Installation and Setup of IBM Sametime From Zero to Hero Part 2 Edge Components

Transcription

1 IBM Collaboration Solutions Installation and Setup of IBM Sametime From Zero to Hero Part 2 Edge Components Frank Altenburg SME for Sametime IBM Collaboration Solutions mailto:frank.altenburg@de.ibm.com New version from IBM Corporation

2 Agenda Components of IBM Sametime Requirements for a IBM Sametime Edge deployment Architecture of a IBM Sametime Edge deployment The 25 steps to a IBM Sametime Edge deployment 2

3 The IBM Sametime Components we will cover In Part 1: IBM DB2 Database Server IBM Sametime System Console IBM Sametime Community Server IBM Sametime Proxy Server IBM Sametime Meeting Server IBM Sametime Media Manager IBM Sametime Advanced Server (optional) IBM Sametime Connect Client In this Part 2: IBM Sametime Community MUX (optional) IBM Sametime SIP Edge Proxy IBM Sametime Meeting HTTP Proxy IBM Sametime TURN Server IBM Sametime Gateway (optional) In Part 3: Moving Sametime Servers to separate boxes Implementing additional Servers for clustering Clustering of Sametime Servers 3

4 IBM Sametime System Level Architecture Sametime Clients HTTP HTTP VP SIP, RTP SIP, RTP Meeting Server VP Community Server VP Advanced Server VP Media Manager Unified Telephony VP VP SIP SIP, TCSPI Partner A/V Bridges Sametime Proxy Sametime Gateway SIP, XMPP HTTP Logical servers shown may be combined physically depending on user workload Enterprise Phone System External IM Communities Embedded Applications, including Web Client, Portal, and Mobile 4

5 IBM Sametime System Console Manage prerequisites. Centralize configuration. Setup & testing of things like LDAP centralized in a single location, instead of various wizards in different installers Facilitate deployment planning. Mechanism to plan the Sametime server deployment Installation of server nodes is simpler, as the shared configuration already exists. Server installers are headless, and need no input from user Sametime Classic Meetings Domino Sametime Presence/IM LDAP Sametime New Meetings Sametime Media Server Sametime Proxy WebSphere No install/reinstall of IBM DB2 (for example) for each separate offering Sametime System Console System console manages all needed info for prerequisite components DB2 Sametime Advanced Single point of action for administrative tasks Example: Policies are managed from a single place for all components 5

6 Agenda Components of IBM Sametime Requirements for a IBM Sametime Edge deployment Architecture of a IBM Sametime Edge deployment The 25 steps to a IBM Sametime Edge deployment 6

7 IBM Sametime Prerequisites IBM Sametime Community MUX Server requires IBM Sametime SIP Edge Proxy IBM WebSphere Application Server (provided automatically via Install) IBM Sametime Meeting Server IBM Sametime TURN Server requires IBM WebSphere Application Server (provided automatically via Install) IBM Sametime Mdia Manager IBM Sametime Meeting HTTP Proxy IBM Sametime Community Server (Version >= 7.5.1) IBM Sametime Media Manager IBM Sametime Gateway Server requires IBM WebSphere Application Server (provided automatically via Install) IBM DB2 9.7 or 9.5 FP1 LDAP directory server (Supported IBM Lotus Domino Directory LDAP, Microsoft Active Directory, IBM Tivoli Directory Server, SunOne iplanet, Novell edirectory ) IBM Sametime Community Server (Version >= 8.0.1) 7

8 IBM Sametime Prerequisites (cont.) IBM Sametime System Console Server requires IBM Sametime Community Server requires IBM WebSphere Application Server (provided automatically via Install) IBM Sametime Community Server (Version >= 7.5.1) IBM Sametime Meeting Server requires IBM Lotus Domino or (32 Bit Version only) LDAP directory server IBM Sametime Proxy Server requires IBM WebSphere Application Server (provided automatically via Install) IBM DB2 9.7 or 9.5 FP1 LDAP directory server (Supported IBM Lotus Domino Directory LDAP, Microsoft Active Directory, IBM Tivoli Directory Server, SunOne iplanet, Novell edirectory ) IBM WebSphere Application Server (provided automatically via Install) IBM DB2 9.5 FP1 (provided automatically via Install) LDAP directory server IBM Sametime Media Manager requires IBM WebSphere Application Server (provided automatically via Install) IBM Sametime Community Server LDAP directory server 8

9 IBM Sametime Prerequisites (cont.) IBM Sametime Advanced Server requires IBM WebSphere Application Server (provided automatically via Install) IBM DB2 9.7 or 9.5 FP1 LDAP directory server (Supported IBM Lotus Domino Directory LDAP, Microsoft Active Directory, IBM Tivoli Directory Server, SunOne iplanet, Novell edirectory ) IBM Sametime Community Server (Version >= 8.0.1) 9

10 IBM Sametime Prerequisites (continued) Software requirements Client Windows XP (SP2), XP Tablet, Vista and Windows 7 32 and 64 bit MAC OS X x86-64 and future OS fix packs RHEL 5.0 Update 4 Desktop Edition x86-32 and future OS fix packs SLED 10.0 SP3 and 11.0 SP1 32 and 64 bit and future OS fix packs Ubuntu LTS x85-32 and future OS fix packs Server Windows Server 2003/ and 64 bit (including R2) Linux (RHEL, SLES) - 32 and 64 bit AIX 5.3/6.1 i5/os 5.4, 6.1 Solaris 10 ESX and ESXi 4.0, MS Hyper-V R2 Browsers Microsoft Internet Explorer 6.x, 7.x, 8.0 (Windows) Firefox 3.5 and 3.6 (Windows, Mac, Linux) Safari 5.0 (Mac) Other Domino 8.5.1/8.5.2 for Community Server / 'Classic' meetings WebSphere Application Server 7 for new servers and gateway (included) DB2 9.7 for new servers and gateway (included) 10

11 IBM Sametime Prerequisites (continued) Software requirements For WEB A/V Microsoft Internet Explorer 6.x(!!), 7.x, 8.0 (Windows) Firefox 3.5 and 3.6 (Windows, Mac) SPECIAL NOTE: Microsoft Internet Explorer 9, Apple Safari and Google Chrome are not supported with the Sametime Audio/Video Browser Plugin in this actual Sametime Version We do not support any Linux based OS now for Browser A/V. Microsoft Internet Explorer 6 should work and is officially supported. But it is not recommended to use this version because it can cause issues when several parallel connections needs to be established with the meeting server. 11

12 Other requirements Make sure that all servers you want to use can be resolved in DNS. If DNS is not available then list all full qualified server names and IP addresses from all servers in the hosts file and publish this file to all servers. The Media Manager Server does not work when installing with a DNS alias. You must configure the full qualified machine host name (including domain part) and use this for the installation. This name does not need to be configured anywhere else and the client does not see it. If you use Windows 2008 as Operating System, then you need to start all installations and configurations in Administrative mode. You need a LDAP Server hosting your user base. This can be a Domino LDAP or Microsoft Active Directory or any other supported V3 LDAP. The Sametime gateway requires a public, not NATed IP address. NAT does not work with SIP traffic (specially when using TLS encryption) because the SIP packages contain the sending IP address inside. Then the receiver refuses the SIP package coming from another address then the one inside the package. 12

13 Required files for a deployment on Windows For a Windows installation of the Edge components you need to download these files from Passport Advantage: CZYD7ML.zip CZYE0ML.zip CZYF0ML.zip CZYF9ML.exe CZYA0ML.zip CZYH1ML.zip IBM Sametime Community Server Standard IBM Sametime Meeting Server IBM Sametime Media Manager Server IBM Sametime Gateway IBM Sametime WebSphere Application Server IBM Sametime WebSphere Application Server ifixes Create a directory, for example C:\Install, on the servers where you want to install. Then unpack the downloaded files into this directory. Just unpack the files required for your deployment architecture on the particular server. If you run the CZYF9ML.exe, create a subdirectory C:\Install\SametimeGateway to unpack the file. When unpacked the CZYH1ML.zip file go into the subdirectory C:\Install\SametimeWASiFixes\WebSphereUPDI and unzip the update installer for your used operating system. 13

14 Agenda Components of IBM Sametime Requirements for a IBM Sametime Edge deployment Architecture of a IBM Sametime Edge deployment The 25 steps to a IBM Sametime Edge deployment 14

15 IBM Sametime Our pilot recommendation Compared with the last version of this document installing IBM Lotus Sametime (from Lotusphere 2011), we have changed again our recommendation for a pilot deployment. The reason for the change is the availability of new features in installation methods as well as our increased experience and many successful installations using this method in the last months. The most Edge components described in this part 2 can be installed on one single box in the DMZ because all of them use different ports for communication. Only the Sametime Gateway requires a separate box because it uses the SIP Protocol and requires a non NATed public IP address. The Sametime Gateway is optional and not required for the other Edge components to work properly. It is important to have the full environment described in the Part 1 of this documentation up and running before starting the Edge components installation. The Sametime Advanced part is not required for this installation. 15

16 IBM Sametime Edge our pilot deployment STMux DB2 9.5 Server Sametime System Console SIP Edge Proxy Sametime Media Manager edge.renovations.com Sametime Meeting Server Sametime Proxy Server meeting.renovations.com webchat.renovations.com Active Directory LDAP ldap.renovations.com WAS HTTP Proxy sametime.renovations.com Sametime Community Server TURN Server gateway.renovations.com DNS entries: sametime.renovations.com meeting.renovations.com chat.renovations.com webchat.renovations.com edge.renovations.com pointing to Sametime Gateway Server Port Forwardings: 80 TCP 1533 TCP 5061 TCP 5081 TCP 3478 UDP to gateway.renovations.com chat.renovations.com

17 Hardware required for this Pilot Example Deployment 1 Server for the IBM Sametime Community MUX, IBM Sametime Meeting HTTP Proxy, IBM Sametime SIP Edge Proxy, IBM Sametime TURN Server Quad CPU, 8GB RAM or more, 100GB disk space or more, 64 Bit OS 1 GBit Network Interface with 2 IP addresses (internal and external). 1 Server for the IBM Sametime Gateway Server Dual CPU, 4GB RAM or more, 50GB disk space or more, 64 Bit OS 1 GBit Network Interface with 2 IP addresses (internal and external but not NATed). Various client endpoints With such a configuration you can host up to 300 concurrent Meeting Participants * concurrent Sametime Clients * 150 concurrent Media Streams * 1500 concurrent Proxy web client users * * Ask you IBM representative for more detailed sizing information in a defined environment 17

18 Special IP configuration for the WebSphere based Server For this Edge environment it is required to have the same FQ Host names that you use in the internal network (see Part 1 of this documentation) be configured in the public DNS pointing to the public IP address of the server machine in the DMZ hosting the Edge components. This means splitted DNS configuration is required. Host Name: Alias Names: Public IP: DMZ IP: edge.renovations.com sametime.renovations.com meeting.renovations.com webchat.renovations.com chat.renovations.com (NATed to the DMZ IP) Local address in the Intranet: Host Name: edge.renovations.com IP:

19 Special IP configuration for the WebSphere based Server (cont) For the Sametime Gateway Server a not NATed public IP address is required. Best practice is to have a splited DNS configuration. Public address in the Internet: Host Name: gateway.renovations.com Public IP: (not NATed) Local address in the Intranet: Host Name: gateway.renovations.com IP:

20 Required technical users for IBM Sametime IBM Sametime requires some technical users for components to communicate in an authenticated mode. All of this users should be configured so that the password never expires and never needs to be changed. db2admin This user is created during installation of the DB2 server in the Operating System. Do not create this user in advance. It is the user for all IBM Sametime related components using DB2 to access their databases. Be sure to match the password policy requirements of the OS. wasadmin This is the user to access the IBM WebSphere components and to administer the system. This user must not exist in your LDAP directory. It is created during WebSphere installation in a local file repository. You can use the same user name and password for all components (makes it easier) or different names and passwords. But again, it does not work when this user exists in the LDAP. 20

21 Required technical users for IBM Sametime (cont) Domino Administrator This user is created during installation of Domino for the IBM Sametime Community Server. It is a best practice to not use a existing administrative account because it is the account with that the IBM Sametime System Console communicates with the Community Server. LDAP Bind User This is a user account in your LDAP directory. This account is used to connect in authenticated mode to the LDAP server to get all required attributes. It is possible to connect anonymously to the LDAP but then it does not work with some LDAP systems or the LDAP server requires special configuration to allow anonymous bind. 21

22 Starting and stopping the WebSphere based Server In this pilot deployment we install and configure all WebSphere based Sametime servers using a single Cell. Then it is easy to administer all of them using just one administrative interface. (The Integrated Solutions Console of the Sametime System Console) With Sametime the services where created automatically for all servers because we used for all of them a separate Cell Profile deployment. Now with IBM Sametime we use the Network deployment method by implementing all servers as a Primary Node federated to the Deployment Manager of the Sametime System Console in just one Cell. Using this method the installer does not create some required components and it does not create some services in the Windows operating system. We need to manually create this components and Services. All the required steps are described in detail later this slide deck. 22

23 Audio/Video Plug-In for Browser access to Meeting Rooms The Meeting Plug-In is shipped with the Media Manager in two formats. 1.) Download Version This version files needs to be copied onto a Web Server that can be accessed by the Browser from the client who want to access the Meetings using Audio and Video services. This could be the Domino based Sametime Community Server, the Sametime Proxy Server or the Sametime Meeting Server or any other web server in your organization. In this pilot deployment recommendation we use the Sametime Proxy server for this service. To download and install this Plug-In it is required to have Administrative access rights on Windows 7. With all other OS the user right is enough 2.) Deployment Version This version can be deployed using your preferred deployment tool. It contains a MSI installer file. But be careful in some operating systems as Windows 7, it is required to install this version with administrative rights. 23

24 Agenda Components of IBM Sametime Requirements for a IBM Sametime Edge deployment Architecture of a IBM Sametime Edge deployment The 25 steps to a IBM Sametime Edge deployment 24

25 The 25 steps to deploy a Sametime EDGE environment 1.Enable Trust for the Community Mux in the Sametime Community Server 2.Install the Sametime Community Mux 3.Configure the Community Mux in the Sametime System Console 4.Install the SIP EDGE Proxy without the Sametime System Console 5.Configure the SIP Edge Proxy 6.Post Install Tasks 7.Create a Deployment Plan for the Sametime Meeting HTTP Proxy 8.Install the Sametime Meeting HTTP Proxy 9.Run the guided activity to add the Sametime Meeting HTTP Proxy to the Meeting Cluster 10.Remove the Sametime Meeting Server on the Edge Server 11.Create the WebSphere Meeting Http Proxy on the Edge Server 12.Post Install tasks 13.Install the TURN Server 14.Configure the TURN Server and enable NAT Traversal 15.Test all the Edge components 25

26 The 25 steps to deploy a Sametime EDGE environment 16.Create the Sametime gateway DB2 Database 17.Configure the DB2 Database Prerequisite in the Sametime System Console 18.Enable Trust for the Gateway in the Sametime Community Server 19.Install the Sametime Gateway without the Sametime System Console 20.Post Install Tasks 21.Register the Gateway to the Sametime System Console 22.Connect to the local Sametime Community 23.Connect to a Partner Sametime Community 24.Enable clients to use the Sametime Gateway 25.Test the Gateway 26

27 STEP ONE: Enable Trust for the Community MUX in the Sametime Community Server Summary A Sametime Community Server only accepts connections from a Community Services multiplexer that is listed in the "CommunityTrustedIps" field of a "CommunityConnectivity" document to prevent an unauthorized machine from connecting to the Sametime community server. This can be configured directly in the STCONFIG.NSF Database CommunityConnectivity Document, or and this is now much easier in the Sametime System Console. This is the way we want to configure this part. 27

28 Enter the URL The WebSphere Application Server Administrative interface (the Integrated Solutions Console ISC) is always secured by SSL. Therefore you will be redirected to HTTPS and the port 8701 automatically. You are prompted to accept the default certificate. For different browsers the procedure to accept this IBM signed certificate is different. You can use the direct URL: 28

29 Enter the WebSphere Application Server Administrative User name and its password. We use wasadmin. Then click the Log in button to continue. 29

30 You have now reached the IBM Lotus Sametime System Console. 30

31 Click on Sametime System Console, then on Sametime Servers and then on Sametime Community Servers. 31

32 Click your Chat Server now. 32

33 Go to the bottom of the page and enter the IP address of your Edge server that hosts your Sametime Community MUX. Then click the Add button 33

34 The IP address is now added. Click the OK button to save the setting into the Sametime Community Server configuration. 34

35 Restart your Sametime Community Server to apply the trust settings. Be aware to use this restart server console command only in your test environment. On a production server this won't work because the restart is often faster then stopping all 41 Sametime server tasks. The complete restart can take up to 5 minutes. Wait until all 41 ST... tasks appear in your Task Manager. 35

36 STEP TWO: Install the Sametime Community MUX Summary This step installs theibm Sametime Community MUX. We like to use a CMD command line window to enter some of the commands and start the installers. For that we have created a short cut in our fast start section. You can use the Windows Explorer as well to navigate to the destination directory and double click the installation file (setupwin32.exe) 36

37 Enter the command cd \Install\CommunityMux and press the Enter key. Enter the command setupwin32.exe and press the Enter key. 37

38 My Operating System was set to German language. But I want to use the English language (default) for the installation. Just click the OK button. 38

39 Now click the Next button to continue. 39

40 Accept the terms in the license agreement and click the Next button to continue 40

41 Remove Program Files\ and click the Next button to continue We recommend to use path names without spaces (as some scripts may require this) and also shorten the path name so that the typical limits of some operating systems and applications for path + file name length are avoided. 41

42 Enter the full qualified host name of your community Server. We use chat.renovations.com. Then click the Next button to continue. 42

43 Click the Install button to install the Community MUX. 43

44 The Sametime Community MUX is now installing. This step takes approximately 1 to 2 minutes. 44

45 Important to know... Consider the requirements of the community server multiplexer machine before installing it. * community server multiplexer installation files are available for Windows, AIX, Linux, and Solaris. A stand-alone community server multiplexer cannot be installed on IBM i. However, Sametime on IBM i supports the use of a standalone multiplexer installed on a Windows system. * The minimum system requirements for the community server multiplexer machine are the same as the system requirements for the core Sametime community server. * A machine that meets the minimum system requirements should be able to handle approximately 20,000 simultaneous client connections. * Testing indicates that machines with dual 1133 MHz CPUs and 2 GB of RAM can handle approximately 30,000 simultaneous client connections. * TCP/IP connectivity must be available between the community server multiplexer machine and the Sametime community server. Port 1516 is the default port for the connection from the community server multiplexer machine to the Sametime Community Server. 45

46 When the installation has finished successfully, click the Finish button to close the Installer. 46

47 Set the preferences of the Community Mux ST Mux service to start and stop automatic with the Operating System. Then start the service. 47

48 The Community Mux is now setup to start and stop automatic with the Operating System, and it is started. 48

49 Install a Sametime Connect client in the public network and connect to your Sametime Community Mux server. In the public network this should be the same address as in your local network chat.renovations.com. The Sametime Community Mux forwards your connection to the internal Sametime Community Server. Login with a user in your directory to see that the Mux works. 49

50 Another way to test the functionality and connectivity of your Sametime Community Mux is to enter the command netstat -an in a CMD line window. There you should see the ST Mux is listening on ports 1533 and There are established connections to your Community Server (IP ) on port 1516 and from your Sametime Client (IP ) on port

51 STEP THREE: Configure the Community MUX in the Sametime System Console Summary Use the IBM Sametime System Console to connect to a Sametime Community Mux and validate its settings. 51

52 Click on Sametime System Console then on Sametime Prerequisites and then on Connect to Sametime Community Mux Servers. 52

53 Click the Add button Enter the host name of your Sametime Community Mux server (we use edge.renovations.com ) and click the Save button. 53

54 The Sametime Community Mux Server is now successfully added to your Sametime System Console. 54

55 STEP FOUR: Install the SIP EDGE Proxy without the Sametime System Console Summary The IBM Lotus SIP Edge Proxy is a SIP Application installed over a WAS server. Since there is no specific installer for the IBM Lotus SIP Edge Proxy server, you can use the SIP Proxy/Registrar installer and then perform manual steps in order to adjust the environment to the Lotus SIP Edge Proxy. 55

56 Navigate to the \Install\SametimeMediaManager directory and enter the command Launchpad 56

57 The Sametime Launchpad opens. Click the Install IBM Lotus Sametime Media Manager link on the left side. 57

58 Now click the link Launch IBM Lotus Sametime Media Manager Installation 58

59 The Installation Manager is now loading. 59

60 Click the Next button to continue. 60

61 Accept the terms in the license agreement and click the Next button to continue 61

62 Remove Program Files\ and click the Next button to continue We recommend to use path names without spaces (as some scripts may require this) and also shorten the path name so that the typical limits of some operating systems and applications for path + file name length are avoided. 62

63 Click the Install button to install the Installation Manager. 63

64 The installation Manager is now installing 64

65 If you are using Windows 2008 R2 or Windows 2003 R2 then it can be possible that you run into a JAVA heap memory overflow. To prevent this issue change a parameter in The IBMIM.INI configuration file of the Sametime Install Manager. See the next 2 slides how to do this. And then click the Restart Installation Manager button to continue. 65

66 In the File Explorer navigate to your Install Manager's eclipse directory C:\IBM\Install Manager\eclipse. Then open the configuration file IBMIM.ini in notepad. 66

67 Add he parameter -Xmx1024m at the end. Then save and close the file. This parameter is case sensitive. Now click the Restart Installation Manager button in your Install Manager screen to continue your Installation. 67

68 Click the Install icon to start the installation. 68

69 Select IBM Sametime Media Manager and Version Then click the Next button to continue. 69

70 Accept the terms in the license agreement and click the Next button to continue. 70

71 Enter the correct path (remove Program Files\ ) and click the Next button to continue. 71

72 Enter the correct path (remove Program Files\ ) and click the Next button to continue. 72

73 Select IBM Sametime Media Server but deselect Use Lotus Sametime System Console to Install. Then click the Next button to continue. 73

74 With IBM Sametime it is possible to install Sametime on top of an existing WebSphere Server. We don't want to do this in this pilot deployment. Just click Next to continue. 74

75 In this screen you need to select the WebSphere deployment method. We use Standalone for this installation. And you need to define the WebSphere Application Server administrative user. You need to authenticate with this user to access the Integrated Solutions Console of your Media Manager Server. It is important that this user does not exist in your LDAP. In this example we use the standard wasadmin. Enter the password twice and click the Next button to continue. 75

76 The host names for the SIP Proxy/Registrar, Conference Manager, Packet Switcher, and Community Server must be all different. The Proxy/Registrar host name should be the local host, and the others should be different from the Proxy/Registrar host name and also from each other. We use in this example: * Conference Manager host name: sametime.renovations.com * Proxy/Registrar host name: edge.renovations.com * Packet Switcher host name: meeting.renovations.com For the Community Server we use our chat server chat.renovations.com Then click the Validate button to continue. 76

77 If the connection to the different hosts was successful, then you should see that the text in the button has changed to Validated. Now click the Next button to continue. 77

78 Select the checkbox Configure LDAP after the installation and click the Next button. 78

79 Click the Install button to install the Sametime Media Manager Server. 79

80 The Installation Manager now installs the Sametime Media Manager. This step can take approximately 30 to 45 Minutes. 80

81 Important to know... It should be possible to do this installation with every other Sametime component that is WebSphere based to just have the WebSphere binaries and the Cell profile structure on the box. But we need to implement a special application - the Edge Proxy Application. This application is shipped in the Media Manager install package. So it is easier to use this installer for this installation. If you plan to implement all Edge components on one box, like described in this document, then you need to install the SIP Edge Proxy component first before the Meeting Http Edge Proxy. The reason is the required configuration steps for the Meeting Http Edge Proxy disallow the complete Cell installation of the SIP Edge Proxy. 81

82 The Installer first unpacks the WebSphere Application Server install files Then he installs the WebSphere Application Server binaries Then he creates the WebSphere profiles Then he installs the Update Installer Then he installs the Update to WebSphere Then he install the application and configures everything 82

83 In this directory is the log file where the installer logs its progress. The file increases up to approximately 302 KBytes. Director on Windows 2008: C:\Users\All Users\IBM\Installation Manager\logs\ant The last step is to configure the services and some post install tasks. 83

84 The Sametime Media Manager server has installed successfully. Click the Finish button and close the Installation Manager and the Launchpad. 84

85 STEP FIVE: Configure the SIP Edge Proxy Summary The SIP Edge Proxy needs to be configured. Several steps are required to complete this configuration: A)Login to the new Media Manager integrated Solutions Console B)Uninstall all Media manager applications C)Install the new SIP Edge Proxy application D)Configure the SIP Ports E)Modify the SIP Edge Proxy Settings in the edge-proxy.xml file F)Replace the default certificate G)Exchange certificates between the SIP Edge Proxy and the SIP Proxy Registrar 85

86 A) Login to the new Media Manager integrated Solutions Console Enter the URL Then click the Add Exception button. The WebSphere Application Server Administrative interface (the Integrated Solutions Console ISC) is always secured by SSL. Therefore you will be redirected to HTTPS and the port 8701 automatically. You are prompted to accept the default certificate. For different browsers the procedure to accept this IBM signed certificate is different. You can use the direct URL: 801/ibm/console. 86

87 The IBM signed certificate is not trusted by the browser. Click the Get Certificate button to accept the certificate by clicking the Confirm Security Exception Button. (this dialog is different using other browsers) 87

88 Enter the WebSphere Application Server Administrative User name and its password. We use wasadmin. Then click the Log in button to continue. 88

89 You have now reached the IBM WebSphere Integrated Solutions Console. 89

90 B) Uninstall all Media manager applications Click on Applications - Application Types and then on WebSphere enterprise applications. 90

91 Select the installed applications ConferenceFocus and SSCConnect.ear. If other applications are installed like SIP Proxy, SIP Registrar or Packet Switch, select them as well and then click the Uninstall button. 91

92 Click the OK button to continue. 92

93 Yes we want to save the changes and click the save link. 93

94 C) Install the new SIP Edge Proxy application The applications are now deleted. Next is to install the SIP Edge Proxy application. Click the Install button. 94

95 If you run your browser on the Edge machine, you can use Local File System. If you use your Browser from your workstation, then the install files are remote. So use the Remote file system and click the Browse button. 95

96 Select the directory where you have unpacked the Media Manager install files. And from there the subdirectory SIPEdgeProxy. Then select the EdgeProxyAppl.ear file and click the OK button. 96

97 Click the Next button to continue. 97

98 Click the Next button to continue. 98

99 Click the Next button to continue. 99

100 Click the Next button to continue. 100

101 Click the Next button to continue. 101

102 Click the Finish button to continue. 102

103 Click the save link to continue. 103

104 The EdgeProxyAppl is now installed successfully. 104

105 D) Configure the SIP Ports To set up ports for the IBM Lotus SIP Edge Proxy, an administrator needs to determine the SIP ports used for the SIP Proxy/Registrar and ensure that the Lotus SIP Edge Proxy listens on these same ports. To perform this configuration step we open a new browser window and connect to our Sametime System Console Integrated Solutions Console. Enter the URL If the console is already open in your browser, then switch to this browser window. 105

106 Click on Servers - Server Types and then on WebSphere application servers. 106

107 Click on STMediaServer. 107

108 On the right side under Communications click on Ports. 108

109 Record the ports that are used for the SIP_ProxyRegHOST and SIP_ProxyReg_SECURE. Here we can find ports 5080 and

110 Go back to the Integrated Solutions Console of your Edge Media Manager installation. Now click on Servers Server Types and then on WebSphere application servers. 110

111 Click on STMediaServer. 111

112 On the right side under Communications click on Ports. 112

113 Click on SIP_ProxyRegHOST 113

114 Enter the Port 5062 and click the OK button. 114

115 Click on SIP_ProxyReg_SECURE 115

116 Enter the Port 5063 and click the OK button 116

117 Click on SIP_DEFAULTHOST 117

118 Enter the Port 5080 and click the OK button. 118

119 Click on SIP_DEFAULTHOST_SECURE 119

120 Enter the Port 5081 and click the OK button. 120

121 Click the Save link to save the last changes. 121

122 Next is to add the ports to the virtual hosts table. Click on Environment and then on Virtual hosts. 122

123 Click on default_host 123

124 Click on Host Aliases. 124

125 Click the New button to add a new entry. 125

126 Leave the Host Name as it is and enter the Port 5080 in the Port field. Then click the OK button. 126

127 To add an other entry click the New button again. 127

128 Enter the Port 5081 and click the OK button. 128

129 We have changed the SIP_ProxyRegHOST and SIP_ProxyReg_SECURE ports. So we need to map this changes here as well. Click the * near the Port

130 Change the port to 5062 and click the OK button. 130

131 Now click the * near the port

132 Change the port to 5063 and click the OK button. 132

133 Click the Save link to save the last changes. 133

134 We have now successfully configured the host aliases for our SIP Edge Proxy server. 134

135 Now we need to make sure that the setting Use available authentication data when an unprotected URI is accessed is switched off. To check that click on Security - Global Security. 135

136 Under Web and SIP security click on General settings. 136

137 Confirm that the check box near Use available authentication data when an unprotected URI is accessed is switched off. 137

138 Now we need to confirm 2 more settings in the Server configuration for our SIP Edge Proxy Server. Click on Servers - Server Types and then on WebSphere application servers 138

139 Click the STMediaServer application server. 139

140 Under SIP Container Settings click on SIP container. 140

141 Now click on Custom properties 141

142 Confirm that the setting com.ibm.ws.sip.sent.by.host contains the full qualified host name of your Edge Proxy Server machine. If this is wrong, click on com.ibm.ws.sip.sent.by.host and change the host name. Then check that a property com.ibm.ws.sip.security.trusted.iplist does not exist. If it exists mark it and click the Delete button. Then click the Save link in the next screen. 142

143 E) Modify the SIP Edge Proxy Settings in the edge-proxy.xml file Next step is to configure the edge-proxy.xml file and populte it to the server node. Open a windows File explorer and navigate to the directory: C:\IBM\WebSphere\AppServer\profiles\STMSDMgrProfile\config\cells\edgeMediaCe ll\applications\edgeproxyappl.ear\deployments\edgeproxyappl\edgeproxyweb.wa r\web-inf. Then open the file edge-proxy.xml with notepad or better with wordpad. 143

144 The authoritativeproxy section contains the hostname, port, and transport of the SIP Proxy/Registrar: * Specify the SIP port used for TCP. * Specify the SIP port used for TLS. The edgeproxy section contains the hostname, port, and transport of the Lotus SIP Edge Proxy: * Specify the SIP port used for TCP. * Specify the SIP port used for TLS. The authproxysourceaddr section specifies the address of the SIP Proxy/Registrar. When the Lotus SIP Edge Proxy receives stand-alone or initial requests, it determines the remote address from which the request was received. If the remote address does not match the SIP Proxy/Registrar address, the request is sent to the SIP Proxy/Registrar for further processing. Supported values: IP address, regular expression that matches the SIP Proxy/Registrar address (for example, " "). 144

145 We use in our example: authproxyhost= sametime.renovations,com authproxyport= 5081 authproxytransport= TLS authproxysourceaddr= edgeproxyhost= edge.renovations.com edgeproxyport= 5081 edgeproxytransport= TLS Now save the file and close your wordpad editor. 145

146 Next is to copy the edited file to the application server configuration in the Deployment Manager. Open a second File explorer and navigate to the directory: C:\IBM\WebSphere\AppServer\profiles\STMSDMgrProfile\config\cells\edgeMediaCell \nodes\edgemedianode\servers\stmediaserver. 146

147 Now copy the file. (be sure to copy and not move the file) 147

148 Next is to synchronize the file to the node. In your Edge Integrated Solutions Console click on System administration - Nodes. 148

149 Select the edgemedianode and click the Full Resynchronize button. 149

150 F) Replace the default certificate To avoid the problem of IBM Sametime clients rejecting the certificate issued for the IBM Lotus Edge Proxy server, an administrator needs to replace the default certificate on the Lotus SIP Edge Proxy so that it contains the SIP Proxy/Registrar's FQDN. These instructions are for the default certificate, which is meant for internal communications (not meant to act as a CA). Sametime clients verify that the certificate was issued for the SIP Proxy/Registrar. In a Lotus SIP Edge Proxy deployment, the client opens a TLS connection to the Lotus SIP Edge Proxy resulting in the client receiving a certificate issued for the Lotus SIP Edge Proxy server. This certificate will be rejected by the client. Click on Security and then on SSL certificate and key management. 150

151 Now click the Manage endpoint security configurations link. 151

152 Open the Inbound tree and click on edgemediacell and then edgemedianode 152

153 Click the Manage certificates button. 153

154 Click the Create button and then the Chained Certificate... menu entry. 154

155 This fields are required to continue: Alias sip-pr-cn-cert Common name sametime.renovations.com Organization renovations Country or region US Then click the OK button. 155

156 To save the last changes just click the Save link. 156

157 Now click again the edgemedianode in the Inbound tree. 157

158 Click the Manage certificates button. 158

159 Check mark the default certificate and then click the Replace button. 159

160 In the Replace with selection box select the newly generated sip-pr-cn-cert certificate. Check mark both check boxes Delete old certificate after replacement and Delete old signers. Then click the OK button. 160

161 To save the last changes click the Save link. 161

162 G) Exchange certificates between the SIP Edge Proxy and the SIP Proxy Registrar Click Security and then on SSL certificate and key management. 162

163 Now click Key stores and certificates on the right side. 163

164 Click on CellDefaultTrustStore. 164

165 On the right side click on Signer certificates. 165

166 Check the check box near the root certificate (the one with the root alias). Then click the Extract button. 166

167 Enter a path to save the certificate. We use c:\temp\edgeroot.cer. Then click the OK button. 167

168 The certificate was extracted successful. Now you need to copy this certificate file to your Sametime Media Manager box. Best is to copy it there into the C:\temp directory. 168

169 We have exported the root certificate in the SIP Edge Server and need to import that into the Sametime Media Manager. We have copied the file and need to import it next. Go to the Sametime System Console (which is the Integrated Solutions Console for our Sametime Media Manager). The Browser window should still be open from a previous step. But it can be possible that the session is timed out. Then you need to re-authenticate with your wasadmin account. 169

170 Click on Security and then on SSL certificate and key management. 170

171 On the right side click on Key stores and certificates. 171

172 Click the CellDefaultTrustStore. 172

173 On the right side click on Signer certificates. 173

174 To import the root certificate from the SIP Edge Proxy server click the Add button. 174

175 Enter a name for the certificate, we just use edge_root. In the File name field enter the path to where you have copied the certificate file and the filename. We use c:\temp\edgeroot.cer. Then click the OK button. 175

176 To save the last changes click the Save link. 176

177 Now we need to do the same thing in the opposite direction. Copying the root certificate of our Media Manager to the SIP Edge Proxy. For that we check the check box near the root certificate (the one with root in the Alias) and then click the Export button. 177

178 Enter a path and file name to where the certificate should be saved. We use c:\temp\siproot.cer. Then click the OK button. 178

179 The certificate is now saved. Next is to copy this file from the Media manager to the SIP Edge Proxy box. Best is to copy the file to c:\temp. 179

180 Go back to the Integrated Solutions Console of your SIP Edge Proxy server. There just click the Add button. 180

181 Enter a name for the Media Managers root certificate. We just use sip_root. In the File name field enter the path to where you have copied the file and the file name. We just use c:\temp\siproot.cer. Then click the OK button. 181

182 To save the last changes just click the Save link. 182

183 Because we did security changes in bot servers it is required to restart the Deployment Manager and all nodes on both servers. Lets start with the Sametime Media Manager Server first. In the Services window select the Deployment Manager (the Service with the..._dm at the end) and click the Stop service button. You are asked to stop all services. Click Yes to really stop all services. 183

184 When all services are stopped you should start all services. Start with the Sametime System Console, then the Media Manager, then the Meeting Server and at last the Proxy Server. This takes a long time and sometimes the services cause into a popup Window saying a service could not be started. You can ignore that and just wait until All services are started. Another option is to reboot the Operating system of the box. Then you need to wait as Well until all services are started. This really can take some time. We can recommend to check this in your Task Manager. Wait until you can see 10 Java.exe tasks running and each of them consuming between 170 and 450 MB of RAM. When the CPU usage goes down then the startup of all tasks has finished. For the SIP Edge Proxy Server box we will do the restart after we configured the post install tasks. 184

185 STEP SIX: Post Install tasks for the Sametime SIP Edge Proxy Summary This step is to configure automatic stop, startup and dependencies in the Windows Operating System Services. 185

186 Configure the properties of all 3 task to start automatic. Then restart the Operating System of your SIP Edge Proxy Server. 186

187 When the Operating System has restarted, you should see all 3 services as started. 187

188 STEP SEVEN: Run the guided activity to configure the IBM Sametime Meeting Server deployment plan for the Meeting Edge HTTP Proxy Summary This step is to preconfigure the settings for the Sametime Meeting Edge HTTP Proxy Server installation. 188

189 Start your browser and enter the URL to access the Sametime System Console. Log in with your wasadmin user. 189

190 In your Sametime System Console click on Sametime System Console then Sametime Guided Activities and then on Install Sametime Meeting Server. 190

191 Use the first entry Create a New Deployment Plan and click the Next button. 191

192 Enter a name for your Meeting Server Deployment Plan. In this example we use Meeting Edge. Then click the Next button to continue. 192

193 We want to install the product version Click the Next button to continue. 193

194 Change to Secondary Node and click the Next button to continue. 194

195 Check the Systemconsole... and click Next to continue. 195

196 Enter the full qualified host name of your Sametime Meeting Server. In this example we use edge.renovations.com. Enter a WebSphere administrative user name and its password twice. We just use the standard wasadmin name. Click the Next button to continue. 196

197 Check your settings and then click the Finish button to save the new Deployment Plan. 197

198 You have now successfully created a Deployment Plan for the Sametime Meeting Edge Server installation. The next step is to install the Sametime Meeting Edge Server. 198

199 STEP EIGHT: Install the IBM Sametime Meeting Server Summary In this step you install the Sametime Meeting Server secondary node for the Sametime Meeting Edge HTTP Proxy Server using the preconfigured settings in the deployment plan on the Sametime System Console. 199

200 On your Edge Box start a CMD line window and navigate to the Sametime Meeting Server install directory. We do this with the command: cd \Install\SametimeMeetingServer. Then start the Launchpad installer with the command launchpad. 200

201 Click the Install IBM Lotus Sametime Meeting Server link. 201

202 Click the Launch IBM Lotus Sametime Meeting Server Installation link. 202

203 The Installation Manager is starting loading. 203

204 Just click the Install icon to start the Sametime Meeting Server installation. 204

205 Check the IBM Sametime Meetings server and Version entries. They are unchecked by default. Then click the Next button. 205

206 Accept the terms in the license agreement and click the Next button. 206

207 Because we have already installed a WebSphere based Sametime Server on this box, (The Sametime SIP Edge Proxy Server) we can reuse the installed binaries. The installer detects this and checks the Use the existing package group. And therefore the path is greyed and can not be changed. Click the Next button to continue. 207

208 We want to use the predefined Deployment Plan from the Sametime System Console. Click the Next button to continue. 208

209 We don't want to use an other existing WebSphere Application Server installation so we just click the Next button. 209

210 Enter the Sametime System Console Server information and credentials to authenticate. In our example we use sametime.renovations.com as SSC Server name and wasadmin as the WebSphere Administrative User name. The last field is the host name where we want to install the Sametime Meeting Server. Here we use edge.renovations.com. Then click the Validate button to check the connection to the System Console Server. 210

211 The connection to the Sametime System Console was successful when the button text Validate changes to Validated. Click the Next button to continue. 211

212 Select your Sametime Meeting Server Deployment plan that you have created in the previous step. We use our Meeting Edge. Then click the Next button to continue. 212

213 Control the settings you received from the System Console. Then click the Next button. 213

214 To start the installation click the Install button. 214

215 The Sametime Meeting Server is now installing. This takes approximately 30 to 45 minutes. But because we already have the binaries installed and reuse this data, the installation is much shorter. It then takes only 15 to 20 minutes. 215

216 Now the installation is in progress

217 Important to know... The Meeting Server can be clustered using the WebSphere Network Deployment. This can be configured and deployed with the Sametime System Console. The new Sametime Meeting Server consists of two components. - the Meeting Server - the Meeting HTTP Proxy Clustering means that a meeting room is running only on one server at a time. The Meeting Proxy servers have the information on witch Meeting Server instance the Meeting Room is running and forward incoming requests to the right server. Meeting data are stored only in the database. In case of a fail over the Meeting Room will be started on another Meeting Server in the cluster immediately. For external access a separate Sametime Meeting Server in your DMZ is recommended for better security. 217

218 You have now successfully installed the Sametime Meeting Server. Click the Finish button and exit the Installation Manager and Launchpad. 218

219 Click File in the menue bar and then Exit. 219

220 In the Launchpad click again on Exit. 220

221 Click the OK button to close the Launchpad. 221

222 Close the CMD line window with the command exit. 222

223 STEP NINE: Use the Guided Activity in the Sametime System Console to federate the new installed Meeting Server node to the Deployment Manager and cluster it. Summary In this step you create a Meeting cluster, add the new node on your Edge Server to the WebSphere Cell of your Sametime System Console and add it to the cluster. 223

224 In your Sametime System Console click on Sametime System Console - Sametime Guided Activities and then on Cluster WebSphere Application Servers. 224

225 Click the Next button to continue. 225

226 We want to cluster our Meeting Server installations. So select Sametime Meeting Server and click the Next button. 226

227 Enter a name for the cluster. We use Meeting_Cluster. Then click the Next button. The cluster name can not contain blank characters. 227

228 We want to use the System Console Deployment Manager. Select the entry and click the Next button. 228

229 Click the Create cluster button to create the cluster. This step can take 4 or 5 minutes. If the process takes too long and runs into a timeout, then you get a failure message here. Wait 2 minutes and click the button Create cluster again. Then it works mostly. 229

230 The cluster is now created successfully. Click the Next button to continue. 230

231 The secondary node is already federated to the cell. Click the Next button to continue. 231

232 To add the secondary node to the cluster click the Add to cluster button. 232

233 The secondary node is now successfully added to the cluster. Click the Next button to continue. 233

234 Now you have successfully clustered the 2 Sametime Meeting Servers. Click the Finish button to continue. 234

235 STEP TEN: Remove the newly created application server Meeting Server. Summary In this step you remove the installed meeting server. We only need the node installation for the Edge HTTP Proxy but we dont need the Server. 235

236 In your Sametime System Console Integrated Solutions Console click on Servers Server Types and then on WebSphere application servers. 236

237 Check the check box near your new meeting Server STMeetingServer1. The one who is not running and installed on your edge box. Be sure to select the right one. Then click the Delete button. 237

238 Crosscheck that you have selected the right one. If yes, then click the OK button. 238

239 Save the last changes by clicking the Save link. 239

240 STEP ELEVEN: Create the WebSphere Meeting HTTP Edge Proxy. Summary In this step you create a Meeting HTTP Edge Proxy on your Edge Server to forward incomming HTTP requests from Internet clients to your Sametime Meeting and Sametime Proxy servers in your Intranet. This step has to be done in your Sametime System Consoles Integrated Solutions Console. 240

241 Click on Servers - Server Types and then on WebSphere proxy servers. 241

242 Click the New button to create the new HTTP Proxy server. 242

243 Select the node on your edge server edgestmnode1 and enter a name for your Edge HTTP Proxy Server. We just use STMeetingHttpEdgeProxy. Then click the Next button to continue. 243

244 Uncheck the SIP property. In this server we only need HTTP. Then click the Next button to continue. 244

245 Click the Next button to continue. 245

246 Click the Next button to continue. 246

247 Save the last changes by clicking the Save link. 247

248 STEP TWELVE: Post Install tasks for the WebSphere Meeting HTTP Edge Proxy. Summary In this step you configure the ports used by your HTTP Edge Proxy Server and the Services for automatic startup with the Operating System. 248

249 Click on Servers - Server Types and then on WebSphere proxy servers. 249

250 Click the newly created STMeetingHttpEdgeProxy server. 250

251 On the right side click on Ports. 251

252 Click the PROXY_HTTP_ADDRESS. 252

253 Change the Port to 80 and click the OK button. 253

254 Now click the PROXY_HTTPS_ADDRESS. 254

255 Change the port to 443 and click the OK button. 255

256 To save the last changes click the Save link. 256

257 The Installer has installed a service for an server that does not exist anymore. We first need to remove that service and then create the services we need. 257

258 In a CMD line window navigate to the directory WebSphere binaries directory with the command cd \IBM\WebSphere\AppServer\bin. 258

259 Remove the service with the command: wasservice -remove STMeetingServer. 259

260 Confirm that the removal was successful. 260

261 To create the right services we need the profile path in the command line. In your file explorer navigate to the directory C:\IBM\WebSphere\AppServer\profiles\edgeSTMSNProfile1. Copy the link into your dashboard with the Ctrl-C keycombination. 261

262 Now enter the command to create the service: wasservice -add STMeetingHttpEdgeProxy -servername STMeetingHttpEdgeProxy -profilepath C:\IBM\WebSphere\AppServer\profiles\edgeSTMSNProfile1 -stopargs -username wasadmin -password passw0rd -encodeparams. Check that the command was processed successfully. 262

263 Now enter the command to create the Nodeagent service: wasservice -add STMeetingHttpEdgeProxy_NA -servername nodeagent -profilepath C:\IBM\WebSphere\AppServer\profiles\edgeSTMSNProfile1 -stopargs -username wasadmin -password passw0rd -encodeparams. Check that the command was processed successfully. 263

264 Last step is to configure the dependencies between the 2 services. For that enter the command: sc config IBMWAS70Service STMeetingHttpEdgeProxy depend= IBMWAS70Service STMeetingHttpEdgeProxy_NA. Confirm that the command was processed successfully. 264

265 You have now successfully created the required services. Set both to start automatic. Then restart the OS. 265

266 When the OS has been restarted after some minutes you should see that all services are started succesfully. 266

267 STEP THIRTEEN: Install the TURN server. Summary In this step you copy the TURN Server files to the Edge server and configure it. 267

268 First you need to check that JAVA is installed and in the PATH environment variable. Open a CMD line window and enter the command java -version. If you get back the version info, then all is ok. The JAVA Version should be 1.6 at minimum. Because we have installed 2 Websphere parts before, we already have the Java version we need. 268

269 If the command java -version does not return the JAVA version, then you need to set the System PATH environment variable correctly first. Right Click on your Computer and then Properties. In the Properties Window click on Advanced System Settings 269

270 Click the Environment Variables Button. 270

271 In the System Variables part click the Path variable and then the Edit.. button. 271

272 At the end of the path add ;C:\IBM\WebSphere\AppServer\java\bin. Don't forget the Semicolon character at the beginning. Then click the OK button. 272

273 Click OK to close the window. 273

274 Click OK again to close the window. Then close the Control Panel. 274

275 In your File Explorer copy the TURN_Server directory from your Media Manager Install package to the destination folder you want. We copy the directory to C:\IBM. 275

276 Navigate to this new directory C:\IBM\TURN_Server and open the configuration file TurnServer.properties with notepad or wordpad. 276

277 Configure the TURN Server configuration file with the IP addresses who are used in your environment. In this example we use: turn.local.hostname.ipv turn.allocation.hostname.ipv turn.public.hostname.ipv And udp.turn.port 3478 Then save and close the file. 277

278 To start the TURN server open a CMD line window and navigate to the TURN Server directory with the command cd \IBM\TURN_Server. Then start the turn server with the command run. 278

279 The TURN server is now started and listens on the required ports. 279

280 STEP FOURTEEN: Configure the TURN server. Summary In this step you configure your Sametime Media Manager to support NAT Traversal using the TURN server. 280

281 On your Sametime Media Manager Machine open a File Explorer and navigate to the directory: C:\IBM\WebSphere\AppServer\profiles\STSCDMgrProfile\config\cells\sametimeSSC Cell\nodes\sametimeSTMSNode1\servers\STMediaServer. Here open the file stavconfig.xml using your Wordpad. (we need to edit the file so a browser wont work) 281

282 Find the setting NATTraversalEnabled and set its value to true. Then save and close the file. 282

283 To synchronize this change to the Sametime Media Manager go to your Sametime System Console Integrated Solutions Console and click on System Administration and then on Nodes. 283

284 Check all nodes and click the Full Resynchronize button. 284

285 Then click on Sametime System Console - Sametime Servers and then on Sametime Media Managers. 285

286 Click your Media Manager. 286

287 Go down to the NAT Traversal settings. In the UDP host name field enter the edge server host name edge.renovations.com. Then click the OK button. 287

288 To apply the changes just restart the Sametime Media Manager by restarting the STMediaServer service. 288

289 Next is to implement a Service to start and stop the TURN server automatic during OS startup and to run the TURN server in the background. Stop your running TURN server now by clicking the Ctrl-C key combination. Then just hit the Y key and then Enter. 289

290 For that you need a small tool called SRVANY.EXE. This tool is in the Microsoft Windows Resource Kit for the Windows Server Take a Windows 2003 Server, download the resource kit from Microsoft and install the kit. Then copy this file from the resource kit to your Windows OS into the directory C:\Windows\system32. (This can be Windows 2003 or 2008, 32 or 64bit. It works in all versions) 290

291 To create the service open a CMD Windows in Administrator mode and enter the command: sc create IBM Sametime TURN Server binpath= C:\Windows\System32\srvany.exe Don't forget the space between the binpath= and the path. 291

292 Now you need to configure the service. This can be done only in the Registry Editor. Open your regedit and navigate to the key of your new service: HKEY_LOCAL_MACHINE SYSTEM - CurrentControlSet - Services - IBM Sametime TURN Server 292

293 Create a new key by clicking Edit - New - Key. 293

294 Give the new Key a name. Enter just Parameters. 294

295 Next is to enter the Parameter String. For that a String Value field is required. Click on Edit - New - String Value 295

296 Enter the name for your new String Value. Enter Application here. 296

297 Now double Click into the Application String Value to enter the content string. 297

298 Enter the string: java.exe -Djava.util.logging.config.file=c:\IBM\turn_server\logging.properties -cp c:\ibm\turn_server\turnserver.jar;c:\ibm\turn_server\icecommon.jar com.ibm.turn.server.turnserver 298

299 Be sure that you have entered the string correctly. 299

300 The Service runs the JAVA command out of the C:\Windows\System32 directory. And this requires that the TURN Server Properties file is there as well. So copy your turnserver.properties file from your C:\IBM\TURN_Server to your C:\Windows\System32 directory. 300

301 Your Service is now ready to use. Just configure it to start Automatic and then start it. 301

302 Your TURN Server Service is now configured and started. 302

303 STEP FIFTEEN: Test all Edge components. Summary In this step you use your Browser and a Sametime Connect client to access your Sametime System from the Internet thrugh a NAT traversal firewall. 303

304 Install a Sametime Connect client in the public network and connect it to chat.renovations.com for community services. Tthis DNS host name should be routed to your Edge server in your public DNS. Login with a user in your LDAP. You should see that you are online and that you have connectivity to your Media Manager when the Audio and Video icons appear. Configure the Sametime meeting server meeting.renovations.com to access your meeting rooms. This host name should point to your Edge server as well in your public DNS. 304

305 If you attend a meeting room with someone in your Intranet you should see Audio and Video works. 305

306 Next test is to access the URL in your browser. You should be redirected to the../stmeetings page. 306

307 Next test is to access the URL in your browser. You should be redirected to the../stwebclient/index.jsp page. 307

308 STEP SIXTEEN: Create the DB2 Database for the Sametime Gateway. Summary In this step you create the DB2 Database for the Sametime Gateway. 308

309 You need to copy the DB2 Database creation script createdb.sql from the Install directory C:\Install\SametimeGateway\database\db2 to your DB2 server machine. We copy it to D:\Install on this box.. 309

310 Open a CMD line window, navigate to the D:\Install directory and enter the command db2cmd. 310

311 A new CMD line window opens. This window now has the environment to run the DB2 Database installation script. Enter the command db2 -tvf createdb.sql. 311

312 It takes some time until the database is created and configured. Confirm that you can see all commands completed successfully. 312

313 STEP SEVENTEEN: Create the DB2 Prerequisite in the Sametime System Console for the Sametime Gateway database. Summary In this step you create a DB2 Prerequisite for your Sametime Gateway DB2 database to be used in the Sametime System Console. 313

314 In the Sametime System Console click on Sametime System Console - Sametime Prerequisites and then on Connect to DB2 Databases. 314

315 Click the Add button to add your new database. 315

316 Enter the data in the form: Host name: sametime.renovations.com Database name: stgw Application user ID: db2admin Application password: password of your db2admin user Then click the Finish button. 316

317 Your Sametime Gateway DB2 database is now successfully added to the prerequisites in your Sametime System Console. 317

318 STEP EIGHTEEN: Enable Trust for the Sametime Gateway in the Sametime Community Server. Summary In this step you enable your Sametime Gateway to connect to your Sametime Community Server. 318

319 Open the Sametime System Console, and navigate to the Sametime Community Server by clicking on Sametime System Console then Sametime Servers and then Sametime Community Servers. 319

320 Click the link to your Community Server. We click on Chat Server because this is our name for the Community Server Deployment Plan. 320

321 Enter the IP address of the Server you want to allow connecting to the Sametime Community Server. In this example we use the IP for the Sametime Gateway Server and then click the Add Button. 321

322 We have now added the required IP addresses for the Sametime Gateway. Now click the OK button to continue. 322

323 Now restart the Sametime Community Server by entering the command restart server in the Domino Console window. Never use this command in a production Sametime server because it can happen that not all Sametime tasks are stopped before the domino server restarts. This can cause massive problems for starting the Sametime Services. Stop your Domino Server using the Quit command or by stopping the Lotus Domino Service. Wait until all ST... Tasks disappeared in your TaskManager. Then restart the Domino Server again. It takes up to 5 Minutes until the Sametime Community Server is completely restarted and all 41 Sametime tasks are again active. 323

324 STEP NINETEEN: Install the Sametime Gateway. Summary Complete these steps to install Sametime Gateway as a single server on Windows, to create an administrative user ID for WebSphere Application Server, and to connect to an LDAP server. This installation program installs WebSphere Application Server and Sametime Gateway. 324

325 Open a CMD line window and navigate to the directory cd \Install\SametimeGateway. Then enter the command install.bat. 325

326 The Install Shield Wizard is starting up. 326

327 Select your preferred language. We use English. Then click the OK button. 327

328 Click the Next button to continue. 328

329 Accept the terms in the license agreement and click the Next button to continue. 329

330 We want to install a Standalone server. Then click the Next button to continue. 330

331 We need to select the WebSphere installation files directory. Click the Browse button to continue. 331

332 Select the directory ifpackage under the directory to where you have unpacked the WebSphere Application Server install package. Click the Open button to continue. 332

333 Click the Next button to continue. 333

334 As always in this example installation remove \Program Files please. Then click the Next button to continue. 334

335 Confirm that your host name is listed correctly. Then click the Next button to continue. 335

336 Enter the user name for your WebSphere Administrator. As for other WebSphere based servers before, this user must not exist in your directory. We use our standard user name wasadmin. Enter the password for this user twice. Then click the Next button to continue. 336

337 As always in this example installation remove \Program Files please. Then click the Next button to continue. 337

338 In this screen we need to configure the DB2 server and database properties. We use: DB2 Host name: sametime.renovations.com Database name: stgw Application User ID: db2admin and its password Schema User ID: db2admin and its password Then click the Next button to continue. 338

339 Yes, we want to configure the LDAP settings now. Then click the Next button to continue. 339

340 The Host name in our example is ldap.renovations.com. And the Port is 3268 because it is an Active Directory Server. Then click the Next button to continue. 340

341 The Bind distinguished name in our example is cn=ldap Bind,cn=users,dc=ad,dc=renovations,dc=com. Enter the password of this user in the Bind password field. Then click the Next button to continue. 341

342 Theis are the detected basedn settings retrieved from our AD LDAP. If using another LDAP like Domino LDAP, then this screen can be different. We use the default DC=ad,DC=renovations,DC=com. Then click the Next button to continue. 342

343 Click the Install button to start the installation. 343

344 The Sametime Gateway including the base WebSphere Application Server is now installing. This task takes approximately 15 minutes. 344

345 The installation has finished successfully. Click the Finish button to continue. 345

346 STEP TWENTY: Post Install tasks for the Sametime Gateway. Summary In this step you install the WebSPhere Update Installer and install some WebSphere ifixes that are required by the Sametime Gateway. Then you create the service to start the Sametime Gateway automatic with the Operating System. 346

347 You need to unzip the installer for the WebSPhere Update installer first. Unzip the zip file for your Operating System. In our example we use Windows. So we unzip the file WS-UPDI-WinIA32.zip. 347

348 Open a CMD line window and navigate to the directory where you have unpacked the UPDI install files. We just use the command cd \Install\SametimeWASiFixes\WebSphereUPDI\UpdateInstaller. Then start the installer with the install.exe command. 348

349 Click the Next button to continue. 349

350 Accept the terms in the license agreements and click the Next button to continue. 350

351 Confirm the System Prerequisite Check is passed. Then click the Next button to continue. 351

352 As always we recommend to remove the \Program Files part in the Path. Then click the Next button to continue. 352

353 Click the Next button to continue. 353

354 The Update Installer is now installing. 354

355 Confirm that the installation was successful. Mark the check box to launch the Update installer. Then click the Finis button to continue. 355

356 Click the Next button to continue. 356

357 Click the Next button to continue. 357

358 Click the Next button to continue. 358

359 We need to change the directory path where the ifixes can be found. Click the Browse button. 359

360 Change to the directory where you have unpacked the ifixes. We use C:\Install\SametimeWASiFixes\WebSphereiFixes. Then click the Open button. 360

361 Click the Next button to continue. 361

362 Click the Next button to continue. 362

363 Click the Next button to continue. 363

364 The WebSphere ifixes are now installing. 364

365 Confirm that all ifixes where installed successfully. Then click the Finish button to continue. 365

366 To create the service we need the profile path. Open a file explorer and navigate to this directory C:\IBM\WebSphere\AppServer\profiles\RTCGW_Profile. Then copy this path into your dashboard using the Ctrl-C key combination. 366

367 Now start a CMD line window. There navigate to the WebSphere binaries directory with the command: cd \IBM\WebSphere\AppServer\bin. Then enter the command to create the service: wasservice -add RTCGWServer -servername RTCGWServer -profilepath C:\IBM\WebSphere\AppServer\profiles\RTCGW_Profile -stopargs -username wasadmin -password passw0rd -encodeparams Confirm that the service creation was successful. 367

368 The Service was created and can be seen in the services view. 368

369 Set the service to Automatic in the preferences. Then start the service. 369

370 The Sametime Gateway Service has started successfully. 370

371 STEP TWENTYONE: Register the Sametime Gateway in the Sametime System Console. Summary After installing an IBM Sametime Gateway server on IBM AIX, Linux, Sun Solaris, or Microsoft Windows, register it with the Sametime System Console, so you can manage all of the Sametime servers from a central location. 371

372 This registration requires to configure two preferences files and then run a registration batch file. Open a file explorer and navigate to the directory C:\IBM\WebSphere\STgateway\console. There open the file console.properties in a notepad session. 372

373 Configure the parameters: SSCHostName sametime.renovations.com SSCUserName wasadmin and its password. Then save and close the file. 373

374 Next is to open the file productconfig.properties in your notepad. 374

375 In this file you need to enter several variables: DepName Sametime Gateway (or whatever you want to name it in your SSC) WASPassword Enter the password of your local wasadmin user in the Gateway. 375

376 Enter the passwords of your db2admin user and of your LDAP Bind user. 376

377 Enter the DNS FQ Host name of your Sametime Community Server. We use chat.renovations.com. The Port is Important is to set the flag IsFederated to true. Otherwise the registration can fail. Save and close the file. 377

378 Open a CMD line window and navigate to the console directory with the command cd \IBM\WebSphere\STGateway\console. Then start the registration bat with the command registerproduct.bat. 378

379 Just hit the ENTER key

380 The registration has finished. Confirm that it has completed successfully. 380

381 STEP TWENTYTWO: Connect the Sametime Gateway to the local Sametime Community. Summary Connect a local Sametime Community Server or Sametime community cluster to Sametime Gateway to enable Sametime users to have instant messaging with external users. Important: You can only connect one gateway to a community; otherwise the awareness and chat features may not work properly. Likewise, you can connect only one local Sametime community to Sametime Gateway. You must add the local community to Sametime Gateway before you add external communities. 381

382 In your Sametime System Console click on Sametime System Console - Sametime Servers and then on Sametime Gateway Servers. 382

383 Click on Communities. 383

384 Click the New button. 384

385 Fill the form with your data. For the Name we just use Renovations. The Domains should contain your local internet domains. We use renovations.com. The Sametime Community Host is chat.renovations.com in our example. Then click the Apply button. 385

386 The local community has been added. 386

387 Restart the Sametime Gateway by restarting the RTCGWServer service. 387

388 After the restart you should see in your Sametime System Console that the local community is connected. 388

389 STEP TWENTYTHREE: Connect the Sametime Gateway to an other Sametime Community. Summary Add an external Sametime community to IBM Sametime Gateway. You connect to a Sametime community by specifying domains in the external community, selecting a translation protocol, and setting the host name, port, and transport protocol for the external community. 389

390 To connect to an external Sametime Community click the New button in your Sametime System Console. 390

391 We have already prepared a partner community with a working Sametime Gateway. We need to fill the connectivity data to this community now. Name IBM Type External Domains ibm.com Protocol SIP for Sametime Gateway Host name gateway.ibm.com Port 5060 Transport TCP then click the OK button. 391

392 It is again required to restart the gateway server by restarting the RTCGWServer service. 392

393 The Gateway is restarted and connected to the internal and external Sametime community. 393

394 STEP TWENTYFOUR: Enable the clients to use the Sametime Gateway. Summary In this step you allow your Sametime Clients to add external users to their contact lists. 394

395 In your Sametime System Console click on Sametime System Console - Manage Policies. 395

396 Edit the default policy by clicking the Edit button. 396

397 Check the check box Allow users to add external users using the Sametime gateway communities. 397

398 On the bottom of the form click the OK button to save the policy changes. 398

399 Restart the Sametime Community Server with the console command restart server. You know don't use this command in a production environment. 399

400 STEP TWENTYFIVE: Test the Sametime Gateway with the Sametime Client. Summary You are done with installing and configuring all the Edge components. Now you want to know if all works. Here we test the Sametime Gateway functionality. 400

401 In your Sametime Connect Client click the Add Person button. 401

402 Because of the policy change you can add external users now. Check the check box to Add external users by address and enter a valid address from your partner community. We try it with the name dan.misawa@ibm.com. Then click the Add button. 402

403 The user is now added. Some partner gateways require a permission by the partner. Click the OK button. 403

404 Close the New Contact dialog with the Close button. 404