Acano solution. Acano Server & VM Release Release Notes. September V

Transcription

1 Acano solution Acano Server & VM Release Release Notes September V

2 Contents 1 Introduction 4 2 New Features/Changes in R Recording meetings Overview of steps to configuring the Recorder Example of deploying recording Recorder licensing Customizable background images for SIP and Lync calls Improvements in screen layouts for SIP endpoints Enhancement to TIP support Additional CDR records Started and stopped recording Guest joining conference after waiting in lobby Changes to configuring the TURN server Miscellaneous changes and improvements Summary of additional MMP commands MMP commands for the Recorder Summary of API Additions & Changes API Additions for recording Additional controls over muting audio Additional controls over presenting content Additional control of far end systems with DTMF sequences 23 3 Notes on Installing and Upgrading to R R1.9 Deployments Deployments using a single host server Deployments using a single split server hosted on a Core server and an Edge server Deployments for scalability and resilience Upgrading to Release R Downgrading 27 4 Resolved Issues 28 Resolved in R Resolved in R Resolved in R V: Acano Server & VM R1.9.5 Release Notes 2

3 Resolved in R Resolved in R Resolved in R1.9.0 (formerly released as RC3) 33 5 Known Limitations 35 Figures: Figure 1: Permitted deployment for recording: remote mode 7 Figure 2: Permitted deployments for recording: multiple recorders 8 Figure 3: Permitted deployments for recording: Call Bridge cluster 8 Figure 4: Permitted deployment for testing or small deployments: local mode 9 Figure 5: Ports to open if using the TURN server in a Combined server deployment 16 Figure 6: Ports to open if using the TURN server in a Split server deployment V: Acano Server & VM R1.9.5 Release Notes 3

4 1 Introduction 1 Introduction This release note describes the new features, improvements and changes in release 1.9 of the Acano solution software for both Acano Server and virtualized deployments. Note: From 1.9.5, there is a change to the ports used by the TURN server, this is described in the New Features section. Note about beta features: This release contains features that are provided for beta testing only and not intended for a production environment. The beta features are: firewall traversal for SIP and Lync devices, XMPP resiliency, certificate based login from clients. Acano does not guarantee that a beta feature will become a fully supported feature in the future. Beta features are subject to change based on feedback, and functionality may change or be removed in the future Before upgrading to R1.9.5, you are advised to take a configuration backup using the backup snapshot <filename> command, and save the backup safely on a different device. See the MMP Command Reference document for full details. Note: If you experience issues with a SIP call then you may have configured a loop in your dial plan. Refer to the Troubleshooter for Acano Clients, WebRTC and SIP endpoints for advice on what to avoid, and typical symptoms indicating a configuration problem. The Troubleshooter also contains many other useful pieces of advice for troubleshooting issues in your deployment. Note: From release 1.8 the user rule max_failed_logins <attempts> MMP command has been added to configure the number of login attempts allowed before the 15 minute lockout. The Call Bridge must be restarted for this setting to take effect V: Acano Server & VM R1.9.5 Release Notes 4

5 2 New Features/Changes in R1.9 Release 1.9 comprises: support for recording meetings, recording including support for: standalone and remote recorders multiple simultaneous recordings customizable background images for SIP and Lync calls, further improvements to screen layouts for SIP endpoints, enhancement to TIP support, additional API parameters to allow meeting participants greater control over audio and presenting content, additional DTMF support, additional CDR records, from 1.9.5, the default configuration of the TURN server has changed. By default, the TURN server now listens on port 3478 for TCP communication from the Call Bridge, instead of port 443 as in previous releases. If you are using the TURN server in your deployment, then refer to Section 2.6 for further details. and a few miscellaneous improvements. In addition, the term cospaces has been renamed as spaces; the Web Admin interface of the Acano Server reflects this change. 2.1 Recording meetings Release 1.9 adds a new component: Recorder, to the Acano server. The Recorder component adds the capability of recording meetings and saving the recordings to a document storage such as a network file system (NFS). The Recorder should be hosted on an Acano server that is remote to the server hosting the Call Bridge, see Figure 1. If the Recorder is hosted on the same server as the Call Bridge (local), then it should only be used for testing purposes or for very small deployments. The recommended deployment for production usage of the Recorder is to run it on a dedicated VM with a minimum of 4 physical cores and 4GB. In such a deployment, the Recorder should support 2 recordings per physical core, so a maximum of 8 simultaneous recordings V: Acano Server & VM R1.9.5 Release Notes 5

6 Table 1: Recommended Core VM configurations for Recording Number of simultaneous recordings CPU configuration RAM configuration Example systems 40 Dual Intel E5-2680v2 32 GB (8x4GB) Cisco UCS C220 M3 Dell R620 HP DL380p Gen8 32 Dual Intel E5-2650v2 32 GB (8x4GB) Cisco UCS C220 M3 Dell R620 HP DL380p Gen8 20 Single Intel E5-2680v2 16 GB (4x4GB) Cisco UCS C220 M3 12 Single Intel E5-2640v2 8 GB (4x2GB) Cisco UCS C220 M3 In addition: All memory channels should be populated Dell R620 HP DL380p Gen8 Out-of band-management systems configured to share a network port must be disabled Where available, hyperthreading should be enabled on the host The host must be dedicated to the Acano VM If a VMWare hypervisor with EVC mode enabled is used, the EVC must be set to one of the following modes or higher: B1 /AMD Opteron Generation 4 L2 /Intel Nehalem generation (formerly Intel Xeon Core i7) EVC modes which enforce compatibility with older CPUs than those listed above, are not supported as they will disable SSE 4.2; SSE4.2 is required. For Hyper-V, the Processor Compatibility Mode MUST NOT be enabled as it disables CPU extensions, in addition SSE 4.2 is required. Where possible it is recommended that the Recorder is deployed in the same physical locality as the target file system to ensure low latency and high network bandwidth. It is expected that the NFS is located within a secure network. Note: Depending on the mechanism you use to store the recordings you will need to open firewall ports so that the recorder and storage system can communicate. For example: NFS running version 2 or 3 of the port mapper protocol uses TCP or UDP ports 2049 and V: Acano Server & VM R1.9.5 Release Notes 6

7 Figure 1: Permitted deployment for recording: remote mode The Recorder also supports redundant configurations, see Figure 2 and Figure 3. If you use multiple recorders then the solution load balances recordings between all recording devices and no knowledge of the physical location of recording devices is known. Every Call Bridge will use every Recorder V: Acano Server & VM R1.9.5 Release Notes 7

8 Figure 2: Permitted deployments for recording: multiple recorders Figure 3: Permitted deployments for recording: Call Bridge cluster V: Acano Server & VM R1.9.5 Release Notes 8

9 For testing purposes or for small deployments with only occasional usage of the Recorder, the Recorder can be co-located on the same server as the Call Bridge. This may support between 1 to 2 simultaneous recordings. Note: Acano X series servers used in the single combined deployment mode should only be used for testing the Recorder, they should not be used in production networks to host the Recorder. Figure 4: Permitted deployment for testing or small deployments: local mode V: Acano Server & VM R1.9.5 Release Notes 9

10 2.1.1 Overview of steps to configuring the Recorder Use MMP commands to enable the Recorder on an Acano server, specify which Call Bridges within the deployment will work with the Recorder and where to save the recordings. The additional MMP commands are given in Section Specify the HTTPS URL address that the Call Bridge will use to reach this recorder. Either POST the URL to the /recorders object or PUT to the /recorders/<recorder id> object. Use the new recordingmode parameter on the API object /callprofiles or /callprofiles/<call profile id> to select whether a meeting can be recorded or not. Options for this are: Automatic - recording occurs without any user intervention, if recording cannot occur the meeting still occurs. Manual - users can manually start and stop the recording using DTMF. Disabled - no users can record. Control which users have permission to start and stop recording by setting the recordingcontrolallowed parameter on calllegprofiles. Use the new startrecording and stoprecording parameters for /dtmfprofiles and /dtmfprofiles/<dtmf profile id> to map the DTMF tones for starting and stopping recording. Note: The additional API objects are given in Section 2.9. At the end of recording the meeting, the recording is automatically converted to MP4. The converted file is suitable for placing within a document storage/distribution system, for example a network file system (NFS). Recorder logs are stored in the NFS folder, spaces are stored in spaces/<space guid> and tenant spaces are stored in tenants/<tenant guid>/spaces/<space guid>. Note: For the first 5 seconds after recording is started, the call will not be recorded. This is intentional and is to aid lipsync between video and audio in the recording. If you record for less than 5 seconds a small file will be saved on the NFS, but it will not play back V: Acano Server & VM R1.9.5 Release Notes 10

11 2.1.2 Example of deploying recording Note: If you plan to save the recordings on a NFS server running Windows 2008 R2 SP1, there is a windows hotfix required to fix permission issues: Consult your Microsoft Windows Administrator before applying this fix. Note: The Recorder behaves as an XMPP client, so the XMPP server needs to be enabled on the Acano server hosting the Call Bridge. This example gives the steps to deploy a recorder remote to the Call Bridge. It assumes that you already have a working Call Bridge and XMPP server. 1. Create a certificate and private key for the Recorder, following the steps described in the Certificates guidelines for an internal CA signed certificate. 2. SSH into the MMP of the Acano server hosting the Recorder. 3. Configure the Recorder to listen on the interface(s) of your choice with the following command: recorder listen <interface[:port] whitelist> The Recorder can listen on multiple interfaces, e.g. one on public IP and one on the internal network. (However, it cannot listen on more than one port on the same interface.) The following is an example where interfaces are set to interface A and B, both using port recorder listen a:8443 b:8443 To use a local Recorder, the Recorder must listen on the loopback interface lo:8443, for example recorder listen lo:8443 b: Upload the certificate file, key file and certificate bundle to the MMP via SFTP. recorder certs <keyfile> <certificatefile> [<crt-bundle>] 5. Add the Call Bridge certificate to the Recorder trust store using the command: recorder trust <crt-bundle> 6. Specify the hostname or IP address of the NFS, and the directory on the NFS to store the recordings recorder nfs <hostname/ip>:<directory> Note: The Recorder does not authenticate to the NFS. 7. Use the recorder command to list the details for the recorder, for example: acano1> recorder V: Acano Server & VM R1.9.5 Release Notes 11

12 Enabled : true Interface whitelist : a:8443 b:8443 Key file : recorder0.key Certificate file : recorder0.cer CA Bundle file : recorder.crt Trust bundle : callbridge.crt NFS domain name : examplecompany_nfs NFS directory : /home/examplecompany/nfs 8. Enable the Recorder: recorder enable 9. Create DNS A record for the Recorder and set it to resolve to the IP Address of the Ethernet interface you want the Recorder to listen on. 10. Use the API of the Acano server hosting the Call Bridge to configure the settings through which the Call Bridge will communicate with the Recorder. a. Specify the HTTPS URL address that the Call Bridge will use to reach this recorder. Either POST the URL to the /recorders object or PUT to the /recorders/<recorder id> object Note: If using a local Recorder, the URL must be the loopback interface, for example b. Select whether a meeting can be recorded or not and whether the recording will start without any user intervention. Use the recordingmode parameter on the API object /callprofiles or /callprofiles/<call profile id> c. Control which users have permission to start and stop recording. Use the recordingcontrolallowed parameter on /calllegprofiles d. Use the startrecording and stoprecording parameters for /dtmfprofiles and /dtmfprofiles/<dtmf profile id> to map the DTMF tones for starting and stopping recording. For example: **7 to start and **8 to stop recording. 11. Remember to set the permissions on your NFS to rw and change the chown and chmod permissions on the directory. For example: sudo chown nobody:nogroup /record sudo chmod -R 777 /record Recorder licensing You will need an activation key for each Acano virtualized server, and one or more licenses for recording which is loaded on the Call Bridge server, not the Recorder V: Acano Server & VM R1.9.5 Release Notes 12

13 server. A recording license supports 1 concurrent recording. Contact your Acano sales representative to discuss your licensing requirements. 2.2 Customizable background images for SIP and Lync calls To enhance the pre-meeting experience for participants on SIP calls (including Lync), from release two additional background images for the callbrandingprofiles API method are supported. They are: passcode_background.jpg is a customizable screen that can be shown when a passcode needs to be entered. deactivated_background.jpg is a customizable screen which can be shown when awaiting activation, (waiting for host to join, meeting needs to be unlocked etc) Both files require similar image properties to background.jpg, that is, they need to be in.jpg format, less than 500kB in size and a maximum of 1920 pixels wide and 1200 pixels high. Images will be centered, scaled and padded to preserve their aspect ratio. Progressive JPEG is not supported. Copy the files to the same location on the web server as background.jpg. For more details of the customization procedure, refer to the Acano solution Customization Guidelines. Notes: the use of callbrandingprofiles requires a branding license, the new background images will not be utilized until cache memory has expired on your web server, and any calls utilizing call branding have completed, behaviour and choice of background image when in the IVR are not affected by this change to callbrandingprofiles. If these new image files are missing, then the background.jpg file (if present) will be used in place of passcode_background.jpg and deactivated_background.jpg. You do not need to load multiple copies of background.jpg, the single file will be used automatically to replace the missing images. If background.jpg is not present then the screen remains black. 2.3 Improvements in screen layouts for SIP endpoints Release 1.7 introduced a new "all equal" layout for SIP endpoints, where the layout is based on recent active speakers: V: Acano Server & VM R1.9.5 Release Notes 13

14 participants are shown in "big panes" when they become the active speaker, recent active speakers are shown in big panes, with other participants shown in a "dock" of smaller Picture in Picture (PiP) at the base of the screen, people move out of the "active speaker list" to the PiP bar after a period of inactivity (not speaking), the screen layout accommodates up to 4 "big panes" and 8 PiPs. From Release 1.9.0, the "all equal" layout is renamed "automatic", and the "all equal" layout reverts to the pre R1.7 arrangement, where the layout expands from a 4 person (2 x 2) view up to a 25 person (5 x 5) view, with all participants shown at equal size. To accomodate this change: an "automatic" type has been added to the defaultlayout parameter for /calllegprofiles and /cospace API objects and to layout, defaultlaout and chosenlayout parameter for /calls. an "automatic" option has been added to the Default layout pull down list on the Configuration>Spaces web page in the Web Admin interface. the layout cycling triggered by DTMF now includes both automatic and all equal; from R1.9.0 the sequence is speakeronly -> telepresence-> stacked -> all equal -> automatic (-> speakeronly ) 2.4 Enhancement to TIP support R1.9 introduces support for distributed TIP (Telepresence Interoperability Protocol) in clustered server deployments. From R1.9.0, the Acano Call Bridge can send multiple video streams from 3 camera TIP systems over cascade links and have them recombined to form a "room view" for display on the remote TIP system. This enhancement requires all servers involved in the call to be running release or later. R1.9 also introduces support for auxiliary audio for TIP (Telepresence Interoperability Protocol). From R1.9.0 the Acano Call Bridge will now process auxiliary audio input from a TIP system. Auxiliary audio can be from a presentation source or from an Audio Add-In participant. 2.5 Additional CDR records Started and stopped recording Release 1.9 introduces two new CDR records to indicate the start and ending of recording a call: V: Acano Server & VM R1.9.5 Release Notes 14

15 recordingstart This record is generated when recording starts on a call. The record contains the ID of the recording that is starting, the path where the recording will be stored (directory and filename), the URL of the recording device, the ID of the call that is being recorded and the ID of the call leg that is recording the call. recordingend This record is generated when the recording on a call is ended. It contains the ID of the recording that is ending Guest joining conference after waiting in lobby Prior to release 1.9 there was no mechanism to distinguish between the time spent by a guest participant waiting in the lobby for a conference to start, and the time they were in a conference seeing and sending media (video/audio/content). Release 1.9 introduces a new parameter deactivated to the CDR calllegupdate record. If deactivated is set to true it indicates that the conference is waiting for activation, deactivated is set to false when the Activator (host) joins the conference. 2.6 Changes to configuring the TURN server From version 1.9.5, the default configuration of the TURN server has changed. By default, the TURN server now listens on port 3478 for TCP communication from the Call Bridge, instead of port 443 as in previous releases. If you are using the TURN server in your deployment then: For combined deployments: after upgrading to 1.9.5, the TURN server must be configured to listen on the loopback interface. Ensure that the whitelist of interfaces to listen on contains at least one interface, and specify the loopback interface. Use the MMP command: turn listen <interface whitelist> For example: turn listen c lo Note: The loopback interface must not be the first interface in the whitelist. For split deployments: before upgrading to 1.9.5, you must open TCP port 3478 in the firewall separating the core and edge servers; UDP port 3478 should already be open. TCP port 3478 and UDP port 3478 are used in the event that ports are blocked by the internal firewall V: Acano Server & VM R1.9.5 Release Notes 15

16 Figure 5: Ports to open if using the TURN server in a Combined server deployment V: Acano Server & VM R1.9.5 Release Notes 16

17 Figure 6: Ports to open if using the TURN server in a Split server deployment 2.7 Miscellaneous changes and improvements Release 1.9 supports the following changes and new features: a new member is given the same calllegprofile permissions as the member that adds the new member additional controls over muting audio and presenting content for meeting participants, through the API, see Section 2.9.2, Section 2.9.3, Section improvements in dual homed conferencing. Chatting now works in: o o Lync/Skype for Business AVMCU conferences with Acano client users as well as in Acano spaces (this was supported in R1.8) direct calls between an Acano client and a Lync/Skype for Business client improvements to logging for failed login attempts: V: Acano Server & VM R1.9.5 Release Notes 17

18 o o the IP address of far end is included in existing event log messages relating to logins audit messages are generated for successful logins, unsuccessful logins (minus the user name) and log in session timeouts. improvements to the quality of main video and content to webrtc clients. added the ability to have the ciphers configured on the server to apply to both inbound as well as outbound TLS calls. ability to monitor the number of active database connections. A new syslog message will be generated every minute on each (database-enabled) server reporting the number of connections in use on the database master and its configured maximum number of connections (from release 1.9.3). cospace has been renamed as space, this is reflected in the Web Admin interface. 2.8 Summary of additional MMP commands Release 1.9 supports these additional MMP commands MMP commands for the Recorder Command/Examples recorder restart recorder recorder listen <a b c d lo none [:<port>] whitelist> recorder listen a b recorder listen none recorder (enable disable) recorder certs <keyfile-name> <crt filename> [<crt-bundle>] recorder certs none Description/Notes Restarts the Recorder Displays the current configuration of the Recorder Sets up the interface(s) and port(s) for the Recorder to listen on. You must enable the service to start listening with the command recorder enable. The default for the optional port argument is 443. Stops the Recorder listening. Enables or disables the Recorder Provides the name of the key file and.crt file for the Recorder and, optionally, a CA certificate bundle as provided by your CA Removes certificate configuration V: Acano Server & VM R1.9.5 Release Notes 18

19 Command/Examples recorder trust <crt-bundle crt-file> Description/Notes Controls which Call Bridge instances are allowed to connect to the Recorder. If the trusted Call Bridge is running on the same server as the Recorder, then issuing the recorder trust command with the name of the Call Bridge public certificate/certificate bundle is sufficient. If the Call Bridge is running on another server, the public certificate/certificate bundle of the Call Bridge must first be copied to the server with the enabled Recorder using SFTP. recorder trust none recorder nfs <hostname/ip>:<directory> Provides the Recorder with details of the network file server (nfs) and folder to save the recording. 2.9 Summary of API Additions & Changes API Additions for recording Note: You need to set up and enable a recorder through the MMP, prior to using the API to configure the recorder. New API objects for recording Use these API objects to specify the HTTPS URL address that the Call Bridge should use to reach an enabled recorder: /recorders /recorders/<recorder id> If you have enabled multiple recorders so that the list exceeds a single page, you can supply an offset and limit to retrieve recorders that are listed on subsequent pages. New error codes for recording The following error codes have been added to support the recording feature: recorderdoesnotexist - You tried to modify or remove a recorder using an ID that did not correspond to a valid recorder callrecordingcannotbemodified - You tried to start/stop recording a call that can't be modified V: Acano Server & VM R1.9.5 Release Notes 19

20 New /system/alarms for recording The following /system/alams have been added to support the recording feature: recorderunavailable - the Acano Call Bridge has not managed to successfully contact a configured recorder; the recorder is specified by the accompanying "recorder" GUID parameter recorderlowdiskspace - a recorder has limited disk space; the recorder is specified by the accompanying "recorder" GUID parameter New parameters and response elements on API objects for recording Parameters/ response element Type/ Value On API object Description/Notes recording recordingmode /calls and /calls/<call id> /callprofiles and /callprofiles/<call profile id> If true, this call is currently being recorded Controls how this cospace or ad hoc call can be recorded: disabled manual automatic disabled - call is not recorded manual - users can start/stop recording, this is the default automatic - call is automatically recorded and users cannot start/stop recording recordingcontrolallowed /calllegprofiles and /calllegprofiles/<call leg profile id> Determines whether call legs using this call leg profile are allowed to start/stop recording the call. startrecording stoprecording string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequences to be used by a participant to start and stop recording the active call Additional controls over muting audio New parameters and response elements on various API objects for controlling the muting of audio: V: Acano Server & VM R1.9.5 Release Notes 20

21 Parameters/ response element Type/ Value On API object Description/Notes allowallmuteself true false /calls and /calls/<call id> If true, participants have the permission to mute and unmute themselves. If false, this permission is dependent on muteselfallowed in the call leg profile. Default is false. allowallmuteselfallowed true false unset /calllegprofiles and /calllegprofiles/<call leg profile id> Determines if a participant using this calllegprofile is allowed to change the permission of all call legs to mute and unmute themselves in the call using DTMF allowallmuteself string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to allow all participants to mute and unmute themselves. This sets allowallmuteself in the call object to true. cancelallmuteself string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to cancel the permission to allow all participants to mute and unmute themselves.this sets allowallmuteself in the call object to false. joinaudiomuteoverride true false unset /calls and /calls/<call id> If true, new participants will be muted when joining the call. If false, new participants join unmuted. If unset, the mute value of new participants is determined by rxaudiomute in the calllegprofile changejoinaudiomuteoverrideallowed true false unset /calllegprofiles and /calllegprofiles/<call leg profile id> Determines if a participant can modify joinaudiomuteoverride in call object using DTMF V: Acano Server & VM R1.9.5 Release Notes 21

22 Parameters/ response element Type/ Value On API object Description/Notes muteallnewaudio string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to mute all new participants. This sets joinaudiomuteoverride in the call object to true. unmuteallnewaudio string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to unmute all new participants. This sets joinaudiomuteoverride in the call object to false. defaultmuteallnewaudio string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to use the audio mute value from the call leg profile for new participants. This unsets joinaudiomuteoverride in the call object. muteallnewandallexceptselfaudio string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to mute all new participants and all other participants in the call. This sets joinaudiomuteoverride in the call object to true and mutes all calllegs except for the issuer. It requires muteothersallowed to be true in the call leg profile of the issuer. unmuteallnewandallexceptselfaudio string /dtmfprofiles and /dtmfprofiles/<dtmf profile id> DTMF sequence to be used by a participant to unmute all new participants and all other participants in the call. This sets joinaudiomuteoverride in the call object to false and unmutes all calllegs except for the issuer. It requires muteothersallowed to be true in the call leg profile of the issuer Additional controls over presenting content New parameters and response elements on various API objects for controlling presenting content: V: Acano Server & VM R1.9.5 Release Notes 22

23 Parameters/ response element Type/ Value On API object Description/Notes allowallpresentationcontribution true false /calls and /calls/<call id> If true, participants have the permission to present. If false, this permission is dependent on 'presentationcontributionallowe d` in the calllegprofile. Default is false. allowallpresentationcontributionallowed true false unset /calllegprofiles and /calllegprofiles/<call leg profile id> Determines if a participant can modify allowallpresentationcontribution in call object using DTMF. allowallpresentationcontribution cancelallowallpresentationcontribu tion string string /dtmfprofiles and /dtmfprofiles/<dtm f profile id> /dtmfprofiles and /dtmfprofiles/<dtm f profile id> DTMF sequence to be used by a participant to allow all participants to present. Sets allowallpresentationcontribution in the call object to true. DTMF sequence to be used by a participant to cancel permission for all participants to present. Sets allowallpresentationcontribution in the call object to false Additional control of far end systems with DTMF sequences Parameters/ response element Type/ Value On API object Description/Notes dtmfsequence string calllegs and /calllegs/<call leg id> A sequence of DTMF key press commands to send to the far end either when the call leg initially connects, or during the call. In the supplied sequence, you can use the digits 0 to 9, * and #, as well as one or more comma characters (",") which add a pause between digits V: Acano Server & VM R1.9.5 Release Notes 23

24 3 Notes on Installing and Upgrading to R1.9 3 Notes on Installing and Upgrading to R1.9 This release note assumes that you have already upgraded to R1.8.x. If you have not, and are upgrading from R1.7.x, then read the R1.8 release notes first and follow the instructions, before following any instructions in this R1.9 release note. CAUTION: Before upgrading to R1.9 you must take a configuration backup using the backup snapshot <filename> command and save the backup safely on a different device. See the MMP Command Reference document for full details. 3.1 R1.9 Deployments R1.9 supports the new deployments introduced in R1.6: the single combined Acano server, the single split server and the deployment for scalability and resilience Deployments using a single host server If you are installing the Acano solution for the first time on a single host server (a combined deployment), we recommend that you read and follow the documentation in the following order: 1. Appropriate Installation Guide for your Acano Server or virtualized host. 2. The Single Combined Acano server Deployment Guide enabling all the solution components on the single host (. This guide refers to the Acano Certificate Guidelines for Single Combined Acano Server Deployments for details on obtaining and installing certificates for this deployment Deployments using a single split server hosted on a Core server and an Edge server If you are installing the Acano solution for the first time in a split server model, we recommend that you deploy the XMPP server on the Core server, and deploy the Load Balancer on the Edge server. Read and follow the documentation in the following order: 1. Appropriate Installation Guide for your Acano server or virtualized deployment 2. The Single Split Acano server Deployment Guide. This guide refers to the Acano Certificate Guidelines for Single Split Acano Server Deployments for details on obtaining and installing certificates for this deployment V: Acano Server & VM R1.9.5 Release Notes 24

25 3 Notes on Installing and Upgrading to R Deployments for scalability and resilience If you are installing the Acano solution for scalability and resilience using multiple host servers, we recommend that you deploy the XMPP server on Core servers, and deploy Load Balancers on the Edge server. Read and follow the documentation in the following order: 1. Appropriate Installation Guide for your Acano server or virtualized deployment 2. The Scalability and Resilience Deployment Guide. This guide refers to the Acano Certificate Guidelines for Scalable and Resilient Acano Server Deployments for details on obtaining and installing certificates for this deployment. 3.2 Upgrading to Release R1.9.5 The instructions in this section apply to both Acano server and virtualized deployments with a previous Acano server release already installed. CAUTION: Before upgrading to release 1.9 you must take a configuration backup using the backup snapshot <filename> command and save the backup safely on a different device. See the MMP Command Reference document for full details. Do NOT use the automatic backup file that is created during the upgrade process. Upgrading the firmware is a two-stage process: first, upload the upgraded firmware image; then issue the upgrade command. This restarts the Acano server: the restart process interrupts all active calls running on the Acano server; therefore, this stage should be done at a suitable time so as not to impact users or users should be warned in advance. To install the latest firmware on the Acano server follow these steps: 1. Obtain the upgrade image from the support section of the Acano website. You should have obtained a file called upgrade.img. If this is not the case rename the file to upgrade.img. Validate the download see this FAQ, the SHA-256 hash for the R1.9.5 releases are given in the table below: Type File Hash Serve r upgrade.im g 71de2ed3b0f0ae03cd2c9a76c7c43a a7fbabe7003b afad V: Acano Server & VM R1.9.5 Release Notes 25

26 3 Notes on Installing and Upgrading to R1.9 Type File Hash VM VM VM VM VM 4883aea8be95c30793bfc3459b1ad9d83c205a06ec085462a88a00878d6a630f /acanoservervhd/acanoserver.vhd upgrade.im g 313dab d68cc576f66f2666fcefc5c652a1311f988dccd45b2a57590a3 b55093af8e0aabb70d0be37286f2d3a0212a136dd28e f62d3b3bdc36 /acanoserverovf/acanoserverdisk1.vmdk /acanoserverovf/acanoserver.mf /acanoserverovf/acanoserver.ovf 7cee24da75bde5af8ba30d95fd47bf192fdc4f037ee7ac73b93e1f09d8e0458a 7fc30881c9fe40b7a32894bdb71ff4cb449c724d24ece31c455017f123d4b69b Note: If you are using WinSCP for the file transfer, ensure that the Transfer Settings option is binary not text. Using the incorrect setting results in the transferred file being slightly smaller than the original and this prevents successful upgrade. 2. Using a SFTP client, log into the MMP using its IP address. The login credentials will be the ones set for the MMP admin account. If you are using Windows, we recommend using the WinSCP tool. Note: a) You can find the IP address of the MMP s interface with the ipv4 admin command or the equivalent ipv6 command. b) The SFTP server runs on the standard port, 22. c) After copying the upgrade.img file, you will not be able to see it listed as being in the file system; this is normal. 3. Copy the software to the Acano Server/ virtualized server. 4. To apply the upgrade, issue the upgrade command V: Acano Server & VM R1.9.5 Release Notes 26

27 3 Notes on Installing and Upgrading to R1.9 a. Establish a SSH connection to the MMP and log in. b. Initiate the upgrade by executing the upgrade command. upgrade The Acano Server/ virtualized server restarts automatically: allow 10 minutes for the process to complete. 5. Verify that the Acano solution is running the upgraded image by re-establishing the SSH connection to the MMP and typing: version 6. Check the Configuration > Outbound Calls rules updating the Local Contact Domain field and completing the new Local From Domain field if necessary. 7. Update the customization archive file when available. 8. Only if you are deploying a scaled or resilient deployment (with more than one server host Acano server, virtualized host or a combination) read the Scalability & Resilience Deployment Guide and plan the rest of your deployment order and configuration. 9. If you have deployed a database cluster, be sure to run the database cluster upgrade schema command after upgrading the database schema. For instructions on upgrading the database schema refer to the Scalability & Resilience Deployment Guide. 10. You have completed the upgrade. 3.3 Downgrading To return to the older version of the Acano solution, use the regular upgrade procedure to upgrade to the appropriate version. Then restore the configuration backup for the older version, using the backup rollback <name> command. See the MMP Command Reference document for full details. Do not rely on the backup generated automatically during upgrade. Note: The backup rollback <name> command overwrites the existing configuration as well as the license.dat file and all certificates and private keys on the system, and reboots the Acano server. Therefore it should be used with caution. Make sure you copy your existing license.dat file and certificates beforehand because they will be overwritten during the backup rollback process. The.JSON file will not be overwritten and does not need to be re-uploaded V: Acano Server & VM R1.9.5 Release Notes 27

28 4 Resolved Issues 4 Resolved Issues Resolved in R1.9.5 Reference Issue Summary Typically, when an account expires the user is prompted to enter a new password on next login. This was not applying to the API access, where there was no mechanism to prompt for a password change CallLegUpdate and CallLegEnd CDR messages could stop being sent to a second CDR receiver When the API is in heavy use, responses to some queries could take over five seconds to complete. Fixed in 1.9.5; API access is prevented for expired users. If two CDR receivers are configured and one becomes inaccessible to the Acano server, CallLegUpdate and CallLegEnd CDR messages would cease being sent to the other. Fixed in Fixed in and In previous releases, the TURN server could sometimes listen on all interfaces rather than those it was explicitly configured to use. In some cases this led to some deployments working despite being incorrectly configured, and in other cases the TURN server not working at all. Fixed in Configuration changes to your TURN configuration may be necessary, see Section 2.6 for details of ports to open in the firewall The web bridge could crash when processing invalid XML in an XMPP message If Cisco Jabber in desk phone mode joins a conference where content is already being shared, the Acano Server will not send it any content video. Fixed in Fixed in V: Acano Server & VM R1.9.5 Release Notes 28

29 4 Resolved Issues Reference Issue Summary If a TURN server was deployed behind a NAT, it could return its private IP address instead of the public one as a media relay destination. This would cause media to fail for devices using TURN A crash could occur if an Acano Server received an instant message through a Lync conference from a Lync participant not in a call to that conference The Acano Server could crash due to a race condition between TLS allocation at thread creation and dlopen Media modules on the Acano server could crash. Fixed in Fixed in Fixed in Fixed in Resolved in R1.9.4 Reference Issue Summary 9294 In some situations after an LDAP sync, a newly created user would be unable to log in using Cisco Meeting App After restarting the H.323 Gateway, it would no longer accept any more calls When the API is in heavy use, responses to some queries could take over five seconds to complete No audio is heard in a twoparticipant, clustered AVMCU call Fixed in The H.323 Gateway was failing to start correctly due to a port conflict. Fixed in GET queries for /users/ and /users/<guid> were taking longer than necessary to resolve. Any query queued behind large numbers of /users/ or /users/<guid> GET requests could wait for over five seconds to be processed. Fixed in If two participants dial into an AVMCU conference through different CallBridges in a cluster, no audio will be heard until a third participant joins. Fixed in V: Acano Server & VM R1.9.5 Release Notes 29

30 4 Resolved Issues Reference Issue Summary The Acano server API does not allow passwords containing a colon character. Although a password containing a colon is allowed by the Web Admin interface and the MMP, the API rejected the password returning a 401 Unauthorized Error. Fixed in Resolved in R1.9.3 Reference Issue Summary The WebBridge could crash if it had an invalid or no TURN server configuration Sometimes after a network outage, users were failing to be instantiated, and then shortly after the Acano server would reboot Passcodes set on access methods are not working, when calls are placed through an IVR part of tenant group Audio from Single Screen SIP endpoints was being echoed back when on a call with a TIP 3-Screen System In a distributed TIP deployment, a new active speaker from a TIP room was not always being shown full screen The Web Bridge redirect was not consistently working correctly The Acano server log was filling with "mf report overflow general status" INFO messages Fixed in Fixed in If a passcode is set on an cospace access method and a call arrives via an IVR then the passcode is not recognised, when the IVR has a tenant which is part of a tenant group. Fixed in Fixed in Some improvements had been made in release The initial 8 characters were being stripped from some URL redirects. Fixed in This did not indicate anything sinister. Fixed in V: Acano Server & VM R1.9.5 Release Notes 30

31 4 Resolved Issues Reference Issue Summary The Acano server Web Bridge occasionally crashed during periods of network instability On a large cluster, it was possible to exceed the maximum number of database connections supported, which led to users being dropped for active calls or unable to join new calls The Acano server Web Bridge sometimes restarted when it attempted to use a TCP connection which had already been closed by the remote end. XMPP requests were not always being correctly terminated in cases where network connectivity failed for a server. Fixed in The maximum number of database connects has been increased from 100 to 500. In addition a new feature has been added so that the number of active database connections can be monitored (see miscellaneous features). Fixed in Fixed in Resolved in R1.9.2 Reference Issue Summary 9258 Multiple Web Bridge XSS vulnerabilities The Web Bridge could not interpret %20 as a space when supplied in the name field It was possible for a Lync user to share content before being activated by the host When the Acano Server was under load it failed to respond to API requests rather than respond 200OK to GET requests on callleg details. Multiple Web Bridge XSS vulnerabilities due to improper use of JQuerys html method leading to untrusted input being rendered as HTML This issue is reported as Security Alert 042. Fixed in Fixed in It was discovered that with calllegprofile set to "needsactivation" => true, and presentationcontributionallowed => true, a Lync user was able to send content (which is received by all guests) prior to the Space being activated by a host accessmethod. Fixed in The Server will now generate a "busy" (HTTP 503, "service unavailable") or "bad request" (HTTP 400) for these failures. Fixed in V: Acano Server & VM R1.9.5 Release Notes 31

32 4 Resolved Issues Reference Issue Summary Admin port unresponsive, experienced after upgrading from 1.8.x Occasionally during a dual homed call, the active speaker on the Lync side of the call doesn't show in the Active speaker pane on the SIP side Fixed in Fixed in Resolved in R1.9.1 Reference Issue Summary 9901 XMPP client connections drop WebRTC App connection drops when sharing content WebRTC client does not dial a slaved phone In the Contact list on the WebRTC App a contact s address was not shown Clicking the drop down from the "New call" page did not work on the WebRTC client The Acano Server uses ntp which was vulnerable to a Denial of Service attack Under certain conditions a network drop resulted in the Web Bridge leaking sessions Users of the native Acano App may see a 'lost connection to server' error message on their App UI and then lose the connection to the call they were in. Fixed in If the HTTP transmission between the browser and the Web Bridge failed, the WebRTC App would not retry, resulting in a dropped connection. Fixed in WebRTC client will dial directly to a phone, but not when the phone is slaved via the pull down menu next to the video symbol. Fixed in The contact s address wasn t shown on the WebRTC app if only one address was configured. If more than one was configured, the addresses could be seen by clicking the dropdown arrow. Fixed in Fixed in This issue is reported as Security Alert 050 and Fixed in When the XMPP connection between the Web Bridge and the XMPP server dropped because of a network event or protocol error, the session would not be returned to the pool. Fixed in V: Acano Server & VM R1.9.5 Release Notes 32

33 4 Resolved Issues Reference Issue Summary Core to SIP Edge connection failure when TLS SIP cipher added to the core. Note: SIP Edge is a beta feature In a clustered deployment the Acano Server Call Bridge could lock up and restart following an XMPP Server restart Fixed in Fixed in Resolved in R1.9.0 (formerly released as RC3) Reference Issue Summary 6157 Unknown Participant shown in Roster list and sharing 8837 Call button shown on guest caller in cospace 9574 Cisco DX80 endpoints can not receive or present content 9864 Calls were sometimes failing when an Acano Space was drag-anddropped into an existing Lync/Office365 conference A guest joining a Lync conference can cause the Call Bridge to crash Video from SIP endpoints was blurred and poor to S4B clients, but looked good on other SIP endpoints Join tones were being played before a new participant heard the welcome message Occasionally, an unknown participant was being shown in the roster list after a participant who was sharing left the conference and then later rejoined. Fixed in Fixed in Cisco DX80 endpoints which dialed into a space meeting rather than being paired with an Acano client, did not receive content and were unable to present content. Fixed in R The outbound call, via the sipedge, was failing with "'ERROR : problem adding connection...' in the syslog. Fixed in A guest using WebRTC joining a Lync conference as a second or subsequent participant on a Call Bridge, can cause the Call Bridge to crash. Participants that are drag-and-dropped, or join via direct dial or the IVR should not be affected. Fixed in Initially, the video looked good from SIP endpoints, but quickly became blurry and constantly refreshed. Fixed in This resulted in the joining tone playing some time before the new participant entered the space meeting, which could cause confusion for the users. Fixed in R V: Acano Server & VM R1.9.5 Release Notes 33

34 4 Resolved Issues Reference Issue Summary Echo was heard in space meetings with two or more three-screen TIP endpoints The Acano server failover was taking up to 20 minutes to complete In some Lync calls RTCP authentication/replay/cryptography failures were being logged every 10 seconds Changing the layout using DTMF only worked intermittently This was caused by not refreshing the main (center) rx audio configuration upon a change in the number of rx audio streams negotiated. Fixed in R There was an issue with TCP keepalives, it was possible that a network partition between the XMPP server and a callbridge would not have been detected for a number of minutes. Fixed in These messages were related to the RTCP for secondary streams that Lync sends. The log messages are not indicative of a problem and are suppressed in Issue in decryption prevented DTMF tones form being decrypted correctly. Fixed in R V: Acano Server & VM R1.9.5 Release Notes 34