SCOPIA Video Gateway for Microsoft Lync

Transcription

1 SCOPIA Video Gateway for Microsoft Lync OCS Deployment Guide

2 RADVISION Ltd. All intellectual property rights in this publication are owned by RADVISION Ltd and are protected by United States copyright laws, other applicable copyright laws and international treaty provisions. RADVISION Ltd retains all rights not expressly granted. All product and company names herein may be trademarks of their registered owners. This publication is RADVISION confidential. No part of this publication may be reproduced in any form whatsoever or used to make any derivative work without prior written approval by RADVISION Ltd. No representation of warranties for fitness for any purpose other than what is specifically mentioned in this guide is made either by RADVISION Ltd or its agents. RADVISION Ltd reserves the right to revise this publication and make changes without obligation to notify any person of such revisions or changes. RADVISION Ltd may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time. If there is any software on removable media described in this publication, it is furnished under a license agreement included with the product as a separate document. If you are unable to locate a copy, please contact RADVISION Ltd and a copy will be provided to you. Unless otherwise indicated, RADVISION registered trademarks are registered in the United States and other territories. All registered trademarks recognized. For further information contact RADVISION or your local distributor or reseller. OCS Deployment Guide for SCOPIA Video Gateway for Microsoft Lync, 13 December

3 1 Table of Contents 1 About SCOPIA Video Gateway for Microsoft Lync Main Features of the SCOPIA Video Gateway...2 New Features of the SCOPIA Video Gateway...2 Technical Specifications Preparing the SCOPIA Video Gateway Setup Planning the Deployment Topology of your SCOPIA Video Gateway in the Enterprise... 6 Locating your SCOPIA Video Gateway within your Deployment...8 Ports to Open on the SCOPIA Video Gateway Prerequisites of your Current Video Network Checking Site Suitability Unpacking the Device Inspecting for Damage Setting up the SCOPIA Video Gateway Verifying Rack Suitability Choosing the Type of Rack Making Space for the SCOPIA Video Gateway Complying with SCOPIA Video Gateway Lifting Guidelines Mounting the SCOPIA Video Gateway onto the Rack Using a Shelf Locating a Shelf in the Rack Checking the Accessories Required for Mounting Attaching Brackets to the SCOPIA Video Gateway Table of Contents i

4 Marking the Location of the Device-fixing Cage Nuts Removing the Cage Nut Screws Mounting the Device-fixing Cage Nuts Mounting the SCOPIA Video Gateway onto the Shelf Connecting Cables to the Device Setting the IP Address of the SCOPIA Video Gateway Verifying the SCOPIA Video Gateway Installation Configuring Your SCOPIA Video Gateway Deployment Creating User Groups and Users in the Microsoft Active Directory Creating New User Groups in the Active Directory Creating New Users Representing Room Systems in the Active Directory Creating New Users Representing Personal Endpoints in the Active Directory Creating New Users Representing Virtual Rooms in the Active Directory Creating a User Representing the Auto-Attendant in the Active Directory Creating a User Representing My Virtual Room in the Active Directory Configuring the Office Communications Server Configuring OCS R2 to trust iview Management Suite Configuring Office Communications Server Static Route Enabling the TLS Connection in the Office Communications Server Configuring Ports on the SCOPIA Video Gateway Limiting TCP Port Range for H.245 on the SCOPIA Video Gateway Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway Configuring UDP Port for RAS on the SCOPIA Video Gateway Configuring TCP Port for Q.931 on the SCOPIA Video Gateway Adding and Configuring a SCOPIA Video Gateway in iview Management Suite Connecting iview Management Suite to Microsoft Components of Your Video Network Enabling the TLS Connection in iview Management Suite Adding an OCS Profile in iview Management Suite Connecting iview Management Suite with the LDAP Server Downloading H.323 Endpoints from the LDAP Server Downloading Virtual Rooms from the LDAP Server Enabling the Auto-Attendant Adding an OCS R2 Link to Join a Videoconference from MS Outlook Configuring a Third Party Deployment Table of Contents ii

5 Adding a Neighbor Gatekeeper Defining a Third Party Gatekeeper in SCOPIA iview Management Suite Importing Endpoints Registered to a Third-Party Gatekeeper Defining a Third-Party MCU in SCOPIA iview Management Suite Securing Your Video Network Using TLS Planning the Required Certificates for TLS Generating the Certificate Signing Request for iview Management Suite Generating the Certificate Signing Request for the SCOPIA Video Gateway Uploading iview Management Suite Certificates into iview Management Suite Uploading Certificates for Other Devices into iview Management Suite Uploading Certificates into the SCOPIA Video Gateway Performing Maintenance Procedures Upgrading the SCOPIA Video Gateway Restoring a Previous Software Version for the SCOPIA Video Gateway Downgrading your SCOPIA Video Gateway Changing the IP Address of your Gateway Troubleshooting Your SCOPIA Video Gateway Deployment All Endpoints Appear Offline Resolving Room System Availability Resolving OCS Client Connectivity in TLS Environment Retrieving SCOPIA Video Gateway Logs Resolving Secure Connectivity Issues in the SCOPIA Video Gateway Resolving a Copy and Paste Issue in the SCOPIA iview Network Manager Dealing with an Expired Certificate in the SCOPIA Video Gateway Table of Contents iii

6 1 About SCOPIA Video Gateway for Microsoft Lync SCOPIA Video Gateway for Microsoft Lync serves as a bridge between a video network based on endpoints and room systems using H.323 protocol and a video network based on Microsoft Lync platform. With a SCOPIA Video Gateway deployed into your existing solution, you can use these two separate video networks as one, making video calls from H.323 endpoints to Lync clients and vice versa. This bridge functionality characterizes the SCOPIA Video Gateway. Figure 1-1 on page 1 depicts the SCOPIA Video Gateway functionality. Figure 1-1 SCOPIA Video Gateway functionality You can use the SCOPIA Video Gateway both in SCOPIA Solution deployments and in third party video deployments. The SCOPIA Video Gateway for Microsoft Lync is also the first and only gateway available which is officially certified for Microsoft OCS-R2 and Lync video deployments. The certification process required rigorous and extensive testing to ensure the highest quality and compatibility. About SCOPIA Video Gateway for Microsoft Lync 1

7 Main Features of the SCOPIA Video Gateway The SCOPIA Video Gateway includes many powerful features including: Presence reflection All H.323 devices appear on the Lync Contact List. Their presence is updated dynamically according to their real-time status. Presence is updated for H.323 room systems, RADVISION MCU virtual rooms and the video auto-attendant. HD video transcoding SCOPIA Video Gateway transcodes Microsoft's RTVideo codec to H.264 video codec and vice versa, from RTVideo to H.264. This enables end-to-end HD video quality for every call, assuming HD is supported by both sides. Point-to-point calls A Microsoft Lync client can easily initiate a point-to-point call with any of the H.323 endpoints or room systems that are part of the Contact List. Calling an H.323 endpoint is just like when calling any other Lync client. Users can also call from an H.323 endpoint to a Lync client. Multipoint calls Several users can participate in the same meeting. This includes Lync clients and H.323 room systems and endpoints. Multipoint calls may be hosted on the RADVISION MCU or the Lync internal A/V MCU. Using the RADVISION MCU upgrades the user experience by providing continuous presence, Telepresence interoperability and full moderation capabilities. Joining a call on the RADVISION MCU is done by directly accessing one of the virtual rooms or using the video auto-attendant. Note that virtual rooms and auto-attendant are features of the RADVISION MCU. New Features of the SCOPIA Video Gateway The SCOPIA Video Gateway includes these new features: Support for the SCOPIA Solution The SCOPIA Solution supports the SCOPIA Video Gateway, allowing complete connectivity to the service provider network as well as complete integration with a Microsoft Lync deployment installed locally in the enterprise (tenant). Support for Microsoft Lync deployments hosted in the service provider network The RADVISION videoconferencing services support the SCOPIA Video Gateway and integrate with Microsoft Lync deployments installed in the service provider s network. Support of multiple Microsoft edge servers The SCOPIA Video Gateway works seamlessly with multiple edge servers located within the same domain or in a multi-tenant deployment where the gateway s resources are shared among multiple tenants. The SCOPIA Video Gateway always negotiates the call with the edge server located in its vicinity, thus attaining immediate call efficiency. About SCOPIA Video Gateway for Microsoft Lync 2

8 End-to-end call encryption The SCOPIA Video Gateway supports the H.235 encryption standard when connecting to H.323 devices. There is now a fully secured media path when connecting a call between a Microsoft Lync client and an H.323 device. All media lines (audio, video, data) are encrypted. Dialing an H.323 endpoint that has a public address A Lync client can dial the public IP address of an H.323 endpoint to set up the video call, even if the called H.323 endpoint does not belong to the organization (enterprise and/or partner) and as such is not listed in the Active Directory. Up-to-date presence information for an endpoint registered to a third-party gatekeeper Presence information in the Lync Contact List is available for non-radvision components in the H.323-based video network where you have deployed the SCOPIA Video Gateway. For example, all H.323 endpoints and third-party MCUs registered to the Cisco Video Communication Server (VCS) appear on the Lync Contact List and their presence is updated dynamically according to their real-time status. Seeing content shared by an H.323 endpoint When an H.323 endpoint shares content in a video call or in a videoconference, the SCOPIA Video Gateway automatically switches to the presentation channel and starts sending the presentation to the Lync client. The presentation is supported in H.264 format with a maximum resolution of 720p at 30fps; the minimum supported resolution is VGA at 30fps. Video Scaling The SCOPIA Video Gateway is capable of upscaling and downscaling the actual video resolution. The video resolution matching is required for Microsoft Lync native resolutions, such as VGA, to avoid image cropping. Customized user pictures in the Contact List of the MS Lync client Contacts have custom profile image for meeting rooms, virtual meeting rooms (including their personal virtual room), and auto attendant, allowing to identify the listed videoconference equipment at a glance. Technical Specifications This section lists important information about the device you purchased. Refer to this information when preparing system setup and afterwards to verify that the environment still complies with these requirements. System power requirements: VAC input, 50/60Hz auto-switched Power consumption: 946W (230V/4.3A or 115V/8.6A) Environmental requirements: Operating temperature: 10 C to 35 C (50 F to 95 F) Humidity: 90% non-condensing at 35 Storage and transit temperature: -40 C to 70 C (-40 F to 158 F), ambient About SCOPIA Video Gateway for Microsoft Lync 3

9 Physical dimensions: Size: 430mm (16.9 ) width x 43mm (1.7 ) height x 690mm (27.2 ) depth Weight: ~15kg (~34lbs) 19-inch rack-mountable with flanges Ethernet connection requirement: 1Gbps Communications: H.323 IPv4 Bit rate: up to 1.5Mbps per call Audio support: Codecs: G.711. G.722, G DTMF Translation: In-band to out-of-band translation Video support: Codecs: Microsoft RTVideo, H.264, H.263 Video resolutions for Microsoft Lync: CIF, VGA, 720p@30fps Microsoft RTVideo HD transcoding Content sharing H.323 to Lync, up to 720p resolution support Call capacity Table 1-1 on page 4 lists, for each SCOPIA Video Gateway license, the number of ports used for transcoding the video resolutions. Table 1-1 Call capacity Transcoding SCOPIA Video Gateway Entry Level SCOPIA Video Gateway X2 Capacity* HD 720p 5 ports 10 ports VGA 10 ports 20 ports CIF 20 ports 40 ports * Capacity is doubled using a license key that should be purchased separately. Scalability About SCOPIA Video Gateway for Microsoft Lync 4

10 Unlimited scalability with multiple Gateways The ratio depends on the number of room systems and on the overall video usage in the company. The recommended ratio is: High video usage demands one gateway port per one room system Medium video usage demands one gateway port per three room systems Low video usage demands one gateway port per five room systems Firewall traversal Microsoft A/V Edge integration using Microsoft ICE2 and Microsoft TURN. H , H (through SCOPIA PathFinder) Security Microsoft SRTP support Microsoft Transport Layer Security (TLS) H.235 AES encryption Interfaces RJ-45, dual gigabit Ethernet RJ-45 serial port connector About SCOPIA Video Gateway for Microsoft Lync 5

11 2 Preparing the SCOPIA Video Gateway Setup Perform procedures in this section to prepare the site and device for installation. Planning the Deployment Topology of your SCOPIA Video Gateway in the Enterprise page 6 Prerequisites of your Current Video Network... page 13 Ports to Open on the SCOPIA Video Gateway... page 10 Checking Site Suitability... page 13 Unpacking the Device... page 14 Inspecting for Damage... page 15 Planning the Deployment Topology of your SCOPIA Video Gateway in the Enterprise Note: This section provides general guidelines that are common for both the SCOPIA Solution deployments and third party deployments. Follow these guidelines to locate the SCOPIA Video Gateway and iview Management Suite in your video network, when the SCOPIA Solution is deployed in the enterprise. The guidelines describe a typical entreprise deployment of Lync Server 2010 and includes one OCS Server or multiple OCS Servers: Preparing the SCOPIA Video Gateway Setup 6

12 In a local deployment with one OCS Server, always place the SCOPIA Video Gateway and iview Management Suite at the location of the OCS Server (Figure 2-1 on page 7). Typically, there is no firewall between the iview Management Suite and the OCS Server and between the iview Management Suite and the SCOPIA Video Gateway. Figure 2-1 Example of a local deployment with one OCS Server However, if there is a firewall between these components, for example, if the iview Management Suite is located in the DMZ in the Complete Centralized Solution, you need to open several ports on the firewall to allow connection. For more information, see Ports to Open on the SCOPIA Video Gateway on page 10. In a local deployment with more than one OCS Server, place your SCOPIA Video Gateway and iview Management Suite in the same location as the mainocs Server (Figure 2-2 on page 7). It is recommended that you locate the iview Management Suite within a close physical proximity to the OCS Server. If you need to locate more than one SCOPIA Video Gateway in such a deployment, place them together with the other OCS Servers. Figure 2-2 Example of a local deployment with multiple Lync Servers Preparing the SCOPIA Video Gateway Setup 7

13 Locating your SCOPIA Video Gateway within your Deployment After you have chosen the topology of your deployment, you must decide how many SCOPIA Video Gateways you need to deploy, and where to locate these gateways in your deployment. Planning your SCOPIA Video Gateway deployment can make the process significantly more efficient. The deployment process may be different depending on your current video network and the features you want to enable. Deploying the SCOPIA Video Gateway requires configuring the unit itself as well as several other components. It is due to this nature of configuration that it becomes very important to plan how many SCOPIA Video Gateways, meeting rooms, endpoints and public virtual rooms you want to add to your deployment. Depending on the selected deployment, the setup is composed of these mandatory components: SCOPIA Video Gateway SCOPIA iview Management Suite Standalone SCOPIA Gatekeeper for providing the address resolution functionality in H.323 networks. Lync Server and Clients (and associated components). All clients are assumed to have video and audio support. H.323 endpoints. Other optional components typically include: RADVISION MCU for housing videoconferences from multiple endpoints, both H.323 and SIP. Personal terminals. These are specifically defined endpoints which are associated with a Lync account. When the account is dialed, both the personal terminal and the Lync Client ring simultaneously. SCOPIA PathFinder Server. This component allows H.323 calls to traverse firewalls. SCOPIA Desktop Server, SCOPIA Desktop Clients and SCOPIA Mobiles. SCOPIA Desktop Server acts as a gateway from SCOPIA Desktop Clients to a RADVISION MCU and handles all media connections.scopia Desktop Client is a simple web conferencing client for interactive conferencing using high definition or standard definition broadcasting. SCOPIA Mobile enables users to easily connect to a videoconference and fully participate in the meeting on ios devices like the Apple iphone, ipod touch and ipad. Figure 2-3 on page 9 describes a typical deployment of the SCOPIA Video Gateway in an enterprise that uses a locally installed Lync Server. Preparing the SCOPIA Video Gateway Setup 8

14 Figure 2-3 Deploying the SCOPIA Video Gateway and the Lync Server in the enterprise Plan your deployment by answering the questions below and checking Technical Specifications page 3. Where are you planning to locate the SCOPIA Video Gateways? Decide how many SCOPIA Video Gateways you need to deploy: How many simultaneous Microsoft Lync or Microsoft Office Communications participants will be in your SCOPIA Video Gateway deployment? What video quality will be used in your deployment: high definition (HD) or standard definition (SD)? How many Microsoft Edge Servers will the SCOPIA Video Gateway support? How many H.323 room systems do you want to add to your SCOPIA Video Gateway deployment? Where are these H.323 room systems physically located? If you have a RADVISION MCU deployed in your network, do you want to enable public virtual rooms? How many public virtual rooms do you want to enable? If you have a RADVISION MCU deployed in your network, do you want to enable the video auto-attendant feature? Which type of security (TLS/TCP) do you want to ensure in your deployment? If TLS is required, make sure to generate the SCOPIA iview Management Suite and SCOPIA Video Gateway certificates. Which naming convention do you want to use for your meeting rooms and virtual meeting rooms? It is important to use these names consistently during configuration of different network components. We highly recommend that you use self-explanatory names based on a location or a user name. For example, use London Main Meeting Room for a meeting room situated in London. Preparing the SCOPIA Video Gateway Setup 9

15 Ports to Open on the SCOPIA Video Gateway The SCOPIA Video Gateway is typically deployed in the enterprise network. When opening ports on the device, use the following as a reference: If you are opening ports that are both in and out of the gateway, see Table 2-1. If you are opening ports outbound from the gateway, see Table 2-2. If you are opening ports inbound to the gateway, see Table 2-3. Note: Choosing the specific firewalls where ports need to be opened depends on where your gateway and your other SCOPIA Solution products are deployed. Table 2-1 Bidirectional Ports to Open on the SCOPIA Video Gateway Port Range Protocol Destination Functionality Result of Blocking Port 443 STUN (TCP) Microsoft STUN Server Enables remote SIP ICE connectivity H.245 (TCP) Any H.323 device Enables H.245 signaling 1719 RAS (UDP) H.323 gatekeeper Enables RAS signaling 1720 Q.931 (TCP) Any H.323 device Enables Q.931 signaling 3336 XML (TCP) iview Management Suite Enables you to manage this gateway via the XML API Cannot connect remote endpoints Cannot connect H.323 calls Cannot communicate with H.323 gatekeeper Cannot connect H.323 calls Cannot use the XML API to manage the gateway Required Mandatory Mandatory To limit range, see Limiting TCP Port Range for H.245 on the SCOPIA Video Gateway on page 53 Mandatory To configure, see Configuring UDP Port for RAS on the SCOPIA Video Gateway on page 56 Mandatory To configure, see Configuring TCP Port for Q.931 on the SCOPIA Video Gateway on page 58 Mandatory Preparing the SCOPIA Video Gateway Setup 10

16 Port Range Protocol Destination Functionality Result of Blocking Port 3338 XML (TCP) iview Management Suite, or any third-party configuration applications 3346 XML (TLS) iview Management Suite 3348 XML (TLS) iview Management Suite, or any third-party configuration applications Enables you to configure the gateway via the XML API Enables you to manage SCOPIA Video Gateway for Microsoft Lync via the XML API Enables you to configure SCOPIA Video Gateway for Microsoft Lync via the XML API 3478 STUN (UDP) STUN Server Enables remote endpoint to connect 5060 SIP (TCP/ UDP) Any SIP video network devices 5061 SIP (TLS) Any SIP video network devices RTP/ RTCP / SRTP(UDP) RTP/ RTCP / SRTP (UDP) Any H.323 or SIP media- enabled video network device Any H.323 or SIP media-enabled video network device Enables SIP signaling Enables secure SIP signaling Video: Enables real-time delivery of video media Audio: Enables real-time delivery of audio media Cannot use the XML API to configure the gateway Cannot use the XML API to manage SCOPIA Video Gateway for Microsoft Lync Cannot use the XML API to configure SCOPIA Video Gateway for Microsoft Lync Cannot connect remote endpoints Cannot connect SIP calls Cannot connect SIP calls via TLS Cannot transmit/ receive video media streams Cannot transmit/ receive audio media streams Required Mandatory Mandatory if using TLS Mandatory if using TLS Mandatory Mandatory Mandatory if using TLS Mandatory To configure, see Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway on page 54 Mandatory To configure, see Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway on page 54 Preparing the SCOPIA Video Gateway Setup 11

17 Port Range Protocol Destination Functionality Result of Blocking Port (SCOPIA Video Gateway only) (SCOPIA Video Gateway only) RTP/ RTCP / SRTP (TCP) RTP/ RTCP / SRTP (TCP) Any H.323 or SIP media-enabled video network device Any H.323 or SIP media-enabled video network device Audio: Enables real-time delivery of audio media Video: Enables real-time delivery of video media Cannot transmit/ receive audio media streams Cannot transmit/ receive audio media streams Required Mandatory To configure, see Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway on page 54 Mandatory To configure, see Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway on page 54 Table 2-2 Outbound Ports to Open from the SCOPIA Video Gateway Port Range Protocol Destination Functionality Result of Blocking Port 162 SNMP (UDP) iview Network Manager, iview Management Suite, or any SNMP manager station Enables sending SNMP Trap events Cannot send Traps via a Network Manager Required Recommended Table 2-3 Inbound Ports to Open to the SCOPIA Video Gateway Port Range Protocol Destination Functionality Result of Blocking Port 21 FTP (TCP) FTP Server Enables audio stream recording 22 SSH (TCP) SSH Client Enables you to view logs for SCOPIA Video Gateway in real-time 80 HTTP (TCP) Web client Enables you to upgrade SCOPIA Video Gateway and download customer support information Cannot record audio streams Cannot view logs in real- time (logs are collected on local storage device) Cannot upgrade SCOPIA Video Gateway or download customer support information Required Optional Optional Mandatory Preparing the SCOPIA Video Gateway Setup 12

18 Prerequisites of your Current Video Network Verify that your current video network complies with the following requirements: Your video network employs a Microsoft Office Communications Server 2007 R2 Standard Edition or Enterprise Edition Your video network uses H.323 endpoints and MCU The iview Management Suite containing the SCOPIA Gatekeeper should be installed and configured. For information about installing iview Management Suite, refer to the Installation Guide for iview Management Suite release 7.7. Note: This document assumes that SCOPIA Gatekeeper (the gatekeeper module which is part of iview Management Suite) is used for H.323 signal management. When using the standalone ECS gatekeeper, perform the same actions on the standalone ECS instead of the SCOPIA Gatekeeper. If you want to support high definition (HD) video calls, Microsoft Office Communications Clients must be installed on computers capable of supporting HD video calls according to system requirements defined by Microsoft. In addition to these requirements, ensure that you have administrator s rights on the Microsoft Office Communications Server as well as the Microsoft Active Directory. You need to be able to change configuration settings on these servers. Checking Site Suitability Prior to installing the SCOPIA Video Gateway you need to verify your site suitability for: System power requirements System environmental requirements The device physical dimensions Read the Technical Specifications page 3 to learn about these requirements. Ensure to make necessary changes in case you find that the site does not meet any of the requirements described in that section. Preparing the SCOPIA Video Gateway Setup 13

19 Unpacking the Device We strongly recommend that you follow safety guidelines described in this section during unpacking. Procedure Step 1 Step 2 Inspect the shipping box to verify that it is not seriously damaged during shipping. Place the shipping box on a horizontal surface paying attention to the This Side Up symbol on the shipping box. See Figure 2-4 on page 14. Figure 2-4 This Side Up symbol Caution The accessories kit is situated on top of the device inside the shipping box and can be damaged if the box is placed upside down. Pay attention to the This Side Up symbol on the shipping box to handle the box correctly at all times. Warning To prevent injury and equipment damage, follow lifting guidelines described in the Safety Guide when lifting or moving the shipping box. Step 3 Caution Cut the plastic straps. The plastic straps are tightly stretched and can hit you when you cut them. To avoid this, make sure you do not face the side of the box secured by the straps before you cut the straps. Step 4 Step 5 Step 6 Step 7 Cut the strapping tape. Open the shipping box. Take the accessories kit out of the shipping box. Take the device out of the shipping box. Preparing the SCOPIA Video Gateway Setup 14

20 Step 8 Carefully open the additional boxes, remove the packing material, and remove the drives and other contents. Note: We recommend that you keep the packaging materials in case you need to repack the device. Step 9 After opening the shipping box, check the shipment is complete. Compare the contents of the shipment with your packing list. Inspecting for Damage After you verify that all of the equipment is included, carefully examine the power supplies and cables for any damage resulting from shipping. If you suspect any damage from shipping, contact your local freight carrier for procedures on damage claims. If you observe any physical defects in the items you ordered, contact RADVISION Technical Support for Return Material Authorization (RMA) form. Note: Before proceeding with the installation, verify that all of the ordered parts are present and in good condition. Keep a record of the parts and serial numbers. If any parts are missing or damaged, contact your sales representative. Preparing the SCOPIA Video Gateway Setup 15

21 3 Setting up the SCOPIA Video Gateway Mount the device onto a 19 square-hole rack. Use a shelf to support the device in the rack (Figure 3-1 on page 16). Figure 3-1 Shelf mounted SCOPIA Video Gateway These sections describe how to set up the device: Verifying Rack Suitability... page 17 Complying with SCOPIA Video Gateway Lifting Guidelines... page 19 Mounting the SCOPIA Video Gateway onto the Rack Using a Shelf... page 19 Connecting Cables to the Device... page 27 Setting up the SCOPIA Video Gateway 16

22 Verifying Rack Suitability Choosing the Type of Rack There are some critical requirements that you must meet when choosing a rack and before mounting the device into it. Choosing the Type of Rack... page 17 Making Space for the SCOPIA Video Gateway... page 17 There are many types of racks on the market. The installation instructions in this guide are intended for a 19 rack. Verify that the 19 rack meets the EIA-310 standards. This standard includes precise definitions of the shape of the holes, their size, the depth of the rack and other features. For more information on the EIA-310 standard, see Notice that the vertical square holes on the rack posts are not spaced equally. They form a repeating pattern of two holes close together, then one hole separate, then two holes close together and so on. See Figure 3-2 on page 17. Figure 3-2 Hole distribution on 19 rack Making Space for the SCOPIA Video Gateway When checking for an empty space to setup the device, be aware of its physical dimensions. Install the device in an open rack whenever possible. If installation in an enclosed rack is unavoidable, ensure that the rack has adequate ventilation. Avoid placing the device in an overly congested rack or directly next to another equipment rack. Otherwise, the heated exhaust air from other equipment can enter the inlet air vents and cause the device to overheat. Maintain a minimum clearance of 3 inches (7.62 cm) on the left and right of the device for the cooling air inlet and exhaust vents. Setting up the SCOPIA Video Gateway 17

23 Find a space on the rack which is at least 7 empty square holes in height on the rack posts. The SCOPIA Video Gateway takes up 3 holes (1U) on the posts. You need at least 2 additional holes to slide the device into the rack. See Figure 3-3 on page 18. Figure 3-3 Height of the SCOPIA Video Gateway in the rack To mount the SCOPIA Video Gateway between two posts, the width between the inner sides of the two posts must be at least 17.7 inches (45 cm). See Figure 3-4 on page 18. Figure 3-4 Width between inner sides of posts Setting up the SCOPIA Video Gateway 18

24 Complying with SCOPIA Video Gateway Lifting Guidelines The device is very heavy and is not intended to be moved frequently. Before you install the device, ensure that your site is properly prepared, so you can avoid having to move the chassis later to accommodate for power sources and network connections. Whenever you lift the chassis or any heavy object, follow these guidelines: Always disconnect all external cables before lifting or moving the SCOPIA Video Gateway. Do not attempt to lift the device by yourself; have someone assist you. Ensure that your footing is solid, and balance the weight of the object between your feet. Lift the device slowly; never move suddenly or twist your body as you lift. Keep your back straight and lift with your legs, not your back. If you must bend down to lift the device, bend at the knees, not at the waist, to reduce the strain on your lower back muscles. Lift the device from the bottom. Grasp the underside of the device with both hands. Mounting the SCOPIA Video Gateway onto the Rack Using a Shelf Locating a Shelf in the Rack This section describes how to mount the unit on to your rack: Locating a Shelf in the Rack... page 19 Checking the Accessories Required for Mounting... page 20 Attaching Brackets to the SCOPIA Video Gateway... page 22 Marking the Location of the Device-fixing Cage Nuts... page 23 Removing the Cage Nut Screws... page 24 Mounting the Device-fixing Cage Nuts... page 25 Mounting the SCOPIA Video Gateway onto the Shelf... page 25 Before choosing a shelf that will support the device, follow this procedure. Procedure Step 1 Step 2 Read Verifying Rack Suitability on page 17, which contains important positioning and spacing information. Prepare masking tape or a felt-tip pen to mark the location of the device-fixing cage nuts. If the holes on the rack are marked with numbers, write down the numbers on a piece of paper. Setting up the SCOPIA Video Gateway 19

25 Step 3 If you choose to mount the shelf, see the manufacturer s guidelines for mounting a shelf. When looking for a location on the rack (see Figure 3-5 on page 20): Choose a shelf on a rack with at least 1.73 inches (4.4 cm) of empty space above. Verify that the shelf you want to use is properly mounted and secured. Verify that the shelf can support the device weight. See Technical Specifications page 3. Verify a hole is present 0.75 inches (2 cm) above the shelf (measured from the center of the hole). Figure 3-5 Checking the location of the shelf in the rack Step 4 Step 5 Ensure the shelf is positioned horizontally in the rack. Ensure the rack breaks are locked or the rack is stabilized. Checking the Accessories Required for Mounting Check you have the accessories necessary for mounting the device (see Figure 3-6 on page 21): 2 mounting brackets (left and right) 2 cage nuts (M6) each with its hexagon socket cap screw (M6x10, DIN 7984), not included. 4 Phillips screws already mounted on the device. 4 Phillips screws #6-32 x 1/4 inch for mounting the brackets replacing the mounted Phillips screws. 2 rack screws #10-32 x 3/4 inch, to attach the brackets to the rack. Note: Make sure you have a ruler, an Allen wrench (4 mm diameter), and a screwdriver (Nr. 1 tip) ready to hand before you start the setup. Setting up the SCOPIA Video Gateway 20

26 Figure 3-6 Accessories required for mounting Setting up the SCOPIA Video Gateway 21

27 Attaching Brackets to the SCOPIA Video Gateway The brackets serve to secure the device to the rack s front posts. Procedure Step 1 Step 2 Position the device on a flat, horizontal surface. Make sure the device front panel faces toward you. Unscrew the two Phillips screws on either side of the device. They hold the front panel in place. See Figure 3-7 on page 22. Figure 3-7 Removing the Phillips screws on the side panel Step 3 Attach the brackets on each side of the device side panel with the Phillips screws. See Figure 3-8 on page 23. Use the Phillips screws of the accessories kit, as they have the correct length and color. Setting up the SCOPIA Video Gateway 22

28 Figure 3-8 Aligning the bracket with the SCOPIA Video Gateway front panel Marking the Location of the Device-fixing Cage Nuts There is a pair of cage nuts, one for each front-facing rack post. You need these cage nuts to fix the device brackets to the post. Before attaching the cage nuts to the rack, mark where you plan to attach them, so you can be sure they are level and properly placed. Setting up the SCOPIA Video Gateway 23

29 Procedure Step 1 From inside the front-facing rack post, mark the location of the device-fixing cage nut measured at 0.75 inches (2 cm) above the shelf. See Figure 3-9 on page 24. Figure 3-9 Marking the location of the device-fixing cage nut on the rack Step 2 Repeat this procedure for the other front-facing post. Removing the Cage Nut Screws The cage nuts are not included with this product, but are typically supplied with pre-mounted screws. Remove the screws and put them aside for later. See Figure 3-10 on page 24. Figure 3-10 Removing the cage nut screw Setting up the SCOPIA Video Gateway 24

30 Mounting the Device-fixing Cage Nuts After you have marked the location of these cage nuts on the front-facing posts, you can mount them into the rack. Insert each cage nut on each of the posts where you have placed marks on the rack. Procedure Step 1 Step 2 Rotate the bottom cage nut so that its wings are on the top and bottom sides of the cage nut. See Figure 3-9 on page 24. Compress the wings. From the back side of the post, insert first the wide wing, then the narrow wing into the marked square hole. Release the wings after the nut is in position. Mounting the SCOPIA Video Gateway onto the Shelf After you have inserted the cage nuts onto the posts, you can mount the device onto the rack. Before mounting the device, read the Safety Guidelines described in the Safety Guide. Secure the device on the rack s posts to prevent it from moving around or falling. Warning The device is heavy and we recommend that you ask someone to help you lift it. Setting up the SCOPIA Video Gateway 25

31 Procedure Step 1 Step 2 Lift the device according to the instructions in Complying with SCOPIA Video Gateway Lifting Guidelines on page 19. Slide the device onto the shelf until the holes on the device s brackets align with the cage nuts you mounted previously. See Figure 3-11 on page 26. Figure 3-11 Sliding the SCOPIA Video Gateway onto the shelf Step 3 Insert the two long rack screws provided with the product through the bracket holes into the cage nuts in the rack. Using the Allen wrench tighten the screws to secure the device to the front posts. See Figure 3-12 on page 27. Setting up the SCOPIA Video Gateway 26

32 Figure 3-12 Securing the SCOPIA Video Gateway to the rack Connecting Cables to the Device Follow the safety guidelines described in the Safety Guide during this procedure, and use the power, network, and serial cables supplied with the accessories kit. Procedure Step 1 Connect the power cable: a. Turn off the power distribution unit (PDU). b. On the rear side of the device, plug in the power cable into the AC power connector (see Figure 3-13 on page 27). Figure 3-13 Rear panel of the device c. Plug in the other end of the power cable into the mains. Setting up the SCOPIA Video Gateway 27

33 d. Power on the device using the On/Off switch on the front side of the device (see Figure 3-14 on page 28). Figure 3-14 Device front panel Step 2 e. Turn on the power distribution unit (PDU). Connect a computer to the device with a serial cable. Connect one end to the PC serial port and the other end to the SCOPIA Video Gateway Serial connector. This connection is required for local configuration and maintenance. Note: Do not connect a screen or a keyboard to the SCOPIA Video Gateway. Setting the IP Address of the SCOPIA Video Gateway Use the serial port on the back panel of the device to connect it directly to a PC to assign an IP address. You must assign the IP address before you connect the device to the network. Before You Begin Make sure you have these items: Dedicated IP address for the device Dedicated subnet mask for the device IP address of the default router which the device uses to communicate over the network A PC with an available serial port. It should have terminal emulator software installed. Serial cable provided with the device. Procedure Step 1 Step 2 Connect the power cable but do not switch on the device. Start the terminal emulation application on the PC. Setting up the SCOPIA Video Gateway 28

34 Step 3 Set the communication settings in the terminal emulation application on the PC as follows: Field Name Value Baud Rate 9600 Data bits 8 Parity None Stop bits 1 Flow Control None Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Turn on the power to the SCOPIA Video Gateway. A log of the auto-boot events scrolls across the computer monitor. When the message Press any key to start configuration appears on the screen, press a key and wait for the following message: Main menu N: Configure network port values Enter N at the prompt to configure default network port values and press Enter. Enter 2 to change the network configuration. Enter the subnet mask without leading zeros at the Enter IP Mask for default device prompt and then press Enter. If you are not using a subnet mask, press Enter. Allow the unit to complete the reboot process. A new emulator session begins. Close the terminal emulator session. Connect a network cable to the left Ethernet connector on the rear side of the device (see Figure 3-13 on page 27). Setting up the SCOPIA Video Gateway 29

35 Verifying the SCOPIA Video Gateway Installation After you installed the device and performed its initial configuration, you need to verify that it is installed and configured correctly. Procedure Step 1 On the front panel, verify that the power alarm LED is lit green lower down on the unit. Figure 3-15 Locating the front panel LEDs Step 2 Step 3 Step 4 On the front panel, verify that the status LED is lit green. Check the network connection by verifying that the Ethernet activity LED is lit green. If one of the LEDs does not light as described in the previous steps, the device is not functioning properly. Setting up the SCOPIA Video Gateway 30

36 4 Configuring Your SCOPIA Video Gateway Deployment To configure your video network using SCOPIA Video Gateway, you need to configure the following deployment components: SCOPIA Video Gateway, iview Management Suite, Microsoft Active Directory, and Microsoft Office Communications Server (OCS). You also need to configure non-radvision gatekeepers if they are used in your video network. Note: Only the personnel that installed the OCS services and the customer's network administrator can modify the OCS configuration. Most of the SCOPIA Video Gateway features need to be configured on more than one component. For example, to add H.323 meeting rooms to your Microsoft Lync deployment, you first need to add users that represent H.323 meeting rooms to the Active Directory, and then you download these users as H.323 meeting rooms from the Active Directory into the iview Management Suite. To make the configuration process orderly we recommend that you configure all necessary features on each component in the correct order. This chapter guides you through the recommended configuration process which consists of these stages: 1. Configure the Microsoft Active Directory as described in Creating User Groups and Users in the Microsoft Active Directory page Perform procedures in Configuring the Office Communications Server page Perform the procedures in Configuring Ports on the SCOPIA Video Gateway page Perform the procedure in Adding and Configuring a SCOPIA Video Gateway in iview Management Suite page Connect iview Management Suite to Microsoft components and synchronize them as described in Connecting iview Management Suite to Microsoft Components of Your Video Network page If your video network consists not only of RADVISION products, perform procedures described in Configuring a Third Party Deployment page 79. Configuring Your SCOPIA Video Gateway Deployment 31

37 Creating User Groups and Users in the Microsoft Active Directory As the first step of your SCOPIA Video Gateway deployment, you need to add user groups and users dedicated to room systems and personal endpoints to your Active Directory. If your deployment has a RADVISION MCU, you can also add a user group and users for public virtual rooms and auto-attendant. At a later stage the users you created are downloaded into the iview Management Suite as meeting rooms, personal endpoints, public virtual rooms, and auto-attendant. You create new user groups for different kinds of users. After the user groups are ready, you create users and assign users to user groups. For example, in order to create a user dedicated to an H.323 room system, you need to first create a user group for H.323 room systems, and then create a user and assign this user to the H.323 user group. We highly recommend that you plan your SCOPIA Video Gateway deployment before performing this procedure. Creating New User Groups in the Active Directory... page 32 Creating New Users Representing Room Systems in the Active Directory... page 34 Creating New Users Representing Personal Endpoints in the Active Directory... page 37 Creating New Users Representing Virtual Rooms in the Active Directory... page 39 Creating a User Representing the Auto-Attendant in the Active Directory... page 42 Creating a User Representing My Virtual Room in the Active Directory... page 44 Creating New User Groups in the Active Directory You need to create these user groups for these types of users: H.323 room systems registered to a SCOPIA Gatekeeper personal endpoints registered to a SCOPIA Gatekeeper or a third-party gatekeeper public virtual rooms H.323 room systems registered by a third-party gatekeeper (only in deployments using a third-party gatekeeper) Before You Begin Decide on names you want to use for user groups before starting the procedure. We highly recommend that you use these names: Meeting Rooms for H.323 rooms systems Personal Rooms for personal endpoints Public Virtual Rooms for public virtual rooms Procedure Step 1 Step 2 Access the Active Directory. Navigate to the relevant folder in the left pane. Configuring Your SCOPIA Video Gateway Deployment 32

38 Step 3 Create a user group for H.323 room systems: a. Right-click Users and select New > Group in the left pane. Figure 4-1 Creating a new user group in Active Directory b. Enter the name for your new user group. Figure 4-2 Entering details for a new user group Configuring Your SCOPIA Video Gateway Deployment 33

39 c. Select a relevant option in the Group scope section. d. Select Security in the Group type section. Step 4 e. Select OK. Repeat Step 3 to create other user groups necessary for your deployment: Personal endpoints Public virtual rooms Creating New Users Representing Room Systems in the Active Directory During this procedure you create Active Directory users for all room systems you want to enable in your video network. H.323 users can be represented by Active Directory users either of the room system type or the personal endpoint type. If a room system functions as someone s personal endpoint, you should assign the personal endpoint type to this room system. At the end of this procedure you assign these new users to the Meeting Rooms user group. Before You Begin Verify that there is a user group representing room systems in Active Directory. For information about creating user groups, see Creating New User Groups in the Active Directory on page 32. Procedure Step 1 Step 2 Access the Active Directory. Create a new user for a specific room system: a. Right-click Users and select New > User in the left pane. b. Enter the name for this meeting room in the First name and Full name fields. We recommend that you use a self explanatory name like London_Meeting_Room. Note: You cannot use spaces in names. Configuring Your SCOPIA Video Gateway Deployment 34

40 Figure 4-3 Entering details for the new user Step 3 c. Enter the user login name. d. Select Next. e. Enter your password when prompted. f. Select Finish. The new user is added to your Active Directory. Define the user you created: a. Right-click the user you added and select Properties. The General tab is displayed. b. Enter the telephone number for the H.323 room system. c. Enter the address for the H.323 room system. For example, in Figure 4-4 we created a new user representing a room system in London with the telephone number 1111 and the address London_Meeting_Room@support2008.com. Configuring Your SCOPIA Video Gateway Deployment 35

41 Figure 4-4 Entering a phone number and an for the new user d. Enable new users on OCS by selecting the Communications tab and then selecting the Enable user for Office Communications Server. Figure 4-5 Enabling a user for Office Communications Server Step 4 Assign the user you created to a relevant user group: a. Select the Member Of tab. Configuring Your SCOPIA Video Gateway Deployment 36

42 Figure 4-6 Assigning the new user to a user group b. Select Add. c. Select Advanced. d. Select Find Now. e. Select Meeting Room from the list. f. Select OK. g. Select OK. Creating New Users Representing Personal Endpoints in the Active Directory Perform this procedure to create users for all personal H.323 endpoints that you want to enable in your video network. Before You Begin Verify that there is a user group representing personal endpoints in Active Directory. For information about creating user groups, see Creating New User Groups in the Active Directory on page 32. Procedure Step 1 Step 2 Access the Active Directory. Double-click the Active Directory user to whom you want to assign a personal endpoint. The Properties dialog box opens. Configuring Your SCOPIA Video Gateway Deployment 37

43 Figure 4-7 The Properties Dialog box Step 3 Step 4 Verify that the telephone number configured in the Active Directory is the number of this user s personal endpoint. Figure 4-7 shows details of an existing user with the personal endpoint number Assign the user you created to the Personal Endpoints group. a. Select the Member Of tab. Figure 4-8 Assigning the new user to the Personal Endpoints group Configuring Your SCOPIA Video Gateway Deployment 38

44 b. Select Add. c. Select Advanced. d. Select Find Now. e. Select Personal Endpoints from the list. f. Select OK. g. Select OK. Creating New Users Representing Virtual Rooms in the Active Directory You need to create users for public virtual rooms only if your video network includes a RADVISION MCU. During this procedure you define the virtual room ID that is used by H.323 room systems for accessing this virtual room. Procedure Step 1 Step 2 Access the Active Directory. Create a new user for a specific virtual room: a. Right-click Users and select New > User in the left pane. b. Enter the name for this virtual room in the First name field. We recommend that you use a self explanatory name like Virtual_Room_1. Note: You cannot use spaces in user names. Figure 4-9 Entering details for the new user c. Enter the user login name. d. Select Next. The new user is added to your Active Directory. Configuring Your SCOPIA Video Gateway Deployment 39

45 Step 3 Define the user you created: a. Right-click the user you added and select Properties. The General tab is displayed. b. Enter the virtual room ID number in the Telephone Number field. c. Enter the address for this virtual room. For example, in Figure 4-10 we created a new user representing a virtual room with the ID and the Virtual_Room_1@support2008.com. The address cannot be longer than 25 characters. Figure 4-10 Entering a phone number for the new user d. Enable new users on OCS by selecting the Communications tab and then selecting the Enable user for Office Communications Server. Configuring Your SCOPIA Video Gateway Deployment 40

46 Figure 4-11 Enabling a user for Office Communications Server Step 4 Assign the user you created to a relevant user group: a. Select the Member Of tab. Figure 4-12 Assigning the new user to a user group b. Select Add. c. Select Advanced. Configuring Your SCOPIA Video Gateway Deployment 41

47 d. Select Find Now. e. Select Public Virtual Room from the list. f. Select OK. g. Select OK. Creating a User Representing the Auto-Attendant in the Active Directory You need to create a user that represents the auto-attendant if you want to enable this functionality in your video network. This functionality is available only in deployments using a RADVISION MCU. Procedure Step 1 Step 2 Access the Active Directory. Create a new user for a specific room system: a. Right-click Users and select New > User in the left pane. b. Enter the name for this user in the First name field. We recommend that you use a self explanatory name like AutoAtten. Note: Do not use spaces in names. Figure 4-13 Entering details for the new user c. Enter the user login name. d. Select Next. Configuring Your SCOPIA Video Gateway Deployment 42

48 Step 3 e. Select Finish. The new user is added to your Active Directory. Define the user you created: a. Right-click the user you added and select Properties. The General tab is displayed. b. Enter the address for this user. The address cannot be longer than 25 characters. For example, in Figure 4-14 we created a new user representing the auto-attendant with the address AutoAtten@support2008.com. Note: This Active Directory user does not need to be part of a user group. Figure 4-14 Entering an address for the new user Note: The LDAP Configurations tab includes the checkbox Do not update users without an address from the LDAP server to RADVISION iview Suite. If the checkbox is selected, you need to configure the auto-attendant with an address for receiving future updates. c. Enable new users on OCS by selecting the Communications tab and then selecting the Enable user for Office Communications Server. Configuring Your SCOPIA Video Gateway Deployment 43

49 Figure 4-15 Enabling a user for Office Communications Server Creating a User Representing My Virtual Room in the Active Directory You need to create a user that represents the user s personal virtual room if you want to enable this functionality in your video network. This functionality is available only in deployments using a RADVISION MCU. Procedure Step 1 Step 2 Access the Active Directory. Create a new user for a specific room system: a. Right-click Users and select New > User in the left pane. b. Enter the name for this user in the First name field. We recommend that you use a self explanatory name like My_Virtual_Room. Note: Do not use spaces in names. Configuring Your SCOPIA Video Gateway Deployment 44

50 Figure 4-16 Entering details for the new user Step 3 c. Enter the user login name. d. Select Next. e. Select Finish. The new user is added to your Active Directory. Define the user you created: a. Right-click the user you added and select Properties. The General tab is displayed. b. Enter the address for this user. The address cannot be longer than 25 characters. For example, in Figure 4-14 we created a new user representing My Virtual Room with the address MyVRoom@support2008.com. Note: This Active Directory user does not need to be part of a user group. Configuring Your SCOPIA Video Gateway Deployment 45

51 Figure 4-17 Entering an address for the new user Note: The LDAP Configurations tab includes the checkbox Do not update users without an address from the LDAP server to RADVISION iview Suite. If the checkbox is selected, you need to configure the user with an address for receiving future updates. Configuring Your SCOPIA Video Gateway Deployment 46

52 Configuring the Office Communications Server You configure the Office Communications Server after the Microsoft Active Directory is configured. Figure 4-18 The second step of configuring components of your SCOPIA Video Gateway deployment Configuring OCS R2 to trust iview Management Suite... page 47 Configuring Office Communications Server Static Route... page 49 Configuring OCS R2 to trust iview Management Suite Ensure that OCS R2 and the SCOPIA Video Gateway can work together in the same deployment by configuring OCS R2 to trust the iview Management Suite. Procedure Step 1 Step 2 Step 3 On the server on which OCS R2 runs, select Start > Administrative tools > Office Communications Server. In the left pane, navigate to the OCS folder. Right-click the OCS folder and select Properties > Front End Properties. The OCS R2 Front End Properties dialog box opens. Configuring Your SCOPIA Video Gateway Deployment 47

53 Figure 4-19 Adding iview Management Suite to the list of trusted hosts of OCS Step 4 Select Add. The Add Authorized Host dialog box opens. Figure 4-20 Entering the IP address of iview Management Suite in the Add Authorization Host dialog box Configuring Your SCOPIA Video Gateway Deployment 48

54 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Select the FQDN and enter the FQDN of the iview Management Suite in the field, for example RVCN-IVIEW-W14.LYNC2010.COM. Or Select IP address and enter the IP address of the iview Management Suite in the field. Select Throttle As Server. Select Treat As Authenticated. Select OK. Select OK. The iview Management Suite is added to the list of authorized hosts of OCS R2. Configuring Office Communications Server Static Route A static route allows you to define call paths so that they are redirected from the front end of the main OCS sever to the iview Management Suite. The iview Management Suite, in turn, redirects calls to the SCOPIA Video Gateway. If you have more than one OCS server deployed, when calls are directed to any of the other OCS servers, they must be routed from the front end of the other OCS server to the main OCS server so it can be routed to iview Management Suite. This procedure is relevant for configuring your SCOPIA Video Gateway to work in both TCP and TLS environment. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 On the main OCS server, select Start > Administrative tools > Office Communications Server. In the left pane, navigate to the OCS folder. Right-click this pool and select Properties > Front End Properties. The OCS R2 Front End Properties dialog box opens. Select the Routing tab. Select Add. The Add Static Route dialog box opens (Figure 4-21). Configuring Your SCOPIA Video Gateway Deployment 49

55 Figure 4-21 Configuring a static route Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Enter the OCS domain in the Domain field. For TCP environment: Select IP address and enter the iview Management Suite IP address in the Next hop section. Or Select FQDN and enter the FQDN of iview Management Suite in the Next hop section. For TLS environment: a. Select FQDN and enter the FQDN of iview Management Suite in the Next hop section. b. Select TLS from the Transport list. Select OK. Select OK. The static routing is configured. All calls routed to the iview Management Suite must come from the main OCS server. If there are additional OCS servers deployed in your network, you must create a static route from the front end of each OCS server to the main OCS server. The commands to create the extra static routes are the same as the previous steps in this procedure: a. On the main OCS server, select Start > Administrative tools > Office Communications Server. b. In the left pane, navigate to the OCS folder. c. Right-click this pool and select Properties > Front End Properties. The OCS R2 Front End Properties dialog box opens. d. Select the Routing tab. Configuring Your SCOPIA Video Gateway Deployment 50

56 e. Select Add. The Add Static Route dialog box opens (Figure 4-21). f. Enter the OCS domain in the Domain field. g. For TCP environment: Select IP address and enter the iview Management Suite IP address in the Next hop section. Or Select FQDN and enter the FQDN of iview Management Suite in the Next hop section. Enabling the TLS Connection in the Office Communications Server By default, the Office Communications Server (OCS) is configured to use TCP connection. You need to enable the OCS to use TLS connection to enable the OCS to function in the TLS environment. Procedure Step 1 Step 2 Step 3 On the server on which OCS R2 runs, select Start > Administrative tools > Office Communications Server. In the left pane, navigate to the OCS folder. Right-click the OCS folder and select Properties > Front End Properties. The OCS R2 Front End Properties dialog box opens. Configuring Your SCOPIA Video Gateway Deployment 51

57 Figure 4-22 Enabling the MTLS connection Step 4 Step 5 Select the All check box for the MTLS transport. Select OK. Configuring Ports on the SCOPIA Video Gateway This section provides instructions of how to configure the following ports and port ranges on the SCOPIA Video Gateway: Limiting TCP Port Range for H.245 on the SCOPIA Video Gateway... page 53 Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway... page 54 Configuring UDP Port for RAS on the SCOPIA Video Gateway... page 56 Configuring TCP Port for Q.931 on the SCOPIA Video Gateway... page 58 Configuring Your SCOPIA Video Gateway Deployment 52

58 Limiting TCP Port Range for H.245 on the SCOPIA Video Gateway The SCOPIA Video Gateway designates ports for H.245 (signaling). H.245 is a control protocol used for multimedia communications that enables transferring information about the device capabilities, as well as opening/closing the logical channels that carry media streams. To provide additional security for your firewall, you can limit this range. Procedure Step 1 Log in to NMS. Step 2 Select the relevant gateway from the Network tab. Step 3 Select the Configure tab (see Figure 4-23 on page 53). Figure 4-23 Configure Tab Configuring Your SCOPIA Video Gateway Deployment 53

59 Step 4 Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 4-24 on page 54). Figure 4-24 Advanced Parameters Dialog Box Step 5 Step 6 Step 7 To set the base port for the H.245 range, do the following: a. Enter h245baseport in the Command ID field. b. Enter the port value in the Value field. To set the port range for H.245, do the following: a. Enter h245baseport in the Command ID field. b. Enter the port value in the Value field. Select Save. Configuring RTP/RTCP/SRTP Ports on the SCOPIA Video Gateway The SCOPIA Video Gateway designates ports for UDP audio media, and for UDP video media. In addition, the SCOPIA Video Gateway uses ports for TCP audio and for TCP video. To provide additional security for your firewall, you can limit these ranges. Procedure Step 1 Step 2 Log in to iview Network Manager. Select the relevant gateway from the Network tab. Configuring Your SCOPIA Video Gateway Deployment 54

60 Step 3 Select the Configure tab (see Figure 4-25 on page 55). Figure 4-25 Configure Tab Step 4 Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 4-26 on page 55). Figure 4-26 Advanced Parameters Step 5 Set the video base port by doing the following: a. Enter the advcmdmpcsetval command in the Command field. Configuring Your SCOPIA Video Gateway Deployment 55

61 b. Enter the parameter field depending on whether you are defining UDP or TCP video. To set the UDP video base port, enter mf.baseport in the Parameter field. To set the TCP video base port (SCOPIA Video Gateway only), enter mf.mvptcpbaseport in the Parameter field. c. Modify the port value in the Value field. Step 6 Step 7 Step 8 d. Select Save. Set the UDP audio base port by doing the following: a. Enter the setmprtpbaseport command in the Command field. b. Modify the port value in the Value field. c. Select Save. Set the TCP audio base port (SCOPIA Video Gateway only) by doing the following: a. Enter the setmptcpbaseport command in the Command field. b. Modify the port value in the Value field. c. Select Save. Select Close. Configuring UDP Port for RAS on the SCOPIA Video Gateway The SCOPIA Video Gateway designates port 1719 for RAS. You can configure a different port for RAS (if, for example, port 1719 is busy). Procedure Step 1 Step 2 Log in to NMS. Select the relevant gateway from the Network tab. Configuring Your SCOPIA Video Gateway Deployment 56

62 Step 3 Select the Configure tab (see Figure 4-27 on page 57). Figure 4-27 Configure Tab Configuring Your SCOPIA Video Gateway Deployment 57

63 Step 4 Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 4-28 on page 58). Figure 4-28 Advanced Parameters Dialog Box Step 5 Step 6 Step 7 Select h323rasport from the Command ID field. Modify the port value in the Value field. Select Save. Configuring TCP Port for Q.931 on the SCOPIA Video Gateway The SCOPIA Video Gateway designates port 1720 for Q.931. Q.931 is a telephony protocol used for establishing and terminating the connections in H.323 calls. You can configure a different port for Q.931 (if, for example, port 1720 is busy). Procedure Step 1 Step 2 Log in to NMS. Select the relevant gateway from the Network tab. Configuring Your SCOPIA Video Gateway Deployment 58

64 Step 3 Select the Configure tab (see Figure 4-29 on page 59). Figure 4-29 Configure Tab Configuring Your SCOPIA Video Gateway Deployment 59

65 Step 4 Select Advanced Parameters Settings. The Advanced Parameters dialog box appears (see Figure 4-30 on page 60). Figure 4-30 Advanced Parameters Dialog Box Step 5 Step 6 Step 7 Select h323sigport from the Command ID list. Modify the port value in the Value field. Select Save. Adding and Configuring a SCOPIA Video Gateway in iview Management Suite This section explains how to add the SCOPIA Video Gateway into the iview Management Suite and configure its settings. Perform this procedure after your Microsoft Office Communications Server is configured. Since the SCOPIA Video Gateway does not have a direct GUI of its own, its configuration is performed in the iview Management Suite. First add the gateway to the iview Network Manager to configure it, and then add it as a resource to the iview Communications Manager to manage it as a network resource. The iview Management Suite and SCOPIA Video Gateway communicate in XML over TCP for control and configuration commands. You can secure the connection by configuring it to the TLS protocol. Make sure to generate the SCOPIA iview Management Suite and SCOPIA Video Gateway certificates before configuring the connection to TLS. The SCOPIA Video Gateway is configured by default to switch to the presentation channel whenever an H.323 endpoint shares content during a video call. The SCOPIA Video Gateway sends the shared content to the Lync client. If this feature does not suit the needs of the video call, you can disable it in iview Management Suite. Configuring Your SCOPIA Video Gateway Deployment 60

66 Procedure Step 1 Step 2 Log into the iview Network Manager. Add SCOPIA Video Gateway to the iview Network Manager: a. Select Add button in the left pane. The Add Element dialog box opens. Figure 4-31 Adding a SCOPIA Video Gateway to the iview Network Manager b. Enter the name for this SCOPIA Video Gateway. c. Enter the Management IP address for SCOPIA Video Gateway. d. Select SCOPIA Video Gateway from the list. Step 3 e. Select OK. Configure the SCOPIA Video Gateway settings: a. Select the SCOPIA Video Gateway in the tree view. b. Select the Configure tab. Configuring Your SCOPIA Video Gateway Deployment 61

67 Figure 4-32 The Configure Tab c. Enter the following values: Field Names Registration Name Service Prefix Secure connection using HTTPS Required Gatekeeper SIP Proxy Server Transport Type Default SIP Domain Description The name of this gateway is automatically generated by the system. The prefix to dial to access this gateway. Select this setting to encrypt the communication between the gateway and the iview Network Manager. Before selecting HTTPS, you must generate the gateway certificates. The gatekeeper to which you want to register the gateway. The IP of the SIP Server for this gateway. Typically iview Management Suite acts as the SIP server. The default setting is TCP. Choose TLS for encrypted communications with the SIP server. TLS requires correctly issued certificates from a CA for the gateway and the SIP server. The SIP domain of your organization. Configuring Your SCOPIA Video Gateway Deployment 62

68 Field Names NTP IP Address NTP Time Zone Trap Server Address SNMP Community MTU size DNS Server 1, 2 Quality of Service Description The IP address of a Network Time Protocol server which sets the time for the gateway s clock. External NTP servers ensure the same clock throughout all devices on the network. If you have no NTP server, enter The time zone of the NTP server. The IP address of the server which receives the SNMP traps from the gateway, including alarms and events. Typically the iview Management Suite acts as the gateway s SNMP traps server. The SNMP Server group setting. The size of the packets received from the gateway. Only change this if a router uses a non-standard MTU size. The IP address(es) of the organization s DNS server(s). Typically this setting remains on Default. You can customize the priority given to the different elements of the gateway communication if required. Step 4 d. Select Upload. Add the SCOPIA Video Gateway as an iview Management Suite resource: a. Access the iview Management Suite administrator interface. b. Select Resource Management in the sidebar. c. Select the Gateway tab. d. Select Add. Figure 4-33 Adding SCOPIA Video Gateway to iview Communications Manager e. Enter a name for your SCOPIA Video Gateway in the Name field. f. Select SCOPIA Video Gateway from the Model list. Configuring Your SCOPIA Video Gateway Deployment 63

69 g. Select the IP address of the gatekeeper that the SCOPIA Video Gateway is registered to in the Registered To field. h. Enter the IP address of the SCOPIA Video Gateway in the Management IP Address field. i. If there is more than one location in your deployment, assign your SCOPIA Video Gateway to a location by selecting an option from the Location list. j. Enter the login name and password of the SCOPIA Video Gateway. The default username is admin and the default password is password. k. If required, select Secure XML Connection using TLS to use TLS and thus secure the exchange of XML messages and commands between the SCOPIA Video Gateway and iview Management Suite. Note: Before selecting TLS, you must generate the SCOPIA iview Management Suite and SCOPIA Video Gateway certificates. After you select that checkbox, click Test Connection. When the test is successful, the OK button is enabled. l. Select OK. m. Select Synchronize. Connecting iview Management Suite to Microsoft Components of Your Video Network You must connect the iview Management Suite to the Microsoft Active Directory and the Office Communications Server. This procedure is performed after your SCOPIA Video Gateway is configured, including port configuration. Connection to the OCS is established by adding the OCS profile to the iview Management Suite. Connection to the Active Directory is performed by configuring settings of the Active Directory on the iview Management Suite. After the Active Directory is connected, you download endpoints and virtual rooms from the Active Directory into the iview Management Suite, and enable the auto-attendant feature if necessary. For any questions and/or assistance on Microsoft components, see the Microsoft documentation and/or Microsoft Support Services. The auto-attendant feature is available only in video networks where a RADVISION MCU is deployed. Configuring Your SCOPIA Video Gateway Deployment 64

70 Figure 4-34 Connecting iview Management Suite to Microsoft components We recommend that you perform procedures in this order. 1. Adding an OCS Profile in iview Management Suite page Connecting iview Management Suite with the LDAP Server page Downloading Users from the LDAP Server page 1 4. Downloading H.323 Endpoints from the LDAP Server page Downloading Virtual Rooms from the LDAP Server page 73. Virtual meeting rooms are available only in deployments using a RADVISION MCU. 6. Enabling the Auto-Attendant page Adding an OCS R2 Link to Join a Videoconference from MS Outlook page 78. Enabling the TLS Connection in iview Management Suite You can configure your iview Management Suite to use the TLS connection by modifying the configuration of the B2BUA component of the iview Management Suite. Perform this procedure only if you want to secure your video network using TLS. Configuring Your SCOPIA Video Gateway Deployment 65

71 Procedure Step 1 If the TLS connection is with the SCOPIA Video Gateway, configure the device to TLS signaling as explained in Adding and Configuring a SCOPIA Video Gateway in iview Management Suite on page 60. Note: Each SCOPIA Video Gateway in the video network has its own configuration that is saved in iview Management Suite. Step 2 Step 3 Step 4 Navigate to C:\Program Files\RADVISION\iVIEW Suite\iCM\sipserver\conf. Open the UpdatedSIPConfig.xml file in a text editor. Configure FQDN of the B2BUA component by setting the value the <B2bFQDN> element as shown in Figure In a redundancy environment, add the FQDN of the public virtual IP address. In a standalone environment, this is automatically added. Figure 4-35 Adding the B2bFQDN element Configuring Your SCOPIA Video Gateway Deployment 66

72 Step 5 Configure the DNS of the B2BUA component by setting values in the entire <DNSServerList> element as shown in Figure 4-36: Figure 4-36 Adding the <DNSServerList> element Step 6 Step 7 Save and close the file. Start the iview Management Suite service and the iview Management Suite SIP service. Adding an OCS Profile in iview Management Suite You need to add your OCS to the iview Management Suite so that iview Management Suite can use them as a SIP proxy/registrar. iview Communications Manager is interoperable with these Microsoft environments: Microsoft Lync Server 2010 Microsoft Office Communications Server 2007 R2 Microsoft Lync Server 2010 Hosting Pack This procedure is part of the configuration described in Connecting iview Management Suite to Microsoft Components of Your Video Network on page 64. Procedure Step 1 Step 2 Step 3 Step 4 Log into the iview Communications Manager. Select Resource Management in the sidebar. Select Gatekeeper/SIP server/presence server. The Gatekeeper/SIP server/presence server tab opens. Select Add to create a new SIP server profile. The New Gatekeeper/SIP server/presence server window opens. Configuring Your SCOPIA Video Gateway Deployment 67

73 Step 5 Configure these settings: Field Name Model FQDN Transport Type Port Location SIP Domain Description Enter the name of the. We recommend that you use the IP address as the name unless the selected model is a Microsoft LYNC/OCSR2 server; in this case, used the server FQDN as the name. Select the relevant model of the SIP server depending on your deployment. If you select Other, select SIP in the Protocol list. If you select Microsoft LYNC/OCSR2 in the Model list, enter the OCS FQDN which iview Communications Manager can resolve. Set this value to TCP or TLS. Enter a value for port. The default value is 5060 for a TCP port and 5061 for a TLS port. In distributed deployments select the office or branch to which the OCS is registered. Enter the Lync Server s default SIP domain. Figure 4-37 Configuring settings for the OCS Step 6 Step 7 (Optional) Enter the name of a preferred and an alternative DNS server in the relevant fields. Select OK to save your changes. Configuring Your SCOPIA Video Gateway Deployment 68

74 Connecting iview Management Suite with the LDAP Server To allow user provisioning and synchronization of user profiles using an LDAP server, you have to configure the connection between iview Management Suite and the LDAP server. Before You Begin Make sure User Provisioning Using a Directory Server is selected during the installation process (see Installation Guide for iview Management Suite). When working with Microsoft Active Directory and the iview Microsoft Outlook Add-on, select User Provisioning Using a Directory Server with Single Sign-on. This procedure is part of the configuration described in Connecting iview Management Suite to Microsoft Components of Your Video Network on page 64. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Log in to iview Communications Manager. Select Advanced Settings in the sidebar menu. Select LDAP Configurations. Select Add to add a new LDAP server, or click the required LDAP server entry to modify an existing LDAP server. Select the type of LDAP server in the Server Type field. This is the LDAP Server to which you connect iview Communications Manager. For a deployment that includes the SCOPIA Video Gateway, select Active Directory Server in the Server Type field. Enter the directory server domain or directory server URL in the Domain/URL field. Note: For the secure connection between the iview Management Suite and LDAP server use the Idaps:// prefix. For regular connection use the Idap:// prefix. Step 7 Enter the directory server login ID and password in the relevant fields. Note: The user account needs to have read access to all user accounts that you want to synchronize to iview Communications Manager. This user account does not have to be part of the search base. Configuring Your SCOPIA Video Gateway Deployment 69

75 Step 8 Select Configure to configure the LDAP Search Base field. A tree structure of the Users Search Base appears, showing all OUs (Organization Units) defined on the directory server. Figure 4-38 on page 70 illustrates the tree structure for an enterprise deployment. Figure 4-38 Tree structure in an enterprise deployment Step 9 Select the OUs whose users you want to download. Step 10 Select OK to close the Users Search Base. The selected OUs are displayed in the LDAP Search Base field. Step 11 To download endpoints, see Downloading H.323 Endpoints from the LDAP Server on page 70. Downloading H.323 Endpoints from the LDAP Server Endpoints are predefined in the LDAP server and imported to iview Management Suite as room systems and personal terminals. Personal terminals are added to iview Management Suite as default personal H.323 endpoints. Room systems can be registered to a RADVISION gatekeeper or to a third party gatekeeper.this section explains how to import endpoints registered to the SCOPIA Gatekeeper. For information about importing endpoints registered to a third-party gatekeeper, see Importing Endpoints Registered to a Third-Party Gatekeeper on page 82. In SCOPIA Video Gateway deployments the LDAP Server is your Active Directory Server. During this procedure you define a prefix for endpoints you import. The prefix is part of the unified string that is defined by a dial plan and is added to the endpoint number. The prefix helps to route a call to a specific endpoint. Defining prefixes is optional. This procedure is part of the configuration described in Connecting iview Management Suite to Microsoft Components of Your Video Network on page 64. Procedure Step 1 Step 2 Step 3 Log in to iview Communications Manager. Select Advanced Settings in the sidebar. Select the LDAP Configurations tab. Configuring Your SCOPIA Video Gateway Deployment 70

76 Step 4 Step 5 Step 6 Verify that you selected the LDAP server where the organization users were defined, including the defined Users Search Base and the Terminals Search Base. For more information on configuring these settings, see the Administrator Guide for SCOPIA iview Management Suite. Select Advanced. The Advanced section of the screen is displayed. Navigate to the Terminals section of the tab. Figure 4-39 Terminals section of the LDAP Configurations tab Configuring Your SCOPIA Video Gateway Deployment 71

77 Step 7 Configure room systems in the Room Systems area of the Terminals section of the LDAP Configurations tab as described in Table 4-1. Table 4-1 Configuring settings for downloading virtual meeting rooms and endpoints Field The Select button The Prefix field The telephonenumber list Description Select the Active Directory user group to which you assigned the room systems in the Meeting Rooms field. Enter a number that you want to use for a prefix. Use any number that is that is shorter than 11 digits and not used as a prefix for the auto attendant, auto routing, or for other deployment components. You cannot use the same prefix for personal virtual rooms and personal endpoints when configuring the same LDAP attribute (such as telephonenumber). When configuring settings for virtual rooms, you do not need to enter a prefix. If you do enter a prefix for the virtual room, you can use any number not used as a prefix for the auto attendant, auto routing, personal endpoint, or for other deployment components. Verify that the telephonenumber options is selected. Step 8 Step 9 Step 10 Step 11 Step 12 Configure personal endpoints in the Personal Terminals area of the Terminals section as described in Table 4-1. Define how often iview Management Suite is synchronized with the LDAP server by selecting a value from the Update Frequency list. Select OK. The LDAP Configurations tab is displayed. Select Synchronize. Endpoints defined in the LDAP server are downloaded and saved in the iview Management Suite as room systems and personal endpoints. Verify that endpoints were downloaded correctly: a. Select Resource Management in the sidebar. b. Select the Terminals tab. c. Verify that all endpoints defined in the LDAP server were downloaded and appear on the Terminals tab. The download icon is displayed next to all downloaded endpoints to differentiate endpoints from the LDAP server from endpoints added manually to the network. Configuring Your SCOPIA Video Gateway Deployment 72

78 Downloading Virtual Rooms from the LDAP Server Virtual meeting rooms are literally virtual rooms that serve as a meeting place for your video network users. Virtual meeting rooms can be public, available for any user, and personal, assigned to a specific user, who is the only one allowed to schedule meetings in this room.virtual meeting rooms appear in the Contact List of Office Communications Video Chat Clients, unlike personal endpoints which are not shown. Virtual rooms, meeting rooms and endpoints are pre-defined in the LDAP server and downloaded to iview Management Suite during LDAP synchronization. To download virtual rooms from the LDAP server, the following conditions must be met: The value of the LDAP field mapped to the virtual room must be numeric. The virtual room number is not editable in the virtual room profile window. If the same virtual room number is defined for two users in the LDAP server, the virtual room is created and downloaded to iview Management Suite for only one of the users. Each virtual room in iview Management Suite is defined by the default settings configured in Advanced Settings > Default Meeting Settings. Virtual rooms are available only in video networks where a RADVISION MCU is deployed. The virtual meeting rooms comprise an additional contact named My Virtual Room. This is a personal meeting place where the user can host meetings. When My Virtual Room is enabled in the system, it shows its availability in the Contact List (while the user s personal virtual room indicates an unknown presence). Before You Begin Check the prefixes used for the auto-attendant and for other components within your network, such as RADVISION MCUs, Gatekeeper, and SCOPIA Gateway. Prefixes assigned to virtual rooms must be unique. Choose a SIP URI for the user to whom a virtual room is assigned (for example, bfmyvr@lync2010.com ). This procedure is part of the configuration described in Connecting iview Management Suite to Microsoft Components of Your Video Network on page 64. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Log in to iview Communications Manager. Select Advanced Settings in the sidebar. Select the LDAP Configurations tab. Select the LDAP server to which organization users were added. Select Advanced. The Advanced section of the screen is displayed. Configuring Your SCOPIA Video Gateway Deployment 73

79 Step 6 Navigate to the Virtual Rooms section of the tab. Figure 4-40 Virtual Rooms section of the LDAP Configurations tab Step 7 Configure public virtual rooms in the Virtual Meeting Rooms area of the Virtual Rooms section as described in Table 4-2. Table 4-2 Configuring settings for downloading virtual meeting rooms and terminals Field The Select button The Prefix field The telephonenumber list Description Select the Active Directory user group to which you assigned the public virtual rooms in the Virtual Room field. Enter a number that you want to use for a prefix. Use any number that is shorter than 11 digits and is not used as a prefix for the auto attendant or for other deployment components. Verify that the telephonenumber options is selected. Step 8 Step 9 Step 10 Step 11 Define how often users and meeting rooms are synchronized with the LDAP server by selecting a value from the Update Frequency list. Select OK. Select Synchronize on the LDAP Configurations tab. Users from the LDAP server downloaded into iview Management Suite as virtual meeting rooms. Verify that the virtual meeting rooms were downloaded correctly: a. Select Users Management in the sidebar. b. Select the Users tab. c. Verify that the virtual meeting rooms defined in the LDAP server were downloaded and appear on the Users tab. Configuring Your SCOPIA Video Gateway Deployment 74

80 Step 12 Step 13 If new users were added to the Active Directory after you downloaded users virtual rooms, you can force synchronization between the Active Directory and the Lync Server to update the Lync Contact List immediately: a. On the Lync Server, select Start > Microsoft Lync Server 2010 > Lync Server Management Shell > Run as administrator. b. Type Update-CsAddressBook and press Enter. Download the meeting types from MCUs. a. Select Meeting types in the sidebar. b. Select Download. MCU services are downloaded from all network MCUs. Because MCU services are downloaded via SNMP, the process might take some time if there are many MCUs in your deployment. Figure 4-41 Meeting types downloaded into the iview Management Suite from MCUs Step 14 c. Enter a unique name for each meeting type. d. Select OK. Enable My Virtual Room : a. Select Advanced Settings in the sidebar. b. Select the Default Meeting Settings tab. c. Select Enable My Virtual Room. Configuring Your SCOPIA Video Gateway Deployment 75

81 Figure 4-42 Enabling the personal virtual room d. Enter the SIP URI of My Virtual Room as configured in the Active Directory user. e. Select OK. Enabling the Auto-Attendant The auto-attendant allows users to access a video menu and select menu options using DTMF. In video networks, this functionality is typically used to provide quick access to meetings currently running on an RADVISION MCU. The process of enabling the auto-attendant includes creating an Active Directory (AD) user dedicated to the auto attendant. The auto-attendant is available only in video networks where a RADVISION MCU is deployed. Before You Begin 1. Choose a number you want to assign to the auto-attendant feature. This number must be different from these numbers: MCU service SCOPIA Gateway service Gatekeeper zone prefix IP terminal number 2. Verify the of the Active Directory user that represents the auto-attendant feature. Procedure Step 1 Download the meeting types from MCUs. a. Access the iview Communications Manager user interface. b. Select Meeting types in the sidebar. c. Select Download. MCU services are downloaded from all network MCUs. Because MCU services are downloaded via SNMP, the process might take some time if there are many MCUs in your deployment. Configuring Your SCOPIA Video Gateway Deployment 76

82 Figure 4-43 Meeting types downloaded into the iview Management Suite from MCUs Step 2 d. Enter a unique name for each meeting type. e. Select OK. Enable the auto-attendant for the meeting type you want to use for the auto-attendant functionality: a. Select the meeting type on the Active Meeting Types tab. Figure 4-44 Enabling the auto-attendant feature for a meeting type Configuring Your SCOPIA Video Gateway Deployment 77

83 b. Select Auto Attendant Support. Note: When enabling auto-attendant support, if your deployment uses a third party gatekeeper, ensure that the gatekeeper has a prefix configured to direct calls to the auto-attendant. Step 3 c. Select OK. Assign an auto attendant number to the meeting you configured with auto-attendant support: a. Select Advanced Settings in the sidebar. b. Select the Default Meeting Settings tab. Figure 4-45 Selecting the auto-attendant number c. Select Please specify the auto attendant number. d. Enter the number for accessing the auto-attendant. Typically, the number 1800 is used as the auto-attendant number. e. Select Enable integration with MS Lync/OCS R2 and specify the user URI which represent the auto attendant in the directory. In our example, it is AutoAtten@support2008.com. f. Select OK. Adding an OCS R2 Link to Join a Videoconference from MS Outlook As an administrator, you decide on the default text which accompanies videoconference invitations in Microsoft Outlook. You can set up this feature in the iview Communications Manager module of iview Management Suite. The invitation text is compartmentalized into sections which relate to the different implementations your organization supports. This section details how to activate the link for joining a videoconference using the OCS client. For more information regarding the iview Microsoft Outlook Add-on configuration, see the User Guide for iview Microsoft Outlook Add-on. Configuring Your SCOPIA Video Gateway Deployment 78

84 Procedure Step 1 Step 2 Step 3 Step 4 Log in to iview Communications Manager. Select Advanced Settings in the sidebar menu. Select the Default Meeting Settings tab. Select Add LYNC/OCSR2 client access information. Figure 4-46 Adding an OCSR2 link for joining the videoconference from MS Outlook Step 5 Select OK to save the change. Configuring a Third Party Deployment If your H.323-based video network is not a SCOPIA Solution, the SCOPIA Video Gateway and iview Management Suite will fully integrate into your video network allowing you to make calls from an H.323 endpoint to a Lync client and vice versa. However, please notice that there are several features whose behavior is different in the third party deployments: Presence information for H.323 endpoints is unavailable. The presence status for these endpoints is always shown as online in the OCS Client Contact list. You may still call each one of these endpoints, but the result of the call is unpredictable. Third party MCUs do not appear in the OCS Client Contact list: users need to dial the sip address of a video conference to join. Figure 4-47 on page 80 depicts such type of dialing. Configuring Your SCOPIA Video Gateway Deployment 79

85 Figure 4-47 Dialing a Third-party MCU from the OCS Client Contact List This section describes additional configuration procedures for third party deployments. Do not perform these procedures if your video network is based on the SCOPIA Solution. For iview Management Suite to interoperate with third party gatekeepers, they need to be configured as neighbors to the SCOPIA iview Management Suite s internal gatekeeper. Adding a Neighbor Gatekeeper... page 80 Defining a Third Party Gatekeeper in SCOPIA iview Management Suite... page 81 Importing Endpoints Registered to a Third-Party Gatekeeper... page 82 Defining a Third-Party MCU in SCOPIA iview Management Suite... page 85 Adding a Neighbor Gatekeeper Perform this procedure to add your third party gatekeeper as a neighbor to the RADVISION SCOPIA Gatekeeper. Neighbor gatekeepers are stored in a Neighbor Table in the SCOPIA Gatekeeper database. The SCOPIA Gatekeeper uses this table for resolving destination IP addresses when the source endpoint is not in the same zone as the destination endpoint. The list of Neighbor gatekeepers and their IP addresses allows a gatekeeper to search for and communicate directly with the gatekeeper of the destination endpoint. As a result, there is no need for a gatekeeper to multicast a Location Request message (LRQ) to the entire network in order to resolve addresses from other zones. This makes call routing to the other zones more efficient and reliable. To define Neighbor gatekeepers, you specify the IP address and port number of the Neighbor Gatekeeper. You can also specify a zone prefix. Each Neighbor gatekeeper should have a unique prefix. If you specify a zone prefix, the SCOPIA Gatekeeper routes LRQ messages and calls only to the Neighbor gatekeeper that starts with the zone prefix in the destination address. Procedure Step 1 Step 2 Step 3 Select the Hierarchy tab. Select the Neighbors tab. Select Add. The Add Neighbor dialog box opens. Configuring Your SCOPIA Video Gateway Deployment 80

86 Figure 4-48 Adding a neighbor gatekeeper Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Enter the zone prefix for the neighbor gatekeeper. Enter a free text description for the neighbor gatekeeper. Enter the IP address for the neighbor gatekeeper. Enter the neighbor gatekeeper port. Verify that Use Cisco proxy is unchecked. Select Upload. Defining a Third Party Gatekeeper in SCOPIA iview Management Suite You can define and configure third party external gatekeepers in SCOPIA iview Management Suite. Procedure Step 1 Step 2 Step 3 Log in to iview Communications Manager. Select Resource Management in the sidebar menu. Select Gatekeeper/SIP server. Configuring Your SCOPIA Video Gateway Deployment 81

87 Step 4 Select Add to create a new gatekeeper profile. Figure 4-49 Adding a new gatekeeper Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Enter the gatekeeper name. Enter the management IP address of the gatekeeper. Select Other Model from the Model list. Select H.323 in the Protocol list. Select the office or branch to which the gatekeeper belongs from the Location list. Each location can have only one gatekeeper. The Location field is visible only when the IP Topology tab is activated in the iview Communications Manager. Select OK to add the new gatekeeper to iview Communications Manager. Define a dial plan for the gatekeeper in the Dialing Plan Information section. For more information, see the Administrator Guide for SCOPIA iview Management Suite. Importing Endpoints Registered to a Third-Party Gatekeeper When you use a third-party gatekeeper in your deployment and there are endpoints registered to this gatekeeper, you need to import these endpoints. Before you can import endpoints registered to third-party gatekeeper, you must define the gatekeeper in the iview Communications Manager. Note: If you have a Tandberg VCS gatekeeper and want to register your endpoints, follow the procedure described in the Administrator Guide for SCOPIA iview Management Suite, section Importing Endpoints from the Gatekeeper. Configuring Your SCOPIA Video Gateway Deployment 82

88 Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Access the iview Management Suite user interface. Select Advanced Settings in the left pane. Select the LDAP Configurations tab. Select the relevant LDAP link. Select Advanced. Navigate to the Terminals section of the tab. In the Registered to third party gatekeeper area, define the endpoints registered to the third-party gatekeeper in the iview Management Suite as described in Table 4-3: Figure 4-50 Registered to third-party gatekeeper area of the LDAP Configurations tab Configuring Your SCOPIA Video Gateway Deployment 83

89 Table 4-3 Configuring settings in the Registered to third-party gatekeeper area Field The Select button The Prefix field The telephonenumber list Description Select the Active Directory user group to which you assigned the endpoints in the Meeting Rooms field. Enter a number that you want to use for a prefix. Use any number that is shorter than 11 digits and is not used as a prefix for the auto attendant or for other deployment components. Verify that the telephonenumber options is selected. Step 8 Step 9 Step 10 Step 11 Step 12 Select OK. Select Synchronize. Select Resource Management in the left pane. Select the Terminals tab. Select an endpoint that is registered to the third-party gatekeeper in the table. The Modify Terminal page opens. Figure 4-51 Modifying registration setting for an endpoint Step 13 Step 14 Step 15 Select the third-party gatekeeper from the Registered To list. Select OK. Repeat Step 12 - Step 14 for all endpoints that are registered to the third-party gatekeeper. Configuring Your SCOPIA Video Gateway Deployment 84

90 Defining a Third-Party MCU in SCOPIA iview Management Suite Integrating a third-party party MCU enables users to dial in to MCU meeting rooms as if they were endpoints. You can view the presence of these meeting rooms in your Lync client. Note: The virtual room icon only appears for RADVISION MCUs. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Register the third-party MCU to your gatekeeper, as follows: If your deployment includes a SCOPIA ECS Gatekeeper, SCOPIA Gatekeeper, or Tandberg VCS, register the MCU directly to the gatekeeper. If your deployment includes a third-party gatekeeper, register the MCU after SCOPIA Gatekeeper your third-party gatekeeper to SCOPIA Gatekeeper. Access your Active Directory and create a user group for all the MCU rooms you want to add. Add a user for each MCU room to the group, with the telephone number of the MCU room. Enable these users in Lync, as described in Enabling New Active Directory Users on the Lync Server on page 1. Access the iview Management Suite user interface. Select Advanced Settings in the left pane. Select the LDAP Configurations tab. Select the relevant LDAP link. Select Advanced. Navigate to the Terminals section of the tab. Configuring Your SCOPIA Video Gateway Deployment 85

91 Step 11 Select the user group you created in Step 2 and add it to Registered to third-party gatekeeper (see Table 4-3). Figure 4-52 Registered to third-party gatekeeper area of the LDAP Configurations tab Table 4-4 Configuring settings in the Registered to third-party gatekeeper area Field The Select button The Prefix field The telephonenumber list Description Select the Active Directory user group to which you assigned the endpoints in the Meeting Rooms field. Enter a number that you want to use for a prefix. Use any number that is shorter than 11 digits and is not used as a prefix for the auto attendant or for other deployment components. Verify that the telephonenumber options is selected. Step 12 Step 13 Step 14 Step 15 Select OK. Select Synchronize. If you are using a SCOPIA Gatekeeper, SCOPIA Gatekeeper, or Tandberg VCS, continue with Step 16. If you are using a third-party gatekeeper, perform the following steps: a. Select Resource Management in the left pane. b. Select the Terminals tab. c. Select an endpoint that is registered to the third-party gatekeeper in the table. The Modify Terminal page opens. Configuring Your SCOPIA Video Gateway Deployment 86

92 Figure 4-53 Modifying registration setting for an endpoint Step 16 d. Select the third-party gatekeeper from the Registered To list. e. Select OK. f. Repeat Step 12 - Step 14 for all endpoints that are registered to the third-party gatekeeper. Add the rooms to your Lync client Contact List. Presence is indicated for each of the rooms. You can call them and reach the third-party MCU. Securing Your Video Network Using TLS You can configure your video network, whether it is a SCOPIA Solution or a third party deployment, to support Transport Layer Security (TLS) for the SIP signaling protocol. The TLS protocol is based on a public and private keys for authorization and encryption, exchanged between iview Management Suite and SCOPIA Video Gateway to allow an authenticated and secure connection. The public and private keys are contained in a certificate signed by a certification authority (CA) known as a CA signed certificate. As you configure your deployment for TLS, you need to generate a certificate signed request for every component that uses TLS in your deployment and send it to your network administrator for creating a CA signed certificate. A CA has its own certificate the CA root certificate. When the CA signed certificate is ready, you upload it into the component for which it was created, together with the CA root certificate. In some cases, when the CA signing the certificate is not a known trusted source, you must obtain an additional certificate vouching for the trustworthiness of the CA. These certificates are known as intermediary certificates, and must be signed by a trusted CA. Each time a TLS connection is established, a deployment component that starts the TLS communication session requests another component to produce its signed certificate together with the CA root certificate if not already available. After the second component verifies its Configuring Your SCOPIA Video Gateway Deployment 87

93 identity with these certificates, a secure connection can be established. Exchanging certificates between components is part of the TLS protocol; it happens in the background and is transparent to a user. TLS is used to secure the connection between iview Management Suite and the following solution components: SCOPIA Video Gateway SCOPIA Desktop Microsoft Office Communications Server or The following set of procedures create a basis for the secure connection between iview Management Suite and the solution components listed above. Perform these tasks in the order listed below: Planning the Required Certificates for TLS... page 88 Generating the Certificate Signing Request for iview Management Suite... page 94 Generating the Certificate Signing Request for the SCOPIA Video Gateway... page 97 Ensuring that you have the root certificate of the certificate authority your organization uses. This root certificate is used for importing signed certificates into iview Management Suite and SCOPIA Video Gateway. Uploading iview Management Suite Certificates into iview Management Suite... page 99 Uploading Certificates for Other Devices into iview Management Suite... page 101 Uploading Certificates into the SCOPIA Video Gateway... page 104 Enabling the TLS Connection in iview Management Suite... page 65 Planning the Required Certificates for TLS When a device establishes a secure TLS connection with another component, it sends a signed certificate verifying its identity. The signature on the certificate must be from a known (trusted) certification authority (CA). There are several types of TLS connections: Standard TLS, where all certificates are signed by the same CA. Unique CAs, where each certificate is signed by a different CA. Unknown gateway CA, where the gateway s certificate is signed by an unknown (untrusted) CA. Unknown iview Management Suite CA, where iview Management Suite s certificate is signed by an unknown (untrusted) CA. Mutually unknown CAs, where both components carry certificates signed by CAs that are unknown to each other. Each situation requires a different set of certificates to be uploaded to each of the components. A CA s signature is always verified by its root certificate, which identifies the CA and is self-signed by that CA. When a device receives a certificate as part of TLS negotiations, it must verify that the CA signing the certificate is trusted, so it must have the CA s root certificate uploaded. Configuring Your SCOPIA Video Gateway Deployment 88

94 Standard TLS These connections use the same CA for signing all certificates on both sides. In this case, you need to upload two certificates to iview Management Suite and two for the gateway (Figure 4-54 on page 89). Figure 4-54 Standard TLS: Component Certificates and a CA Root Certificate Upload the following certificates to the iview Management Suite: A certificate identifying iview Management Suite, signed by the CA. This is sent to the gateway as part of the TLS negotiation. A root certificate verifying the CA s identity, self-signed by that CA. This is used by iview Management Suite to verify the certificate sent by the gateway. On the gateway side, upload the following certificates (Figure 4-54 on page 89): A certificate identifying the gateway, signed by the same CA. This is sent to iview Management Suite as part of the TLS negotiation. A copy of the root certificate verifying the CA s identity, self-signed by the CA. This is used by the gateway to verify the certificate sent by iview Management Suite. Unique CAs When certificates are signed by different CAs, each CA requires its own root certificate to be uploaded for authentication. For example, in Figure 4-55 on page 90, the certificate identifying iview Management Suite is signed by CA1, while the gateway s certificate is signed by CA2. This requires three certificates to be uploaded to iview Management Suite and two for the gateway (Figure 4-55 on page 90). Configuring Your SCOPIA Video Gateway Deployment 89

95 Figure 4-55 TLS connection using certificates signed by different CAs When each certificate is signed by a different CA (Figure 4-55 on page 90), upload the following certificates to the iview Management Suite: A certificate identifying iview Management Suite, signed by trusted CA1. This is sent to the gateway as part of the TLS negotiation. A root certificate from the trusted CA1 verifying CA1 s identity, self-signed by CA1. This is used by iview Management Suite to authenticate its certificate. A root certificate from the trusted CA2 verifying CA2 s identity, self-signed by CA2. This is used by iview Management Suite to authenticate the certificate sent by the gateway, which is signed by CA2. On the gateway side, upload the following certificates (Figure 4-55 on page 90): A certificate identifying the gateway, signed by trusted CA2. This is sent to iview Management Suite as part of the TLS negotiation. A root certificate verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the certificate sent by iview Management Suite, which is signed by CA1. Unknown gateway CA If the CA of the gateway s certificate is unknown, it cannot be trusted unless it comes with an intermediate certificate, which vouches for the trustworthiness of the unknown CA. Intermediate certificates must be signed by a trusted CA. For example, in Figure 4-56 on page 91, the certificate identifying the gateway is signed by CA3, which may be known and trusted by those who installed the gateway, but in this scenario CA3 is not trusted by iview Management Suite. Meanwhile iview Management Suite s certificate is signed by CA1, a trusted CA. This scenario requires four certificates to be uploaded to iview Management Suite and two for the gateway (Figure 4-56 on page 91). Configuring Your SCOPIA Video Gateway Deployment 90

96 Figure 4-56 Signature of Gateway Certificate from Unknown CA When CA3 is untrusted (Figure 4-56 on page 91), the certificates to upload to the iview Management Suite are: A certificate identifying iview Management Suite, signed by trusted CA1. This is sent to the gateway as part of the TLS negotiation. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by iview Management Suite to authenticate its certificate. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA2. This is used to trust the certificate sent by the gateway, which is signed by CA3. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by iview Management Suite to authenticate the intermediate certificate, which is signed by CA2. On the gateway side, the certificates to be uploaded are (Figure 4-56 on page 91): A certificate identifying the gateway, signed by CA3, an unknown CA. This certificate is sent to iview Management Suite as part of the TLS negotiation. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the certificate sent by iview Management Suite, which is signed by CA1. Unknown iview Management Suite CA When iview Management Suite s certificate is signed by a CA unknown to the gateway, you must upload an intermediate certificate for the untrusted CA signed by a trusted CA to vouch for its authenticity. In the example of Figure 4-57 on page 92, iview Management Suite s certificate is signed by CA3, an unknown CA, while the gateway s certificate is signed by CA2, a trusted CA. This requires four certificates to be uploaded to iview Management Suite and three for the gateway (Figure 4-57 on page 92). Configuring Your SCOPIA Video Gateway Deployment 91

97 Figure 4-57 Signature of iview Management Suite Certificate from Unknown CA When CA3 is untrusted by the gateway (Figure 4-57 on page 92), the certificates to upload to the iview Management Suite are: A certificate identifying iview Management Suite, signed by CA3, a CA unknown to the gateway. This is sent to the gateway as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust iview Management Suite s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by iview Management Suite to authenticate the intermediate certificate, which was signed by CA1. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by iview Management Suite to authenticate the gateway s certificate, which is signed by CA2. On the gateway side, the certificates to be uploaded are (Figure 4-57 on page 92): Configuring Your SCOPIA Video Gateway Deployment 92

98 A certificate identifying the gateway, signed by trusted CA2. This certificate is sent to iview Management Suite as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust iview Management Suite s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the intermediate certificate, which is signed by CA1. Mutually unknown CAs In the final scenario, both components use certificates signed by CA s which are not recognized by each other. In this case, there needs to be two intermediate certificates, one for each of the untrusted CAs, to vouch for their authenticity. For example, in Figure 4-58 on page 93, the certificate identifying the gateway is signed by CA4, an unknown CA, while iview Management Suite s certificate is signed by CA3, also untrusted. This would require five certificates to be uploaded to iview Management Suite and three for the gateway (Figure 4-58 on page 93). Figure 4-58 Signature of Both Certificates are from Untrusted CAs When CA3 is untrusted by the gateway and CA4 is untrusted by iview Management Suite(Figure 4-57 on page 92), the certificates to upload to the iview Management Suite are: A certificate identifying iview Management Suite, signed by CA3, a CA unknown to the gateway. This is sent to the gateway as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust iview Management Suite s identity certificate, which is signed by CA3. Configuring Your SCOPIA Video Gateway Deployment 93

99 A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by iview Management Suite to authenticate CA3 s intermediate certificate, which was signed by CA1. A root certificate from CA2 verifying CA2 s identity, self-signed by trusted CA2. This is used by iview Management Suite to authenticate CA4 s intermediate certificate, which is signed by CA2. An intermediate certificate vouching for the trustworthiness of CA4, signed by trusted CA2. This is used to trust the gateway s identity certificate, which is signed by CA4. On the gateway side, the certificates to be uploaded are (Figure 4-57 on page 92): A certificate identifying the gateway, signed by CA4, a CA unknown to iview Management Suite. This is sent to iview Management Suite as part of the TLS negotiation. An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1. This is used to trust iview Management Suite s identity certificate, which is signed by CA3. A root certificate from CA1 verifying CA1 s identity, self-signed by trusted CA1. This is used by the gateway to verify the intermediate certificate, which is signed by CA1. For more information on uploading certificates to the gateway and to iview Management Suite, see Securing Your Video Network Using TLS on page 87. Generating the Certificate Signing Request for iview Management Suite This section details how to generate a certificate signing request for iview Management Suite, that must be signed by a CA using a certificate authority (CA) application. Once properly signed, the certificate would confirm the identity of iview Management Suite to other components in the network, and can also facilitate encrypted communications with other components. Configuring Your SCOPIA Video Gateway Deployment 94

100 Procedure Step 1 Step 2 Navigate to Start > All Programs > RADVISION iview Management Suite > Certificates Management. The Certificate Management Tool is displayed. Select the iview Certificates tab. Figure 4-59 Certificate Management Tool Step 3 Select Generate. The Generate CSR window is displayed. Figure 4-60 Certificate Signing Request Step 4 Step 5 Enter details as required. The Common Name must be FQDN of iview Manager Server/SIP server: rvcn-iview-7201.radvision.com. For a redundancy deployment, the common name must be the public virtual FQDN. The Country code must include two characters. Select Generate Certificate Signing Request (CSR). Configuring Your SCOPIA Video Gateway Deployment 95

101 Step 6 Select Save to view the certificate content. The certificate content is displayed in the Download iview CSR window. Figure 4-61 Saving the Certificate Step 7 Step 8 Select Save Certificate. Choose an appropriate folder and file name when saving the certificate. The certificate is saved as a text file compatible with Base-64 ASCII code. Send the text file containing the certificate for signing as a certificate compatible with Base-64 ASCII code. We recommend to use the same CA for both the CSR and the Lync Server certificate. Note: It is very important that the certificate is signed as a certificate compatible with Base-64 ASCII code. If other components communicating with iview Management Suite also have their own certificates, we recommend using a common CA for all certificates for a more efficient implementation. Select Web Server as the certificate template when submitting a certificate request or renewal request. Configuring Your SCOPIA Video Gateway Deployment 96

102 Generating the Certificate Signing Request for the SCOPIA Video Gateway Before generating a certificate signing request (CSR) for the gateway, you must first create a CSR for iview Management Suite as explained Generating the Certificate Signing Request for iview Management Suite on page 94. Then perform this procedure to generate a gateway certificate that needs to be signed by the network administrator using a certificate authority certification. Procedure Step 1 Step 2 Step 3 Log in to the iview Network Manager. Navigate to the gateway in the left pane to create its CSR. Select the Certificate Management tab. Figure 4-62 Certificate Management tab Step 4 Select Create a new certificate request. The Save Certificate Request window opens displaying the certificate request. Configuring Your SCOPIA Video Gateway Deployment 97

103 Figure 4-63 Save Certificate Request Step 5 Copy the certificate request into a separate text file and save it with the.csr extension. Note: If copying does not work, follow the procedure described in Resolving a Copy and Paste Issue in the SCOPIA iview Network Manager on page 119. Step 6 Step 7 Select Close. Send the text file containing the certificate request to your network administrator for signing using a certificate authority application. Note: The certificate request must be signed with the setting to ensure it is compatible with Base-64 ASCII code. Step 8 Save the CA root certificate as the gateway s root certificate file. Configuring Your SCOPIA Video Gateway Deployment 98

104 Uploading iview Management Suite Certificates into iview Management Suite This procedure describes how to upload certificates that confirm the identity of iview Management Suite. To upload certificates that confirm the identity of other SCOPIA Solution and third-party devices, see Uploading Certificates for Other Devices into iview Management Suite on page 101. In most TLS connections, iview Management Suite requires two certificates to be uploaded: a signed certificate identifying iview Management Suite signed by a certification authority (CA) and that CA s root certificate (Figure 4-64 on page 99). Each time a deployment component tries to establish a new TLS session with iview Management Suite, it sends its identity certificate to the component to establish a secure connection (Figure 4-64 on page 99). Figure 4-64 Typical TLS communication with a gateway However, if the component certificates are signed by a different CA than iview Management Suite s certificate, you may need to upload more certificates to establish authenticity. For more information, see Planning the Required Certificates for TLS on page 88. You need to perform this procedure after you have the signed certificate from the CA for iview Management Suite. Before You Begin 1. Ensure that you have the root certificate for the certificate authority that your organization uses. The root certificate must be compatible with the Base-64 ASCII code. 2. Ensure that you have the signed certificate for the iview Management Suite. Configuring Your SCOPIA Video Gateway Deployment 99

105 Procedure Step 1 Step 2 Copy the CA root certificate and the CA signed certificate that confirm the identity of iview Management Suite into the iview Management Suite server. Open the iview Management Suite Certificates Management tool. Figure 4-65 Certificate Management Tool window Step 3 Upload the CA root certificate, including intermediate certificates, into iview Management Suite: a. Select Upload next to the CA files. The Open window is displayed. Configuring Your SCOPIA Video Gateway Deployment 100

106 Figure 4-66 Open window Step 4 Step 5 b. Browse and select the CA root and intermediate certificates. You can select multiple certificates by holding the Ctrl key as you select. c. Select Open. Verify that the upload success message is displayed. The CA root and intermediate certificates are uploaded into iview Management Suite. Upload the CA signed certificate into iview Management Suite: a. Select Upload next to the CA Signed file. The Open window is displayed. See Figure 4-66 on page 101. b. Browse and select the CA signed certificate. c. Select Open. Verify that the upload success message is displayed. The CA signed certificate is uploaded into iview Management Suite. Select Apply Certificates. The iview Management Suite service is automatically restarted. Uploading Certificates for Other Devices into iview Management Suite This procedure describes how to upload certificates to iview Management Suite for all devices in your deployment, except for the certificates which confirm the identity of iview Management Suite itself. To upload certificates which identify iview Management Suite itself, see Uploading iview Management Suite Certificates into iview Management Suite on page 99. For most TLS connections, you need to upload the device s CA root certificate (Figure 4-67). Each time a deployment component tries to establish a new TLS session with iview Management Suite, it sends its identity certificate to the component to establish a secure connection (Figure 4-67). Configuring Your SCOPIA Video Gateway Deployment 101

107 Figure 4-67 Typical TLS communication with a gateway However, if the component certificates are signed by a different CA than iview Management Suite s certificate, you may need to upload more certificates to establish authenticity. For more information, see Planning the Required Certificates for TLS on page 88. You need to perform this procedure after you generate the CSR for the deployment component, which is done via the device. For details about generating CSRs for SCOPIA Solution products, see the product's Administrator Guide. Before You Begin Ensure that you have the root certificate, including all intermediate certificates, for the certificate authority that your organization uses to identify the device. The root certificate must be compatible with the Base-64 ASCII code. Procedure Step 1 Step 2 Copy the CA root (and intermediate, if relevant) certificate that confirms the identity of the device into the iview Management Suite server. Open the iview Management Suite Certificates Management tool. Configuring Your SCOPIA Video Gateway Deployment 102

108 Step 3 Select the Certificates for Other Devices tab (Figure 4-68 on page 103). Figure 4-68 Certificates for Other Devices tab Step 4 Upload the CA root certificates, including intermediate certificates, into iview Management Suite: a. Select Import. The Certificate Import window is displayed (Figure 4-69 on page 103). Figure 4-69 Certificate Import window b. Type an internal name for the certificate (for easy identification) in the Alias field. c. Select Next and browse to the CA root certificate. d. Select Open. e. Repeat steps a--d for other CA root and intermediate certificates, if relevant. f. Select Apply Certificates. g. Select OK in the success message. The CA root and intermediate certificates are uploaded into iview Management Suite. The iview Management Suite service is automatically restarted. Configuring Your SCOPIA Video Gateway Deployment 103

109 Uploading Certificates into the SCOPIA Video Gateway In most TLS connections, the gateway requires two certificates to be uploaded: a certificate signed by a certificate authority (CA) identifying the gateway and the CA root certificate which authenticates the CA as a trusted source (Figure 4-64 on page 99). Each time the iview Management Suite tries to establish a new TLS session with the gateway, iview Management Suite sends its identity certificate to the gateway. The gateway must have all the certificates requried to authenticate the validity of that certificate. Only then a secure connection is established. For more information on determining the certificates required in each component, see Planning the Required Certificates for TLS on page 88. If certificates are signed by different CA s, you may need to establish the trustworthiness of each CA s signature, sometimes through using an intermediate certificate which vouches for the CA in question. In such cases, you would also need to upload the intermediate s root certificate to verify it is a trusted source. For more information, see Planning the Required Certificates for TLS on page 88. Perform this procedure after the CA signed certificate for the gateway is produced. Before You Begin 1. Ensure that you have the root certificate for the certificate authority that your organization uses. The CA root certificate must be compatible with the Base-64 ASCII code. 2. Ensure that you have the signed certificate for your gateway. Procedure Step 1 Step 2 Log in to the iview Network Manager. Navigate to the gateway in the left pane whose certificate you want to upload. Configuring Your SCOPIA Video Gateway Deployment 104

110 Step 3 Select the Certificate Management tab (Figure 4-70 on page 105). Figure 4-70 Certificate Management tab Step 4 Select Upload the signed certificate to upload the certificate for the gateway which has been signed by the CA. The Upload Signed Certificate window opens (Figure 4-71 on page 106). Configuring Your SCOPIA Video Gateway Deployment 105

111 Figure 4-71 The Upload Signed Certificate window Step 5 Paste the content of the gateway certificate signed by the CA and select OK. The CA signed certificate is uploaded. Note: If pasting does not work, follow the procedure described in Resolving a Copy and Paste Issue in the SCOPIA iview Network Manager on page 119. Step 6 Step 7 Step 8 Step 9 Select Upload under the CA root section of the window to upload the CA s root certificate. The upload certificate window opens. Paste the content of the CA root certificate and select OK. The CA root certificate is uploaded. In cases where the CA root certificate is signed by another CA, you also need to upload the root of the second CA to verify it is trusted. Select Upload under the CA intermediate section of the window to upload the intermediate s root certificate. Paste the content of the intermediate CA s root certificate and select OK. The intermediate CA s root certificate is uploaded. Configuring Your SCOPIA Video Gateway Deployment 106

112 5 Performing Maintenance Procedures This section details to the ongoing administrator tasks required to maintain your video network: Upgrading the SCOPIA Video Gateway... page 107 Restoring a Previous Software Version for the SCOPIA Video Gateway... page 109 Downgrading your SCOPIA Video Gateway... page 111 Changing the IP Address of your Gateway... page 111 Upgrading the SCOPIA Video Gateway The upgrade procedure is different when upgrading to a major new version compared with smaller incremental upgrades. Note: You perform the upgrade remotely using the iview Management Suite. You cannot upgrade the firmware of the gateway directly on the device. Depending on your support contract, you can upgrade to: The next major version. Upgrading a major version requires a new license. This kind of upgrade changes one of the first two digits in a version number. For example, upgrading from version 7.6 to version 7.7 requires a new license. An incremental version. Upgrading an incremental version does not require a new license. This kind of upgrade changes the third, fourth and fifth digits in the version number. For example, upgrading from to or to does not require a new license. Upgrades may require first applying the major upgrade and then the incremental upgrade within that major version. For example, to upgrade from to , first apply the major upgrade to , and then the incremental upgrade to The procedure in this section applies to both types of upgrades. Performing Maintenance Procedures 107

113 Note: To upgrade via HTTPS, enable HTTPS in the iview Network Manager. Select the device you are upgrading from the network tree, select the Configure tab, and select the Secure connection using HTTPS check box. Before You Begin Go to to apply for and download your upgrade package. If you upgrade to a major version, ensure you have a new license key. Procedure Step 1 Step 2 Step 3 Access the iview Network Manager. To upload a new upgrade package into iview Management Suite for the gateway, navigate to Settings > Element Management > Software Upgrade Files. Select Add. Figure 5-1 Adding an upgrade package Step 4 Step 5 Step 6 Step 7 Select the upgrade package: a. Select Browse and navigate to the upgrade package. b. Enter the package name in the Save As field which would appear in the table of the Upgrade Software dialog box (Figure 5-2 on page 109). c. Enter a free text description of the upgrade package. d. Select Ok. To apply the new upgrade package to a specific gateway, locate the device in the network tree. Right-click the gateway device and select Update > Upgrade Software. The confirmation message opens informing you that all active calls on the gateway will be disconnected when you begin the upgrade process. Select Yes in the confirmation message. The Upgrade software window opens (Figure 5-2). Performing Maintenance Procedures 108

114 Figure 5-2 Upgrade software dialog box Step 8 Step 9 Step 10 Step 11 Select the package you added. If you are upgrading for a major version, enter the license key: a. Select Enter license keys. b. Enter the license key in the field. c. Select OK. Select Upgrade now. Select OK. The Upload Log window opens showing the upgrade progress. The upgrade process typically takes 10 minutes with optimal network conditions where the iview Management Suite is located in the same network zone as the gateway. The upgrade process may require more time if network connections are less than optimal. Restoring a Previous Software Version for the SCOPIA Video Gateway The procedure in this section explains how to restore a previous software version after you upgrade your gateway. You can restore the same software version only once. During this procedure the gateway shuts down for a few minutes causing all active calls to be disconnected. Performing Maintenance Procedures 109

115 Please notice that some parameters are not backed up and cannot be restored: IP address IP mask Default router MTU DNS suffix DNS primary address DNS secondary address Note: To restore a previous version via HTTPS, enable HTTPS in the iview Network Manager. Select the device you are upgrading from the network tree, select the Configure tab, and select the Secure connection using HTTPS check box. Only versions SCOPIA Video Gateway 7.7 and later support HTTPS. If you are restoring an earlier version of SCOPIA Video Gateway, do not enable HTTPS. Before You Begin Make sure no active calls are running on the gateway. Procedure Step 1 Step 2 Step 3 Step 4 Access the iview Network Manager. Navigate to the required SCOPIA Video Gateway in the tree structure. Right-click the gateway to be restored and select Update > Restore Previous Version. The confirmation message opens informing you that all active calls on device will be disconnected when you begin the process. Select Yes in the confirmation message. The Upload Log window opens showing the task progress. Figure 5-3 Upload Log Performing Maintenance Procedures 110

116 Downgrading your SCOPIA Video Gateway If necessary, you can downgrade your gateway in one of the following ways: To downgrade one version back after you upgraded your gateway, perform the procedure in Restoring a Previous Software Version for the SCOPIA Video Gateway page 109. To downgrade to a version earlier than the previous version, see Upgrading the SCOPIA Video Gateway on page 107. Changing the IP Address of your Gateway You may need to change the IP address of your gateway when it is transferred to a different subnet of your network. Perform the procedure described in Setting the IP Address of the SCOPIA Video Gateway on page 28. Performing Maintenance Procedures 111

117 6 Troubleshooting Your SCOPIA Video Gateway Deployment This section covers troubleshooting problems that may occur when setting up and operating the SCOPIA Video Gateway. All Endpoints Appear Offline... page 112 Resolving Room System Availability... page 116 Resolving OCS Client Connectivity in TLS Environment... page 117 Retrieving SCOPIA Video Gateway Logs... page 118 Resolving Secure Connectivity Issues in the SCOPIA Video Gateway... page 118 2Resolving a TCP Connectivity Issue with Lync Server 2010 Hosting Pack... page v Resolving a Copy and Paste Issue in the SCOPIA iview Network Manager... page 119 Dealing with an Expired Certificate in the SCOPIA Video Gateway... page 120 All Endpoints Appear Offline Problem All H.323 endpoints appear offline in the Office Communications Video Chat Client. Possible Causes Solution All SCOPIA Video Gateways used in your deployment are offline. The iview Management Suite service fails or is unavailable. The endpoint is defined but did not register successfully in the Gatekeeper. If the problem is caused by SCOPIA Video Gateways being offline, perform this procedure: Procedure Step 1 Step 2 Access the iview Communications Manager. Select Resource Management on the sidebar. Troubleshooting Your SCOPIA Video Gateway Deployment 112

118 Step 3 Select the Gateways tab. The Gateways tab is displayed. Figure 6-1 Checking settings in the Gateway tab Step 4 Step 5 Step 6 Step 7 Check that the status of all SCOPIA Video Gateways is Online. Select Synchronize. Select Advanced Settings in the sidebar. Select the LDAP Configurations tab. The LDAP Configurations tab opens. Troubleshooting Your SCOPIA Video Gateway Deployment 113

119 Figure 6-2 LDAP Configurations tab Step 8 Step 9 Solution Select Synchronize. The iview Management Suite synchronizes with the Microsoft Active Directory. As a result, endpoints status is updated. Check the endpoint status in the Office Communications Client. If the problem is caused by the iview Communications Manager service failure, perform this procedure: Procedure Step 1 Check that the iview Communications Manager service and the Gatekeeper services are running: a. On the iview Communications Manager Server, select Start > Administrative Tools > Services. Troubleshooting Your SCOPIA Video Gateway Deployment 114

120 Figure 6-3 The Services window displaying iview Management Suite and Gatekeeper services Step 2 Step 3 b. Verify that the RADVISION iview Suite service is started. The status of the RADVISION iview Suite watchdog service is not important. c. Verify that the Gatekeeper services are started. Restart the services: a. Double-click one of the services. The Service Properties window opens. b. Select Automatic from the Startup Type list. c. Select Start. d. Select OK. e. Repeat this step for the rest of iview Suite and Gatekeeper services. If the problem persists, restart the iview Communications Manager Server. Troubleshooting Your SCOPIA Video Gateway Deployment 115

121 Resolving Room System Availability Problem In iview Management Suite, a room system that is online appears to be unavailable or offline. Possible Causes Solution The room system does not appear in the filtered terminal list of iview Management Suite. The room system is not registered with the Gatekeeper. Check that the room system is registered with the Gatekeeper. Alter the search criteria of the endpoints listed in the terminal list in iview Management Suite to include the missing endpoint. Procedure Step 1 Log in to the iview Communications Manager. Step 2 In the sidebar, navigate to Admin > Advanced Settings. Select the LDAP Configurations tab. Step 3 Edit the Users Search Base by selecting Configure. See Figure 6-4 on page 116. Figure 6-4 Editing the Users Search BaseiVIEW Management Suite Step 4 Step 5 In the Users Search Base list select the checkbox of the areas to ensure they include the missing endpoint. Select OK. The Users Search Base window closes, and the Users Search Base field displays the name of the selected country (China, in this example). iview Management Suite only lists endpoints from the selected search base. Troubleshooting Your SCOPIA Video Gateway Deployment 116

122 Resolving OCS Client Connectivity in TLS Environment Problem Calls from OCS clients do not connect to H.323 room systems in TLS environment. Possible Causes Solution The OCS server FQDN must be configured to a domain name, and not to an IP address. The connection between a OCS client and the SCOPIA Gatekeeper has become unstable. The TLS environment was not successfully deployed. Verify that the Lync Server name is configured to a domain name by performing this procedure: Procedure Step 1 Step 2 Step 3 Access the iview Communications Manager. Select Resource Management on the sidebar. Select the Modify Gatekeeper/SIP Server/ Presence server tab. The tab is displayed. Figure 6-5 Checking the FQDN field configuration for Microsoft Client connectivity in TLS environment Step 4 Solution Solution Verify the FQDN field configuration: it must be configured to a domain name as shown in Figure 6-5 on page 117. Make an H.323 point-to-point call between the OCS client and the Gatekeeper to verify Gatekeeper functioning. If this fails, troubleshoot the Gatekeeper. Verify the deployment of the TLS environment by performing this procedure: Troubleshooting Your SCOPIA Video Gateway Deployment 117

123 Procedure Step 1 Step 2 Step 3 Open the B2BUA log file. If you see these error messages in the file, they indicate an issue in TLS negotiation: ERROR - TLS - RvTLSSessionClientHandshake: session (0x8c35c58) general eerror ERROR - TLS - RvTLSSessionServerHandshake: session (0x8c35098) general error - SSL alert number 43, file -.\ssl\s3_pkt.c, line [...B2BAPP] Proxy core obj=0x0e39f5f0, appobj=0x0e39f698 was created ERROR - TLS - RvTLSSessionClientHandshake: session (0x8c35c58) general eerror ERROR - TRANSPORT - TlsContinueHandshake - Connection 0x : Call to handshake failed side=1 closing connection, (rv=-512) Troubleshoot by verifying that the certificates are properly applied at both the SCOPIA Video Gateway and SCOPIA iview Management Suite. Retrieving SCOPIA Video Gateway Logs When reporting a problem to customer support, you may be asked to retrieve and send logs of SCOPIA Video Gateway. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Access the iview Network Manager. Navigate to the required SCOPIA Video Gateway in the tree pane. Right-click the SCOPIA Video Gateway. Select Retrieve Customer Support Package. The logs are retrieved in form of a zip file. Send the zip file containing logs to the RADVISION customer support. You can find recommendations concerning contacting RADVISION customer support at this web page: Resolving Secure Connectivity Issues in the SCOPIA Video Gateway View alert messages that iview Management Suite generates to describe and help solve secure connectivity issues. Procedure Step 1 Step 2 Access iview Communications Manager. Select Network Management on the sidebar. Troubleshooting Your SCOPIA Video Gateway Deployment 118

124 Step 3 Select the Gateway tab. The tab is displayed. Figure 6-6 Viewing alert messages on secure connectivity Step 4 Step 5 Navigate to the SCOPIA Video Gateway that displays a blue icon next to its IP address in the Management IP address column. Place the cursor on the blue icon to view the alert message. Resolving a Copy and Paste Issue in the SCOPIA iview Network Manager Problem Copying the certificate request from SCOPIA iview Network Manager > Certificate Management tab > Save Certificate Request window does not work. Pasting the certificate into SCOPIA iview Network Manager > Certificate Management tab > Upload Signed Certificate window does not work. Note: This issue might also occur when copying the license, license key, serial number or MAC (Media Access Control) address. Possible Causes Solution There is a JRE (Java Runtime Environment) security issue in your web browser. For detailed information, see the Java Forum at ion Grant permission in Java to do copy/paste in SCOPIA iview Network Manager. Troubleshooting Your SCOPIA Video Gateway Deployment 119

125 Procedure Step 1 Step 2 Log out of SCOPIA iview Network Manager Search for the java.policy file in C:\Program Files\Java\jre6\lib\security\. Note: If your server runs the 64-bit version of Windows, there are two Program folders under the C: drive; one folder holds 64-bit programs (Program Files) and the other one holds 32-bit programs [Program files (x86)]. Search for the java.policy file in C:\Program Files (x86) \Java\jre6\lib\security\. Step 3 Step 4 Step 5 Step 6 Open the file and add this line at the end of the grants list: permission java.awt.awtpermission "accessclipboard"; Close all browser windows to re-start Java. - or- Right-click the Java icon in the system tray to open the Java console, and type r to reload the policy configuration. Login to SCOPIA iview Network Manager. Perform the copy/paste on the certificates as described in Generating the Certificate Signing Request for the SCOPIA Video Gateway on page 97 and Uploading Certificates into the SCOPIA Video Gateway on page 104, respectively. Dealing with an Expired Certificate in the SCOPIA Video Gateway If the device certificate is renewed after its expiration date and the device communicates with SCOPIA iview Management Suite in XML over TLS, you must configure the communication to TCP before uploading the renewed certificate. Before You Begin Make sure you have these items: A PC with an available serial port. It should have terminal emulator software installed. Serial cable provided with the device. Procedure Step 1 Step 2 Start the terminal emulation application on the PC. Set the communication settings in the terminal emulation application on the PC as follows: Field Name Value Baud Rate 9600 Data bits 8 Troubleshooting Your SCOPIA Video Gateway Deployment 120

126 Field Name Value Parity None Stop bits 1 Flow Control None Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Power off, then on the SCOPIA Video Gateway. A log of the auto-boot events scrolls across the computer monitor. When the message Press any key to start configuration appears on the screen, press a key and wait for the following message: Main menu T: Set the XML connection mode to TCP (Reboot is not required) Enter T at the prompt so that the device can communicate with SCOPIA iview Management Suite in XML over TCP and press Enter. Enter Q to close the terminal emulation. Upload the new certificate into the device. Reconfigure the XML connection to TLS by logging into iview Management Suite and selecting Resource management > Gateway tab > Add > Secure XML Connection. Troubleshooting Your SCOPIA Video Gateway Deployment 121

127 About RADVISION RADVISION (NASDAQ: RVSN) is the industry s leading provider of market-proven products and technologies for unified visual communications over IP, 3G and IMS networks. With its complete set of standards-based video communications solutions and developer toolkits for voice, video, data and wireless communications, RADVISION is driving the unified communications evolution by combining the power of video, voice, data and wireless for high definition video conferencing systems, innovative converged mobile services, and highly scalable video-enabled desktop platforms on IP, 3G and emerging next generation IMS networks. To gain additional insights into our products, technology and opinions, visit blog.radvision.com. For more information about RADVISION, visit USA/Americas T F infousa@radvision.com EMEA T F infouk@radvision.com APAC T F infoapac@radvision.com This document is not part of a contract of license as may be expressly agreed RADVISION is registered trademarks of RADVISION, Ltd. All trademarks recognized. All rights reserved 2011 RADVISION, Ltd.