Advanced Configuration

Transcription

1 Advanced Configuration 31 Mar 2019 TM and copyright Imagicle spa

2 Table of Contents Advanced Configuration...1/41 The Backup/Restore Tool...1/41 Basic Troubleshooting...5/41 Bitlocker Driver Encryption...7/41 Presence Service Configuration...13/41 Imagicle Presence Service Configuration...13/41 Configuration for Cisco Presence...18/41 Configuration for Microsoft Presence...21/41 High Availability...26/41 Introduction to HA Configuration...26/41 Creating a new Cluster...27/41 Cluster Management...33/41 Monitoring a Cluster...36/41 CuCM HA configuration for Imagicle Applications...39/41 Product Integration API...40/41 User Sync Integration API...40/41

3 Advanced Configuration The Backup/Restore Tool Imagicle AppSuite has an integrated tool which can be used to schedule backups towards a local folder or a network share. The backup includes the configuration and, optionally, the fax and the calls. With an AppSuite backup, you can: Easily recover the system, by reinstalling the package and restoring the backup Revert the system to a previous state, in case of wrong configuration Move the configuration to another server Backup procedure You can run the backup and restore tool by logging onto the Application Suite server and selecting this link form the start menu: "Programs"-> "Imagicle Application Suite" -> "Backup and Restore" This tool creates a copy of the configuration files (.INI,.XML), audio files, faxes, reports and database contents on a directory. Database contents include the user's list, Speedy contacts, and other application configuration. Those data will be copied on the target directory. All the application data will be copied at once. You cannot backup or restore the configuration of a single application. E.g. you cannot restore an old status of Stonefax while preserving SSAM configuration. Old SSAM status would be restored as well. Warning: special customized files received through technical support will NOT be stored. There is no need to stop Imagicle services during backup. Just click the Backup button. Advanced Configuration 1/41 Advanced Configuration

4 The destination can be a network folder: just enter the complete network path in the top textbox and ignore the drive selection below. If you enable the "Include call history" the backup will contain Imagicle Billing complete call history and QME statistics records. In detail: Calls, Discarded Call, Storicoxxxx.txt, BluesRecxxxx.txt Files. In this case the backup of the database could be larger than 2 Gb, and you need to select a NTFS drive as destination. Performing the backup will take a long time and the interface may freeze for a while. Just be patient and wait for the completion message. Diagnostic information on the progress of the backup is displayed on the right panel and it is also stored in this folder: c:\program files\stonevoiceas\var\log Backup versions Backups are forward - compatible. E.g. if you have the backup of a configuration, you will be able to restore it over a installation. Scheduled backups Backups can be easily scheduled by Windows' Task Scheduler, selecting a destination folder in "Scheduled backups" tab of the Backup/restore tool and entering this command line in the scheduled task "Run" field: "C:\Program Files\StonevoiceAS\System\BackupRestore.exe" /AUTO To achieve destination folder rotation, you can add the following constants in the path specified in the upper textbox: Advanced Configuration 2/41 The Backup/Restore Tool

5 $$FULLDATE$$: current date. E.g. ' ' $$MONTHDAY$$: day of month. E.g. '08' $$WEEKDAYINDEX$$: week day, where 1 is Monday. E.g. Wednesday = '3' $WEEKDAYNAME$$: name of the week day. E.g. 'tuesday' Restore Performing a restore is like making your applications return to a past status. Restore can be made for different purposes: crash recovery, application migration... The crash recovery procedure involves: Complete installation of the OS, prerequisites and package, as described in the Installation section of this guide Restore of an old configuration A new online license activation for each application (same license codes, new response string) The migration procedure involves: Clean installation of the OS, prerequisites and package on the destination machine Backup of the configuration source machine Restore on the destination machine A new online license activation for each application (same license codes, new response string) Please look for the detailed update procedures in the Package Update section. A backup may be taken even if the IAS services are running. On the contrary, the restore procedure requires that all the IAS engines are stopped. So click the "Stop all applications" button first. Should some service fail to stop, please stop it by the web interface. When this message appears you can go on with the restore: Advanced Configuration 3/41 The Backup/Restore Tool

6 Note: the Blue's Recorder service files (BluesRecxxxx.txt and Storicoxxxx.txt) will not be restored even if included in the backup. Database call tables will be restored if they were included in the backup. If they were not included, the Calls and Discarded Calls tables will be unaffected by the restore operation. Other backup options for Imagicle VAI If your system was deployed through Imagicle VAI, you could use a third party tool to backup the whole virtual machine on which Imagicle Application Suite is installed. Advanced Configuration 4/41 The Backup/Restore Tool

7 Basic Troubleshooting Log files The Application Suite modules record some or all their activity into plain text files known as log files. The content of the log files is mainly addressed to Imagicle technical support team or to the developers, but you can also find information about application configuration (or misconfiguration) which can be useful to the system administrator. Program internal errors are always logged. All the Application Suite modules generate log files in the same folder: C:\Program Files\StonevoiceAS\Var\Log Log collection Enable logs Collect logs 1. Login as Administrator in the SAS web interface 2. Go to Admin Support Logs 3. Place a flag on "Enable Diagnostic Logs" 4. Recreate the issue 1. Login as Administrator in the SAS web interface 2. Go to Admin Support Logs 3. Select "All" under "Download logs for application:" 4. Select the correct date when the issue has been recreated under "Download logs with date:" 5. Click on "Download" and provide us the file Event viewer If a Application Suite service raises an unhandled exception (i.e. crashes) the details are recorded in Windows Event Viewer. At the command prompt type: eventvwr.exe Check both the special IAS event viewer log and the standard Windows Application log. Warning: a failed fax will generate an error entry in the Application log. This is not an issue. A fax can fail for a number of reasons, including the destination number being busy or wrong. Advanced Configuration 5/41 Basic Troubleshooting

8 Advanced configuration through settings files Many details of the behaviour of Imagicle application are controlled by configuration files. As a general rule, you do not need to change them unless Imagicle Technical Supports instructs you to do so. After changing any setting, stop the affected service from the web interface, run "iisreset" from the command prompt, and restart the service form the web interface. You may change more than a parameter at once. Advanced Configuration 6/41 Basic Troubleshooting

9 Bitlocker Driver Encryption Introduction A secure computing environment would not be complete without consideration of encryption technology. This article describes how it is possible to encrypt Imagicle Application Suite server storage leveraging Microsoft BitLocker feature. BitLocker is Microsoft's encryption program that provides full-disk encryption of the hard drives. By utilizing the latest encryption algorithms and leveraging the power and efficiency of modern CPUs, the entire contents of the startup disk are encrypted, preventing unauthorized access to the data stored on the disk, save for those with either the login account to decrypt the disk, or those which possess the recovery key. By enabling BitLocker's whole-disk encryption, data is secured from prying eyes and all attempts to access this data physically or over the network will be met with either prompts to authenticate or error messages stating the data cannot be accessed even when attempting to access data backups, as BitLocker encrypts those too. Configuration Adding (virtual) floppy drive For the sake of simplicity, in this article the encryption key will be stored on the floppy drive. Make sure floppy resource is configured in your environemnt and, if not, follow the below steps to make it available into a Vsphere environment. Open VM properties and click on Add Advanced Configuration 7/41 Bitlocker Driver Encryption

10 Select floppy drive and click on next Advanced Configuration 8/41 Bitlocker Driver Encryption

11 In the next screens, first select "Create a blank floppy image", click on next and select datastore location where to save the floppy image. Make sure flag "Conncet at power on" is selected. Enabling Bitlocker Start the VM and enable Bitlocker feature, with Local Group Policy Editor (gpedit.msc) and navigate to "Require additional authentication at startup", as described in picture below. Select "Enable". Make sure the other options are as in picture below. Click on "Apply" and "OK". Close Local Group Policy Editor. Advanced Configuration 9/41 Bitlocker Driver Encryption

12 Select in the VM the created floppy drive and format it with default settings. Generating and saving the Encryption key From the VM that needs to be encrypted, open a CMD prompt window as admin and navigate to C:\windows\system32\ Run the command manage-bde.exe -on C: -rp -sk A: Advanced Configuration 10/41 Bitlocker Driver Encryption

13 This command generates a key (i.e XXXXXX), and saves it in the floppy drive.the floppy drive will provide the key at each boot, enabling the VM to properly boot. It is very important to save the geenrated key in case floppy becomes not available (i.e. damaged, unredable,...). Please copy it from the prompt windows to a text file and store securely, as it contains the key enabling boot. Check that Hard Drive is set to be first in order, reboot the VM and wait a few time until encryption process starts, as shown in picture below. Final recommandations Make sure the VM properties are configured as reported in the following picture; enabling the flag "Connect at power on" makes the floppy (with the key that will be installed into it in the next steps) available for booting. Make also sure VM boot order in the BIOS has hard Drive in frst place (prior to any other I/O devices) Advanced Configuration 11/41 Bitlocker Driver Encryption

14 Advanced Configuration 12/41 Bitlocker Driver Encryption

15 Presence Service Configuration Imagicle Presence Service Configuration The Presence feature allows you to view the presence status of other users belonging to your organization. If a presence server is available, this service offers rich presence status and telephony presence status of your pbx phones. The Presence feature is available for all pbx and presence servers that support SIP/Simple presence (SIP SUBSCRIBE/NOTIFY - RFC 3265, 4662, PIDF/XML - RFC 3863). Thanks to the Presence service you will be able to monitor the presence status of your colleagues in your Blue's Attendant Console, without the need of monitor all the phones via a CTI link. You'll also be able to monitor the rich presence status of your external contacts, when a suitable presence server is available. Directly from your Attendant Console you can monitor: Telephony status of internal contacts, knowing if they are busy in a call Rich presence status, knowing if they are available, not to be disturbed or just out for a while. I.e. Available, Away and Custom status messages, that the users can set in their client Imagicle applications can leverage the presence feature provided that appropriate configuration is made. See below. Imagicle Notes Imagicle Application Suite includes the Notes feature, that is an enhanced presence feature allowing to associate custom messages to an Application Suite user, directly from Imagicle Attendant client. This feature is useful to write a note on important information about a user, (e.g. if he is out of office for a long time or only for a day), saving time in trying to contact him. Notes are shared and aligned between all the Attendant users in real-time. The Imagicle Notes feature is does not need any additional configuration. Note: Imagicle Notes on HA deployment has limited functionality. The content of the note is displayed to operators registered to a different node only after the next search. Architecture Imagicle Presence can work in two reference architectures: With an IP-PBX, that supports SIP/Simple Presence interactions and No Presence Server With a Presence Server that supports SIP/Simple Presence interactions. Presence Server can be federated with an IP-PBX, this means that it will work as gateway for presence subscription requests coming from Presence Server and directed to IP-PBX, e.g. phone status requests Presence Service Configuration 13/41 Presence Service Configuration

16 Configuration As usual, the configuration steps involve user settings and service settings. User settings Telephony presence works thanks to the First extension number. Rich presence requires a Presence server and need a SIP URI. Without a presence server: you need to fill the First Extension number of the users, and you only get telephony presence status With a presence server: you need to fill both the First Extension number and the SIP URI fields of the users, and you get telephony presence plus rich presence status If you synchronize the users' list with an external source, such as the PBX or a LDAP server, you need to have the the SIP URI fields filled only if your architecture includes a presence server. If you get the presence status from the PBX, you can safely ignore the field. Service settings - Sip Simple configuration In order to configure Presence Service click on Admin -> Presence, Configuration tab. Here you have to enable the presence services (flagging the checkbox causes Imagicle SIP Connector presence service to start) and enter the server address and protocol. Without a presence server: enter the IP address or FQDN of the PBX With a presence server: enter the IP address or FQDN of the Presence server (federated with the PBX) Port and Protocol By default, a connection will be attempted from the Imagicle Presence Service to the PBX or Presence serve towards port If the PBX or the Presence Server listen for connections on a different port, just fill the Server Address field in the format ip:port. E.g :5070. As protocol to use, choose between UDP or TCP, depending on which protocol is supported by your presence server or IP-PBX. Credentials While is mandatory to fill all the Credentials fields (because Imagicle Presence Service needs a user for sending SIP requests), depending on your presence server or ip-pbx this user or extension can be dummy. Usually, if the SIP connection requires authentication these fields need to be filled accurately, in other cases (e.g. if there is the possibility to configure a trusted SIP trunk Presence Service Configuration 14/41 Imagicle Presence Service Configuration

17 between Presence Server or IP-PBX and Imagicle Application Suite) it's possible to fill the field with dummy values such as Imagicle Presence Service diagnostic will warn you about not existing credentials but you can safely ignore the warning. URI: this is the SIP address of the entity used for presence monitoring. With presence server: it could be an ad hoc created user or extension in the format E.g. Without presence server: you can set it as e.g. Auth ID: mandatory if your presence server requests authentication, in other case only set the first part of the URI field, e.g. imagicle.presence Password: mandatory if your presence server requests authentication, in other case leave empty Domain: With presence server: the domain of the presence server. E.g. IMAGICLE.COM Without presence server: the IP address or FQDN of the IP-PBX How to configure more than one presence server If you want to use more than one presence server at a time, and they are not federated, you must activate the connectors flagging the "enable" checkbox and configuring the parameters as described in the related sections. Then you must choose the priority server in the "Preferred Presence Server" dropdown list at the top of the page. When conflicting presence information for a user is reaching the Application Suite, the presence status supplied by the priority server will be displayed. Diagnostics This page is intended for service monitoring, and it could be useful after first configuration, to check Sip Connector Status and try to subscribe a user, making an exhaustive test on configuration. Note that page is not auto refreshing, so after user subscription it could be necessary to wait some seconds to obtain all the information. Use the reload button on the top of the table if the presence status has not changed after a while. Connector Status In the Diagnostics Tab you can check the status of the SIP Presence Connectors. Possible values are: Negative Positive Server Not configured: Service enabled but not yet configured, go to Configuration tab to complete the configuration Disabled: Service is disabled, go to Configuration tab to enable it Forbidden: Access denied, check the credentials entered and if your presence server is accessible by Imagicle Application Suite server ConnectionError: Presence Server is unreachable, this could be due to a network error or a wrong address configuration UpAndRunning (Successfully connected): Service is active, you can monitor presence Credentials entered not found: Service is active, credentials you entered has not been found, but this could not be a problem, you should be able to monitor presence Users list with presence status The following table contains the list of configured Imagicle Application Suite users and shows the following columns: User: username of Imagicle Application Suite user and user's Imagicle Note, if existing. Presence Service Configuration 15/41 Imagicle Presence Service Configuration

18 Rich Presence: rich presence status of the user and associated custom message. If the page shows a warning such as "User not configured or not enabled for this type of presence" this means that the user field sip uri has not been populated. Telephony Presence: telephony presence status of the user. In this field you can monitor the telephony status of a user. The information can come from the TAPI link or from the SIP Presence Connector, or both. In the case that both information are available, system gives priority to TAPI information. If the page shows a warning such as "User not configured or not enabled for this type of presence" this means that the user field "First extension number" has not been populated. Action: possible actions for the user. You can subscribe to a user presence if nobody has requested to subscribe it before. After one minute the subscription is automatically removed. Filters The diagnostic page lets you filter the user list by User, Rich Presence and Telephony Presence. This is the meaning of the Presence modes, as displayed for diagnosting, also available for filtering. Standard: Error: Service status: Notes: Available Busy Do not disturb Offline Forwarded to voice mail: when the user's phone is diverted to a user's voic number or to the voic pilot Forwarded to phone number: when the user's phone is diverted to any other number Access denied: there is no SIP access to presence server Error: there have been an error, it could be a temporary network down Not Found: presence server replied with a Not Found, so field in sip uri could be incorrect or not configured on presence server Not requested by anyone: there are no request for this user Requesting: request has been sent, but answer hasn't't arrived yet Server not configured: somebody requested the user presence, but Imagicle Presence Server has not been configured yet The DND status overrides the Forwarded status The Forwarded presence status overrides the Available and Occupied status. That is, when an IP phone is diverted, the status is always Forwarded regardless it is free or in busy. The TAPI details are always displayed The voic pilot is recognized by the IP telephony settings. If you are using a third party voic (e.g. Cisco Unity) you must enter it's pilot number in the Admin -> System Parameters -> IP Telephony Parameters web page. The users' voic number must be configured in the users list If you make changes to the users' voic numbers or to the voic pilot number, you have to restart the Presence Server to make IAS correctly evaluate the presence status Manage Services This page allows administrators to monitor the status of the Presence Services. There are two services involved in the Imagicle Presence feature: Imagicle Presence Server: the main service that collects and aggregates all the presence information and provides them to the services that need them. If this service is stopped, no Presence information as available. This service automatically starts the TAPI connector service Presence Service Configuration 16/41 Imagicle Presence Service Configuration

19 Imagicle Presence SIP/SIMPLE Connector: this service connects and gets presence information from the Presence server (or ip-pbx that supports SIP/Simple protocol). If this service is stopped, rich presence information won't be available. Configurations changes are immediately loaded by the services and, usually, there is no need to restart them. Specific issues can be fixed stopping and starting the services. E.g. if the SipSimple status in diagnostic page it's "Error" for all users, try restarting the Imagicle Presence SIP/SIMPLE Connector. Presence server configuration (SIP generic version) Create a trunk between Imagicle Application Suite and the Presence Server or IP-PBX. If this trunk requires SIP authentication, create an ad-hoc user and configure the Presence Service as described above. Presence Service Configuration 17/41 Imagicle Presence Service Configuration

20 Configuration for Cisco Presence With Cisco unified Presence Server Note: prior to configure Imagicle presence server, you must configure CuCM following the "Configuring Cisco Unified Communications Manager for Integration with Cisco Unified Presence" guide, available on Cisco web site, which is version dependant. Then you must configure Cisco Presence Server as described here. In this configuration, the Imagicle Presence Service connects to Cisco Presence Server. You must enter the Presence server Ip address in the Imagicle Presence Service configuration page. Open your Cisco Unified Presence Administrator web page, accessing as administrator, and go to the System->Security->Incoming ACL page. Add new Incoming ACL Entry. Presence Service Configuration 18/41 Configuration for Cisco Presence

21 Enter a Description and the IP Address of the Imagicle Application Suite. After saving the changes, Imagicle Presence Service it is ready to be used. Without Cisco unified Presence Server In this configuration, the Imagicle Presence Service connects to Cisco Unified CallManager. You must enter the Cisco unified CallManager Ip address in the Imagicle Presence Service configuration page. 1. SIP trunk security profile Define a new SIP trunk security profile named "Imagicle Presence Security Profile", with following settings different from the default values: Incoming Transport Type Outgoing Transport Type TCP + UDP UDP Incoming Port 5060 Enable Digest Authentication disabled Enable Application Authorization disabled Accept presence subscription Accept Out-of-Dialog REFER Accept Unsolicited Notification Accept Replaces Header 2. SIP trunk enabled disabled disabled disabled Define a new SIP trunk named "Imagicle_PRS_SIP_Trunk", with following settings (which are different from the default values): Device Information Call classification: Run On All Active Unified CM Nodes (CUCM 8.X and later): OnNet enabled Presence Service Configuration 19/41 Configuration for Cisco Presence

22 SIP Information Destination Address: Destination Port: 5064 SUBSCRIBE Calling Search Space SIP Trunk Security Profile: DND configuration IP address of the Imagicle server (IPv4) A CSS suitable to reach phones to monitor Imagicle Presence Security Profile With Imagicle Presence you can get notifications on DND telephony status. In order to enable this feature, log onto CuCM web interface and select: System-> Service Parameter -> Cisco CallManager Then set this parameter to true: BLF Status Depicts DND Troubleshooting If you experience problems showing user activities, such as "On-the-phone" or "In-a-meeting", open Cisco Unified Presence Server administration web page, go to CUPS -> Presence -> Settings and disable the following flags: Use DND status when user is on the phone Use DND status when user is in a meeting If presence notifications seems to be slow: check CallManager and Presence Server dns and ntp configuration. If there are dns resolutions or ntp misalignment issues, SIP transactions could timeout, bringing the presence status to error. Presence Service Configuration 20/41 Configuration for Cisco Presence

23 Configuration for Microsoft Presence Architecture Imagicle Presence Service connects directly to Microsoft Lync / SfB Frontend Service through Microsoft UCMA API. Requirements Imagicle presence service is compatibile with Microsoft Lync 2010 server and above (Skype for Business server). Connection to Microsoft Lync / SfB requires Windows Server 2008 R2 64 bit or better (32 bit not supported). Configuration Task List The main configuration steps are: 1. Choose the EndPoint type 2. Configure Microsoft Lync/Skype for Business Server 3. Configure Imagicle AppSuite Server 4. Configure Imagicle Presence Service Choose EndPoint Type An UCMA application can connect to Microsoft Lync / SfB in three different modes, that have different requirements. Here they are, ordered from the quicker to setup to the slower: User End Point without Secure TLS Connection User End Point with Secure TLS Connection Trusted Application End Point (manually provisioned) User End Point without Secure TLS Connection In this mode, Imagicle Presence Service impersonates a standard Microsoft Lync / SfB user to queries for other users' presence. Hence, a Microsoft Lync / SfB user is required to be created specifically. This mode doesn't require the Imagicle Application Suite to be been joined to the Microsoft Lync / SfB Server domain. This mode uses a non-secure SIP connection. User End Point with Secure TLS Connection It's like User End Point without Secure TLS Connection, except that a secure TLS SIP connection to Microsoft Lync / SfB Server is used. So you need to install a Web Server certificate from the network Certification Authority (see below). Trusted Application End Point (manually provisioned) Presence Service Configuration 21/41 Configuration for Microsoft Presence

24 In this mode, Imagicle Presence Service does not represent an individual user, hence it is not required to create a dedicated Microsoft Lync / SfB user. A secure TLS SIP connection to Microsoft Lync / SfB Server is used. You need to to install a Web Server certificate from the network Certification Authority (see below). On the other hand, it's mandatory to join the Imagicle Application Suite to the Microsoft Lync / SfB Server domain. Microsoft Lync / SfB Configuration User End Point without Secure TLS Connection The configuration task list is: 1. Create an ad-hoc user on Active Directory 2. Enable user on Microsoft Lync / SfB Server 3. Enable non secure standard SIP port on Microsoft Lync / SfB Server: On a Microsoft Lync / SfB Server node, open "Lync / SfB Server Management Shell" and execute the command: Set-CsRegistrar "registrar:fqdn-registrar.domain" -SipServerTcpPort Ensure that port 5060 of Microsoft Lync / SfB Front End Server is reachable via TCP from the Imagicle Application Suite server User End Point with Secure TLS Connection The configuration task list is: 1. Create a dedicated user on Active Directory 2. Enable the user on Microsoft Lync / SfB Server Application End Point (manually provisioned) A trusted application requires an entry in the Microsoft Lync / SfB Server topology document that specifies the computers on which the application runs. The main steps to configure Microsoft Lync / SfB Server are: 1. Create a Trusted Application Pool for Imagicle Server 2. Create a Trusted Application for Imagicle Presence Service 3. Enable modification to the topology On a Microsoft Lync / SfB Server node open the "Lync / SfB Server Management Shell" and execute all commands explained in this section. Create a Trusted Application Pool for Imagicle Server First of all, the Imagicle Server must be configured as a Trusted Application Pool server within Microsoft Lync / SfB topology. You can skip this step if you have already configured a Trusted Application Pool to activate Queue Manager Enteprise integration. To check whether a Trusted Application Pool already exists for Imagicle server, execute command: Get-CsTrustedApplicationPool -Identity fqdn-imagicleapplicationserver If you get an error, the Trusted Application Pool does not exist. You can create it executing the following command (pay attention to adjust the FQDN of Front End node): New-CsTrustedApplicationPool -Identity fqdn-imagicleapplicationserver -Site site-imagicleapplicationserver -registrar Create a Trusted Application for Imagicle Presence Service Presence Service Configuration 22/41 Configuration for Microsoft Presence

25 To configure Imaigcle Presence Service as a Trusted Application within Microsoft Lync / SfB, execute the following command: New-CSTrustedApplication -ApplicationId ImagicleLyncConnector -TrustedApplicationPoolFqdn fqdn-imagicleapplicationser This will return a result similar to: Identity: fqdn-imagicleapplicationserver/urn:application:imagiclelyncconnector ComputerGruus: {fqdn-imagicleapplicationserver sip:fqdn-imagicleapplicationserver@youtdomain..uu;opaque=srvr:imagicle ServiceGruu: sip:fqdn-imagicleapplicationserver@yourdomain..uu;opaque=srvr:imagiclelyncconnector:atifa-vpofo2x9rrbueo Protocol: Mtls ApplicationId: urn:application:imagiclelyncconnector TrustedApplicationPoolFqdn: fqdn-imagicleapplicationserver Port: LegacyApplicationName: imagiclelyncconnector Copy the ServiceGruu paste into a temporary text file - this will be required later, in step "Presence Service Configuration". Enable modification to the topology To apply all above modifications, execute command: Enable-CsTopology Imagicle Server Configuration Imagicle server needs to be configured once, through these steps: 1. Instal UCMA Runtime Join Active Directory Domain (only when using Trusted Application End Point) 3. Install Web server Certificate (only when using a secure SIP connection) Install UCMA Runtime 3.0 Imagicle Presence Service with Microsoft Lync / SfB integration needs Microsoft UCMA version 3.0 runtime to run. You must download it from and install it on Imagicle Application Server. Note: Microsoft UCMA version 3.0 is compatible with Microsoft Lync 2010, 2013 and SfB Note: while Presence integration requires UCMA 3.0, QME integration with Microsoft Lync / SfB requires UCMA 4.0, that does not replace UCMA 3.0. So, if you plan to use both QME and Presence, you have to install first UCMA 4.0 Runtime, then UCMA 3.0 Runtime. Join Active Directory Domain If you have planned to configure Presence integration as Trusted Application End Point, Imagicle Server must be joined to the Microsoft Lync / SfB Server domain. Install a Web server Certificate If you have planned to configure Presence integration to use secure connection to Microsoft Lync / SfB Front End Server (i.e. if you have choosed either User End Point with Secure TLS or Trusted Application), you have to get a Web Server certificate from the network Certification Authority and install it as a computer certificate on the Application Suite server. Certificate enrollment Presence Service Configuration 23/41 Configuration for Microsoft Presence

26 1. Log in to the Imagicle Application Server as an administrator with permission to Enroll for a Web Server Certificate (e.g. a Domain Administrator).. 2. Click the Start button, then Run, type cmd.exe, right click over Command Prompt and click on Run as administrator 3. In the Command prompt shell, type mmc.exe. 4. Open the File menu and select Add/Remove snap-in. 5. In the Add or Remove Snap-ins window, select Certificates, and click Add. 6. Choose Computer Account, and click Next. 7. Choose Local Computer, and then Finish. 8. Click OK on the Add or Remove Snap-ins window. 9. Expand Certificates. 10. Expand Trusted Root Certification Authorities and click Certificates. Make sure the root certificate is present for the Enterprise Certificate Authority in the domain. 11. Right-click Personal and select All Tasks, then Request New Certificate. 12. Click Next. 13. If prompted to select a Certificate Enrollment Policy, select one under the category of Configured by your administrator. Click Next. 14. Select Web Server (If Web server is unavailable see the WebServer certificate section), and click the link for More information is required to enroll for this certificate. Click here to configure settings. 15. Click the Subject tab. 16. For Microsoft Lync Server 2010/2013/SfB: 1. Under the Subject Name section, change the Type to Common Name, and change the Value of the Fully Qualified Domain Name of the Microsoft Lync / SfB Server Pool (e.g. sfb.mydomain.com), and then click Add. 2. Under the Alternative Name Section, change the Type to DNS, and change the Value to the Fully Qualified Domain Name of the Microsoft Lync / SfB Server Pool (e.g. sfb.mydomain.com), and then click Add. 3. Again, under the Alternative Name Section, leave the Type specified as DNS, and change the Value to the Fully Qualified Domain Name of the server hosting the Imagicle Application Suite (e.g. ias.mydomain.com). 4. Click Add. 17. Click the General tab. 18. Type OCSConnector for the Friendly Name, then click Apply, and OK. 19. On the Certificate Enrollment window, click Enroll. 20. Verify that the STATUS is Succeeded, and click Finish. WebServer certificate If there is no available WebServer certificate, you have to create it. 1. On the CA computer, click Start, type certtmpl.msc, and then press ENTER. 2. In the contents pane, right-click the Web Server template, and then click Properties. 3. Click the Security tab, and then click Add. 4. Click Object Types 5. Flag Computers checkbox 6. In Enter the object names to select, type the name of Imagicle Application Suite Server, and then click OK. 7. In Permissions, click Enroll under Allow, and then click OK. Imagicle Presence Service Configuration Please configure the users properties as described in the Imagicle Presence Service configuration section of this guide. Login into Imagicle Application Suite web portal with global administrative privilege. Go to Administration, Presence web page, select Configuration tab and then: Enable rich presence services (Microsoft Lync / SfB based) by flagging the checkbox Select the End Point of your choiche User End Point Configuration Fill all the following fields: Presence Service Configuration 24/41 Configuration for Microsoft Presence

27 Credentials Microsoft Lync / SfB Server Address: FQDN of Microsoft Lync / SfB Front End server Use TLS: flag if connection with Microsoft Lync / SfB Server is Secure SIP (needs a valid certificate released by the network Authority - see above) Fill the following fields with credentials of the ad-hoc created user (see paragraph "Microsoft Lync /SfB Configuration - User End Point"): Username: enter the username of the ad hoc created monitoring user URI: enter the sip address of the ad hoc created user, in the format user@mydomain.com. E.g. imagicle.presence@imagicle.com Password: enter the password of the ad hoc created monitoring user Domain: enter the domain of the presence server e.g. IMAGICLE.COM Application End Point Configuration Microsoft Lync / SfB Server Address: enter FQDN of Microsoft Lync / SfB Front End server Application Contact URI: enter an existing Lync / SfB SIP URI (e.g. Lync / SfB_administrator@yourdomain.com) Application Gruu: enter the ServiceGruu value returned by New-CSTrustedApplication command Certificate Name: enter the Friendly Name of the certificate installed on Imagicle server Application Host: check that matches value used for Identity parameter in New-CsTrustedApplicationPool command Application Port: check that matches the Port value returned by New-CSTrustedApplication command Presence Service Configuration 25/41 Configuration for Microsoft Presence

28 High Availability Introduction to HA Configuration An Application Suite cluster is a set of two or more IAS installations (cluster nodes) that have been configured to work together in order to grant continued service even when some of them fail. Each node in the cluster synchronises its data with another one. In a normal situation the information tend to be exchanged in a ring to ensure that every node is updated as soon as possible. If one of the nodes fails, the data synchronization service can detect it and automatically bypass it by changing its topology without any administrative intervention. In the same way, when the failed node is restored, the cluster will reintegrate it automatically. This section of the Administrator Guide explains how to create, manage and monitor an Application Suite Cluster to provide high availability. High Availability 26/41 High Availability

29 Creating a new Cluster Before starting Before creating a new cluster or joining a node to an existing cluster, keep in mind the following restrictions: It's strongly suggested to configure all Application Suite nodes to send notifications Ensure that all Application Suite nodes clocks are up-to-date and synchronized All nodes in the same cluster must have the same Application Suite version. If they are not, upgrade them to the latest AppSuite version before creating the cluster It's highly recommended that all nodes use the same SQL server version At the beginning, all nodes in the cluster will get the configuration and data from the first node. A node that joins an existing cluster will completely loose both its configuration and data. So, choose carefully the first node that will be used to create a cluster. Joining a node to a cluster requires to stop all applications on that node. Once added, a server restart of all other nodes is required, too. If even one single node is connected to an external SQL Server, then "shared db" strategy must be chosen when creating a cluster Network considerations TCP port will be allocated to the communication between the nodes A set of TCP ports above are used for data synchronization between the nodes (the number of ports depends on the number of nodes) Creating a new cluster Before creating an Application Suite cluster you have to choose the node that will be used as the first source of data (i.e. the node that contains the data that will be shared in the cluster). Notice that this is a critical decision, since all the data in the other nodes will be lost. Also, before continuing, ensure that the node is already configured to use the desired database server (you can check this through the Support web page). Once you've chosen the node, log in as administrator in that node's Application Suite web interface and click on Admin -> High Availability. You will be asked to choose whether you want to create a new cluster or to add this node to an existing cluster. High Availability 27/41 Creating a new Cluster

30 On the first node choose New Cluster and click Next. In the next page you will have to choose one of the IP addresses of the machine. This will be the address used by the other nodes of the cluster to communicate with this node. You will also have to specify if every node will use its own database instance (Replicated Database) and the cluster will need to synchronise data between all of them, or if the cluster will use a single database instance (Shared Database). High Availability 28/41 Creating a new Cluster

31 If you choose to use multiple database instances, it's highly recommended that all of them have the same SQL Server version. This is the only one available option when at least an Application Suite node is connected to an external SQL Server. Once you've made your choices, click Next. If you confirm your choices, the cluster creation procedure will begin and it may take a long time. While the cluster is being prepared, all the applications will keep running as usual. As soon as the operation completes, if the cluster has been created successfully, the local node will send a success notification. If the creation fails, it will send a failure notification. From now on, every time you'll open this web page, you'll se the list of all the nodes in the cluster. Of course, when the cluster is prepared it contains just the local node. Other nodes will appear when they'll be added. High Availability 29/41 Creating a new Cluster

32 Adding a node to an existing cluster Warning: when you add a node to a cluster you will lose all the data that is on that node. Before you try to add a node to a cluster, ensure that: The new node has the same Application Suite version of the other nodes in the cluster, otherwise you won't be able to complete the procedure The node is already configured to use the desired database server (you can check this through Support web page) If the cluster is using the Replicated Database strategy, there's enough free disk space on the machine to contain at least twice the size of the database of a node that already belongs to the cluster. You should notice also that during this procedure all the applications of the Suite will be stopped and unavailable on this node. To add a node to a cluster, log in as administrator in that node's Application Suite and click on Admin -> High Availability. High Availability 30/41 Creating a new Cluster

33 Choose Add to existing Cluster and click Next. On the next page you will have to choose one of the IP addresses of the machine. This will be the address used by the other nodes of the cluster to communicate with this node. Then you must enter the IP address of an existing node (chosen from the displayed nodes list) of the cluster you want to join. That node must remain up and running until the end of this procedure. When you click Next and confirm your choices, the node addition procedure will start. It may take a long time, depending on the amount of data contained at that moment in the cluster (this procedure will automatically create a SQL backup of source node's database, download and restore it to the node to be added). As a coarse idea, the first node that joins an existing cluster could take 16 minutes per GB of database size. Nodes that join later, could take 3 minutes per GB. High Availability 31/41 Creating a new Cluster

34 When the procedure is complete, the node will send a success notification, but if the addition fails it will send a failure notification. From now on, this page will show the list of all the nodes in the cluster (including the node that you just added). Now, in order to propagate the topology change to all the other nodes, you should restart them one by one. Known limitations There are some actions an administrator won't be able to do on a cluster: Before Application Suite 2015 Summer edition, you can't remove a node from a cluster. Once a node is part of a cluster, you can't change its IP Address. You can't rename a cluster node (i.e. change its Node ID or NetBios Computer Name). You can't restore a IAS backup to a cluster node: data integrity is granted by the cluster itself. For any problem regarding one of the activities above, you'll need to contact Imagicle technical support. High Availability 32/41 Creating a new Cluster

35 Cluster Management Upgrading a cluster node When you upgrade a cluster node to a newer Application Suite version, if needed, the setup procedure will automatically reinitialise the cluster configuration on that node. You won't need to do any other action on it. Note that you can upgrade the cluster nodes one by one, so the cluster availability won't suffer any disruption during the upgrade. This operation may take a while (though not much more than an usual Application Suite upgrade on a standalone machine) but, when complete, the setup program will continue and finish the installation as usual. Upgrading to IAS 2017 Winter Edition When upgrading existing IAS cluster from a release older than Winter 2017 to a newer one, there is an additional requirement. The master node must be upgraded before any other node of the cluster. Besides, the master node must be up and reachable along the upgrade process of a slave node. The setup will warn you if you try to upgrade a slave node without having upgraded the master node first. This requirement applies only once, i.e. only when upgrading existing IAS cluster from a release older than Winter 2017 to a newer one. On subsequent upgrades, you can upgrade slave nodes before the master. Backup of a cluster To backup the configuration and/or historical data of an Imagicle Cluster, just perform a standard Application Suite backup (using the IAS dediceted backup tool) on one node of the cluster. Since data and configuration are shared and syncronized between them, it is enough to backup one node. Restoring a cluster The Application Suite's standard restore procedure on a node belonging to a cluster causes that node to exit the cluster. So, the procedure to restore a previous status (configuration and historical data) of a cluster, given an Application Suite's backup, requires to: 1. Restore an Application Suite's backup on a node (the node will from exit the cluster) 2. Re-create the whole cluster starting from that node, that is, using that machine as first node Detailed steps: 1. Choose a node of the cluster to be the new cluster's first node (N) 2. On node N: 1. restore the Application Suite's backup B1 2. generate a new backup, B2, excluding historical data 3. restart the machine 4. follow the standard cluster creation procedure (see above) 3. On all other nodes (except N): 1. restore the Application Suite's backup B2 2. restart the machine 3. follow the node addition wizard, using N as the node to join to Removing a node from the cluster To remove a node from an existing cluster, use the following procedure. High Availability 33/41 Cluster Management

36 1. Upgrade all the cluster nodes to AppSuite 2015 Summer build 3 or later 2. Stop "Imagicle Replication Service" on all nodes 3. On the node you want to remove, run the following program: %IASROOT%\Apps\Replication\Component\Assembly\Replication.NodeRemovalTool.exe On the tool user interface, choose the local node. 4. Run the same tool on all the remaining cluster nodes. On the tool user interface, choose the IP of the node you removed. High Availability 34/41 Cluster Management

37 For any problem regarding one of the activities above, you'll need to contact Imagicle technical support. High Availability 35/41 Cluster Management

38 Monitoring a Cluster Alarms The operation of the replication service can be monitored by the administrator of the cluster through the status of the following alarms visible in the specific section: Synchronisation Readiness: represents whether local node is ready to synchronise its data. A node could be not ready to synchronise if, during its addition to the cluster or during the last update, it couldn't complete the [re]initialisation ([re]provisioning) procedure. In this case the only way to restore its operation is to run the IAS setup package again, which will complete the initialisation of the node. Synchronisation Activity: represents the status of synchronisation operations in the local node. If a node is not ready to synchronise, this alarm isn't evaluated as it would be meaningless. Otherwise, it shows if the node is synchronising with the expected remote node (green), with a different node (yellow), or with no other node at all (red). Time Alignment: shows whether local node and its expected remote node have the same time configuration, and their system time is the same. All the nodes times must be aligned in order to allow the cluster to work correctly. If local and remote times are aligned the alarm will be green, otherwise it will be red. Event notifications While the Replication Service is running, some events are notified to the cluster administrator to let him identify any potential issue. Readiness events When a node is not ready to synchronise its data, it reports the problem with a sync not ready notification that contains the problem that prevents its readiness. When that problem is solved, the node notifies that it's back to normal with a sync ready notification. Synchronisation events In normal conditions any cluster node will synchronise with its successor in the cluster topology. No notification is reported until any event changes this situation. High Availability 36/41 Monitoring a Cluster

39 If local node fails the synchronisation with its successor, a failure notification is sent. Then the node tries to synchronize with the other nodes of the cluster and, if successful, it sends a failover notification. In this situation the remote node used for the synchronisation will not change unless a new failure occurs. A new failure notification is sent for each synchronisation failure with a remote node, and it will report the failure reason. A new failover notification is sent for each successful remote node change. High Availability 37/41 Monitoring a Cluster

40 If local node fails to synchronise with every other node in the cluster, it sends a no available node notification. After any failure, local node tries periodically to synchronise with its successor and, whenever it succeeds, it sends a failback notification to signal that its normal behaviour has been restored. Time alignment events When time difference between a node and its successor is too high (i.e. over 15 seconds), data replication is inhibited to prevent unexpected behaviours, and a time not aligned notification is sent. A time aligned notification will then signal when time difference is back to normal. High Availability 38/41 Monitoring a Cluster