using ASA and OCS video conferencing server

During my attendance of OCS ignite tour training and some other OCS events, we have been informed that OCS edge video servers cannot be located behind a NAT device e.g. firewall, this is due to the fact the Video conferencing doesn’t work correctly with NATing, so the design was saying give the Edge NIC a real IP and place it directly on the internet.

I have been working a while with ASA and I have tested my configuration, you don’t need a NAT device in ASA (5520,5540) V7 or V8 (this is my testing so results could be true), the edge server could have a real IP on its NIC, and placed in the DMZ for example, in this case the ASA will filter the packets only as a firewall and will not do Natting, creating a DMZ for the edge server might be a hustle but this is not the case if you created sub interfaces.

This might be a tricky discussion when talking to Microsoft partner or consultant since this is not the case of ISA 2006, but you can do the above configuration safely on your ASA.

I am thinking about creating routing rule between the DMZ in ISA server and the internal/external network but I didn’t have the chance to test it, so this might do the trick instead of placing your video edge server naked in the desert.

fast tip for controlling OCS bandwidth

Here is a fast one, you can use a client policy to control the total bandwidth of OCS and livemeeting traffic using the following registry keys:

— HKLM\software\policies\Microsoft\LiveMeeting\MaxAudioVideoBitrate

— HKLM\software\policies\Microsoft\Communicator\MaxAudioVideoBitrate

SSL redirection in NLB configuraiton for CAS servers in windows 2008

Situation:

We have two CAS Servers as NLB cluster on Windows 2008

CAS1.contoso.internal

CAS2.contoso.internal

NLB has A Record in DNS: mail.contoso.com

OWA access works with https://cas1/exchange or https://cas1/owa or https://cas2/exchange or https://cas2/owa

To redirect incoming https://mail.contoso.com to one of the CAS Servers It’s a little different with IIS7.

· You need to go into inetmgr

· Select the default website

· Go to HTTP-Redirection

· Select first option and type only /exchange (or /owa)

· Then select 3^rd option

· Save and close Inetmgr

(Sorry, only German Screenshot available)

HTTPS Redirection is similar

· Create SSLRedirect.htm according to below Technet Article and save to C:\inetpub\wwwroot

· Open intetmgr

· Select the default website

· Go to Error codes

· Add new Entry with Error code 403.4 (note the period instead of the semicolon mentioned in article)

· Save and close inetmgr

Note:

Double-check the HTTPS redirection URL in your SSLRedirect.htm. The article says https://%3cservername%3e/exchange .

But if you simplified the URL already according to the above settings you need to remove /exchange from the redirection URL here. (e.g.: https://server23 instead of https://server23/exchange )

notes from the field configuraing and installing OCS and MP114

Here is a nice tips for MP114 configuration for a customer of mone I did OCS implementation for him:

OCS is installed in Site1, MP114 installed in site2.

This decision was taken to test the functionality of MP-114 across multiple sites, then MP-114 will be moved to Site1.

Configuring the OCS consists of the following steps:

- Install Mediation server.

- Configure the mediation server and add MP-114 as PSTN GW.

- Configure default location profile, normalization rules for all of BMW sites, external call, mobile calls.

- Enable users for enterprise voice:

o Add telephone number, mobile number and work number in user's properties in AD in E.164 format (+XXXXX)

o Enable PBX integration and add the Tel: URI

§ Currently each user has to have separate extension for phone numbers and OCS number (to call the user fro phone to communicator), this is because dual forking is not currently available (simultaneous ringing on phone and OC), this will be available in the second quarter of 2008, for example to dial user x on phone call from OC he has to have extension 14000 (which is configured in the Tel: URI) and to call him from OC to phone he has extension 4000 (which is configured in the phone properties.

o Synchronize the Database with the new numbers:

§ C:\Program Files\Microsoft Office Communications Server 2007\Server\Core>ABServer.exe –regenUR to Synchronize the users from AD to OCS DB.

§ C:\Program Files\Microsoft Office Communications Server 2007\Server\Core>ABServer.exe –synchnow to Synchronize the address book with the users DB.

o Configure the MP-114

§ The current PBX (HIPATH 5000) doesn't understand the phone numbers in E.164 format, when we dial 4000 the normalization rule translate the number to +4000 format, this number is not understandable by the PBX, we use the protocol management > manipulation Table in the MP-114 GW to manipulate the destination number to remove the + (by stripping 2 numbers and adding the dial plan identifier) (attached the INI file for final MP-114 configuration).

o Test the calls from OC to PSTN, PBX.

o Calls are successfully done in local sites, across the sites (OC > GW > Local PBX > remote Site PBX), and thus we need single GW and single Mediation server for the implementation.

The sum of all of really silly OCS questions

I had those silly OCS questions, asked some good folks and have them answered so you might want to take a look on them:

• In web conferencing, I know that the conferencing server has a built-in load balancing functionality, so if we have a pool of servers and new conference will start, the least loaded server will be selected to host the conference, now suppose that a user 1 scheduled a conference in a pool with 3 conf. server. Server 1 is elected to host the conference. Within the conference user 8 and user 9 wanted to join the conference but server1 became loaded so what exactly will happen, user 9 and user 8 will be hosted on server2, or will not be able to join the conf?.

All Conference states and information are on the focus which is in the SQL Data Base… So even if user 1 is on Server 1 the conference info and state are in SQL… So when users 8,9 connects to Servers 2 and 3 no problems…

• In the VOIP when a user forward a call to his mobile, how is the caller/receiver are charged? User1 called user2 and he forwarded the call to his mobile. So user1 will be charged on that as mobile call, does user’s 2 phone system get charged for the call forward?

User 1 calls User 2 (Users 2 pay for costs for calling initial User 1 number)… Users 2 decided to forward to his mobile from system… System of User 2 will pay costs to call User 2 mobile number… User 2 happened to be roaming and kidding around then User 2 pays roaming bills… Think of it as separate phone calls each paying the cost of his decision…

• In the OCS planning examples I found a note that indicates that in the OCS topology only 1 edge server in the OCS topology should serve the external IM access even for multiple pools. Doesn’t seems logic for me why I cannot have multiple edge server for each site and users configured the FQDN for the edge serve and login using edge server in their site.

Because you could only have one FQDN with the name (SIP.company.com) and this is what is initially supported and tested… The main Access edge server has to also be the destination of the FQDN (Sip.company.com)

• If the note in point 3 is right, this means that I will have to plan the BW at the central location to serve the hall clients logging in, and I will need a director as well. The other point the access proxy redirect or proxy the traffic?

Bandwidth for logon and text is not a big deal.. Yes anyway for your first question… For the second question… The Access Proxy Server will proxy the user’s traffic coming from the internet to the user’s internal pool…

• What is the HA planning for the Media Gateway?, searched for that and didn’t find it mentioned any where…

Is it mentioned in the Voice Ignite material… HA planning is to have redundant Media Gateways with similar configuration…

• How to schedule a telephony meeting?

Currently telephony conference role is to integrate with your telephony conference provider, this is planned in the future releases.

 

Duhhhhh J.

 

What is passive SUP for?

Long time I haven’t blogged sorry I was busy with some re-allocation to new place..etc

 

A nice discussion I have involved in about the benefit of having a passive SUP in the SCCM hierarchy, well NOTHING.

 

you do need to create a non active SUP to install the active Internet-based SUP (selected and configured in the Software Update Point Component Properties) and when creating an NLB for the active SUP.  The non active SUP would be installed on each server in the NLB and then the active SUP would be configured as the NLB.

 

Other than this, you cannot use it for reporting. I thought that clients in branch sites can report to the local WSUS and this info will be replicated to the parent WSUS somehow, well this is wrong. So if you will not deploy a WSUS you don’t need passive SUPs.

 

Regards,

Mahmoud.

SCCM across forests - one final note

Hello,

One final note regarding this topic, if you will install SCCM site in different forest, Microsoft doesn’t support installing the secondary site in the new forest,  you will have to install a child site only on the new site. So all the planning has to be done base on child site planning.