Secure Call Recording

Transcription

1 Secure Call Recording Effective Summer 2017, Imagicle Call Recording can record Encrypted calls, i.e. calls which are placed with Secure SIP (SIP/TLS) for the signalling and SRTP for the audio stream. Before trying to record Secure calls, make sure Imagicle Call Recording is fully configured to record Non-Secure calls with clear RTP. Mixed mode must be enabled on your Unified CallManager, and you must be able to effectively place and receive secure calls to and from the agents' phones. Secure calls recording supports forking (Cisco Built-in-Bridge technology), Dial-in (direct call) and Network based (gateway) recording. CuCM Configuration for Secure Call Recording To be able to record secure calls, you need to: 1. Load the Imagicle Call Recording certificate on CuCM, categorized as CallManager-trust 2. Create a SIP Trunk Security Profile which references the Imagicle Certificate 3. Create a SIP trunk which points to the Imagicle Application Suite machine, port 5071, and uses the SIP Trunk Security Profile Loading the Imagicle Call Recording Certificate on CallManager When Imagicle Call Recording service starts, it creates a security certificate which is valid for the IAS server on which it was generated. It must be downloaded from the web interface, and loaded onto CuCM. To get the Imagicle Call Recording certificate: Login to the IAS web interface as Administrator Click on Recording, then Global Settings Expand the "Secure Recording" section Click on the Download button to download the Imagicle Call Recording certificate and save it to your PC. The file extension is.pem. To load the certificate on CuCM: Log on CuCM as Administrator Select OS Administration From the menu, choose Security, Certificate Management Press the "Upload Certificate / Certificate chain" button As certificate purpose, choose "Callmanager-trust" Enter a description, then select the Call Recording Certificate from your PC and upload it Press "Close" to go back to the certificate list. Secure Call Recording 1/5 Secure Call Recording

2 Press "Find" to list the certificates. Locate the Imagicle certificate you just uploaded. Take note of the certificate Common Name for later use. By default, the certificate Common Name will match the computer name of the machine on which it was generated. Warning: Changing the Computer Name will invalidate the certificate. If you change the IAS server computer name, you need to regenerate the Call Recording certificate. Warning: The Call Recording certificate will last 5 years from the day it was generated, which is the day the product was installed. If you make Application Suite generate a new certificate, it will last 5 years from the day it was generated. Creating a SIP Trunk Security Profile with Encryption From the Cisco Unified CM Administration menu, select System, Security, Sip Trunk Security Profile. Add a new item with the following properties: Incoming Transport Type: TLS Outgoing Transport Type: TLS Incoming port: 5071 Accept Out of Dialog Refer: enabled Accept Unsolicited Notification: enabled X.509 Subject Name: enter the Imagicle Call Recording Certificate Common Name you noted before. Secure Call Recording 2/5 Secure Call Recording

3 Please mind the certificate name. Do not enter the certificate description. Do not enter the full Subject Name. Enter the Common Name. If you are unsure, select System, Security, Certificate, and press the Find button. Locate the Imagicle certificate. The Common Name is displayed in the Subject Name column, just after CN= Creating a SIP Trunk for Secure Recording A Secure Sip Trunk is a standard SIP trunk with the following properties: A descriptive name, such as CallRecording_SIP_Trunk_Encrypted SRTP Allowed enabled Run On All Active Unified CM Nodes enabled Secure Call Recording 3/5 Secure Call Recording

4 Destination Address: the IP Address of the Imagicle Application Suite server Destination Port: 5071 SIP Trunk Security Profile: reference the one you just created Route Pattern to the SIP Trunk The route pattern must:create a new Route Pattern pointing to the the Imagicle Call Recording Sip Trunk for secure calls. Make sure you did not select the Call Recording Sip Trunk for standard calls. The pattern should match the Pilot number in the Recording profile you are going to create. Call Recording Profile for Encrypted Calls Create a new Call Recording Profile for encrypted calls. Assign a Pilot number of your choice, and a suitable CSS. The CSS must allow the phones to reach the Route pattern you just created. Secure Call Recording 4/5 Secure Call Recording

5 IP Phone Configuration The IP Phone configuration to record secure calls is similar to the non-secure call recording. Just select the Call Recording Profile for Encrypted Calls. Please refer to non-secure calls configuration page of this guide. Troubleshooting Secure Calls Before testing any other recording technology, try to record a Dial-In call. Choose two phones supporting Encrypted calls, say 101 and 102. Place a call from 101 to 102 and check that a lock appears on the display, meaning that the conversation is encrypted On Imagicle Application Suite, create a user with Primary Extension 101 and the permission to use Call Recording, which is the default Place a call from 101 to a number matching the Secure Call Recording Route pattern You should hear a beep, or, in case of permission mismatch, a message informing that the calling number is not entitled for voice recording. If the call does not seem to reach the Call Recording application, most probably there is a problem with the certificate. Ensure you referenced the correct certificate Common Name. How to detect a certificate problem If you suspect a certificate problem, you can check the detailed error in the Call Recording voip stack log file. To enable detailed voip logging: Edit the this file: <installation dir>\stonevoiceas\apps\recorder\settings\recorder.opal.config.xml Add the following line: <?xml version="1.0" encoding="utf-8"?> <configuration> <preference key="logging.level" value="4" /> </configuration> Restart Imagicle Call Recording service Once the logs are enabled: Try to record a new call, for example dialing the Call Recording pilot number Using your favorite editor, open the log file: <installation dir>\var\log\recorder.service\recorder.opal_<current date>.log Look for a line similar to: Accept: error in state=sslv3 read client key exchange A This means that the TLS certificate exchange failed. Please review the above steps. Secure Call Recording 5/5 Secure Call Recording