Cisco Jabber: Deploying Cisco Jabber On Premise

Transcription

1 Cisco Jabber: Deploying Cisco Jabber On Premise Bryan Morris Engineering Manager, Technical Marketing 1 v8

2 Agenda Jabber Overview Jabber Deployment Configuration Overview Contact Sources Certificate Requirements Service Discovery Microsoft Office Integration Remote Access Session Review / Q&A Presentation_ID 2

3 Jabber Overview

4 Cisco Jabber Product Portfolio All-in-one UC Application Presence & IM Voice, Video, voice messaging Desktop sharing, conferencing Collaborate from any Workspace PC, Mac, tablet, smart phone On-premises and Cloud Integration with Microsoft Office 4

5 A Brief Tour of Jabber Cisco Jabber provides you a hub view. The hub view displays contacts with presence and provides search capabilities Chat, Group Chat, Federated Chat, Chat history, File Transfer, Screen Capture and Emoticons Standards based Voice and high definition video calling Collaboration using Desktop sharing and Web Conferencing 5 5

6 Cisco Jabber - Workflows 6

7 Jabber Deployment

8 Jabber Architecture DNS CertAuth Core Infrastructure Services Exchang e Server LDAP AD Unified CM IM & Presence Server Expressway-C Expressway-E Cisco Web Conferencing Internet Services WebEx Meetings Federation TelePresence Server Conductor Unity Connection Internet B2B Federated Organizations Home Office Coffee Shop Jabber Clients (Corporate Network) Telepresence Cisco Collaboration Endpoint Mobile and Remote Access 8

9 Jabber Core Services (UC manager 9.x+) AD/LDAP Contact Lookup (Contact source) UC Manager Authentication Configuration Call Control IM&P IM/Chat Presence 9

10 Creating Jabber Users 10

11 Jabber Core Services LDAP Sync Recommended approach for creating users is to sync with UC Manager. LDAP SYNC AD/LDAP UC Manager 11

12 Jabber Core Services LDAP Sync Recommended approach for creating users is to sync with UC Manager. LDAP SYNC DB SYNC AD/LDAP UC Manager IM&P Cluster UserID Jabber Domain Jabber ID or JID 12

13 Jabber Core Services LDAP Sync Recommended approach for creating users is to sync with UC Manager. Consider your Jabber domain carefully, you ll live with it for a while! Multi-modal communications address ( , IM, Voice, Video & Federation) Alice Adams Consulting Engineer Contact: aadams@example.com AADAMS@EXAMPLE.COM Jabber ID or JID 13

14 Jabber Core Services LDAP Sync Recommended approach for creating users is to sync with UC Manager. LDAP SYNC DB SYNC AD/LDAP UC Manager IM&P LDAP AUTHENTICATION 14

15 Jabber Core Services LDAP Sync 15

16 Jabber User Configuration Service Configuration Voice/Video Configuration Group Membership 16

17 Jabber User Configuration Service Profile IM&P UC Service SIP URI Line association to SIP URI URI association to User Device association to line Mobile User assigned XML File CTI UC Service Voic UC Service Conference UC Service Directory UC Service Directory Number Softphone User association to devices Home Cluster IM&P enabled Desk Phone Devices membership of group End User Group User association to line membership of group Group Membership CTI Group 17

18 Jabber User Configuration Cluster A Cluster B Cluster C Home Cluster IM&P enabled 18

19 Jabber User Configuration Services Profiles detail the configuration and address of UC services Service Profiles are configured on CUCM in 9.x and later. Home Cluster User assigned IM&P enabled Service Profile XML File IM&P UC Service CTI UC Service Voic UC Service Conference UC Service Directory UC Service 19

20 Creating Service Profiles UC Service Service Profile 20

21 Jabber User Configuration ` 21

22 Jabber User Configuration Services Profiles detail the configuration and address of UC services Service Profiles are configured on CUCM in 9.x and later. Home Cluster User assigned IM&P enabled Service Profile XML File IM&P UC Service CTI UC Service Voic UC Service Conference UC Service Directory UC Service 22

23 Jabber User Configuration Service profiles don t provide access to all settings, the client will download jabber configuration file <config version="1.0"> <Directory> <BDIPrimaryServerName>dir.example.com</BDIPrimaryServerName> <BDIServerPort1>3268</BDIServerPort1> <BDISearchBase1>dc=example,dc=com</BDISearchBase1> <BDIConnectionUsername>cholland@example.com</BDIConnectionU sername> <BDIConnectionPassword>cisco</BDIConnectionPassword> </Directory> <Policies> <EnableSIPURIDialling>True</EnableSIPURIDialling> </Policies> </config>tip You can view the current jabber-config.xml file at: Keep your XML file simple!!! Only specify the settings you need. Don t specify default values. Test your XML file using a browser Test XML file operation with jabber-config-user.xml file. 23

24 Jabber Configuration Policy Settings Jabber Configuration file provides an increasing number of customization settings. Update URL Persistent Chat Enable URI dialling enable Inactivity Status / Timeout Away on OS Lock Start Call with Video Load on OS Start Custom Tabs Controls Show Contact Pictures Show Offline Contacts Docked Window Screen Capture Enable File Transfer controls Video Enable Phone Selection Accessories Control Local Address Book Search Desktop share enabled Meetings Enabled Telephony Enabled Voic Enabled Chat History Enabled 24

25 Jabber Configuration Configuration Sources Operating Config Service Profile IM&P SOAP Jabber-config.xml Bootstrap/Local Priority Configuration During start-up Jabber clients will take configuration from multiple sources Jabber builds a local configuration which is populated from different sources Configuration sources have different priorities with Service profiles highest Operating configuration can made up from different configuration sources Configuration is created at parameter level e.g.. LDAP Host from Jabber-config.xml LDAP user ID from Service profile LDAP password from Service profile 25

26 Jabber User Configuration SIP URI Line association to SIP URI Directory Number URI association to User Device association to line Mobile Softphone User association to devices Desk Phone Devices User association to line Home Cluster User IM&P enabled Users using Jabber for full unified communications will require a device configuration. Devices are configured for soft phone and desk phone control Devices are associated to users, numbers and SIP URI s 26

27 Jabber User Configuration Users also require role assignment on UC manager which are assigned using groups Users need to be members of the end user group for HTTP access Users need to be members of CTI group for phone controls Home Cluster User IM&P enabled membership of group End User Group membership of group Group Membership CTI Group 27

28 Contact Sources

29 Jabber must always be deployed with a contact source.. Jabber clients reference contacts using JID cholland@example.com Contact source provides contact attributes.. Contact details 29

30 Jabber Contact Sources What can be used LDAP based contact Source (EDI or BDI mode) Must be used for on premise deployments HTTP/REST based contact Source CUCM contact source Custom Contacts (Jabber Win 9.7 +) Non directory based contacts stored on IM&P server MS Outlook Contacts Search local contacts from Jabber 30

31 Contact Lookup by Jabber ID Account Name (&(objectcategory=person)(objectclass=user)(samaccountname=cholland)) 31

32 Contact Lookup using Predictive Search ANR Example (&(objectcategory=person)(objectclass=user)(anr=smith*)) 32

33 Contact Lookup by Telephone Number (&(objectcategory=person)(objectclass=user)(telephonenumber=+1 (408) (&(objectcategory=person)(objectclass=user)( ( ( (mobile= ))(homephone= ))(otherTelephone= ))) 33

34 Jabber Contact Source Questions Jabber contact data will normally use or sync with an existing directory What directory does the organisation use? Do they use more than one? You need to understand the directory infrastructure Directory Architecture (AD?, Domain?, Forest) Attribute Usage / Mapping (custom attributes) Connection Parameters (LDAP / LDAPS, DC / GC,Ports) Data completeness / Data quality (Phone Formats?) Phone numbers should not include space, dash or bracket etc. Which Jabber Contact Source are we going to deploy 34

35 On Premise Contact Sources User Data Service Contact Source Contact Source Basic Directory Integration (BDI) Enhanced Directory Integration (EDI) 35

36 LDAP Configuration BDI/EDI LDAP Auto-Discovery EDI only connection LDAP ID / #### GC GC GC Jabber Client Administrator provides server LDAP server address and port Administrator provides credentials for authentication (Default operation) Administrator defines any customizations LDAP Server Jabber Client Example.com (windows domain) Jabber connects to a Windows domain for contact source. Connects to a GC identified by OS Connects using domain authentication NO Basic Configuration required!!!!! MUST BE IN A DOMAIN/FOREST 36

37 Contact Source Configuration Parameters Jabber uses the following LDAP settings to configure different aspects of contact source CONNECTION AUTHENTICATION SEARCH/QUERY ATTRIBUTE MAP Server Type Server Address Server Port Authentication Method Credential Usage Username Password Search Base Base Query ANR Usage Person Attributes Comms Attributes Address Attributes Primary settings required for BDI 37

38 Contact Source Configuration Jabber-Config.xml file Recommended approach Most flexible approach Support for photo source Directory Service profile Limited support at this time No support for photo source 38

39 Jabber Example Contact Source Deployment DNS CertAut h Core Infrastructure Services Exchang e Server LDAP AD Unified CM IM & Presence Server Example Clients Windows 9.7 Workstations in Windows domain TelePresence Conductor Unity Server Connection Mac 9.6 ipod,iphone,ipad 9.6 Jabber Clients (Corporate Network) Cisco Collaboration Endpoint Telepresence Android

40 Contact Source XML Configuration Basic Settings <?xml version="1.0" encoding="utf-8"?> <config version="1.0"> <Directory> <BDIPresenceDomain>example.com</BDIPresenceDomain> <BDIPrimaryServerName>dir.example.com</BDIPrimaryServerName> <BDISearchBase1>ou=staff,dc=example,dc=com</BDISearchBase1> <BDIConnectionPassword>jabber</BDIConnectionPassword> </Directory> </config> EDI and BDI configurations can co-exist. This example shows EDI auto-discovery with an administrator defined configuration for BDI Default behaviour is to connect to 3268 not 389 when using AD Resulting Configuration Windows Auto-Discovery with windows authentication Mac Connection to GC (port 3268) dir.example.com using ad_jabber_access and password ipod,iphone,ipad Connection to GC (port 3268) dir.example.com using ad_jabber_access and password Android Connection to GC (port 3268) dir.example.com using ad_jabber_access and password 40

41 Contact Source XML Configuration Basic Settings <?xml version="1.0" encoding="utf-8"?> <config version="1.0"> <Directory> <PrimaryServerName>dir.example.com</PrimaryServerName> <SearchBase1>ou=staff,dc=example,dc=com</SearchBase1> <UseWindowsCredentials>0</UseWindowsCredentials> <UseSecureConnection>0</UseSecureConnection> <ConnectionPassword>jabber</ConnectionPassword> <BDIPrimaryServerName>dir.example.com</PrimaryServerName> <BDISearchBase1>ou=staff,dc=example,dc=com</BDISearchBase1> <BDIConnectionPassword>jabber</BDIConnectionPassword> </Directory> </config> This example shows administrator defined configuration for both EDI and BDI (effectively EDI using BDI style config) Resulting Configuration Windows Connection to DC dir.example.com using ad_jabber_access and password Mac Connection to DC dir.example.com using ad_jabber_access and password ipod,iphone,ipad Connection to DC dir.example.com using ad_jabber_access and password Android Connection to DC dir.example.com using ad_jabber_access and password 41

42 Contact Source Service Profile BDI EDI Latest JCF based clients provide some support for directory profiles. Recommended approach is jabberconfig.xml file. 42 Basic Support

43 Jabber Contact Sources UDS User Data Services (Contact Service) Sync Resolve Client resolves contact lookups against UDS Directory Source CUCM Clusters Steve Smith (1) The UDS directory integration is used: Optional On Premise Always when Jabber clients are connected via Remote and Mobile Access (MRA). Environment MUST be running UC manager 9.x (COP File may be required) Scaling requirements: A UC manager node can support connections for 50% of the total OVA size for the server. 43

44 UDS Contact Configuration To enable UDS use Jabber-config.xml file <?xml version="1.0" encoding="utf-8"?> <config version="1.0"> <Directory> <DirectoryServerType>UDS</DirectoryServerType> <UdsPhotoUriWithToken> </Directory </config> It is not recommended to use service profiles with UDS (update coming) UDS doesn t support photo objects so must use web source UDS settings not required for expressway, Edge detection will auto switch client to UDS contact source. 44

45 Jabber Contact Sources Retrieving Photos for Contacts Jabber provides a number of methods to retrieve contact photos to support many different customer environments Photo can be JPG,PNG or BMP Recommended size 128x128 but jabber can resize Directory Active Dir Web Server Web Server Note: Option 2 & 3 phase object to detect binary object or URL Option 1: Cloud Default (no config) WebEx Contact Photos Option 2: On Prem Default (no config) Active Directory Binary Objects Retrieve binary photo from thumbnailphoto attribute load with PowerShell Option 3: On Prem PhotoURL Attribute/ Retrieve URL Option 4: On Prem (XML config) URL Substitution/Macro style Jabber will also retrieve thumbnail photos from MS Outlook for personal contacts if photo available 45

46 LDAP UDS BDI/EDI Attribute Index BDI Parameter EDI Parameter AD Attribute GC Enabled Attribute Indexed ANR Enabled BDIUserAccountName UserAccountName samaccountname Yes Yes Yes BDIDisplayName DisplayName displayname Yes Yes Yes BDINickName NickName displayname Yes Yes Yes BDIFirstname Firstname givenname Yes Yes Yes BDILastname Lastname sn Yes Yes Yes BDITitle Title Title Yes No -- BDICommonName CommonName cn Yes Yes No BDICompanyName CompanyName Company Yes Yes No BDIDomainName DomainName userprincipalname Yes Yes No BDI Address Address mail Yes Yes Yes BDIBusinessPhone BusinessPhone telephonenumber Yes No -- BDIHomePhone HomePhone homephone Yes No -- BDIMobilePhone MobilePhone Mobile Yes No -- BDIOtherPhone OtherPhone othertelephone Yes No -- BDISipUri* SipUri msrtcsip-primaryuseraddress Yes Yes Yes BDIStreetAddress StreetAddress streetaddress Yes No -- BDICity City l Yes Yes No BDIPostalCode PostalCode postalcode Yes No -- BDIState State St Yes Yes No BDILocation Location Co Yes No -- BDIPhotoSource PhotoSource thumbnailphoto No No -- See alao BDIDirectoryUri in Policy settings 46 Jabber BDI & EDI parameters AD attribute is default mapping Using AD connection to global catalog is recommended Items in red show defaults: Enable GC attributes Enable indexing

47 Certificates

48 Certificate Validation Jabber Certificate Management For enhanced security Jabber clients by default validate all server certificates in order to establish secure connections between client and server. Administrators need to decide if they want to deploy CA signed certificates to services used by Jabber. Self Signed Deployment Certificate Auth Deployment Jabber clients will prompt end users if a invalid or self signed certificate is presented by a service. 48

49 Certificate Validation Self Signed Option UC Manager IM&P UCxn CWMS 49 Jabber will validate certificates. When Jabber receives a new certificate it will prompt the user to accept each certificate If the user accepts the certificate it will be added to the users device. For windows the users enterprise trust certificate store is used.

50 Certificate Validation Private/Public CA Option Private or Public Cert Authority UC Manager IM&P UCxn CWMS Trusted CA issued certificates installed on each server in cluster UC Manager Tomcat Cert IM & P Tomcat and XMPP Cert Unity Connection Trusted Root Cert distributed to Client, can be via policy iphone With CA issued certificates in place mean users are not prompted to accept certificates Tomcat Cert WebEx Meeting Server Tomcat Cert CAPF functionality uses CTL files so not affected by this change. 50

51 Certificate Management - CUCM TOMCAT / HTTP / CUCM TOMCAT / HTTP / CUCM XMPP / IM&P cucm9.example.com cup9.example.com cucm9.example.com cup9.example.com cup9.example.com + Extension: SubjectAltName (OID ) Critical: false altnames: 2 names 1) cup10.example.com (dnsname) 2) example.com (dnsname) 51 SAN=presence domain (automatically created in CSR)

52 Certificate Validation What do I need to do Jabber clients will now validate infrastructure certificates Unity, IM&P etc) Administrators have two options (UC manager, Self Signed Certificates (Less Configuration) Jabber user accepts certificates using Jabber prompt and Jabber adds to into enterprise certificate store. -- OR -- Admin pre distributes all self signed certificates to users certificate store Public/Private CA issued certificates (Most Secure) Administrator replaces infrastructure self signed certs with public or private CA issued certificates Administrator installs CA certificates on each node within a cluster Root Certificate from CA needs to be published to user workstations To distribute certificate an administrator can use tools such as Microsoft group policies. When deploying Jabber pre plan how you will manage certificates 52

53 Service Discovery

54 What is Service Discovery Service Discovery allows Jabber clients to Identify Operating Domain(s) (Presence/DNS) Jabber Operating Mode (Cloud or On Premise) Network Location (Inside/Outside) Service Registration (UC service)

55 Why Service Discovery User Experience Service Discovery removes the requirements for users to enter service configuration information Users should not have to enter information they don t understand! Reduce support calls 55

56 How does Service Discovery connect? UC Manager Identify Domain (Presence/DNS) Identify XMPP domain for cloud Identify DNS domain for On Premise Identify Operating Mode / Services Cloud HTTP Request to Cloud On Premise DNS SRV Queries Identify Network Location DNS SRV Queries Locate Services Query UC Manager UDS service Jabber Client 56

57 Service Discovery: Identify Domain at First Login Local cache in the device Already stored in cache from previous login Migration case Manual entry by end user May or may not be user s address cpaige@ example.co m Preset by administrator (covered later!) MSI Transformation (Windows only) URL Configuration (Mac, ios & Android) 57

58 Selecting Operating Mode via Service Discovery Jabber sends all requests (HTTP request & DNS queries) simultaneously Among all returned, the record with the highest priority will be used for connecting to UC services Priority Service HTTP Request / DNS SRV 1 WebEx Messenger HTTP CAS lookup 2 Cisco Expressway _collab-edge._tls.<domain_name> 3 Unified CM 9.x _cisco-uds._tcp.<domain_name> 4 Cisco Presence 8.x _cuplogin._tcp.<domain_name> DNS Queries * CAS: Connect Authentication Service Messenger HTTP Request to CAS* ratedsso?org=[domain] DNS SRV Lookups DNS (internal or external) 58

59 Steps to Add DNS SRV Records REFERENCE MATERIAL 1. Start DNS Manager 2. Find your domain 3. Right click on your domain to select Other New Records 59

60 Steps to Add DNS SRV Records (Cont.) REFERENCE MATERIAL 60

61 How to Test DNS SRV Records? REFERENCE MATERIAL nslookup > set type=srv > _ciscouds._tcp.<your_domain_name> If you get an error, do not continue until you get a positive result shown in this picture. 61

62 Service Discovery Flow On-Premises Deployment HTTP Request to CAS URL for corp.example.co m 2 Messenger Home UCM Cluster 1 corp.example.com is not WebEx domain 3 cpaige DNS lookup 2 corp.example.com _cisco-uds 3 Central UCM UDS address Internal DNS Look for home UCM cluster 6 4 Service Profile & jabber-config from TFTP 5 7 User log in Home UCM cluster address UCM IM/P Central UCM UDS 8 Connect/R egister UCM Call Control Unity Connection WebEx Meetings Server 62

63 What Triggers Service Discovery on Jabber? First time user login When no locally cached information available Network change events When the user moves into the corporate network Transport errors (SIP, XMPP & HTTP) When the user moves out from the corporate network Note: DNS SRV lookup is performed only when there is a real-time network activity to save battery life on mobile platforms. 63

64 Best User Experience with Further Simplification Administrative ability to apply discovery information at the beginning of service discovery process User will not be asked to enter on first login Highly recommended especially when: UC services domain WebEx domain (Hybrid deployment) Service(s) needs to be excluded Service Discovery MSI Transformation URL Configuration Best End User Experience 64

65 MSI Transformation for Jabber for Windows SERVICES_DOMAIN Set to domain for discovering WebEx Messenger VOICE_SERVICES_DOMAIN Set to domain for discovering on-prem UC infrastructure (including UCM, CUP, Cisco Expressway) EXCLUDED_SERVICES Set to service(s) to be excluded during service discovery TFTP Set to TFTP address if service discovery is not used or fails AUTHENTICATOR Set to authentication service name if service discovery is not used or fails MS Orca tool for transforming msi file Use CiscoJabberProperties.mst file to transform CiscoJabberSetup.msi. 65

66 URL Configuration for Non-Windows Jabber Clients Works on Mac, Android & iphone/ipad Download/install Jabber client prior to executing URL configuration During installation, Jabber registers ciscojabber protocol handler URL is sent to users via or wiki ciscojabber://provision?servicesdomain=example.com&voiceservicesdomain=corp.example.com As user clicks the URL, Jabber will be cross-launched & the information in the URL will be provided for service discovery 66

67 Excluding UC Service(s) during Service Discovery Potential Issue User will be asked to sign in to WebEx Messenger in on-premises UC deployment (IM and Presence service) Reason Organization is currently subscribing or previously demoed/piloted WebEx services (WebEx conferencing or Messenger) HTTP request to WebEx CAS will return as a WebEx domain Solution Use ServiceDiscoveryExcludedServices parameter in URL Configuration string or MSI transformation to exclude WebEx Exclude WebEx service example.com HTTP Request to CAS URL for example.com DNS SRV lookup Central UCM UDS address _cisco-uds Messenger Internal DNS 67

68 Service Discovery - Review Service Discovery is used enable Jabber to connect to services Identifies Domain Information Identifies Operating Mode Identifies Network Location Connects Users to correct services Service Discovery can operative in different ways DNS SRV for initial discovery Client Customization for initial information Service Discovery sequence can be customized with options disabled Always user Service Discovery rather than manual configuration!!!! 68

69 Microsoft Integration

70 Microsoft Office Integration Cisco Jabber for windows integrated with Outlook 2007, 2010 &

71 Microsoft Office Integration Active Directory requirements Microsoft Office requires the AD proxyaddress attribute to be populated with SIP URI for presence to be associated Add proxyaddress attribute 71

72 Microsoft Office Integration Understanding ProxyAddress Update process 72

73 Remote Access

74 Mobile and Remote Access What is it? Collaboration Edge support provides VPN less access for Jabber clients Service discovery from outside the corporate network Collaboration Services work Inside firewall (Intranet) UCM EXPY Client DMZ EXPY Server Outside firewall Internet the café Home Anywhere Support for Hybrid service models Secure communication over encrypted connection 74

75 Mobile and Remote Access Components Expressway Core Deployed inside corporate firewall Proxies traffic to and from internal UC (CUCM, IM&P) Expressway Edge Deployed in DMZ Routes incoming traffic to Expressway Core Routes outgoing traffic to endpoints outside firewall Mobile and Remote access Service that runs on Expressway C & E to provide VPN less access to internal services for Jabber clients Collaboration Edge Overlying architecture name for Mobile and Remote access solution 75 Expressway C DMZ Expressway E

76 Mobile and Remote Access Turn it on! Enable Mobile and Remote Access on Expressway C & E Enabled/Disabled by jabber-config key <Policies> </Policies> <RemoteAccess>ON</RemoteAccess> (enabled by default) Mobile and Remote Access can be enabled for groups of users jabberconfig.xml 76

77 Mobile and Remote Access Jabber Services with Mobile and Remote Access Instant Messaging Rich / Group Chat Presence Contact User Management Search & Authentication Softphone Voice and Video Desktop Share Cisco Jabber Visual Voic 77

78 Mobile and Remote Access Directory Integration (On Premise IM/P or Phone Mode) LDAP traffic does not traverse the Collaboration Edge solution When in edge mode, UDS directory service provides directory integration for Jabber. UDS service runs on CUCM by default (Cisco Tomcat Service) When inside the firewall, Jabber will connect to a LDAP server to provide directory integration Jabber for Windows supports Enhanced Directory Integration (EDI). Jabber for Windows can automatically discover and load balance connections to Active Directory global catalog. Windows credentials used for authentication. Jabber for Mac, Android and IOS, support Basic Directory Integration (BDI). BDI uses a common username and password to connect to a LDAP server for directory integration. BDI configuration is specified in the jabber-config.xml file. WebEx Messenger provides directory integration for Jabber/Cloud based deployments. 78

79 Jabber Example Deployment Contact Source Zones DNS CertAuth Core Infrastructure Services Exchang e Server LDAP AD Unified CM IM & Presence Server Expressway-C Expressway-E Cisco Web Conferencing Internet Services WebEx Meetings LDAP UDS/HTTP Federation TelePresence Conductor Unity Server Connection Internet B2B Federated Organizations Home Office Coffee Shop Jabber Clients (Corporate Network) Cisco Collaboration Endpoint Telepresence Mobile and Remote Access LDAP or UDS Contact Source Zone 79 UDS Contact Source Zone

80 Mobile and Remote Access Directory Integration Directory integration configured in jabber-config.xml (except for cloud mode) <Directory> </Directory> <!-- EDI Settings --> <SearchBase1>OU=Employees,OU=AllUsers,DC=example,DC=com</SearchBase1> <PhotoURISubstitutionEnabled>True</PhotoURISubstitutionEnabled> <PhotoURISubstitutionToken>sAMAccountName</PhotoURISubstitutionToken> <PhotoURIWithToken> <!-- BDI Settings --> <BDIPrimaryServerName>ds.example.com</BDIPrimaryServerName> <BDIConnectionPassword>readonly</BDIConnectionPassword> <BDISearchBase1>OU=Employees,OU=AllUsers,DC=example,DC=com</BDISearchBase1> <BDIPhotoURISubstitutionEnabled>True</BDIPhotoURISubstitutionEnabled> <BDIPhotoURISubstitutionToken>sAMAccountName</BDIPhotoURISubstitutionToken> <BDIPhotoURIWithToken> <EnableLocalAddressBookSearch>true</EnableLocalAddressBookSearch> <!-- UDS Settings for Edge users only --> <UDSPhotoURIWithToken> 80

81 Mobile and Remote Access Visual Voic and Whitelists Jabber connects to Unity Connection over a REST interface to gather voic data to display in the visual voic tab This is a HTTP connection and will not be allowed through the collaboration edge architecture by default. On the Expressway-C, we can create a HTTP whitelist which allows Jabber to send HTTP requests to specified internal hosts 81

82 Mobile and Remote Access What to whitelist? What should we whitelist? Unity Connection Server for Visual Voic Directory photo server if using http server to deliver photos HTML tab host e.g. company intranet html tab HTML tab icon host Jabber update host 82

83 Mobile and Remote Access Scenario 1 CUCM/IM & P 10.0, inside firewall _cisco-uds CAS Lookup _cisco-uds _cup_login _collab-edge cucm.example.com Authenticate and get config Connect to Services Authenticated & Service Profiles.cnf file 83

84 Mobile and Remote Access Scenario 2 CUCM/IM & P 10.0, outside firewall _collab-edge _cisco-uds CAS Lookup _cisco-uds _cup_login _collab-edge expressway-e.example.com Authenticate and get config Connect to Services Authenticated & Service Profiles.cnf file & cucm DNS 84

85 Session in Review In this Session we discussed Jabber Client Configuration Contact Sources Certificate Requirements Service Discovery Microsoft Office Integration Remote Access 85

86 Complete Your Online Session Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Complete your session evaluation through the Cisco Live mobile app or visit one of the interactive kiosks located throughout the convention center. Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online 86

87 Continue Your Education Demos in the Cisco Campus Walk-in Self-Paced Labs Table Topics Meet the Engineer 1:1 meetings 87

88 88