Best Practices for Businessto-Business. Collaboration. Luca Pellegrini - Technical Marketing Engineer Davide Preti - Technical Marketing Engineer

Transcription

1

2 Best Practices for Businessto-Business Video Collaboration Luca Pellegrini - Technical Marketing Engineer Davide Preti - Technical Marketing Engineer

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Target Architecture Unified CM Enterprise Network 2 nd try SIP to CMS Expressway-C 1 st try SIP/H nd try MS variant MS signaling and media conversion DMZ Expressway-E Outside Network Use standard DNS SRV with SIP/H.323 Internet Standard client MS client Cisco Meeting Server B2B Scenario including MS interop Security, FW traversal, Certificates, TLS, MTLS, Reduced number of ports on external FW Spam calls Multiple edges not covered here: vd/edge.html 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

5 Agenda Expressway Introduction Business-to-business Architecture Signaling Encryption Media Encryption B2B Interop with Microsoft Dial Plan Expressway Policy Protection Global Deployment Overview Minimizing or reducing UDP ports opened in the Internet firewall

6 Expressway Introduction

7 Cisco Expressway

8 Cisco Expressway Jabber Guest/WebRTC B2C

9 Cisco Expressway Jabber Guest/WebRTC B2C Jabber, hw devices MRA

10 Cisco Expressway Jabber Guest/WebRTC B2C Jabber, hw devices MRA Cisco video and 3 rd party devices Endpoint registration

11 Cisco Expressway Jabber Guest/WebRTC B2C Jabber, hw devices MRA Microsoft Integration Cisco video and 3 rd party devices Endpoint registration Signaling and media gateway

12 Cisco Expressway CTI and AXL connection to UCM EWS connection to Exchange Jabber Guest/WebRTC B2C Spark Connector Host Jabber, hw devices MRA Microsoft Integration Cisco video and 3 rd party devices Endpoint registration Signaling and media gateway

13 Cisco Expressway CTI and AXL connection to UCM EWS connection to Exchange Jabber Guest/WebRTC B2C Spark Connector Host Jabber, hw devices MRA B2B Technology Microsoft Integration Cisco video and 3 rd party devices Endpoint registration Signaling and media gateway

14 Cisco Expressway CTI and AXL connection to UCM EWS connection to Exchange Jabber Guest/WebRTC B2C Spark Connector Host Jabber, hw devices MRA B2B Technology Cisco video and 3 rd party devices Endpoint registration Microsoft Integration Calls to and from Cisco Cloud (Spark, CMR) Signaling and media gateway

15 Cisco Expressway CTI and AXL connection to UCM EWS connection to Exchange Jabber Guest/WebRTC B2C Spark Connector Host B2B Open Video Federation Jabber, hw devices MRA B2B Technology Cisco video and 3 rd party devices Endpoint registration Microsoft Integration Calls to and from Cisco Cloud (Spark, CMR) Signaling and media gateway

16 Licensing and Consumption Call scenarios that require Rich Media Session licenses to proceed Business to Business Calls Business to Customer Calls Interoperability Gateway Calls Firewall Traversal Calls consume 1 x RMS on Expressway-E Jabber Guest Calls consume 1 x RMS on Expressway-E i.e. MS Interop calls, consume 1 x RMS on Expressway-C Gateway Registered Calls (no RMS required) Calls between endpoints registered to Cisco Call control services 1 Calls to Cisco conferencing infrastructure 2 or cloud services Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 Routing

18 1 Step: Call enters into Expressway 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

19 Expressway Zone Example Expressway-C Neighbor Zone A to /5061 Neighbor Zone B to / Call From (IP/port) To (IP/port) Mapped to Inbound call on -C / /5061 For Your Reference 1 2 B2B Traversal from /26202 to /7001 UC Traversal from /26209 to /7002 Inbound call on -C Inbound call on -E / / / / B2B Traversal from /7001 to /26202 Default Zone Expressway-E UC Traversal from /7002 to /26209 Inbound call on -E / /5061 Call Routing Rule To (IP/port) Mapped to Outbound call on -C Send 8XXX to Neighbor Zone A / Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Expressway Zone Concept When a call or reaches Expressway, Expressway classifies it based on source and destination address and port Based on classification, the call is sent to a specific «zone». Except for the Local Zone (not covered here), the other zones connects to remote systems as in the case of a SIP Trunk on CUCM Different policies can be applied per zone, such as: signaling and media encryption protocol usage (i.e. SIP and/or H.323) message authentication (PAI header for SIP) use of TLS with Mutual Authentication Others 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

21 Most common used zones on Expressway Neighbor Zone: this is the zone most similar to a SIP Trunk Traversal Zone: it s a special neighbor zone with firewall traversal capabilities DNS Zone: it s a special neighbor zone used for outbound B2B calls supporting DNS SRV Default Zone: it s a special neighbor zone used for inbound B2B calls 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 Cisco Expressway Connectivity Overview Most used zones on Unified CM-centric Architecture Expressway-C Default Zone ENUM Zone B2B Traversal Client Zone UC Traversal Zone Cloud Traversal Client Zone Neighbor Zone DNS Zone H323 and SIP (B2B) SIP TLS and SRTP mandatory (MRA) SIP TLS and SRTP recommended (Spark) UCM SIP Trunk B2B Inbound calls B2B Traversal Server Zone UC Traversal Zone Cloud Traversal Server Zone Neighbor Zone Default Zone Expressway-E DNS B2B Zone B2B Outbound calls ENUM Zone DNS Spark Zone Spark Hybrid Calls Unified CM MRA 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 2 Step: Call is routed 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 Expressway Routing Apply Transform Yes Does the alias match a transform? No Expressway receives alias If reject Forbidden Does calling or called match a CPL rule? No Protocol Selection Yes SIP/H.323/SIP Variants If allow Allow/ Reject Next lowerpriority rule until end of rules or the alias is found No Yes Does the alias match a search rule? Is the alias found? Yes Send call to target Zone 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25 Protocol Selection Configuration From CPL Logic SIP Found Place Call Not found H.323 Found Place Call Not found Use SIP MS Variant Place Call 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

26 Pattern Matching Regular Expressions (RegEx) A standard notation (POSIX), used in Unix and Linux editors Provide a concise and flexible means for matching and transforming strings Used simply, it is simple, but powerful One of the techniques available in Expressway for matching calls in zones 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27 Cisco Expressway Family Overview Key RegEx Metacharacters For Your Reference. Any single character \d Single digit [0-9] * 0 or more repetitions of previous character or expression + 1 or more repetitions of previous character or expression? 0 or 1 repetitions of previous character or expression {n} n repetitions of previous character or expression [abc] A character from this set of characters [1-4] A character from this range of characters [^def] A character NOT including these characters ^ Start of line $ End of line \ Literalize, e.g. \* really is the * (asterisk character) or match (wxy wyx) ( ) Group digits and store in store id \n 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

28 Most common used Regex on Expressway Regex Meaning Replacement Result/Meaning.* Any string of any Internal domain All external (non-corporate) domains PSTN Access number 8-digits internal dialplan Cisco and/or its affiliates. All rights reserved. Cisco Public 28

29 Proxy and B2BUA

30 SIP Proxy or SIP B2BUA? Proxy functionality is the native functionality of Expressway B2BUA is a process internal to Expressway-C and Expressway-E, invoked by configuration B2BUA fully terminates a call leg and establishes a new call leg. The two call legs are then bridged together and count as two different calls B2BUA are of different kinds 1.B2BUA for MRA and Business-to-Business 2.B2BUA for SIP to H.323 Interworking 3.B2BUA for MS Interop If not explicitely stated, this presentation refers to B2BUA as to the 1 st type 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31 Proxy Without B2BUA Engagement Expressway Media leg Exp-C/E Proxy Process Single call leg No media termination B2B call traverses the Expressways Under the following conditions: Exp-C/E B2BUA Process 1. SIP/RTP 2. H SIP/SRTP 4. IPv4 1. SIP/RTP 2. H SIP/SRTP 4. IPv Cisco and/or its affiliates. All rights reserved. Cisco Public 31

32 B2BUA engagement for Media: "Encrypt on behalf of" Expressway-C/E Cisco Unified CM RTP Media leg 1 Exp-C/E Proxy Process Exp-C/E B2BUA Process SRTP Media leg 4 Media leg 2 Media leg 3 The diagram shows the working principle In most cases the B2BUA talks directly to the endpoint or end system without going back to the Proxy 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 32

33 Dual Network Deployment for Firewall Traversal

34 Expressway Firewall Traversal Basics Enterprise Network DMZ Outside Network Unified CM Expressway-C Firewall Expressway-E Firewall 1. Expressway-E is the traversal server installed in DMZ. Expressway-C is the traversal client installed inside the enterprise network. 2. Expressway-C initiates traversal connections outbound through the firewall to specific ports on Expressway-E with secure login credentials. 3. Once the connection has been established, Expressway-C sends keep-alive packets to Expressway-E to maintain the connection 4. When Expressway-E receives an incoming call, it issues an incoming call request to Expressway-C. 5. Expressway-C then routes the call to Unified CM to reach the called user or endpoint Internet Signaling Media 6. The call is established and media traverses the firewall securely over an existing traversal connection 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 34

35 Call Flow

36 Cisco SRV Records for business-to-business SRV record format for SIP and H.323 SIP B2B _sips._tcp.domain 5061 TLS _sip._tcp.domain 5060 TCP _sip._udp.domain 5060 UDP H.323 B2B _h323ls._udp.domain 1719 RAS _h323cs._tcp.domain 1720 H Cisco and/or its affiliates. All rights reserved. Cisco Public 36

37 B2B Call Flow Stark Industries ACME Corp. Calls Media acme.com? sip1.acme.com Cisco Unified CM Expressway-C Expressway-E INVITE sip: to sip2.acme.com sip2.acme.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 37

38 Business-to-Business Architecture

39 Signaling H.323/SIP Protocol Selection Algorithm H.323 and SIP enabled globally and at zone-level H.323/SIP protocol selection: native protocol first, alternative protocol as backup. Interworking has to be enabled SIP to H.323 interworking with media handling Protocol selection can be changed with search rules SIP Expressway-C 1. SIP 2. H.323 VCS-C SIP to H323 B2BUA for signaling and media H.323 H.323 endpoint 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 39

40 TLS: Certificate Check on Expressway During validity check, standard browsers make sure that hostname matches SAN/CN, and that the cert has been signed by a trusted CA On Expressway this is optional and activated by the TLS verify mode set to On and configurable per zone Consequences: if you don t setup TLS verification, TLS can be setup with selfsigned certificate In both cases the call will be encrypted, but TLS verify mode set to On authenticates the other peer 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

41 TLS verify set to Off Traversal Zone Example Expressway-C connecting to Expressway-E via traversal zone Peer1 certificate SAN: X509v3 Subject Alternative Name: DNS:example.com, DNS:expe.example.com If TLS verify mode is set to Off : Expressway won t check hostname and that the cert is properly signed IP addresses can be used Note that IP address is not included in SAN of the remote peer (Expressway-E) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 41

42 TLS verify set to On Neighbor zone example: connection to UCM TLS Verify Mode triggers MTLS Certificate CN or SAN is matched against the Peer Address Peer1 certificate SAN: X509v3 Subject Alternative Name: DNS:example.com, DNS:us-cm-srv1.example.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

43 Outbound B2B calls on Expressway-E with TLS DNS Zone (outbound) TLS verify set to On checks the certificate. Good for closed video federation expe.example.com 3 Client hello 1 host.mypreferredpartner.com If TLS verify subject name is not known in advance (open video federation), TLS verify mode must be turned off Expressway-E host.mypreferredpartner.com CERTIFICATE <Public Key> 2 Server hello Third-party Edge 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

44 TLS verify Summary for B2B Calls TLS Verify increases security by checking the certificate (signature, hostname, etc.) for the called.tls verify requires to know the DNS hostname of the remote peer included in the certificate Recommended to turn it on on Traversal Zones and Neighbor Zones If the hostnames in the DMZ uses a separate DNS and IP addresses are used instead of DNS names, TLS verify must be turned off Closed video federation (B2B communications with selected partners): turn TLS verify on (remote peers and certs are known; neighbor zone can be created) Open video federation (standard B2B): turn TLS verify off (remote peers and certs are not known) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 44

45 TLS vs TLS with Mutual Authentication (MTLS) TLS Client hello Server hello followed by certificate Expressway-E Client hello MTLS Server hello followed by certificate Certificate Request Expressway-E 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 45

46 Open B2B Federation with MTLS and Certificate Check Turn off SIP UDP Turn off SIP TCP Turn off H.323 Enable TLS with Mutual Authentication 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 46

47 Certificate Check with MTLS and Open Video Federation Turning off TLS verify prevents for any sort of certificate check MTLS on port 5061 can be used to turn on certificate verification withouth specifying the TLS verify name Caveat: MRA is not compatible with MTLS on port 5061 Caveat: doesn t work B2BUA on Expressway-E 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 47

48 MTLS and Default Zone Access Rules 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

49 MTLS and Default Zone Access Rules Use If the calling doesn t present a valid certificate, the connection will be rejected before any SIP message is sent If some partners don t have a valid certificate, it s possible to upload the selfsigned certificate into the Expressway-E trust list. Not possible to use a certificate signed by a temporary CA. If a remote host is sending spam calls, the certificate will show in the log and it will be possible to create a rule to stop those calls 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 49

50 Media Encryption Policy Expressway Media Encryption Mode Applies to: Neighbor, DNS, Traversal, and Default Zones SIP and H.323 calls interworked to SIP Does NOT apply to H.323 (only) calls Auto: No media encryption policy applied by Expressway Best Effort: Use encryption if available otherwise fallback to unencrypted Force Encrypted: All media must be encrypted Force Unencrypted: All outgoing media will be unencrypted 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

51 Media Encryption Auto Example Inbound zone CUCM CM Neighbor Zone TLS Auto Expressway-C Traversal Client Zone TLS Auto Traversal Server Zone TLS Auto TLS with SRTP or RTP based on endpoints negotiation Expressway-E Default Zone Not configurable Auto Outbound zone DNS Zone Not configurable Auto Internet RTP/SRTP Auto: doesn t engage B2BUA No control of media status; endpoints decide encryption settings 3 rd Party SIP Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

52 Media encryption Lock icon Optimization of previous example CM Neighbor Zone TLS Best Effort Expressway-C Traversal Client Zone TLS Best Effort Expressway-E Traversal Server Zone TLS Best Effort Inbound zone Default Zone Not configurable Best Effort Outbound zone DNS Zone TLS/SRTP TLS/SRTP Not configurable Best Effort Internet RTP Lock icon shows closed because the first 2 call legs are encrypted 3 rd Party SIP Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 52

53 B2B Interop with Microsoft Lync

54 Terminology Traffic Classification Traffic Classification is a new powerful tool of Expressway X8.9+ Traffic is recognized and classified in SIP Variants Traffic can be routed based on these 4 classifications: Standard-based All Microsoft Variants Microsoft AV&Share only Microsoft SIP IM&P only 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

55 Traffic Classification and Search Rules Similarly to H.323/SIP calls we can t know upfront if a destination address is Microsoft flavor or Standard SIP, we must try both. Interoperability and interworking rely on fallback mechanisms. When a user places a call, Expressway searches for it as SIP/H.323/MSFT-SIP (plus several tcp/tls/udp transport protocols). An administrator can decide the priority order. Typically Standard SIP/H.323 first and, if it s not found, we continue by involving CMS for transcoding. Expressway-E will then search for the Microsoft SRV Record for that domain. This order can be inverted or both can be tried at the same time (call forking). Starting with X8.9+ Expressway-E DNS Enhanced zone is now able to lookup for the Microsoft SRV Record (_sipfederationtls._tcp.company.com) NOTE: CMS is also required for MS B2B Video Federations Cisco and/or its affiliates. All rights reserved. Cisco Public 55

56 Traffic Classification and Search Rules continue 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

57 Traffic Classification and Search Rules continue 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 57

58 Traffic Classification and Search Rules continue 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

59 Traffic Classification and Search Rules Search Rules consider FIVE parameters to determine a destination zone (target): 1. Protocol (i.e. SIP/H.323) 2. Source zone (i.e. a trunk) 3. Authentication (yes/no) 4. Pattern string (i.e. destination domain) 5. SIP Variant (key element for Microsoft Interop Federations) TIP: Always specify Source Zones to avoid loops and make troubleshooting easier 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 59

60 SRV Records and Certificates SRV Records in use (inbound traffic) There s a common misunderstanding about overlapping SRV Records we now must demystify: Microsoft SIP Federations require an SRV targeting _sipfederationtls._tcp.company.com Standard SIP Federations require two SRV records _sip._tcp.company.com; _sips._tcp.company.com There are NO overlapping SIP SRV Records between our Cisco solution and any Microsoft Lync/Skype for Business environment. Confusion comes from an SRV record used by OCS R1 (10 years ago) for _sip._tcp.<domain> - for external TCP connections. This SRV record may be present in your customer environment but it s not needed anymore and they can remove it. Microsoft documentation is pretty clear about that Cisco and/or its affiliates. All rights reserved. Cisco Public 60

61 SRV Records and Certificates Certificate Requirements If the Expressway-E is not clustered: Subject Common Name = FQDN of Expressway-E Subject Alternate Names = FQDN of Expressway-E If the Expressway is clustered, with individual certificates per Expressway: Subject Common Name = FQDN of Expressway-E Subject Alternate Names = FQDN of Expressway; FQDN of cluster; NOTE: Expressway-E FQDN (A-record) must be part of the SIP domain(s)*. You ll need an alias for EVERY SIP domain (i.e. expressway-e.sipdomain.com; expressway-e.sipdomain2.com; etc) *this is a Microsoft requirement Cisco and/or its affiliates. All rights reserved. Cisco Public 61

62 SRV Records and Certificates Example 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 62

63 SRV Records and Certificates Example FQDN of Expressway-E FQDN of Expressway-E cluster 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

64 Business to Business Architecture for MS Interop Outbound calls example Endpoints XMPP/SIP: company.com CUCM Cluster Standard SIP Microsoft SIP XMPP MS SIP SIMPLE CUCM CUCM IM&P TURN Server Internet WebRTC Business Partner/MRA Expressway-C Expressway-E Standard Endpoints Business Partner Lync/SfB Clients 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

65 Traffic Classification and Search Rules Dialplan Example Expressway-C A basic B2B interop federation scenario requires at least 6 Search Rules on Expressway-C: 3 Search Rules for Video - 2 Outbound; 1 Inbound 3 Search Rules for IM&P 1 Outbound; 2 Inbound 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 65

66 Traffic Classification and Search Rules Dialplan Example Expressway-E A basic B2B interop federation scenario requires no specific Search Rules on Expressway-E. Rules can match any SIP Variant. Satisfying Standard AND Microsoft traffic routing at the same time. However, in order to make configurations clean and easy to manage, one could create rules based on specific SIP Variants. I.e. Standards-based; Microsoft Video; Microsoft IM&P 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 66

67 Traffic Classification and Search Rules Dialplan Example Video Outbound Expressway-C Cisco User John calls a Business Partner: jane.doe@federateddomain.com (Skype for Business) 1. John s device is registered to CUCM. CUCM sends SIP invite to Expressway-C 2. Expressway-C recognizes this as Standards-based SIP Variant 3. According to the 5 parameters (protocol; source; authentication, pattern string and SIP Variant) a Target Zone is determined. Call is then routed to Expressway-E 1 st try SIP/H.323 Standard Client MS client 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 67

68 Traffic Classification and Search Rules Dialplan Example Video Outbound Expressway-E Expressway-E recognizes the call as Standards-based SIP Variant 5. According to the call parameters a Target Zone is determined 6. The call is routed to the DNZ Zone Expressway-E will then lookup for Standard SRV records (i.e. _sips._tcp.federateddomain.com) It won t find the destination user/domain returning a 404 Not Found back to the Expressway-C. 1 st try SIP/H.323 Use standard DNS SRV with SIP/H.323 Standard Client MS client 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 68

69 Traffic Classification and Search Rules Dialplan Example Video Outbound Expressway-C Expressway-C will match the next relevant rule (in priority order) 8. Traffic is still classified as Standards-based 9. As sort of fallback mechanism we now hit a Search Rule involving CMS for transcoding 10. CMS generates a new call leg, now transcoded to Microsoft AV&Share traffic. 11. According to the call parameters a Target Zone is determined Call is now routed to Expressway-E as Microsoft AV&Share 2 nd try MS variant Standard Client 2 nd try SIP to CMS MS signaling and media conversion MS client 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 69

70 Traffic Classification and Search Rules Dialplan Example Video Outbound Expressway-E Expressway-E recognizes the call as Microsoft AV&Share SIP Variant 13. According to the call parameters a Target Zone is determined 14.The call is routed to the DNZ Zone Expressway-E will now lookup for the Microsoft SRV Record (i.e. _sipfederationtls._tcp.federateddomain.com) Jane.doe@federateddomain.com is found. 2 nd try MS variant Standard Client 2 nd try SIP to CMS MS signaling and media conversion Use MS DNS SRV with MS variant MS client 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

71 Business to Business Architecture for MS Interop Inbound calls example Endpoints XMPP/SIP: company.com CUCM Cluster Standard SIP Microsoft SIP XMPP MS SIP SIMPLE CUCM CUCM IM&P TURN Server Internet WebRTC Business Partner/MRA Cisco Meeting Server Expressway-C Expressway-E Standard Endpoints Business Partner XMPP/SIP: company.com Lync/SfB Clients 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 71

72 B2B Architecture for MS Interop SRV and combined features Endpoints XMPP/SIP: company.com CUCM Cluster SRV (among others): _h323xs._tcp.company.com - B2B Standard Federations _sip._tcp.company.com - B2B Standard Federations _sips._tcp.company.com - B2B Standard Federations _xmpp-server._tcp.company.com - XMPP Federations _collab-edge._tls.company.com MRA _xmpp-client._ tcp.example.com CMA registration _sipfederationtls._tcp.company.com - MSFT Interop CUCM CUCM IM&P TURN Server Internet WebRTC Business Partner/MRA Cisco Meeting Server Expressway-C Expressway-E Standard Endpoints Business Partner Lync/SfB Clients A single pair of Expressway-C/E can provide all federation, calling and registration services 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

73 Licensing for B2B Federations quick overview Every B2B call consumes 1 RMS on Expressway-E node Audio only calls and Audio/Video calls consume 1 RMS each VCS Control & VCS Expressway still consume Traversal call licenses CMS needs SMP/PMP licenses for video transcoding GENERAL RULE: All B2B calls are handled the same way. We don t care if it is Audio/Video/Standard/Microsoft: It s 1 RMS for each call. In B2B scenarios all the hard work is done by CMS. So, no need for Microsoft Interop Option Key on Expressway/VCS. Expressway/VCS just do call routing and possibly, interworking (i.e. H323/SIP; encryption on-behalf of) IM&P traffic doesn t consume call licenses. It doesn t require any specific license at all Cisco and/or its affiliates. All rights reserved. Cisco Public 73

74 Dial Plan

75 Standard Dial Plan Priority Regex Target Priority Regex Target For Your Reference UCM Zone B2B Traversal Server Zone UCM 65 *$).* B2B Traversal Client Zone 65 *$).* B2B DNS Zone Expressway-C Expressway-E E to C and C to UCM for all calls matching the internal domain UCM routes outbound any URI different from Directory URI and not included in ILS table Expressway-C and E route outbound any URI not matching the internal domain 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 75

76 Standard Dial Plan with Microsoft Interop: Inbound For Your Reference Priority Regex Source Zone Traversal Client SIP Variant Target Continue Standards-based UCM Zone No Expressway-C Traversal Client Microsoft AV CMS Zone No 65 UCM Zone Standards-based Traversal Client 70 UCM Zone Standards-based CMS Zone No Yes No MS? Yes 75 CMS Zone Microsoft AV Traversal Client No Priority Regex Source Zone SIP Variant Target Continue Expressway-E Default Zone All SIP Variants Traversal Server No 65 * Traversal Server All SIP Variants DNS Zone Yes 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 76

77 Standard Dial Plan with Microsoft Interop: Outbound For Your Reference Priority Regex Source Zone Traversal Client SIP Variant Target Continue Standards-based UCM Zone No Expressway-C Traversal Client Microsoft AV CMS Zone No 65 UCM Zone Standards-based Traversal Client 70 UCM Zone Standards-based CMS Zone No 75 CMS Zone Microsoft AV Traversal Client Yes No Yes First try No Priority Regex Source Zone SIP Variant Target Continue Standard MS Expressway-E Default Zone All SIP Variants Traversal Server No 65 Traversal Server All SIP Variants DNS Zone Yes 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 77

78 Expressway Policy Protection

79 Example of unauthorized access attempts on Expressway-E Access codes to PSTN (0,9) and to internal numbering plan (80 ) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 79

80 Expressway Mitigating Toll Fraud Zone authentication policy Traversal Zone Authenticated Unauthenticated Expressway-C Expressway-E Call policy rules applied to the source zone or to unauthenticated traffic 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 80

81 Call Policy Rules with X Source Type From Address Rule Applies To Source Pattern Destination Pattern Action Authenticated vs unauthenticated traffic Configurable with Regex Configurable with Regex Allow/Reject Zone Originating Zone Destination Pattern Action Drop-down menu Configurable with Regex Allow/reject If source type is selected the CPL applies for all calls coming from a specific zone that match the configured called ID pattern (no calling ID) With «from address», it is possible to specify both the calling and the called ID pattern. However, this traffic will apply to authenticated or unauthenticated calls 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 81

82 Checking the calling alias Calling alias of a call hitting the Default Zone (B2B) shouldn t contain: Corporate domain (example.com) Expressway IPs Enterprise Cisco Spark domains From Address Rule Applies To Source Pattern Destination Pattern Action Example Unauthenticated (.*)@example\.com.*.* Reject Call from 100@example.com rejected Unauthenticated (.*)@10\.10\.10\.1[12].* Reject Call from user@ or 200@ rejected 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 82

83 Checking the called alias Block PSTN access Block any numeric range that is not supposed to receive B2B calls (if esists) Allow any other destination that contains the domain Final deny-all Zone Originating Zone Destination Pattern Action Example Default Reject Default Zone Reject Default Zone Allow Default Zone.* Reject Anything else 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 83

84 What s the final result? Routing stops immediately since CPL are the first checked {IP Addr/port No} If you want to be invisible you have to deploy an IPS. Details in the Appendix 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 84

85 Global Deployment Overview

86 Multiple Expressways Outbound calls can be directed by UCM to the Expressway that is nearest the calling endpoint by using CSS and Partitions Inbound calls can be delivered by using two mechanisms: Geo DNS Directory Expressway 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 86

87 Global Deployment Topology & Geo DNS US Europe SIP Trunk SIP Line Expressway edge access Asia Expressway Traversal SME global aggregation US SME EU SME Asia SME Unified CM regional clusters SJC RTP PAR LON TKY BGL DFW AMS HKG 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 87

88 Geo DNS Setup Example with two Expressway Clusters SRV Record Priority Weight Expressway-E _sips._tcp.example.com _sip._tcp.example.com us-expe1.example.com Location: US us-expe2.example.com emea-expe1.example.com emea-expe2.example.com us-expe default for calling devices in US emea-expe as backup for calling devices in US Location: EMEA emea-expe1.example.com emea-expe2.example.com us-expe1.example.com us-expe2.example.com emea-expe default for calling devices in EMEA us-expe as backup for calling devices in EMEA 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 88

89 Directory Expressway Architecture: 2 Sites 4 ucm2endpoint@domain.com Expressway-C1 2 UCM1 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS UCM2 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS. 3 Expressway-C2 2 Expressway-E1 Expressway-E2 1 Call: ucm2endpoint@domain.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 89

90 Directory Expressway Architecture: 3+ Sites 4 ucm2endpoint@domain.com Expressway-C1 3 UCM1 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS UCM2 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS. 3 Expressway-C2 Expressway-E1 2 Directory Expressway-E 2 Expressway-E2 1 Call: ucm2endpoint@domain.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 90

91 Minimizing UDP Ports open to Expressway-E

92 Filtering ACLs for B2B calls: External Firewall Port Requirements Based on medium/small OVA with non-specific configured multiplexed ports Source IP Source Port Transport Protocol Dest. IP Dest. port H.323 calls using Assent (Natted endpoints) Q.931/H.225 and H.245 Any >=1024 TCP ExpE LAN RTP Assent Any >=1024 UDP ExpE LAN * RTCP Assent Any >=1024 UDP ExpE LAN * H.323 endpoints with public IP addresses or remote Edge systems Q.931/H.225 Any >=1024 TCP ExpE LAN H.245 Any >=1024 TCP ExpE LAN to RTP & RTCP Any >=1024 UDP ExpE LAN to 59999* SIP endpoints or remote Edge systems SIP TCP Any >=1024 TCP ExpE LAN SIP UDP Any >=1024 UDP ExpE LAN SIP TLS Any >=1024 TCP ExpE LAN RTP & RTCP Any >=1024 UDP ExpE LAN to 59999* - On large systems, default allocation for multiplexed media is to On small/medium systems, two configurable ports are allocated for multimedia traffic. Defaults are 2776 and 2777 and might be changed, but if admin chooses not to configure those ports, Expressway will listen to and Cisco and/or its affiliates. All rights reserved. Cisco Public 92

93 Business-to-business Access Media Traversal Traversal Media Port Range is set on Configuration > Traversal Subzone menu on both Expressway C & E, defaults to B2BUA could be engaged on Expressway-C and/or Expressway-E in order to perform encrypted to unencrypted call The proxy component is always used on both Expressway-C and Expressway-E This media port range is divided and shared 1st half goes to Proxy 2nd half goes to B2BUA The following example is taken with a port range to 59999: to goes to Proxy to goes to B2BUA 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 93

94 B2BUA Impact on Firewall Ports When Proxy only is engaged (all zones set to auto ) on Expressway-E the number of ports is reduced by a half compared to the situation where B2BUA and Proxy are engaged Enabling encryption on Expressway-C instead of Expressway-E reduces the number of ports opened on external firewall With B2BUA: 24 ports engaged per call Without B2BUA: 12 ports engaged 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 94

95 Example 50 concurrent B2B calls Total 600 (50x12) ports on external FW without B2BUA Ports to be opened on external FW without B2BUA engaged Range configured on Expressway: 1200 ports, from to First half goes to Proxy: to These ports will be opened on external FW Important Note: If you are restricting media ports on Expressway-E make sure that B2BUA is not engaged on Expressway-E, but on Expressway-C 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 95

96 Summary B2B architectures for single edge Expressway-C and Expressway-E with dual network interfaces SIP Variants How to protect the dialplan How to minimize ports opened on external firewall Quick overview on multiple Expressway deployment options 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 96

97 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

98 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

99 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 99

100 Thank you

101 101

102 Use a IPS to Block Spam and Scan Calls from the Internet

103 To make Expressway invisible, use an IPS to block unwanted traffic NGIPS Expressway-E Expressway-C - Traffic analysis based on (customized) signature - Inspects packets - Drop unwanted traffic before it reaches Expressway-E - Drop traffic that doesn t match the internal dial plan - As an example: userid of 8 characters, might end with a digit, needs to have the domain - Block SIP OPTIONS and SIP INVITE that don t match the internal dial plan - Added as an example only. Currently not supported! 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 103

104 Customized Rules offset 1. SIP TCP RULE FOR INVITE: alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (sid: ; msg:"sip SPAM - invalid INVITE Request URI with metadata:service sip"; rev:8; resp:reset_both; content:"invite 20 sip:"; nocase; distance:-11; pcre:!"/sip:[a-z]{2,7}[a-z0-9](\.cmr)?@example\.com/ir"; metadata:service sip; classtype:unknown; ) 2. SIP UDP RULE FOR INVITE: alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (sid: ; msg:"sip SPAM - invalid INVITE UDP Request URI with metadata:service sip"; rev:1; resp:reset_both; content:"invite 20 sip:"; nocase; content:"invite 20 "; distance:-11; pcre:!"/sip:[az]{2,7}[a-z0-9](\.cmr)?@example\.com/ir"; metadata:service sip; classtype:unknown; ) 3. SIP TCP RULE FOR SIP OPTIONS: alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (sid: ; msg:"sip SPAM - invalid OPTIONS TCP Request URI with metadata:service sip"; rev:1; resp:reset_both; content:"options 20 sip:"; nocase; content:"options 20 "; distance:-12; pcre:!"/sip:[a-z]{2,7}[a-z0-9](\.cmr)?@example\.com/ir"; metadata:service sip; classtype:unknown; ) 4. SIP UDP RULE FOR SIP OPTIONS: alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (sid: ; msg:"sip SPAM - invalid OPTIONS UDP Request URI with metadata:service sip"; rev:1; resp:reset_both; content:"options 20 sip:"; nocase; content:"options 20 "; distance:-12; pcre:!"/sip:[a-z]{2,7}[a-z0-9](\.cmr)?@example\.com/ir"; metadata:service sip; classtype:unknown; ) CURRENTLY NOT SUPPORTED! SHOWN AS REFERENCE ONLY 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 104

105 FW Traversal: SIP Signaling Expressway-C Expressway-E TCP TCP (SYN SYN/ACK ACK) + MTLS TCP 7999 SIP TLS OPTIONS PING Source Port Dest Port 200 OK Destination Port Source Port SIP INVITE Cisco and/or its affiliates. All rights reserved. Cisco Public 105

106 FW Traversal Using Assent: Media Expressway-C Expressway-E SIP INVITE Source Port RTP audio RTCP audio RTP video RTCP video RTP duo video RTCP duo video BFCP (not used) ix RTCP ix Dest Port 2776 RTP 2777 RTCP UDP connection Probes to 2776/2777 Return Traffic Media flows bidirectionally Destination Port RTP audio RTCP audio RTP video RTCP video RTP duo video RTCP duo video BFCP (not used) ix RTCP ix Source Port 2776 RTP 2777 RTCP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 106

107 Match the internal dial plan To be used to allow calls only if they are using a legal internal SIP address UserID rule: from 2 to 8 digits, starting with a letter, ending with a letter or a number. Might include.cmr for personal CMR [a-z]{2,7}[a-z0-9](\.cmr)?@example\.com UserID rule: name.surname. Might include an ending letter to distinguish between users with the same userid»[a-z]+\.[a-z]+[0-9](\.cmr)?@example\.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 107

108 DNS SRV Records for B2B SRV record format for SIP and H.323 (RFC 2782) _sips. _tcp.example.com IN expe.example.com SRV Name of the service Protocol and domain name (TCP, UDP...) DNS Class. Always IN Priority: Lowest priority means preferred. Weight: loadbalances records with same priority Port: TCP or UDP port for the service DNS Time-To-Live: how much time the server caches the record before it flushes the cache Targed: hostname or IP Address for the host Providing the service 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 108

109 Service Discovery _sips._tcp.example.com IN SRV bigbox.example.com. _sips._tcp.example.com IN SRV smallbox.example.com. _sips._tcp.example.com IN SRV backupbox.example.com. Smallbox Backupbox 40% Bigbox 60% _sips._tcp.example.com? Dial: luca@example.com SIP Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 109

110 Service Discovery _sips._tcp.example.com IN SRV bigbox.example.com. _sips._tcp.example.com IN SRV smallbox.example.com. _sips._tcp.example.com IN SRV backupbox.example.com. Smallbox Backupbox 40% Bigbox 60% Dial: luca@example.com SIP Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 110

111 Real Scenario _sips._tcp.example.com IN SRV expe1.example.com. _sips._tcp.example.com IN SRV expe2.example.com. _sips._tcp.example.com IN SRV expe3.example.com. expe3.example.com expe2.example.com 33% 33% expe1.example.com 33% SIP Server Dial: 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 111

112 Expressway Dual Network Deployment Model Recommended solution Expressway-E LAN1 interface (internal) is used for clustering Expressway-E LAN1 interface can be translated by static NAT Expressway-E LAN2 interface (external) can be translated by static NAT Expressway-C interface can be translated by NAT 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 112

113 Business-to-business Architecture Expressway Protocol Selection Expressway Transport Protocol Selection Encryption for Signaling Encryption for Media Encryption and lock icon 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 113

114 SIP Transport Protocol Signaling Interworking SIP Transport Protocol Protocol Selection Neighbor zones and Traversal zones: interworks if the outgoing transport type is different from the incoming UCM ExpC ExpE SIP/TLS SIP/TLS/TCP/UDP UCM zone set to TCP TLS to TCP Traversal zone set to TLS Expressway-E Default Zone accepts SIP UDP/TCP/TLS DNS zones: based on priority (TLS/TCP/UDP). DNS zone always tries TLS first UCM ExpC ExpE 1. SIP/TLS SIP/TLS Traversal zone set to TLS 2. SIP/TCP 3. SIP/UDP In case of TLS/TCP protocol translation, B2BUA is not engaged 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 114

115 Media encryption Best Effort example Optimization of previous example Inbound zone Expressway-C CM Neighbor Traversal Zone Client Zone TLS TLS Auto Best Effort Expressway-E Traversal Server Zone TLS Best Effort Default Zone Not configurable Best Effort Outbound zone DNS Zone TCP/RTP or TLS/RTP TLS/SRTP Not configurable Best Effort Internet RTP Remote Edge Best Effort-Auto example: 3 call legs due to 3-in-a-row rule optimization Minimizes number of ports open on external firewall 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 115

116 SIP Trunk Between CUCM and Expressway-C

117 Neighboring Expressway-C to Unified CM w/ SIP TLS Neighbor Zone to Unified CM Turn off H.323 Set port other than 5061 if Expressway if shared between MRA and B2B. TLS verify mode triggers Mutual TLS. Best Effort: Expressway will try SRTP first and RTP if the remote endpoint is non-encrypted. Mixed mode required on Unified CM 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 117

118 Neighboring Expressway to Cisco Unified CM Zone Configuration DNS names mandatory if TLS verification is set to on (MTLS). They will be checked against the certificate SAN. IP addresses require TLS verify mode set to off OPTIONS PING to monitor status /config_guide/x8-8/cisco-expressway-sip-trunk-to-unified-cm- Deployment-Guide-CUCM and-X8-8.pdf Documentation says to create a custom zone with Call signaling routed mode set to always 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 118

119 CUCM SIP Trunk to Expressway-C This check box enables Secure Real-Time Protocol (SRTP) SIP Trunk connections and also allows the SIP trunk to fall back to Real-Time Protocol (RTP) if the endpoints do not support SRTP. In order for this check box to be effective, Cisco Unified CM must be in mixed mode SIP TLS trunk doesn t require mixed mode if RTP only is used 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 119

120 SIP Trunk Destination and SIP Trunk Security Profile SIP Trunk settings Mutual TLS: has to match with the SANs of the remote system cert Unified CM listening port. Has to match the port on the Unified CM neighbor zone configured on Expressway 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 120

121 CPL design Note: CPL are analyzed top-down 1. Reject malformed calling aliases 2. Reject forbidden destinations in called aliases PSTN access Specific numeric ranges not allowed from B2B 3. Allow for called destination matching the internal domain 4. Deny all Point 3. could be much more granular than this! i.e. Allow Allow 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 121

122 Directory Expressway Architecture 4 ucm2endpoint@domain.com Expressway-C1 3 UCM1 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS UCM2 Inbound CSS trunks doesn t include the partition for the Route Pattern to remote cluster. Works with Directory URI with ILS. 3 Expressway-C2 Expressway-E1 2 Directory Expressway-E 2 Expressway-E2 1 Call: ucm2endpoint@domain.com 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 122

123 Directory Expressway Architecture License Optimization Expe1 Expe2 Expe3 Expe4 Neighbor Zones TLS Media: Auto TLS TLS/TCP media TCP Dir Expe Default Zone Not configurable Media: Auto When an Expressway performs TCP to TLS interworking, Expressway can t remove itself for the signaling path Media will flow around if default and neighbors are set to auto, but signaling will flow through No licensing optimization happens in this case: DirExpe license is engaged for the rest of the call Optimization happens for TCP or TLS only 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 123

124