system. The TIP Gateway is used for making video calls from the Scopia Elite MCU to Cisco Telepresence rooms and vice versa. Without the TIP Gateway you see only the active speaker on the endpoint screen. With the TIP Gateway you see all the participants on the screens, giving the full telepresence experience. With a Scopia TIP Gateway deployed into your existing Scopia Solution, Cisco telepresence rooms become an integral part of your deployment. Figure 1: TIP Gateway functionality on page 6 illustrates this functionality, whether the TIP Gateway is located in an enterprise or hosted in a service provider s network. The main features of the TIP Gateway include: TIP protocol support Figure 1: TIP Gateway functionality Cisco telepresence rooms can connect to a Scopia Elite MCU conference and enjoy a comprehensive experience including audio, video and content sharing. Scopia Elite MCU provides video layouts that were designed specifically for telepresence rooms to maintain the telepresence experience in the best possible way. Scheduling Cisco Telepresence rooms can be included in a scheduled Scopia Management meeting like any other endpoint. Scalability The TIP Gateway is designed to grow with deployment requirements from a small workgroup to an entire enterprise. Unlimited scalability is achieved by simply stacking multiple gateways. For more information on the TIP Gateway, see Planning your Topology for the TIP Gateway on page 9. Deployment Guide for Scopia TIP Gateway Version 8.2 About Scopia TIP Gateway 6

7 Technical Specifications This section lists important information about the device you purchased. Refer to this information when preparing system setup and afterwards to verify that the environment still complies with these requirements. System power requirements: V AC input, 50/60Hz auto-switched Power consumption: 350W with 3A of standby current, which meets the SSI EPS 12V specification Environmental requirements: Operating temperature: 10 C to 30 C (50 F to 86 F) Humidity: 90% non-condensing at 35 Storage and transit temperature: -40 C to 70 C (-40 F to 158 F), ambient Physical dimensions: Size: 430mm (16.9 ) width x 43mm (1.7 ) height x 508mm (20 ) depth Weight: 15kg (33lbs) maximum 19-inch rack-mountable with flanges Interfaces 2 x RJ-45 gigabit Ethernet (rear) 1x DB9 serial port (rear) 4 x USB 2.0 ports (rear) Ethernet connection requirement: 1Gbps Communications: H.323 and TIP IPv4 Bit rate: up to 2.25Mbps per segment. See also "Call capacity" in this topic. Supported audio codecs: AAC-LD, G.722, G.722.1, G.711 A-Law/µ-Law DTMF Translation: In-band to out-of-band translation Video support: Video codec: H.264 Video resolution: 720p at 30fps Content Sharing H.264, XGA at 5fps Call capacity: Deployment Guide for Scopia TIP Gateway Version 8.2 About Scopia TIP Gateway 7

8 The TIP Gateway supports up to 36 segments (or ports): Each CTS-500/CTS-1000 (Cisco Telepresence System) has one segment. Each CTS-3000 has three segments. Scalability Unlimited scalability with multiple TIP Gateways Security TLS support H.235 AES encryption No media encryption on the Cisco side of the call Deployment Guide for Scopia TIP Gateway Version 8.2 About Scopia TIP Gateway 8

9 Chapter 2 Planning your TIP Gateway Deployment Perform the procedures in this section to prepare the site and device for installation. Navigation Planning your Topology for the TIP Gateway on page 9 Creating Dial Plans for Cisco Telepresence on page 10 Ports to Open on the Scopia TIP Gateway on page 11 Planning your Topology for the TIP Gateway Deploying the Scopia TIP Gateway requires configuring the unit itself as well as several other components. Depending on the deployment, the setup is composed of these mandatory components: TIP Gateway Scopia Management Scopia Elite MCU for housing telepresence meetings with multiple endpoints, both H.323 and SIP. H.323/SIP endpoints CUCM (Cisco Unified Communications Manager). This is the central communication server for all Cisco related products. Cisco Telepresence Systems. These include single-presence CTS-500/1000 Series and triplepresence CTS-3000 Series. Other optional components typically include: CTMS (Cisco Telepresence Multipoint Switch), which is the Cisco MCU CTS-Manager, Cisco's application for scheduling meetings. Figure 2: Deploying the TIP Gateway in the enterprise on page 10 describes a typical deployment of the TIP Gateway. Deployment Guide for Scopia TIP Gateway Version 8.2 Planning your TIP Gateway Deployment 9

10 Figure 2: Deploying the TIP Gateway in the enterprise Creating Dial Plans for Cisco Telepresence All telepresence calls are made through the Scopia Elite MCU. Users of telepresence deployments do not need to choose a specific MCU. The powerful functionality of virtual rooms enables you to dial the same number anywhere in the world while the Scopia Solution infrastructure transparently directs you to the correct telepresence conference. For information on the devices that are part of the telepresence deployment, see Planning your Topology for the TIP Gateway on page 9. Important: Cisco routing patterns are configured only by the personnel that installed the Cisco services or by the customer's network administrator. Cisco Telepresence Systems can dial into a telepresence conference as follows: By dialing directly into to the Scopia Elite MCU via Scopia Management. For example, a routing pattern might define the dial prefix 5 to route the call to the Scopia Management. Dialing the number would send the number 1234 to the Scopia Management. By dialing through the CTMS in organizations that use this Cisco MCU in their deployment. Standard endpoints can dial into a telepresence conference as follows: By dialing directly to the Cisco Telepresence Systems. For example, to call the CTS, you would dial '3003' which is the phone number the Cisco network administrator has allocated to the device. By dialing through the CTMS. Deployment Guide for Scopia TIP Gateway Version 8.2 Planning your TIP Gateway Deployment 10

11 For example, an endpoint would dial , where the dial prefix '227' routes the call to the Cisco telepresence and '5678' is the relevant service on the CTMS as allocated by the Cisco network administrator. Ports to Open on the Scopia TIP Gateway The Scopia TIP Gateway is typically deployed in the enterprise network. When opening ports on the device, use the following as a reference: If you are opening ports that are both in and out of the gateway, see Table 1: Bidirectional Ports to Open on the Scopia TIP Gateway on page 11. If you are opening ports inbound to the gateway, see Table 2: Inbound Ports to Open to the Scopia TIP Gateway on page 12. Important: Choosing the specific firewalls where ports need to be opened depends on where your gateway and your other Scopia Solution products are deployed. Table 1: Bidirectional Ports to Open on the Scopia TIP Gateway Port Range Protocol Destination Functionality H.245 (TCP) Any H.323 device Enables H.245 signaling Result of Blocking Port Cannot connect H.323 calls Mandatory Required To limit range, see Limiting TCP Port Range for H.245 on the Scopia TIP Gateway on page RAS (UDP) H.323 gatekeeper Enables RAS signaling 1720 Q.931 (TCP) Any H.323 device Enables Q.931 signaling Cannot communicate with H.323 gatekeeper Cannot connect H.323 calls Mandatory To configure, see Configuring UDP Port for RAS on the Scopia TIP Gateway on page 34 Mandatory To configure, see Configuring TCP Port for Q.931 on the Scopia TIP Gateway on page XML (TCP) Scopia Management Enables you to manage this gateway via the XML API Cannot use the XML API to manage the gateway Mandatory Deployment Guide for Scopia TIP Gateway Version 8.2 Planning your TIP Gateway Deployment 11

12 Port Range Protocol Destination Functionality 3338 XML (TCP) Scopia Management, or any third-party configuration applications 5060 SIP (TCP/ UDP) Any SIP device Enables you to configure the gateway via the XML API Enables SIP signaling 5061 SIP (TLS) Any SIP device Enables secure SIP signaling RTP/ RTCP / SRTP(UDP) UDP for any H.323 or SIP media connection Video: Enables realtime delivery of video media Result of Blocking Port Cannot use the XML API to configure the gateway Cannot connect SIP calls Cannot connect SIP calls via TLS Cannot transmit/ receive video media streams Mandatory Mandatory Required Mandatory if using TLS Mandatory To configure, see Configuring RTP/ RTCP/SRTP Ports on the Scopia TIP Gateway on page RTP/ RTCP / SRTP (UDP) UDP for any H.323 or SIP media connection Audio: Enables realtime delivery of audio media Cannot transmit/ receive audio media streams Mandatory To configure, see Configuring RTP/ RTCP/SRTP Ports on the Scopia TIP Gateway on page 33 Table 2: Inbound Ports to Open to the Scopia TIP Gateway Port Range Protocol Destination Functionality 21 FTP (TCP) FTP Server Enables audio stream recording 22 SSH (TCP) SSH Client Enables you to view logs for the gateway in realtime 80 HTTP (TCP) Web client Enables you to upgrade the gateway and download customer support information Result of Blocking Port Cannot record audio streams Cannot view logs in real- time (logs are collected on local storage device) Cannot upgrade the gateway or download customer support information Required Optional Optional Mandatory Deployment Guide for Scopia TIP Gateway Version 8.2 Planning your TIP Gateway Deployment 12

13 Chapter 3 Preparing the Scopia TIP Gateway Setup Perform the procedures in this section to prepare the site and device for installation. Navigation Checking Site Suitability on page 13 Unpacking the Device on page 13 Inspecting for Damage on page 14 Verifying Rack Suitability on page 15 Checking Site Suitability Prior to setting up your device, you need to verify your site suitability for: System power requirements System environmental requirements The device physical dimensions. For more information, see to learn about these requirements. Ensure the site conforms to the listed requirements. Unpacking the Device About this task We strongly recommend that you follow safety guidelines described in this section during unpacking. Procedure 1. Inspect the shipping box to verify that it is not seriously damaged during shipping. 2. Place the shipping box on a horizontal surface paying attention to the This Side Up symbol on the shipping box. See Figure 3: This Side Up symbol on page 14. Deployment Guide for Scopia TIP Gateway Version 8.2 Preparing the Scopia TIP Gateway Setup 13

14 Figure 3: This Side Up symbol Caution: The accessories kit is situated on top of the device inside the shipping box and can be damaged if the box is placed upside down. Pay attention to the This Side Up symbol on the shipping box to handle the box correctly at all times. Caution: To prevent injury and equipment damage, follow lifting guidelines described in the Safety Guide when lifting or moving the shipping box. 3. Cut the plastic straps. Caution: The plastic straps are tightly stretched and can hit you when you cut them. To avoid this, make sure you do not face the side of the box secured by the straps before you cut the straps. 4. Cut the strapping tape. 5. Open the shipping box. 6. Take the accessories kit out of the shipping box. 7. Take the device out of the shipping box. 8. Carefully open the additional boxes, remove the packing material, and remove the drives and other contents. Important: We recommend that you keep the packaging materials in case you need to repack the device. 9. After opening the shipping box, check the shipment is complete. Compare the contents of the shipment with your packing list. Inspecting for Damage After you verify that all of the equipment is included, carefully examine the power supplies and cables for any damage resulting from shipping. If you suspect any damage from shipping, contact your local freight carrier for procedures on damage claims. If you observe any physical defects in the items you ordered, contact Radvision Technical Support for Return Material Authorization (RMA) form. Deployment Guide for Scopia TIP Gateway Version 8.2 Preparing the Scopia TIP Gateway Setup 14

15 Important: Before proceeding with the installation, verify that all of the ordered parts are present and in good condition. Keep a record of the parts and serial numbers. If any parts are missing or damaged, contact your sales representative. Verifying Rack Suitability There are some critical requirements that you must meet when choosing a rack and before mounting the device into it. Navigation Choosing the Type of Rack on page 15 Making Space for the Scopia TIP Gateway on page 15 Choosing the Type of Rack There are many types of racks on the market. The installation instructions in this guide are intended for a 19 rack. Verify that the 19 rack meets the EIA-310 standards. This standard includes precise definitions of the shape of the holes, their size, the depth of the rack and other features. For more information on the EIA-310 standard, see Notice that the vertical square holes on the rack posts are not spaced equally. They form a repeating pattern of two holes close together, then one hole separate, then two holes close together and so on. See Figure 4: Hole distribution on 19 rack on page 15. Figure 4: Hole distribution on 19 rack Making Space for the Scopia TIP Gateway When checking for an empty space to setup the device, be aware of its physical dimensions. Deployment Guide for Scopia TIP Gateway Version 8.2 Preparing the Scopia TIP Gateway Setup 15

16 Install the device in an open rack whenever possible. If installation in an enclosed rack is unavoidable, ensure that the rack has adequate ventilation. Avoid placing the device in an overly congested rack or directly next to another equipment rack. Otherwise, the heated exhaust air from other equipment can enter the inlet air vents and cause the device to overheat. Maintain a minimum clearance of 3 inches (7.62 cm) on the left and right of the device for the cooling air inlet and exhaust vents. Find a space on the rack which is at least 7 empty square holes in height on the rack posts. The Scopia TIP Gateway takes up 3 holes (1U) on the posts. You need at least 2 additional holes to slide the device into the rack. See Figure 5: Height of the Scopia TIP Gateway in the rack on page 16. Figure 5: Height of the Scopia TIP Gateway in the rack To mount the Scopia TIP Gateway between two posts, the width between the inner sides of the two posts must be at least 17.7 inches (45 cm). See Figure 6: Width between inner sides of posts on page 17. Deployment Guide for Scopia TIP Gateway Version 8.2 Preparing the Scopia TIP Gateway Setup 16

17 Figure 6: Width between inner sides of posts Deployment Guide for Scopia TIP Gateway Version 8.2 Preparing the Scopia TIP Gateway Setup 17

18 Chapter 4 Setting up the Scopia TIP Gateway Mount the device onto a 19 square-hole rack. These sections describe how to set up the device: Navigation Mounting the Scopia TIP Gateway onto the Rack Using a Shelf on page 18 Connecting Cables to the Device on page 24 Configuring the Device IP Addresses on page 25 Verifying the Scopia TIP Gateway Installation on page 28 Mounting the Scopia TIP Gateway onto the Rack Using a Shelf This section describes how to mount the unit on to your rack: Navigation Locating a Shelf in the Rack on page 18 Checking the Accessories Required for Mounting on page 19 Attaching Brackets to the Scopia TIP Gateway on page 20 Marking the Location of the Device-fixing Cage Nuts on page 21 Removing the Cage Nut Screws on page 22 Mounting the Device-fixing Cage Nuts on page 22 Mounting the Scopia TIP Gateway onto the Shelf on page 23 Locating a Shelf in the Rack About this task Before choosing a shelf that will support the device, follow this procedure. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 18

19 Procedure 1. Read Verifying Rack Suitability on page 15, which contains important positioning and spacing information. 2. Prepare masking tape or a felt-tip pen to mark the location of the device-fixing cage nuts. If the holes on the rack are marked with numbers, write down the numbers on a piece of paper. 3. If you choose to mount the shelf, see the manufacturer s guidelines for mounting a shelf. When looking for a location on the rack (see Locating a Shelf in the Rack on page 18): Choose a shelf on a rack with at least 1.73 inches (4.4 cm) of empty space above. Verify that the shelf you want to use is properly mounted and secured. Verify that the shelf can support the device weight. See. Verify a hole is present 0.75 inches (2 cm) above the shelf (measured from the center of the hole). Figure 7: Checking the location of the shelf in the rack 4. Ensure the shelf is positioned horizontally in the rack. 5. Ensure the rack breaks are locked or the rack is stabilized. Checking the Accessories Required for Mounting Check you have the accessories necessary for mounting the device (see Figure 8: Accessories required for mounting on page 20): 2 mounting brackets (left and right) 2 cage nuts (M6) each with its hexagon socket cap screw (M6x10, DIN 7984) 4 Phillips screws already mounted on the device. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 19

20 Important: Make sure you have a ruler, an Allen wrench (4 mm diameter), and a screwdriver (Nr. 1 tip) ready to hand before you start the setup. Figure 8: Accessories required for mounting Attaching Brackets to the Scopia TIP Gateway About this task The brackets serve to secure the device to the rack s front posts. Procedure 1. Position the device on a flat, horizontal surface. Make sure the device front panel faces toward you. 2. Unscrew the two Phillips screws on either side of the device. See Figure 9: Removing the Phillips screws on the side panel on page 21. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 20

21 Figure 9: Removing the Phillips screws on the side panel 3. Attach the brackets on each side of the device side panel with the Phillips screws. See Figure 10: Aligning the bracket with the Scopia TIP Gateway front panel on page 21. Figure 10: Aligning the bracket with the Scopia TIP Gateway front panel Marking the Location of the Device-fixing Cage Nuts About this task There is a pair of cage nuts, one for each front-facing rack post. You need these cage nuts to fix the device brackets to the post. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 21

22 Before attaching the cage nuts to the rack, mark where you plan to attach them, so you can be sure they are level and properly placed. Procedure 1. From inside the front-facing rack post, mark the location of the device-fixing cage nut measured at 0.75 inches (2 cm) above the shelf. See Figure 11: Marking the location of the device-fixing cage nut on the rack on page 22. Figure 11: Marking the location of the device-fixing cage nut on the rack 2. Repeat this procedure for the other front-facing post. Removing the Cage Nut Screws About this task The cage nuts are supplied with pre-mounted screws. Remove the screws and put them aside for later. See Figure 12: Removing the cage nut screw on page 22. Figure 12: Removing the cage nut screw Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 22

23 Mounting the Device-fixing Cage Nuts About this task After you have marked the location of these cage nuts on the front-facing posts, you can mount them into the rack. Insert each cage nut on each of the posts where you have placed marks on the rack. Procedure 1. Rotate the bottom cage nut so that its wings are on the top and bottom sides of the cage nut. See Figure 11: Marking the location of the device-fixing cage nut on the rack on page Compress the wings. From the back side of the post, insert first the wide wing, then the narrow wing into the marked square hole. Release the wings after the nut is in position. Mounting the Scopia TIP Gateway onto the Shelf About this task After you have inserted the cage nuts onto the posts, you can mount the device onto the rack. Before mounting the device, read the Safety Guidelines described in the Safety Guide. Secure the device on the rack s posts to prevent it from moving around or falling. Caution: The device is heavy and we recommend that you ask someone to help you lift it. Procedure 1. Lift the device. 2. Slide the device onto the shelf until the holes on the device s brackets align with the cage nuts you mounted previously. See Figure 13: Sliding the Scopia TIP Gateway onto the shelf on page 24. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 23

24 Figure 13: Sliding the Scopia TIP Gateway onto the shelf 3. Insert the two long rack screws provided with the product through the bracket holes into the cage nuts in the rack. Using the Allen wrench tighten the screws to secure the device to the front posts. See Figure 14: Securing the Scopia TIP Gateway to the rack on page 24. Figure 14: Securing the Scopia TIP Gateway to the rack Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 24

25 Connecting Cables to the Device About this task Follow the safety guidelines described in the Safety Guide during this procedure, and follow this procedure to connect the power and serial cables supplied with the accessories kit. Procedure 1. On the rear side of the device, connect the power cable to the AC power connector (see Figure 15: Rear panel of the device on page 25). Figure 15: Rear panel of the device 2. Connect the other end of the power cable to the mains. 3. Use a serial cable to connect a PC to the device's serial port. This connection is required for local configuration and maintenance. Important: Do not connect a screen or a keyboard to the device directly. Define the device's basic settings via the serial connection only. Configuring the Device IP Addresses Before you begin Make sure you have these items: Dedicated IP address for the device Dedicated subnet mask for the device IP address of the default router which the device uses to communicate over the network Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 25

26 A PC with an available serial port. It should have a terminal emulator software installed like SecureCRT or PuTTY. Power, network, and serial cables supplied with the device accessories kit. Procedure 1. Connect the power cable but do not switch on the device. 2. Connect the device serial port to a PC with the terminal emulator software installed. 3. Start the terminal emulation application on the PC. 4. Set the communication settings in the terminal emulation application on the PC as follows (Table 3: Configuring the communication settings on page 26): Table 3: Configuring the communication settings Field Name Baud Rate 9600 Data bits 8 Parity None Stop bits 1 Flow Control None Value 5. Power the device (see Figure 16: Device front panel on page 26). Verify the power LED is lit green (Figure 16: Device front panel on page 26). Figure 16: Device front panel A log of the auto-boot events is displayed in the terminal emulator. 6. When the message Press any key to start configuration appears on the screen, press a key and wait for the following message: Main menu If you do not see this output, contact customer support. 7. Enter N at the prompt to configure network port values. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 26

27 The terminal displays the following message: Configure network port values 1: Show current network configuration 2: Change network configuration 0: Return to main menu Select: 8. Enter 2 to change the network configuration. 9. Enter the new settings at each prompt (Table 4: Configuring network settings on page 27). Table 4: Configuring network settings IP Address Subnet mask Default router Field Description IP address of the device IP address of the subnet mask to which the device belongs. If you are not using a subnet mask, press Enter. IP address of the default router the device uses to communicate over the network 10. Allow the device to complete the reboot process. A new emulator session begins. 11. Close the terminal emulator session. 12. Connect the network cable to the left ethernet connector on the rear panel of the device (see Figure 15: Rear panel of the device on page 25). 13. (Recommended) Set the network switch to 1Gbps Auto Negotiation full duplex, if it can support this configuration. The throughput of the network switch should always be the same as the setting in the MCU, whose default value is also 1Gbps. You can change the default value from the MCU administrator web interface by navigating to Configuration > Network > Port Settings. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 27

28 Figure 17: Configuring the MCU throughput Important: To access the web interface, you need an IP address as explained in Configuring the Device IP Addresses on page 25. Verifying the Scopia TIP Gateway Installation About this task After you installed the device and performed its initial configuration, you need to verify that it is installed and configured correctly. Procedure 1. On the front panel, verify that the power LED is lit green. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 28

29 2. Verify that the status LED is lit green. Figure 18: Locating the front panel LEDs 3. Check the network connection by verifying that the Ethernet activity LED is lit green. Deployment Guide for Scopia TIP Gateway Version 8.2 Setting up the Scopia TIP Gateway 29

30 Chapter 5 Configuring your Scopia Solution for Interoperability with Cisco Telepresence To configure your video network for Cisco telepresence, you need to configure the following deployment components: Scopia TIP Gateway, Scopia Management, and Scopia Elite MCU. You also need to confirm that the CUCM, Cisco's Call Manager, is properly configured for the Scopia Solution. Important: Only the personnel that installed the Cisco telepresence and the customer's network administrator can modify the Cisco telepresence configuration. Scopia Management does not require any specific license for supporting telepresence but is aware of the MCU telepresence license to deliver warning messages to administrators and for display purposes. This section guides you through the steps required to integrate Cisco telepresence with Scopia Solution, as follows: Navigation 1. Verifying the CUCM Settings for Scopia Management on page Configuring Ports on the Scopia TIP Gateway on page Configuring the Scopia TIP Gateway in Scopia Management on page Configuring Cisco Telepresence in Scopia Management on page Configuring Scopia Elite MCU for Cisco Telepresence on page 48 Verifying the CUCM Settings for Scopia Management About this task The Cisco Unified Call Manager (CUCM) can be configured as a SIP proxy with Scopia Solution s components by defining a SIP trunk from the CUCM to the SCOPIA Management, and defining routing patterns which are aligned with the overall dial plan of the network. Perform this procedure to confirm the SIP trunk includes the special settings required for routing video, audio, and data to the Scopia Solution. Caution: Only the personnel that installed the Cisco telepresence and the customer's network administrator should modify the Cisco telepresence configuration. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 30

31 Procedure 1. Make sure the Scopia Management IP address and port number are configured in the SIP trunk. a. Select the relevant trunk in the Device > Trunk tab. b. In the Trunk Configuration page, make sure that the Scopia Management IP address is configured in the Destination Address field. Figure 19: The SIP Information section c. Verify the port number for SIP services is configured in the Destination Port field. By default the field is set to Make sure the SIP trunk is configured to strip the external access code dialed by the CUCM. This enables the Scopia Management to receive the expected number of digits for a Scopia Elite MCU conference. a. Select the relevant route pattern in the Call Routing > Route/Hunt > Route Pattern tab. b. In the Route Pattern Configuration page verify that the Discard Digits field is configured to PreDot. Figure 20: The Called Party Transformations section 3. Make sure the bandwidth is configured to more than 1Mbps, which is the value required for telepresence. A value under 1Mbps causes the videoconference to disconnect. a. Select the relevant server and service in the System > Service Parameters tab. b. In the Service Parameter Configuration page make sure that the Default Intraregion Max Video Call Bit Rate (includes Audio) field is configured to 8128 kbps. Figure 21: The Clusterwide Parameters section (System - Location and Region) Configuring Ports on the Scopia TIP Gateway This section provides instructions of how to configure the following ports and port ranges on the Scopia TIP Gateway: Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 31

32 Navigation Limiting TCP Port Range for H.245 on the Scopia TIP Gateway on page 32 Configuring RTP/RTCP/SRTP Ports on the Scopia TIP Gateway on page 33 Configuring UDP Port for RAS on the Scopia TIP Gateway on page 34 Configuring TCP Port for Q.931 on the Scopia TIP Gateway on page 35 Limiting TCP Port Range for H.245 on the Scopia TIP Gateway About this task The Scopia TIP Gateway designate ports for H.245 (signaling). H.245 is a control protocol used for multimedia communications that enables transferring information about the device capabilities, as well as opening/closing the logical channels that carry media streams. To provide additional security for your firewall, you can limit this range. Procedure 1. Log in to the Scopia Management administrator portal. 2. Select Devices > Devices by Type > Gateways. 3. Select the relevant gateway from the Gateways list. 4. Select the Configure tab (see Figure 22: Configuring a gateway from Scopia Management on page 33). Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 32

33 Figure 22: Configuring a gateway from Scopia Management 5. Select Advanced Parameters. The Advanced Parameters dialog box appears (see Figure 22: Configuring a gateway from Scopia Management on page 33). 6. To set the base port for the H.245 control channel protocol, do the following: a. Clear the values before proceeding to the next step. b. Enter h245baseport in the Command ID field. c. Enter the port value in the Value field. d. Select Save. e. Select Close 7. To set the port range for H.245, do the following: a. Clear the values before proceeding to the next step. b. Enter h245portrange in the Command ID field. c. Enter the port value in the Value field. d. Select Save. e. Select Close Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 33

34 Configuring RTP/RTCP/SRTP Ports on the Scopia TIP Gateway About this task The Scopia TIP Gateway designates ports for UDP audio media, and for UDP video media. Procedure 1. Log in to the Scopia Management administrator portal. 2. Select Devices. 3. Select Gateways in the sidebar menu. 4. Select the relevant gateway from the Gateways list. 5. Select the Configure tab (see Figure 22: Configuring a gateway from Scopia Management on page 33 ). 6. Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 22: Configuring a gateway from Scopia Management on page 33). 7. Set the UDP video base port by doing the following: a. Enter the advcmdmvpsetval command in the Command field. b. Enter the mf.baseport parameter in the Parameter field to set the UDP video base port. c. Enter the port value in the Value field. d. Select Save. 8. Complete the video base port configuration as follows: a. Enter the mvpconfigcompletedcommand command in the Command field. b. Enter 1 in the Value field. c. Select Save. d. Clear the value in the Parameter field before proceeding to the next step. 9. Set the audio base port by doing the following: a. Enter the advcmdmapsetval command in the Command field. b. Enter the mf.udpbaseport parameter in the Parameter field. c. Enter the port value in the Value field. d. Select Save. e. Enter the mapconfigcompleted command in the Command field. f. Enter 1 in the Value field. g. Select Save. 10. Select Close. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 34

35 Configuring UDP Port for RAS on the Scopia TIP Gateway About this task The Scopia TIP Gateway designates port 1719 for RAS, the protocol for signaling messages. You can configure a different port for RAS (if, for example, port 1719 is busy). Procedure 1. Log in to the Scopia Management administrator portal. 2. Select Devices. 3. Select Gateways in the sidebar menu. 4. Select the relevant gateway from the Gateways list. 5. Select the Configure tab (see Figure 22: Configuring a gateway from Scopia Management on page 33). 6. Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 22: Configuring a gateway from Scopia Management on page 33). a. Select h323rasport from the Command ID list. b. Enter the port value in the Value field. c. Select Save. d. Select Close. Configuring TCP Port for Q.931 on the Scopia TIP Gateway About this task The Scopia TIP Gateway designates port 1720 for Q.931. Q.931 is a telephony protocol used for establishing and terminating the connections in H.323 calls. You can configure a different port for Q.931 (if, for example, port 1720 is busy). Procedure 1. Log in to the Scopia Management administrator portal. 2. Select Devices. 3. Select Gateways in the sidebar menu. 4. Select the relevant gateway from the Gateways list. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 35

36 5. Select the Configure tab (see Figure 22: Configuring a gateway from Scopia Management on page 33). 6. Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 22: Configuring a gateway from Scopia Management on page 33). a. Select h323sigport from the Command ID list. b. Enter the port value in the Value field. c. Select Save. d. Select Close. Configuring the Scopia TIP Gateway in Scopia Management This section provides step-by-step procedures for adding and configuring the TIP Gateway. Navigation Adding a gateway in Scopia Management on page 36 Configuring the Scopia TIP Gateway in Scopia Management on page 38 Adding a gateway in Scopia Management About this task This section describes how to add or modify a gateway to your video network in Scopia Management. After you add a device, Scopia Management connects to it and retrieves additional information. You can then configure additional settings for your device, such as managing your bandwidth by using distributed MCUs for a single videoconference. Before you begin If you have multiple locations in your network, make sure you have all the locations defined in Scopia Management before adding devices to the network. See Adding or Modifying a Location. Procedure 1. Access the Scopia Management administrator portal. 2. Select the Devices tab. 3. Select the type of device you are adding or modifying, such as SIP Gateway, TIP Gateway or Scopia Video Gateway from the list in the sidebar. 4. Do one of the following: To add the device, select Add. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 36

37 Figure 23: Adding a new video network device To modify the basic attributes of the device, select the link of the device in the Name column, and select the Configure tab if present. 5. Enter or modify the basic settings for your device, as described in Table 5: Configuring your device's basic settings. Scopia Management then connects to the devices and retrieves additional information, such as the version number. Figure 24: Adding a new gateway Table 5: Configuring your device's basic settings Field Name Name IP Address Location Description Enter the name used to identify the device. This name will be displayed in the list of devices. Enter the device's management IP address, as configured during device installation. This is only relevant for service providers or deployments with multiple locations. Select the device s location. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 37

38 Model Field Name Description This field is only necessary when adding gatekeepers and gateways: If adding a gatekeeper profile, select the gatekeeper's vendor and model from the list. If adding a gateway profile, select the gateway type from the list. Registered GK Select the gatekeeper to which the telepresence system is registered to from the list. If you select None, the endpoint can be added to Scopia Management but will not be connected until you register the endpoint with the gatekeeper, and select the gatekeeper here. Configuring the Scopia TIP Gateway in Scopia Management About this task This section explains how to configure the, Scopia TIP Gateway settings in Scopia Management. Since the Scopia Gateway does not have its own web interface, its configuration is performed in Scopia Management. Scopia Management and gateways communicate in XML over TCP for control and configuration commands. You can secure the connection by configuring it to the TLS protocol. Make sure to generate the Scopia Management and Scopia Gateway certificates before configuring the connection to TLS (see Securing Your Video Network Using TLS on page 51). Before you begin Procedure 1. Access the Scopia Management administrator portal. 2. Select the Devices > Devices by Type > Gateways. 3. Select the Scopia Gateway you are configuring. 4. Select the Configure tab. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 38

39 Figure 25: Configuring the gateway 5. Configure the Scopia Gateway settings as described in Table 6: Configuring settings for the Scopia Gateway on page 39. Table 6: Configuring settings for the Scopia Gateway Name Field Names Secure XML Connection using TLS Description You can modify the name that identifies the Scopia Gateway in Scopia Management. If required, select to use TLS and thus secure the exchange of XML messages and commands between the Scopia Gateway and Scopia Management. Important: Before selecting TLS, you must generate the Scopia Management and Scopia Gateway certificates. After you select that checkbox, click Test Connection. Registration Name Meeting Type Prefix The name of this Scopia Gateway is automatically generated by the system. The prefix to dial to access this gateway. Secure connection using HTTPS Select this setting to encrypt the communication between the gateway and the Scopia Management. Before selecting HTTPS, you must generate the Scopia Gateway certificates. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 39

40 Field Names Required Gatekeeper Current Gatekeeper Location SIP Proxy Server Transport Type Default SIP Domain NTP IP Address NTP Time Zone MTU size DNS Server 1, 2 Quality of Service QoS Priority Description The gatekeeper to which you want to register the Scopia Gateway. This (read-only) field displays the management IP address of the gatekeeper this Scopia Gateway is currently registered to. In most cases, this is the same gatekeeper selected in the Required Gatekeeper field. If the current gatekeeper is not the same as the gatekeeper configured in Required Gatekeeper, an alarm is issued by Scopia Management. If there is more than one location in your deployment, assign your gateway to a location by selecting an option from the list. The IP of the SIP Server for this gateway. Typically Scopia Management acts as the SIP server. The default setting is TCP. Choose TLS for encrypted communications with the SIP server. TLS requires correctly issued certificates from a CA for the gateway and the SIP server. The SIP domain of your organization. The IP address of a Network Time Protocol server which sets the time for the gateway s clock. External NTP servers ensure the same clock throughout all devices on the network. If you have no NTP server, enter The time zone of the NTP server. The size of the packets received from the gateway. Only change this if a router uses a non-standard MTU size. The IP address(es) of the organization s DNS server(s). Typically this setting remains on Default. You can customize the priority given to the different elements of the gateway communication if required. Enter a number from to represent the relative priority of audio, video, and signaling and control data. During low-bandwidth conditions, Scopia Management uses these priority settings to adjust the quality of the meeting. 6. Select Apply. 7. Allow Scopia Management to access the Scopia Gateway: a. Select the Access tab. b. Enter the login name and password of the Scopia Gateway. The default username is admin and the default password is password. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 40

41 c. Select Apply. Configuring Cisco Telepresence in Scopia Management For general information about telepresence systems, see the Administrator Guide for Scopia Management. For information on the telepresence deployment, see Planning your Topology for the TIP Gateway on page 9. These procedures describe the planning and configuration of telepresence in Scopia Management. Navigation Adding the CUCM to Scopia Management on page 41 Adding the CTMS to Scopia Management on page 42 Adding Cisco Telepresence Systems (CTS) in Scopia Management on page 46 Adding the CUCM to Scopia Management About this task To enable Scopia Management to operate with Cisco telepresence, configure Scopia Management with the CUCM which is the call manager to which Cisco telepresence endpoints are registered. For the Scopia Solution, the CUCM acts as a proxy SIP server. You can view the connection status between Scopia Management and the CUCM (SIP server) by navigating to Devices > SIP Servers. Procedure 1. Access the Scopia Management administrator portal. 2. Select the Devices tab. 3. Select SIP Servers in the sidebar. 4. Configure the SIP server settings in the Basics section, as described in this table. Table 7: Configuring the CUCM settings Name Field Name IP Address/ FQDN Description Enter a name to identify the CUCM (SIP server). This name is displayed in the list of SIP servers. Enter either the network name (FQDN) of the computer that you are using as the CUCM (specify all domain levels), or the CUCM's IP address. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 41

42 Field Name Port Transport Type Model Location SIP Domain Description Enter the port used for SIP connections. The default port is 5060 for TCP/UDP, and 5061 for TLS. Select the transport protocol used for connecting to the CUCM (SIP server), according to the selected port number. If the default port is 5060, select TCP/UDP; if it is 5061, select TLS. Select Cisco Call Manager from the list. Select the location of the SIP server. This field is only relevant for distributed or service provider deployments. Enter the domain name of the CUCM (SIP server) network. For example, if the FQDN is <SIP server name>.companyname, the SIP domain is 'companyname'. 5. Select OK to save your changes. 6. You can modify these settings at any time by selecting the device name link in the SIP Servers list. Adding the CTMS to Scopia Management About this task Though the TIP Gateway allows to connect Cisco Telepresence Systems directly into a conference on the Scopia Elite MCU, it also supports connecting these endpoints through the CTMS for organizations using this Cisco MCU in their deployment. When working in a CTMS environment, you actually create a cascading link between two MCUs, where local participants connect to their local MCU, and the conference is cascaded by connecting between the MCUs using a fraction of the bandwidth compared to the centralized deployment. Setup Scopia Management as follows: For calls outbound to Cisco telepresence, configure the CTMS information which consists of a route pattern and service number. For example, a routing pattern might define the dial prefix 227 to route the call to the CTMS, and '5678' as the service number. Scopia Management would send to the CTMS a dial string that includes the number For calls inbound from Cisco telepresence, configure the CTMS Directory Number. For example, the number ' ' would be sent from the Cisco telepresence. Scopia Management would interpret the number '1000' as originating from the CTMS, and '8825' as the MCU service/conference number to which it should send the call. Important: The CTMS is considered as an endpoint in the Scopia Management setup. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 42

43 Procedure 1. Access the Scopia Management administrator portal. 2. Select the Endpoints tab. 3. Select Add > Add manually. The Add Endpoint window appears. 4. Select the Cisco telepresence system in the Type list. Figure 26: Cisco CTMS Configuration screen 5. Configure the CTMS as described in this table. Table 8: Configuring the CTMS Name Description Prefix Location Field Name Visible in the directory of other endpoints Description Enter a name used to identify the CTMS. This name is displayed in the list of endpoints. Enter any description text that you may have for the CTMS. You must configure the prefix for each type of call: For inbound calls, enter the CTMS Directory Number. To locate the number, see Retrieving the CTMS Prefix for Scopia Management on page 44. For outbound calls, enter the dial-in number for each service defined in the CTMS. To locate the numbers, see Retrieving CTMS Routing Information for Scopia Management on page 45. Select the location of the telepresence system, from the list. This is only relevant for deployments with multiple locations. Select to display the CTMS in the corporate address book. The CTMS is represented in the address book as a single endpoint. 6. Select OK. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 43

44 Once configured, the Endpoints tab displays a small icon near the CTMS name, indicating that this is a telepresence system, as well as dialing info numbers with relevant prefixes. 7. Repeat the prefix configuration for each service defined in the CTMS. 8. You can modify these settings at any time by selecting the CTMS name link in the All endpoints list. 9. If the CTMS used in your telepresence is defined in the LDAP server, import the CTMS into Scopia Management, as described in the Administrator Guide for SCOPIA Management. Important: Even if you previously imported the CTMS from the LDAP server, you must re-import it to Scopia Management, in order to define it as part of a telepresence system and not as a regular endpoint. Retrieving the CTMS Prefix for Scopia Management About this task Configure the CTMS prefix (Directoy Number) in Scopia Management so it can identify calls from the Cisco deployment when the CTMS is part of the deployment. For more information, see Adding the CTMS to Scopia Management on page 42. This procedure describes how to retrieve the CTMS Directory Number from the CTMS web interface. Important: This number is configured only by the personnel that installed the Cisco services or by the customer's network administrator. Procedure 1. Login to the CTMS web interface. 2. Select System Settings > Route Pattern. 3. Write down the CTMS Directory Number as you need it for configuring the CTMS prefix in Scopia Management. For more information, see Adding the CTMS to Scopia Management on page 42. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 44

45 Figure 27: Locating the CTMS Directory Number Retrieving CTMS Routing Information for Scopia Management About this task Configure the CTMS route pattern prefix and service numbers in Scopia Management to route calls to the Cisco telepresence devices. For more information, see Adding the CTMS to Scopia Management on page 42. This procedure describes how to retrieve CTMS information from the relevant Cisco devices. Important: This number is configured only by the personnel that installed the Cisco services or by the customer's network administrator. Procedure 1. Retrieve the CTMS route pattern prefix. a. In the CUCM web interface select the relevant route pattern that was configured for the CTMS in the Call Routing > Route/Hunt > Route Pattern tab. b. Write down the prefix used for routing the incoming calls on the CTMS trunk. 2. Retrieve the CTMS service numbers. Figure 28: The CTMS Route Pattern prefix a. In the the CTMS web interface select System Settings > Static Meetings. b. Write down the relevant call-in numbers to the CTMS meetings as you need them for configuring the CTMS prefix in Scopia Management. For more information, see Adding the CTMS to Scopia Management on page 42 Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 45

46 Figure 29: The CTMS Static Meetings page Adding Cisco Telepresence Systems (CTS) in Scopia Management About this task You must manually add telepresence systems to Scopia Management. A telepresence system consists of one segment or three segments, depending on the model, to allow participants to see each other as if they were in the same room. For more information about telepresence systems, see the Administrator Guide for Scopia Management. When configuring telepresence, note the following restrictions and guidelines: Telepresence endpoints cannot be associated with a specific user. Telepresence endpoints cannot be set as VIP (an important endpoint whose video resolution is not scaled down to below HD quality even when the available effective bandwidth is less than optimal). In cascaded meetings, telepresence endpoints always connect to the Master MCU. For more information about cascaded meetings, see the Administrator Guide for Scopia Management. Procedure 1. Access the Scopia Management administrator portal. 2. Select the Endpoints tab. 3. Select Add > Add manually. The Add Endpoint window appears. 4. Select the Cisco telepresence system in the Type list. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 46

47 Figure 30: Cisco CTS Configuration screen 5. Configure your telepresence endpoint as described in this table. Table 9: Configuring telepresence endpoints Name Description Triple Protocol URI Location Field Name Visible in the directory of other endpoints Description Enter a name used to identify the endpoint. This is the name displayed in the list of endpoints. Enter any description text that you may have for this endpoint. Select this field if you are adding a 3-segment CTS-3000 Series endpoint to the deployment. For Cisco telepresence, this field is pre-configured to IP (SIP) since the CTS endpoints are using the SIP protocol. Enter the CTS phone number that is dialed when calling the Telepresence System from the Scopia Elite MCU. Select the location of the telepresence system, from the list. Select to display the telepresence system in the corporate address book. The telepresence endpoint is represented in the address book as a single endpoint. 6. Select OK. Once configured, the Endpoints tab displays a small icon near the endpoint name, indicating that the endpoint is a telepresence system as well as dialing info numbers with relevant prefixes. 7. Repeat the above steps for each CTS in the deployment. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 47

48 8. You can modify these settings at any time by selecting the device name link in the All endpoints list. 9. If the endpoints used in your telepresence are defined in the LDAP server, import the endpoints into Scopia Management, as described in the Administrator Guide for SCOPIA Management. Important: Even if you previously imported the endpoints from the LDAP server, you must re-import the endpoints to Scopia Management, in order to define the endpoints as part of a telepresence system and not regular endpoints. Configuring Scopia Elite MCU for Cisco Telepresence The Scopia Elite MCU enables multimedia, multiparty collaboration. For a smooth experience with Cisco telepresence devices, make sure that these Scopia Elite MCU functionalities are configured as described in the following topics: Navigation 1. Enabling H.264 Presentation in Scopia Elite MCU on page Defining Allowed Bandwidth in the MCU on page Selecting the MCU Presentation Resolution on page 49 Enabling H.264 Presentation in Scopia Elite MCU About this task To enable a participant to start or receive a presentation, you must configure the presentation view and video codec in the MCU. Procedure 1. Access the MCU administrator interface. 2. Select the Configuration > Conferences tab. 3. Locate the Services list section. 4. Select the Review button next to the required service. 5. Select More Additional settings for this service are displayed. 6. Select Enable presentation view. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 48

49 Figure 31: Enabling presentation in an MCU service 7. Select H264 in the video codec list so that the service supports the same video codec as the Cisco devices. 8. Select OK. Defining Allowed Bandwidth in the MCU About this task Make sure the bandwidth is configured to more than 1Mbps, which is the value required for the Cisco telepresence. A value under 1Mbps causes the videoconference to disconnect. Procedure 1. Access the MCU administrator interface. 2. Select Configuration. 3. Select Conferences. 4. Locate the Services list section. 5. Select the Review button next to the required service. 6. Make sure that the required value is set to 1024 Kbps as a minimum in the list under Max call rate (Kbps). 7. Select Apply. Figure 32: Adjusting the bandwidth Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 49

50 Selecting the MCU Presentation Resolution About this task Configure the MCU to allow presentation and video clips to be shared with the Cisco telepresence components without quality loss. Important: The presentation video resolution must be reconfigured each time the service is changed. Procedure 1. Access the MCU administrator interface. 2. Select the icon. 3. Select Advanced parameters. 4. Select the Review button next to Presentation image size. 5. Enter XGA as the format for video resolution, which equates to 1024x768. Figure 33: Configuring the video resolution 6. Enter the service number in the Parameter field. 7. Select Apply. Deployment Guide for Scopia TIP Gateway Version 8.2 Configuring your Scopia Solution for Interoperability with Cisco Telepresence 50

51 Chapter 6 Securing Your Video Network Using TLS You can configure your video network, whether it is a Scopia Solution or a third party deployment, to support Transport Layer Security (TLS) for the SIP protocol. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. TLS is used to secure the connection between Scopia Management and the gateway. The TLS protocol is based on a public and private keys for authorization and encryption, exchanged between Scopia Management and other video network devices to allow an authenticated and secure connection. You can create a pair of keys, public and private, by generating a certificate which must be signed by a certification authority. The public key is placed in a certificate and signed by a certification authority (CA). As you configure your deployment for TLS, you need to generate a certificate signing request (CSR) for every component that uses TLS in your deployment and send it to the CA to be signed. A CA has its own certificate, known as the CA root certificate. When the CA signed certificate is ready, you upload it into the component for which it was created, together with the CA root certificate. In some cases, when the CA signing the certificate is not a known trusted source, you must obtain an additional certificate vouching for the trustworthiness of the CA. These certificates are known as intermediary certificates, and must be signed by a trusted CA. Some third-party components of your deployment may have pre-installed certificates. Each time a TLS connection is established, the video network device which starts the TLS communication session requests a signed certificate together with the CA root certificate. After the other device verifies its identity with these certificates, a secure connection can be established. Exchanging certificates between devices is part of the TLS protocol; it happens in the background and is transparent to a user. Important: Managing certificates for communication between Scopia Management and other devices is done as follows: Scopia Video Gateway, Radvision SIP Gateway, and Scopia TIP Gateway certificates are managed from Scopia Management's administrator portal. Scopia Desktop Server certificates are configured automatically during installation. MCU certificates are managed from the MCU web interface. For details, see the Administrator Guide for Scopia Elite MCU The following set of procedures secure the connection between Scopia Management and other devices. Perform these tasks in the order listed below: 1. Decide your deployment's requirements, as described in Planning the Required Certificates for TLS on page Perform Generating the Certificate Signing Request for Scopia Management on page Ensure you have the root certificate of the certificate authority your organization uses. This root certificate is used when uploading signed certificates into Scopia Management and the gateway. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 51

52 4. Perform Uploading Scopia Management Certificates into Scopia Management on page Perform Uploading Certificates for the TIP Gateway on page If the CA used to identify the device is different from the CA which identifies Scopia Management, perform Uploading Certificates for Other Devices on page Perform Enabling Encryption with Scopia TIP Gateway on page Perform Enabling the TLS Connection in Scopia Management on page 72. Planning the Required Certificates for TLS When a device establishes a secure TLS connection with another component, it sends a signed certificate verifying its identity. The signature on the certificate must be from a known (trusted) certification authority (CA). Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. There are several types of TLS connections: Standard TLS, where all certificates are signed by the same CA. Unique CAs, where each certificate is signed by a different CA. Unknown gateway CA, where the gateway s certificate is signed by an unknown (untrusted) CA. Unknown Scopia Management CA, where Scopia Management's certificate is signed by an unknown (untrusted) CA. Mutually unknown CAs, where both components carry certificates signed by CAs that are unknown to each other. Each situation requires a different set of certificates to be uploaded to each of the components. Typically, the certificates are all signed by the same CA. Some unique deployments, such as service provider deployments, may use multiple CAs. A CA s signature is always verified by its root certificate, which identifies the CA and is self-signed by that CA. When a device receives a certificate as part of TLS negotiations, it must verify that the CA signing the certificate is trusted, so it must have the CA s root certificate uploaded. Standard TLS These connections use the same CA for signing all certificates on both sides. In this case, you need to upload two certificates to Scopia Management and two for the gateway (Figure 34: Standard TLS: Component Certificates and a CA Root Certificate on page 53). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 52

53 Figure 34: Standard TLS: Component Certificates and a CA Root Certificate Upload the following certificates to the Scopia Management: A certificate identifying Scopia Management, signed by the CA. This is sent to the gateway as part of the TLS negotiation. A root certificate verifying the CA s identity, self-signed by that CA. This is used by Scopia Management to verify the certificate sent by the gateway. On the gateway side, upload the following certificates (Figure 34: Standard TLS: Component Certificates and a CA Root Certificate on page 53): A certificate identifying the gateway, signed by the same CA. This is sent to Scopia Management as part of the TLS negotiation. A copy of the root certificate verifying the CA s identity, self-signed by the CA. This is used by the gateway to verify the certificate sent by Scopia Management. Unique CAs When certificates are signed by different CAs, each CA requires its own root certificate to be uploaded for authentication. For example, in Figure 35: TLS connection using certificates signed by different CAs on page 54, the certificate identifying Scopia Management is signed by CA1, while the the gateway's certificate is signed by CA2. This requires three certificates to be uploaded to Scopia Management and two for the gateway (Figure 35: TLS connection using certificates signed by different CAs on page 54). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 53

54 Figure 35: TLS connection using certificates signed by different CAs When each certificate is signed by a different CA (Figure 35: TLS connection using certificates signed by different CAs on page 54), upload the following certificates to the Scopia Management: A certificate identifying Scopia Management, signed by trusted CA1. This is sent to the gateway as part of the TLS negotiation. A root certificate from the trusted CA1 verifying CA1 s identity, self-signed by CA1. This is used by Scopia Management to authenticate its certificate. A root certificate from the trusted CA2 verifying CA2 s identity, self-signed by CA2. This is used by Scopia Management to authenticate the certificate sent by the gateway, which is signed by CA2. On the gateway side, upload the following certificates (Figure 35: TLS connection using certificates signed by different CAs on page 54): A certificate identifying the gateway, signed by trusted CA2. This is sent to Scopia Management as part of the TLS negotiation. A root certificate verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the certificate sent by Scopia Management, which is signed by CA1. Unknown gateway CA If the CA of the gateway s certificate is unknown, it cannot be trusted unless it comes with an intermediate certificate, which vouches for the trustworthiness of the unknown CA. Intermediate certificates must be signed by a trusted CA. For example, in Figure 36: Signature of Gateway Certificate from Unknown CA on page 55, the certificate identifying the gateway is signed by CA3, which may be known and trusted by those who installed the gateway, but in this scenario CA3 is not trusted by Scopia Management. Meanwhile Scopia Management s certificate is signed by CA1, a trusted CA. This scenario requires four certificates to be uploaded to Scopia Management and two for the gateway (Figure 36: Signature of Gateway Certificate from Unknown CA on page 55). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 54

55 Figure 36: Signature of Gateway Certificate from Unknown CA When CA3 is untrusted (Figure 36: Signature of Gateway Certificate from Unknown CA on page 55), the certificates to upload to the Scopia Management are: A certificate identifying Scopia Management, signed by trusted CA1. This is sent to the gateway as part of the TLS negotiation. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by Scopia Management to authenticate its certificate. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA2. This is used to trust the certificate sent by the gateway, which is signed by CA3. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by Scopia Management to authenticate the intermediate certificate, which is signed by CA2. On the gateway side, the certificates to be uploaded are (Figure 36: Signature of Gateway Certificate from Unknown CA on page 55): A certificate identifying the gateway, signed by CA3, an unknown CA. This certificate is sent to Scopia Management as part of the TLS negotiation. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the certificate sent by Scopia Management, which is signed by CA1. Unknown Scopia Management CA When Scopia Management s certificate is signed by a CA unknown to the gateway, you must upload an intermediate certificate for the untrusted CA signed by a trusted CA to vouch for its authenticity. In the example of Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56, Scopia Management s certificate is signed by CA3, an unknown CA, while the gateway s certificate is signed by CA2, a trusted CA. This requires four certificates to be uploaded to Scopia Management and three for the gateway (Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 55

56 Figure 37: Signature of Scopia Management Certificate from Unknown CA When CA3 is untrusted by the gateway (Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56), the certificates to upload to the Scopia Management are: A certificate identifying Scopia Management, signed by CA3, a CA unknown to the gateway. This is sent to the gateway as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust Scopia Management s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by Scopia Management to authenticate the intermediate certificate, which was signed by CA1. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by Scopia Management to authenticate the gateway s certificate, which is signed by CA2. On the gateway side, the certificates to be uploaded are (Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56): A certificate identifying the gateway, signed by trusted CA2. This certificate is sent to Scopia Management as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust Scopia Management s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the intermediate certificate, which is signed by CA1. Mutually unknown CAs In the final scenario, both components use certificates signed by CA s which are not recognized by each other. In this case, there needs to be two intermediate certificates, one for each of the untrusted CAs, to vouch for their authenticity. For example, in Figure 38: Signature of Both Certificates are from Untrusted CAs on page 57, the certificate identifying the gateway is signed by CA4, an unknown CA, while Scopia Management s certificate is signed by CA3, also untrusted. This would require five certificates to be uploaded to Scopia Management and three for the gateway (Figure 38: Signature of Both Certificates are from Untrusted CAs on page 57). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 56

57 Figure 38: Signature of Both Certificates are from Untrusted CAs When CA3 is untrusted by the gateway and CA4 is untrusted by Scopia Management (Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56), the certificates to upload to the Scopia Management are: A certificate identifying Scopia Management, signed by CA3, a CA unknown to the gateway. This is sent to the gateway as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust Scopia Management s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by Scopia Management to authenticate CA3 s intermediate certificate, which was signed by CA1. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by Scopia Management to authenticate CA4 s intermediate certificate, which is signed by CA2. An intermediate certificate vouching for the trustworthiness of CA4, signed by trusted CA2. This is used to trust the gateway s identity certificate, which is signed by CA4. On the gateway side, the certificates to be uploaded are (Figure 37: Signature of Scopia Management Certificate from Unknown CA on page 56): A certificate identifying the gateway, signed by CA4, a CA unknown to Scopia Management. This is sent to Scopia Management as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust Scopia Management s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the intermediate certificate, which is signed by CA1. For more information on uploading certificates to the gateway and to Scopia Management, see Securing Your Video Network Using TLS on page 51. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 57

58 Generating the Certificate Signing Request for Scopia Management About this task This section details how to generate a certificate signing request (CSR) for Scopia Management, which must be signed by a certificate authority (CA). Once properly signed, the certificate would confirm the identity of Scopia Management to other components in the network, and can also facilitate encrypted communications with those components. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Before you begin If you have the Scopia Management redundant solution, it is important to configure redundancy before proceeding with TLS configuration. See Administrator Guide for Scopia Management for details. Procedure 1. Access the Scopia Management administrator portal. 2. Select Settings > Security > Certificates. The Scopia Management Certificate page appears. Important: To replace the certificate that is currently installed, select New. Figure 39: Scopia Management Certificate 3. Enter a name used to identify this certificate in the Name field. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 58

59 4. If necessary, enter a description of the certificate in the Description field. 5. Select Create. The Generate CSR window appears. 6. Enter your organization's details. Important: Figure 40: Certificate Signing Request Common Name must be full name of the Scopia Management/SIP server (FQDN): rvcn-iview-7201.radvision.com. For a redundancy deployment, the common name must be the public virtual FQDN. Country code must include two characters. Encryption Strategy must be the same as the encryption used in your organization. 7. Select Generate CSR. 8. Select Save to view the certificate content. The certificate content is displayed in the Download window. 9. Save the certificate in an appropriate folder. The certificate is saved as a text file compatible with Base-64 ASCII code. 10. Send the text file containing the certificate for signing as a certificate compatible with Base-64 ASCII code. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 59

60 Important: The certificate must be signed as a certificate compatible with Base-64 ASCII code. If other components communicating with Scopia Management also have their own certificates, we recommend using a common CA for all certificates for a more efficient implementation. Select Web Server as the certificate template when submitting a certificate request or renewal request. 11. Continue with Uploading Scopia Management Certificates into Scopia Management on page 60. Uploading Scopia Management Certificates into Scopia Management About this task This procedure describes how to upload certificates which confirm the identity of Scopia Management. To upload certificates which confirm the identity of other Scopia Solution and third-party devices, see Uploading Certificates for Other Devices on page 68 and Uploading Certificates for the TIP Gateway on page 65. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. In most TLS connections, Scopia Management requires two certificates to be uploaded: a signed certificate identifying Scopia Management signed by a certification authority (CA) and that CA s root certificate (Figure 46: Typical TLS communication with a gateway on page 66). Each time a network device tries to establish a new TLS session with Scopia Management, it sends its identity certificate to Scopia Management to establish a secure connection (Figure 46: Typical TLS communication with a gateway on page 66). Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 60

61 Figure 41: Typical TLS communication with a gateway However, if the component certificates are signed by a different CA than Scopia Management s certificate, you may need to upload more certificates to establish authenticity, as described in Uploading Certificates for Other Devices on page 68. For more information about which certificates are required, see Planning the Required Certificates for TLS on page 52. Before you begin 1. Ensure that you have the root certificate for the certificate authority that your organization uses. The root certificate must be compatible with the Base-64 ASCII code. 2. Ensure that you have the signed certificate from the CA for Scopia Management (see Generating the Certificate Signing Request for the Scopia TIP Gateway on page 63 for details on generating the CSR). Procedure 1. Copy the CA root certificate and the CA signed certificate that confirm the identity of Scopia Management into the Scopia Management server. 2. Access the Scopia Management administrator portal. 3. Select Settings > Security > Certificates. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 61

62 Figure 42: Uploading certificates into Scopia Management 4. Select Upload to bring in the CA root certificate, including intermediate and signed certificates, into Scopia Management by doing the following for each certificate: Figure 43: Defining the certificates to be uploaded a. Select Add to browse to the CA root and intermediate certificates. The Open window is displayed. b. Browse to the CA root, intermediate and signed certificates. c. Select Open. d. Select Upload. Verify that the upload success message is displayed. The CA root and intermediate certificates are uploaded into Scopia Management. 5. Select Apply. 6. To finish applying the certificates, select Yes to restart Scopia Management. 7. Continue with generating the CSR for the device's certificates, as follows: Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 62

63 To generate the CSR for Scopia TIP Gateway, continue with Generating the Certificate Signing Request for the Scopia TIP Gateway on page 63. To generate the CSR for other devices, see the product's Administrator Guide for details. Generating the Certificate Signing Request for the Scopia TIP Gateway About this task This procedure describes how to generate a certificate for the Scopia TIP Gateway, that needs to be signed by the network administrator using a certificate authority certification. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Before you begin Upload all certificates for Scopia Management, including certificates signed by the CA to identify Scopia Management, and root and intermediate certificates to identify the CA. See Generating the Certificate Signing Request for Scopia Management on page 57 and Uploading Scopia Management Certificates into Scopia Management on page 60 for details. Procedure 1. Access the Scopia Management administrator portal. 2. Select Devices > Devices by Type > Gateways and navigate to the gateway to create its CSR. 3. Select the Certificate tab. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 63

64 4. Select Create a new CSR. Figure 44: Creating a CSR for the gateway The Save Certificate Request window opens displaying the certificate request. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 64

65 Figure 45: The Save Certificate Request 5. Copy the certificate request into a separate text file and save it with the.csr extension. 6. Select Close. 7. Send the text file containing the certificate request to your network administrator for signing using a certificate authority application. Important: The certificate request must be signed with the setting to ensure it is compatible with Base-64 ASCII code. 8. Save the CA root certificate as the gateway s root certificate file. 9. Continue with uploading the device's certificates, as follows: To upload certificates identifying Scopia TIP Gateway, continue with Uploading Certificates for the TIP Gateway on page 65. To upload certificates identifying other devices, see the product's Administrator Guide for details. Uploading Certificates for the TIP Gateway About this task In most TLS connections, the gateway requires two certificates to be uploaded: a certificate signed by a certificate authority (CA) identifying the gateway and the CA root certificate which authenticates the CA as a trusted source. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 65

66 Each time a deployment component tries to establish a new TLS session with Scopia Management, it sends its identity certificate to the component to establish a secure connection (Figure 46: Typical TLS communication with a gateway on page 66). Each time Scopia Management tries to establish a new TLS session with the gateway, Scopia Management sends its identity certificate to the gateway. The gateway must have all the certificates required to authenticate the validity of that certificate. Only then a secure connection is established. For more information on determining the certificates required in each component, see Planning the Required Certificates for TLS on page 52. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Figure 46: Typical TLS communication with a gateway Before you begin 1. Ensure that you have the root certificate for the certificate authority that your organization uses. The CA root certificate must be compatible with the Base-64 ASCII code. 2. Ensure that the certificates confirming the identity of Scopia Management are uploaded (see Uploading Scopia Management Certificates into Scopia Management on page 60). 3. Ensure that you have the signed certificate for the gateway (see Generating the Certificate Signing Request for the Scopia TIP Gateway on page 63). Procedure 1. Access the Scopia Management administrator portal. 2. Select Devices > Devices by Type > Gateways and navigate to the gateway to upload its certificates. 3. Select the Certificate tab. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 66

67 4. Select Upload a Certificate to upload the certificate for the gateway which has been signed by the CA. The Upload Certificate window opens. 5. Paste the content of the gateway certificate signed by the CA and select OK. The CA signed certificate is uploaded. Figure 47: Uploading a signed certificate 6. Select Upload under the CA root section of the window to upload the CA s root certificate. The upload certificate window opens. 7. Paste the content of the CA root certificate and select OK. The CA root certificate is uploaded. 8. In cases where the CA root certificate is signed by another CA, you also need to upload the root of the second CA to verify it is trusted. Select Upload under the CA intermediate section of the window to upload the intermediate s root certificate. 9. Paste the content of the intermediate CA s root certificate and select OK. The intermediate CA s root certificate is uploaded. 10. Restart the gateway. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 67

68 11. If the device certificates are signed by a different CA than Scopia Management s certificate, continue with Uploading Certificates for Other Devices on page If the device certificates are signed by the same CA as Scopia Management s certificate, continue with Enabling Encryption with Scopia TIP Gateway on page 70. Uploading Certificates for Other Devices About this task This procedure describes how to import the root (and intermediate, if required) certificates to Scopia Management for devices in your deployment. This is necessary if the device certificates are signed by a different CA than Scopia Management s certificate (see Planning the Required Certificates for TLS on page 52 for more information about planning certificates). This is done to establish the trustworthiness of each CA s signature, sometimes through using an intermediate certificate which vouches for the CA in question. In such cases, you would also need to import the intermediate s root certificate to verify it is a trusted source. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Before you begin Ensure that you have the root certificate, including all intermediate certificates, for the certificate authority that your organization uses to identify the device. The root certificate must be compatible with the Base-64 ASCII code. You must first upload the certificate identifying the device, as follows: Procedure To upload certificates identifying Scopia TIP Gateway, see with Uploading Certificates for the TIP Gateway on page 65. To upload certificates identifying other devices, see the product's Administrator Guide for details. 1. Copy the CA root (and intermediate, if relevant) certificate that confirms the identity of the CA into the Scopia Management server. 2. Access the Scopia Management administrator portal. 3. Select Settings > Security > Certificates > Advanced. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 68

69 Figure 48: Upload certificates for other devices 4. Select Import. 5. Select Add to browse each root and intermediate certificate required. 6. Select Upload. Figure 49: Importing certificates for other devices into Scopia Management 7. Repeat for each root and intermediate certificate of each device. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 69

70 8. Select all certificates you uploaded and select Apply. The system prompts for a restart to implement the newly uploaded certificates. 9. Continue with Enabling Encryption with Scopia TIP Gateway on page 70. Enabling Encryption with Scopia TIP Gateway About this task Encrypting communications in the gateway is done at each leg of the gateway (Figure 50: Encryption in Scopia Management on page 70. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Figure 50: Encryption in Scopia Management For the leg communicating with the Cisco telepresence network, there is no media encryption. For the leg communicating with the H.323 network, the gateway provides media encryption using the H.235 standard. For the leg communicating with Scopia Management, the gateway can provides TLS for secure XML over TCP communications. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 70

71 Important: Encrypting communications between the gateway and Scopia Management is typically less common since they are usually both located behind the firewall inside an enterprise. This section details how to encrypt communications between the Scopia Gateway and the video network. To encrypt control and management communications between Scopia Management and the SIP and H.323 networks, see Enabling the TLS Connection in Scopia Management on page 72 Procedure 1. Access the Scopia Management administrator portal. 2. Select Devices > Devices by Type > Gateways. 3. Select the gateway you require. 4. Select the Configure tab. 5. For encrypting communications between the gateway and the SIP network, select one of these settings for the Service Encryption field: Table 10: Configuring the encryption Best effort Mandatory Field Name Description When selected, indicates the gateway supports encryption. If the remote site does not support it, communications are not encrypted. Communications are always encrypted. If the remote site does not support encryption, communications fail. 6. For encrypting communications between the gateway and the H.323 network, especially the MCU, proceed as follows: a. Select Advanced Parameter Settings. The Advanced Parameters dialog box appears (see Figure 51: Enabling H.235 call support on page 72). b. Type h235callssupport in the Command ID field. c. Clean the Value field. d. Select Get. Scopia Management automatically sets the port's value to 1 in the Value field. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 71

72 e. Select Save. f. Select Close Figure 51: Enabling H.235 call support 7. To encrypt communications with Scopia Management which acts as the SIP server, select TLS. For details, see Configuring the Scopia TIP Gateway in Scopia Management on page Continue with Enabling the TLS Connection in Scopia Management on page 72. Enabling the TLS Connection in Scopia Management About this task You can configure your Scopia Management to use the TLS connection by modifying the configuration of the B2BUA component of the Scopia Management. Perform this procedure only if you want to secure your video network using TLS. Important: Using encryption is subject to local regulation. In some countries it is restricted or limited for usage. For more information, consult your local reseller. Procedure 1. Navigate to <install_dir>\sipserver\conf. 2. Open the UpdatedSIPConfig.xml file in a text editor. 3. Configure FQDN of the B2BUA component by setting the value the <B2bFQDN> element as shown in Figure 52: Adding the B2bFQDN element on page 73. In a redundancy Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 72

73 environment, add the FQDN of the public virtual IP address. In a standalone environment, this is automatically added. Figure 52: Adding the B2bFQDN element 4. Configure the DNS of the B2BUA component by setting values in the entire <DNSServerList> element as shown in Figure 53: Adding the <DNSServerList> element on page 73: 5. Save and close the file. Figure 53: Adding the <DNSServerList> element 6. Start the Scopia Management service and the Scopia Management SIP service. Deployment Guide for Scopia TIP Gateway Version 8.2 Securing Your Video Network Using TLS 73

74 Chapter 7 Performing Maintenance Procedures This section details to the ongoing administrator tasks required to maintain your video network: Navigation Upgrading the Software File of a Video Device on page 74 Restoring the Previous Software Version of a Network Device on page 76 Downgrading your Scopia TIP Gateway on page 78 Changing the IP Address of your Gateway on page 78 Upgrading the Software File of a Video Device About this task You can quickly and easily perform remote software upgrades of video devices from Scopia Management by uploading an upgrade file and applying it to the device. Important: Perform the upgrade remotely using the Scopia Management. You cannot upgrade the firmware of the gateway directly on the device. Depending on your support contract, you can upgrade to: The next major version. Upgrading a major version requires a new license. This kind of upgrade changes one of the first two digits in a version number. For example, upgrading from version 8.0 to version 8.1 requires a new license. An incremental version. Upgrading an incremental version does not require a new license. This kind of upgrade changes the third, fourth and fifth digits in the version number. For example, upgrading from to or to does not require a new license. Upgrades may require first applying the major upgrade and then the incremental upgrade within that major version. For example, to upgrade from to , first apply the major upgrade to , and then the incremental upgrade to Deployment Guide for Scopia TIP Gateway Version 8.2 Performing Maintenance Procedures 74

75 Before you begin Before upgrading your video network devices, including endpoints, do the following: Before upgrading a video device software, back up its configuration by retrieving its configuration file. For more information on remote backups, see the Administrator Guide for Scopia Management. Go to to apply for and download your upgrade package. If you upgrade to a major version, ensure you have a new license key. The upgrade procedure is different when upgrading to a major new version compared with smaller incremental upgrades. See Administrator Guide for Scopia Management for details. Navigate to the device and select the Access tab. Enter a name and password for automatic login to the video device during the upgrade process. We recommend using the same name across the deployment. Procedure 1. Access the Scopia Management administrator portal. 2. Select the Devices tab. 3. Locate the video device as explained in the Administrator Guide for Scopia Management. 4. Select the device to be upgraded. 5. Select Manage > Upgrade Software. Figure 54: Upgrading the software file of a device 6. At the prompt, select OK to shut down the video device for a few minutes. This disconnects all active calls. 7. If there is no upgrade package in the dialog box, select Add. 8. Select Browse to search for the package you want to upload. Deployment Guide for Scopia TIP Gateway Version 8.2 Performing Maintenance Procedures 75

76 Figure 55: Uploading software update Table 11: Entering browsing details Field Software Upgrade File Save As Description Version Description This field is automatically filled when you select the software upgrade file. Enter the name of the software upgrade file. Enter a free text description of the upgrade package (for example, the version number). This is the version number of the package you are upgrading too. 9. Select Apply to save the upgrade file and its information in Scopia Management. 10. If required, enter license keys. 11. Select Apply. The system notifies that the video device shuts down for several minutes, causing all the active calls to be disconnected. Deployment Guide for Scopia TIP Gateway Version 8.2 Performing Maintenance Procedures 76

77 Restoring the Previous Software Version of a Network Device About this task This section explains how to restore a previous software version after you upgrade your network device. You can restore the same software version only once. During this procedure the network device shuts down for a few minutes causing all active calls to be disconnected. Some parameters are not backed up and cannot be restored: IP address IP mask Default router IP address MTU size - the size of the packets received from the gateway DNS suffix DNS primary address DNS secondary address Procedure 1. Access the Scopia Management administrator portal. 2. Search for an online network device as explained in. 3. Select Devices > Devices by Type > Gateways. 4. Select the network device whose software version you want to restore. 5. Select Manage > Restore Previous Version. The system informs you that all active calls on the device will be disconnected when you begin the process. 6. Select Yes in the confirmation message. The Update Log window opens showing the task progress (Figure 56: Progress of restoring a software package on page 78). Deployment Guide for Scopia TIP Gateway Version 8.2 Performing Maintenance Procedures 77

78 Figure 56: Progress of restoring a software package Downgrading your Scopia TIP Gateway If necessary, you can downgrade your network device in one of the following ways: To downgrade one version back after you upgraded your network device, perform the procedure in Restoring the Previous Software Version of a Network Device on page 76. To downgrade to a version earlier than the previous version, see Upgrading the Software File of a Video Device on page 74. Changing the IP Address of your Gateway About this task You may need to change the IP address of your gateway when it is transferred to a different subnet of your network. Perform the procedure described in Configuring the Device IP Addresses on page 25. Deployment Guide for Scopia TIP Gateway Version 8.2 Performing Maintenance Procedures 78