Chapter 1. Integration Overview

Partitioned Intradomain Federation

Partitioned Federation Deployment Overview

Single Domain Example

Multiple Domain Example

Multiple Domain Misconfiguration Example

Partitioned Intradomain Federation Configuration

Availability

Availability Subscriptions and Policy

Subscription to an IM and Presence Service User

Subscription to Microsoft Lync or Microsoft Office Communicator User

Jabber for Windows Does not Display Lync/OCS Federated Contacts

Availability Mapping States

Instant Messaging

Request Routing

IM and Presence Service Request Routing

Basic Routing Mode for Partitioned Intradomain Federation

Advanced Routing Mode for Partitioned Intradomain Federation

Microsoft Server Request Routing

Intercluster and Multinode Deployments

Interdomain Federation

High Availability for Intradomain Federation

High Availability for IM and Presence Service to Microsoft Server Request Routing

High Availability for Microsoft Server to IM and Presence Service Request Routing

Contact Search

User Migration

IM Address Examples

User Migration Tools

Chapter 2. Planning for Integration

Supported Partitioned Intradomain Federation Integrations

Presence Web Service API Support

Limitations for Microsoft Lync Integrations

Hardware Requirements

Software Requirements

Server Software

Client Software

IM and Presence Service Supported Clients

Microsoft Server Supported Clients

Integration Preparation

Presence Domains

User Migration

DNS Configuration

Certificate Authority Server

High Availability

Prerequisite Configuration for IM and Presence Service

Additional Configuration for Routing IM and Presence Service Node

Plan Services Restarts during Off-Peak Periods

Chapter 3. Planning for User Migration

Maintenance of User Identity During Migration

Tasks Before Migration

Microsoft Server SIP URI Change

Contact Rename for IM and Presence Service Users

Detailed User Migration Plan

1000 User OVA

5000 User OVA

Duration Guidelines for User Migration Tools

Export Contact List Tool

Disable Account Tool

Delete Account Tool

Bulk Administration Tool Contact List Import

Bulk Administration Tool Contact Rename

Chapter 4. Configuration Workflows for Partitioned Intradomain Federation

Configuration Workflow for Partitioned Intradomain Federation with Lync

Configuration Workflow for Partitioned Intradomain Federation with OCS

Configuration Workflow for User Migration from Microsoft Servers to the IM and Presence Service

Configuration Workflow for Integrating IM and Presence with Microsoft Server Interdomain Federation Capability

Chapter 5. IM and Presence Service Node Configuration for Partitioned Intradomain Federation

Domain Configuration for Partitioned Intradomain Federation

View IM Address Domains

IM and Presence Configuration Task Flow for Federation

Configure the Routing Node

Start Feature Services for Cluster

Configure Partitioned Intradomain Federation Options

Configure Static Routes to Microsoft Lync

Configure an Incoming Access Control List

TLS Encryption Configuration

Configure Application Listener Ports

Configure TLS Peer Subjects

Configure Peer Authentication TLS Context

Import Root Certificate of Certificate Authority

Generate Certificate Signing Request for IM and Presence Service

Import Signed Certificate from Certificate Authority

Configure Expressway Gateway

Chapter 6. Microsoft Lync Configuration for Partitioned Intradomain Federation

Domain Verification for Lync Servers

Lync Federation Configuration Task Flow

Configure Static Route on Microsoft Lync

Configure Trusted Applications for Lync

Publish Topology

Configure Certificates on Lync

Install Certificate Authority Root Certificates on Lync

Validate Existing Lync Signed Certificate

Request a Signed Certificate from a Certificate Authority for Lync

Download a Certificate from the CA Server

Import a Signed Certificate for Lync

Assign Certificate on Lync

Restart Services on Lync Servers

Chapter 7. Microsoft Office Communications Server Configuration for Partitioned Intradomain Federation

Domain Verification for OCS Servers

Enable Port 5060/5061 on OCS Server

Federated Link to Microsoft OCS Server Configuration Task List

Configure Static Routes on OCS to Point to the IM and Presence Service

Add Host Authorization on OCS for IM and Presence Service

Restart Services on OCS Front-End Servers

TLS Encryption Configuration

Enable Federal Information Processing Standard Compliance on OCS

Configure Mutual TLS Authentication on OCS

Install Certificate Authority Root Certificates on OCS

Validate Existing OCS Signed Certificate

Signed Certificate Request from the Certificate Authority for the OCS Server

Install Signed Certificate on the OCS Server

Select Installed Certificate for TLS Negotiation

Chapter 8. User Migration

Cisco User Migration Tools

Recommendations before Migration

Set Unlimited Contact Lists and Watchers

Enable Automatic Authorization of Subscription Requests

Subscriber Notification Pop-ups

Disable Microsoft Lync Pop-ups

Restore Microsoft Lync Pop-up Behavior

Verify Microsoft Server SIP URI Format for Migrating Users

Modify Lync SIP URI

Modify OCS SIP URI

Rename Contact IDs in IM and Presence Service Contact Lists

Results of the Rename Contact IDs Job

Provision of Microsoft Server Users on Cisco Unified Communications Manager

Backups of User Microsoft Server Contact List Information

Export of Contact Lists for Migrating Users

Log File

Run Modes

Input File Formats

Disable Users on Microsoft Servers

Disable Microsoft Server Account for Migrating Users

Verify That Active Directory Updates Synchronized to Microsoft Servers

Delete User Data from Database for Migrating Users

Import Contact Lists for Migrating Users into IM and Presence

CSV File Upload Using BAT

Creation of a New Bulk Administration Job

Results of Bulk Administration Job

Deploy an IM and Presence Service Supported Client on Users Desktop

Reset Maximum Contact List Size and Maximum Watcher Size

Chapter 9. Interdomain Federation and Intradomain Federation Deployment Integration

IM and Presence Service Integration with Interdomain Federation Capability of Microsoft Servers

Interactions and Restrictions

IM and Presence Service Integration with Interdomain Federation Capability of Microsoft Servers

Remote Domain Setup for Interdomain Federation through Intradomain Federation Connections on Microsoft Servers

Configure a Static Route for a Remote Domain

Remove IM and Presence Service Integration with Microsoft Server Interdomain Federation Capability

Remove Static Route for Remote Domain

Remove the SIP Federation Domain

Chapter 10. Integration Troubleshooting

IM and Presence Service Tracing

Configure Tracing on the IM and Presence Service

Microsoft Server SIP Tracing

Enable SIP Tracing on Lync

Enable SIP Tracing on OCS

Common Integration Problems

Lync 2013 Client Repeatedly Logs out and Back in after IM and Presence Service User is Added to its Contact List

Microsoft Server User Does Not Receive Pop-up when Added to IM and Presence Service Contact List

Microsoft Server User Receives a Pop-up when Added to an IM and Presence Service Contact List but Has No Availability after Accepting

IM and Presence Service User Does Not Receive a Pop-up when a Microsoft Lync or Microsoft Office Communicator User Adds the User to their Contact List

Microsoft Server User Does Not Receive IMs Sent by an IM and Presence Service User

IM and Presence User Does Not Receive IMs Sent by a Microsoft Server User

Microsoft Server User Updates and IMs Take up to 40 Seconds to Appear

When Advanced Routing Is Enabled, No Availability Is Exchanged Between IM and Presence Service and Microsoft Server

IM and Presence Service User Does Not Appear in the Microsoft Server Address Book

IM and Presence Service Unable to Route Interdomain Federation Requests through Microsoft Server Deployment

TLS Handshake Errors between the IM and Presence Service and Microsoft Servers

Incorrect SIP URI Specified for Microsoft Lync or Microsoft Office Communicator Users when Added to Cisco Unified Personal Communicator Contact List

Display Names not Shown for Microsoft Lync or Microsoft Office Communicator Contacts on Cisco Unified Personal Communicator

User Migration Troubleshooting

User Migration Tracing

Export Contact List Tool

Disable Account Tool

Delete Account Tool

IM and Presence Service BAT Contact List Import

Configure Bulk Provisioning Service Logging on the IM and Presence Service

IM and Presence Service Bulk Administration Tool Contact Rename

Common User Migration Problems

Application Failed to Initialize Properly - Error Occurs When Running Any of the User Migration Tools

Export Contact List Tool does not Produce an Output File for Lync Users

Export Contact List Tool Log Shows getAndPrintContactsForUsers Error

Export Contact List Tool - Log Summary Shows Several Users as Not Found

Export Contact List Tool - Tool Does Not Show the Progress Bar and Does Not Produce an Output File of Exported Contacts when Run in Normal Mode

Disable Account Tool - Log Shows Unable to Connect to LDAP Using IP/FQDN/Hostname

Delete Account Tool - Unable to Find the Microsoft Server Database or Server Instance

Delete Account Tool - Log Shows Error While Connecting to the SQL Server

BAT Contact List Update - Uploaded Contact List File Not in Drop-Down List

BAT Contact List Update - No Log file Exists on Results Page after BAT Job

BAT Contact List Update - A User's Contacts Are Not Imported During BAT Job

BAT Contact List Update - A User's Contacts Are Partially Imported During BAT Job

BAT Contact List Update - No Contacts are Imported During BAT Job

Migrating User Status Appears as Status Unknown or Presence Unknown to Microsoft Server Users during the Migration Process

Copyright Page

Chapter 1. Integration Overview

Partitioned Intradomain Federation

More and more enterprises are choosing Cisco Unified Communications Manager IM and Presence Service as their IM and availability platform. These enterprises already have Microsoft Lync or Microsoft Office Communications Server (OCS) deployed and want to move their users over to an IM and Presence Service supported client.

During this transition, it is important that these users who migrate to an IM and Presence Service supported client can continue to share availability and instant messages with those users who are still using the Microsoft servers. For more information about supported IM and Presence Service clients, see the "Software Requirements" section.

Partitioned intradomain federation enables IM and Presence Service client users and Microsoft Lync or Microsoft Office Communicator users within the same enterprise to exchange presence Availability and IM.

This integration allows both IM and Presence Service and the Microsoft server to host a common domain or set of domains. Each user within those domains is enabled on either IM and Presence Service or the Microsoft server.

Note

Partitioned intradomain federation requires that a user is enabled on one system only. This integration does not support a user that is enabled on both IM and Presence Service and the Microsoft server at the same time.

IM and Presence Service uses the standard Session Initiation Protocol (SIP RFC 3261) to provide partitioned intradomain federation support for the following Microsoft server platforms:

- Microsoft Lync Server 2010, Standard Edition and Enterprise Edition

- Microsoft Lync Server 2013, Standard Edition and Enterprise Edition

- Microsoft Office Communications Server 2007 R2 Standard Edition and Enterprise Edition

Note

The term Microsoft server is used in this document to refer to all supported Lync and OCS platform types. Any information that is specific to a certain platform is identified.

Related References

Software Requirements

Partitioned Federation Deployment Overview

The following figure shows a high-level sample deployment of IM and Presence Service and Microsoft OCS within the same domain. This example shows an OCS deployment, but it also applies to the other supported Microsoft servers.

Both single presence domain and multiple presence domain deployments are supported. For multiple presence domain deployments, you must configure identical presence domains on both systems.

Integration Overview

Single Domain Example

In this example, users within the presence domain called synergy.com on both theIM and Presence Service node and the Microsoft Lync server are able to exchange Availability and IM using partitioned intradomain federation because the synergy.com presence domain is configured on both systems. The common active directory enables contact searches and display name resolution for all users on both systems.

Single Presence Domain Intradomain Federation Example

Note

Presence domains must be identical. For example, user1@abc.synergy.com cannot share IM and Availability with any of the federated users configured for intradomain federation on synergy.com. Move user1 from the abc.synergy.com presence domain to the synergy.com domain to enable user1 to participate in Partitioned Intradomain Federation in this example.

Multiple Domain Example

In this example, users within the presence domains called synergy.com and synergy.co.uk on both theIM and Presence Service node and the Microsoft Lync server are able to exchange Availability and IM using Intradomain Federation because those domains are configured on both systems. The common active directory enables contact searches and display presence name resolution for all users on both systems. See the following figure.

Multiple Domain Intradomain Federation Example

Multiple Domain Misconfiguration Example

In this example, users on the domains called synergy.com and synergy.co.uk are properly configured for partitioned intradomain federation and can exchange IM and Availability. However, users within the domain called synergy.online.com on the Lync server are unable to exchange Availability and IM with users in the federated IM and Presence Service system because the synergy.online.com domain is not configured on the IM and Presence Service node. See the following figure.

Multiple Domain Misconfiguration Example

To enable synergy.online.com users to exchange Availability and IM with users in the federated IM and Presence Service system, add a domain called synergy.online.com to the IM and Presence Service node.

Note

You can configure additional presence domains on the IM and Presence Service system even if no users are initially assigned to those domains.

Partitioned Intradomain Federation Configuration

You configure the following key components to enable partitioned intradomain Federation between IM and Presence Service and your Microsoft Lync/OCS server:

1. IM and Presence Service node

2. Microsoft server

3. User migration

Tip

See the detailed configuration workflows for the start-to-finish steps needed to enable partitioned intradomain federation and for links to the procedures that are performed at each step of the process.

Cisco recommends that you back up the Microsoft server user contact list information before proceeding to configure partitioned intradomain federation between IM and Presence Service and your Microsoft server.

Partitioned Intradomain Federation High Level Configuration Tasks for the IM and Presence Service Node

Task

O = Optional

M = Mandatory

Ensure that all required domains are configured on the IM and Presence Service node and verify that matching domains are configured on the Microsoft servers

M

Enable partitioned intradomain federation

M

Set up static routes to the Microsoft server

M

Set up access control lists

M

Set up TLS for the Lync server (required if you are using a Lync server)

M

Set up TLS for OCS server

O

Deactivate non-essential services on the dedicated routing server (if applicable)

M

Partitioned Intradomain Federation High Level Configuration Tasks for the Lync Server

Task

O = Optional

M = Mandatory

Ensure that all required Lync domains are configured and verify that matching domains are configured on IM and Presence Service nodes

M

Set up static routes to the IM and Presence Service node

M

Set up host authorization

M

Publish the topology

M

Set up TLS

M

Partitioned Intradomain Federation High Level Configuration Tasks for the OCS Servers

Task

O = Optional

M = Mandatory

Ensure that all required domains are configured on the OCS server and verify that matching domains are configured on theIM and Presence Service nodes

M

Enable SIP port

M

Set up static routes toIM and Presence Service node

M

Set up host authorization

M

Set up TLS

O

Partitioned Intradomain Federation User Migration Tasks

Task

O = Optional

M = Mandatory

Download tools

M

Disable Lync subscriber notification pop-ups

M

Set unlimited contact list sizes and watcher sizes

M

Enable auto authorization of subscriber requests

M

Verify that the local IM and Presence Service domains match the Microsoft server domains for the migrating users

M

If applicable, rename contact IDs in IM and Presence Service contact lists for any Microsoft server SIP URIs formats that were modified

O

Provision Microsoft server users on Cisco Unified Communications Manager

M

Back up user Microsoft server contact list information

M

Export contact lists for users

M

Disable users on Microsoft server

M

Verify that user accounts are disabled

M

Delete user data from database for migrating users

Note:
Depending on your Microsoft server deployment, you may have to perform this procedure on multiple databases.

M

Import contact lists for migrating users in to IM and Presence Service

M

Reset maximum contact list and watcher size

M

Re-enable Lync subscriber notification pop-ups

M

Related Tasks

Disable Microsoft Lync Pop-ups

Restore Microsoft Lync Pop-up Behavior

Related References

Backups of User Microsoft Server Contact List Information

Configuration Workflow for Partitioned Intradomain Federation with Lync

Configuration Workflow for Partitioned Intradomain Federation with OCS

Configuration Workflow for User Migration from Microsoft Servers to the IM and Presence Service

Availability

This section describes Availability functionality.

Availability Subscriptions and Policy

This section describes call flows for IM and Presence Service and Microsoft Lync or Microsoft Office Communicator.

Subscription to an IM and Presence Service User

When a Microsoft Lync or Microsoft Office Communicator user wishes to view the availability of an IM and Presence Service client user, a SIP SUBSCRIBE request is routed from Lync/OCS to IM and Presence Service. IM and Presence Service accepts the incoming subscription and places it in a pending state. Privacy policy is then applied to this incoming subscription request.

Note

Privacy policy applied to subscriptions from Microsoft server users in a partitioned intradomain federation deployment is identical to the privacy policy applied to subscriptions from IM and Presence Service client users.

IM and Presence Service checks whether auto-authorization is enabled or whether the IM and Presence Service client user has previously blocked or allowed presence subscriptions from the Microsoft server user. If either case is true, IM and Presence Service auto-handles policy decision for the subscription request. Otherwise, the IM and Presence Service client user receives an alert regarding the new subscription.

If the subscription is denied, polite blocking is implemented. This means that the presence state of the user appears as offline to the Microsoft server user. If the subscription is authorized,IM and Presence Service sends availability updates to the Microsoft server user and the IM and Presence Service client user also has the option to add the Microsoft server user to their roster.

Subscription to Microsoft Lync or Microsoft Office Communicator User

When an IM and Presence Service client user wishes to view the availability of a Microsoft Lync or Microsoft Office Communicator user, a SIP SUBSCRIBE request is routed from IM and Presence Service to Lync/OCS. The Microsoft server accepts the incoming subscription. Policy is then applied to this incoming subscription request.

If the Microsoft server user has previously accepted a subscription from this IM and Presence Server user, the subscription is auto-accepted and availability is returned to the IM and Presence Service client user in line with the policy level applied by the Microsoft server user. If not, the Microsoft server user receives an alert regarding the new subscription. The Microsoft server user can then accept or block the IM and Presence Service client user.

Note

The Microsoft server performs a refresh SIP SUBSCRIBE approximately every 1 hour and 45 minutes. Therefore, if an IM and Presence Service node restarts, the maximum duration a Microsoft Lync or Microsoft Office Communicator user is without the availability status of the IM and Presence Service contacts is approximately two hours.

If the Microsoft server restarts, the maximum duration an IM and Presence Service client is without available status of Microsoft Lync or Microsoft Office Communicator contacts is approximately 2 hours.

Jabber for Windows Does not Display Lync/OCS Federated Contacts

A Jabber for Windows user will not see presence information for Lync/OCS federated contacts in their directory search results, until they have first added such Lync/OCS contacts to their contact list.

This is due to a protocol limitation between Jabber, which is XMPP-based, and Lync/OCS, which is SIP-based. When Jabber displays the results of a directory search it sends an XMPP Temporary Subscription request for each entry which is not already in its contact list. Because there is no equivalent SIP request, these requests are blocked when they reach the SIP Federation Gateway.

This behavior is expected, because if the XMPP Temporary Subscription request was converted to a SIP SUBSCRIBE request, then each Lync/OCS contact who appears in the directory search result would receive a popup message asking them to allow the Jabber user to see their presence information, as occurs when a Jabber user adds a contact. This solution would result in poor user experience.

Availability Mapping States

The following table shows the availability mapping states from Microsoft Lync or Microsoft Office Communicator to the following IM and Presence Service supported clients:

- Cisco Jabber for Windows

- Cisco Jabber for Mac

- Cisco Jabber for iPad

- Cisco Jabber IM for Mobile (iPhone, Android, Blackberry)

- Cisco Unified Personal Communicator Release 8.x

- Third-party XMPP clients

Availability Mapping States from Microsoft Lync or Microsoft Office Communicator

Microsoft Lync or Microsoft Office Communicator

Setting

Cisco Jabber[1]

Setting

Cisco Unified Personal Communicator

8.x Setting

Third-Party XMPP Clients

Setting

Available

Available

Available

Available

Away

Away

Away

Away

Be Right Back

Away

Away

Away

Busy

Busy

Busy

Busy

Do Not Disturb

Busy

Busy

Busy

Appear Offline

Offline

Offline

Offline

Offline

Offline

Offline

Offline

[1] Applies to all supported Cisco Jabber clients.

The following table shows the availability mapping states from all supported Cisco Jabber clients to Microsoft Lync or Microsoft Office Communicator.

Availability Mapping States from Cisco Unified Personal Communicator Release 8.x to Microsoft Lync or Microsoft Office Communicator

Cisco Unified Personal Communicator

Release 8.x Setting

Microsoft Lync or Microsoft Office Communicator

Setting

Available

Available

Busy

Busy

On the Phone

Busy

Meeting

Busy

Away

Away

Do Not Disturb

Busy

Offline

Offline

Offline—On the Phone

Offline

Offline—Meeting

Offline

Offline—Out of Office

Offline

The following table shows the availability mapping states from Cisco Jabber to Microsoft Lync or Microsoft Office Communicator.

Availability Mapping States from Cisco Jabber to Microsoft Lync or Microsoft Office Communicator

Cisco Jabber[2]

Setting

Microsoft Lync or Microsoft Office Communicator

Setting

Available

Available

Away

Away

Do Not Disturb

Busy

Out of Office

Offline

Offline

Offline

[2] Applies to all supported Cisco Jabber clients.

The following table shows the availability mapping states from third-party XMPP clients to Microsoft Lync or Microsoft Office Communicator.

Availability Mapping States from Third-Party XMPP Clients to Microsoft Lync or Microsoft Office Communicator

Third-Party XMPP

Setting

Microsoft Lync or Microsoft Office Communicator

Setting

Available

Available

Away

Away

Extended Away

Away

Do Not Disturb

Busy

Offline

Offline

Instant Messaging

Partitioned intradomain federation supports point-to-point IM between the IM and Presence Service client users and Microsoft Lync or Microsoft Office Communicator users. This includes support for the following IM features:

- Plain text IM format

- Typing indication

- Basic emoticons

SIP Session Mode IM is used to transfer messages and typing indications between the IM and Presence Service and the Microsoft server.

When an IM and Presence Service client user sends an IM to a Microsoft server user, if no existing IM session is established between these two users, IM and Presence Service sends a SIP INVITE message to the Microsoft server to establish a new session. This session is used for any subsequent SIP MESSAGE or SIP INFO (typing indication) traffic from either of these two users.

Note

The IM and Presence Service client users and third-party XMPP client users can begin an IM conversation with a Microsoft server user even if they do not have availability.

When a Microsoft user sends an IM to an IM and Presence Service client user, if no existing IM session is established between these two users, the Microsoft server sends a SIP INVITE message to the IM and Presence Service. This session is used for any subsequent SIP MESSAGE or SIP INFO (typing indication) traffic from either of these two users.

Note

Due to the proprietary nature of Microsoft server group chat functionality, partitioned intradomain federation does not support group chat between the IM and Presence Service client users and Microsoft Lync or Microsoft Office Communicator users.

Request Routing

This section describes request routing for IM and Presence Service to Lync/OCS and for Lync/OCS to IM and Presence Service.

IM and Presence Service Request Routing

To allow the IM and Presence Service to send SIP requests to the Microsoft front-end server, configure static routes on the IM and Presence Service. For each IM and Presence Service domain, configure a TLS static route that points to the IP address of a Microsoft server of front-end load balancer (for Enterprise Edition MS servers only).

To allow the IM and Presence Service-originated SIP requests to be received by the Microsoft server without an authentication requirement, on the Microsoft server, add the IM and Presence Service as a trusted application. In addition, add the IM and Presence Service cluster nodes to a trusted servers pool.

Routing Modes

For routing SIP requests from IM and Presence Service to the Microsoft servers, partitioned intradomain federation provides two routing modes that you can configure in your IM and Presence Service setup:

- Basic Routing

- Advanced Routing

Basic Routing Mode for Partitioned Intradomain Federation

Basic Routing is the default routing mode for partitioned intradomain federation. When Basic Routing is enabled, IM and Presence Service routes a request to Lync/OCS if the request recipient is within any of the domains in the IM and Presence Service cluster but is not a licensed IM and Presence Service user.

The following figure shows the sequence of the routing request from IM and Presence Service to the Microsoft server when Basic Routing is configured. This figure shows an example of an OCS deployment, but it also applies to the other supported Microsoft servers.

IM and Presence Service to Microsoft Server Request Routing

1

Ann, a Cisco Jabber 8.x user, sends a request to Bob, who is a Microsoft Office Communicator user in the same presence domain.

2

Because Bob is within the local presence domain but is not a licensed IM and Presence Service client user, IM and Presence Service translates the request and routes it to OCS.

3

The OCS server forwards the request to Bob’s Microsoft Office Communicator client.

Note

- For recipients who are not provisioned on either the IM and Presence Service or a Microsoft server, any such request that is forwarded to the Microsoft server is in turn returned by the Microsoft server to IM and Presence Service.

- IM and Presence Service has built-in loop detection to reject any requests that loop back from the Microsoft server in this manner.

Advanced Routing Mode for Partitioned Intradomain Federation

Advanced Routing ensures less traffic between IM and Presence Service and Lync/OCS in deployments in which there are a large number of unprovisioned or unknown contacts in the IM and Presence Service database. However, Advanced Routing does add an additional storage overhead on each IM and Presence Service cluster because each cluster must store all Microsoft Lync or Microsoft Office Communicator users so that the Advanced Routing logic can be applied.

Configure Advanced Routing for partitioned intradomain federation only when you have a single-cluster IM and Presence Service deployment and Cisco Unified Communications Manager synchronizes its users from the same Active Directory that the Microsoft server uses. When more than one IM and Presence Service cluster is deployed, you must use the default basic routing method.

For Advanced Routing, the list of users synchronized from Active Directory must include all Microsoft Lync or Microsoft Office Communicator users.

When Advanced Routing is enabled, IM and Presence Service routes the request to the Microsoft server when both of the following conditions are met:

- The request recipient is within one of the IM and Presence Service domains but is not a licensed IM and Presence Service user

- The request recipient has a valid Microsoft Lync or Microsoft Office Communicator SIP address stored in the IM and Presence Service database.

Microsoft Server Request Routing

To route SIP requests from the Microsoft server (Lync/OCS) to the IM and Presence Service, configure TLS static routes on the Microsoft server for each IM and Presence Service domain:

- For chat-only deployments, point the static route to the designated IM and Presence Service routing node.

- For chat+calling deployments, point the static route to the Expressway Gateway

To allow Microsoft server SIP requests to be received without an authentication requirement, on the IM and Presence Service, configure an access control list that includes the Microsoft server.

The Microsoft server has just a single routing mode in a partitioned intradomain federation deployment. The Microsoft server routes requests to either the IM and Presence Service routing node (for chat-only deployments) or the Expressway Gateway (for chat+calling Lync deployments) if the request recipient is within one of the Microsoft server managed IM and availability domains, but is not a Microsoft Lync or Microsoft Office Communicator user.

Routing Examples

The following figure shows the sequence of the routing request from a Microsoft server to IM and Presence Service. This figure shows an example of an OCS deployment, but it also applies to chat-only deployments with Lync.

Microsoft Server to IM and Presence Service Request Routing

1

Bob, a Microsoft Office Communicator user, sends a request to Ann, who is a Cisco Jabber user.

3

IM and Presence Service accepts the request and forwards it to Ann’s home IM and Presence Service node.

2

Because Ann is within a local presence domain but is not a Microsoft Office Communicator user, the Microsoft server routes the request to IM and Presence Service.

4

IM and Presence Service translates the request and forwards it to Ann’s Cisco Jabber client.

Note

For recipients who are not provisioned on either the IM and Presence Service or the Microsoft server, any such requests that are forwarded by the Microsoft server to IM and Presence Service are rejected by IM and Presence Service.

Intercluster and Multinode Deployments

Lync-originated Requests

When Lync/OCS requests an Availability subscription or IM conversation with IM and Presence Service, the Microsoft server routes the SIP request to:

- For chat-only deployments, the Microsoft server routes SIP requests to the IM and Presence Service routing node. The routing node forwards the SIP request to the cluster node that homes the recipient. The cluster node responds to the routing node, which then forwards the SIP response back to the Microsoft servers.

- For chat+calling deployments, there is no routing node. Instead, the Microsoft server sends the SIP request to the Expressway Gateway. The Expressway Gateway forwards the SIP request to the IM and Presence Service cluster. The IM and Presence Service cluster node returns the SIP response directly to the Microsoft serversy.

IM and PresenceService-originated Requests

When an IM and Presence cluster node requests an Availability subscription or IM conversation with a Microsoft Lync user, the cluster node sends the SIP request directly to the Microsoft server. The Microsoft server returns the SIP response directly to the IM and Presence Service cluster node that initiated the message. For both chat-only and chat + calling scenarios, any IM and Presence Service cluster node can send SIP requests directly to the Microsoft server.

Interdomain Federation

IM and Presence Service supports interdomain federation. This feature is also available when IM and Presence Service is configured for partitioned intradomain federation. However, any interdomain federation that is configured on IM and Presence Service is available only to IM and Presence Service client users.

If the Lync/OCS deployment is already configured for SIP interdomain federation through an Access Edge/Access Proxy server, Microsoft Lync or Microsoft Office Communicator users can continue to use this federation capability. It is also possible to configure the IM and Presence Service and the Microsoft server so that IM and Presence Service client users can take advantage of such existing federation capability.

Note

- It is not supported to configure both the IM and Presence Service and the Microsoft server to federate directly with the same remote domain.

- See the document Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for more information about interdomain federation.

Related References

IM and Presence Service Integration with Interdomain Federation Capability of Microsoft Servers

Related Information

Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager

High Availability for Intradomain Federation

Partitioned intradomain federation supports high availability for request routing between IM and Presence Service and Lync/OCS.

High Availability for IM and Presence Service to Microsoft Server Request Routing

As mentioned earlier, SIP static routes must be configured on IM and Presence Service to enable basic intradomain federation connectivity between IM and Presence Service and Lync/OCS.

To provide high availability for integration with Microsoft servers, you can configure multiple SIP static routes for each address pattern on IM and Presence Service.

You can assign priority values to these static routes, as required, to define primary and backup static routes. Highest Priority routes are attempted first. If those routes are not available, the request is re-sent using the backup route as shown in the following figure. This figure shows an example of an OCS deployment, but it also applies to the other supported Microsoft servers.

High Availability for IM and Presence Service to Microsoft Server Request Routing

1

When routing to a Microsoft server, IM and Presence Service finds the highest-priority static route and attempts to send the request to the next hop address that is configured for that route.

2

If that next hop is not available, IM and Presence Service falls back to the next-highest priority static route and attempts to send the request to the associated next hop address.

In the case of Enterprise Edition Microsoft servers, you can deploy a front-end load balancer. In such cases, you can configure SIP static routes on IM and Presence Service to point to the IP address of the Microsoft server's front-end load balancer. The front-end load balancer provides high availability within its associated Microsoft server pool as shown in the following figure. This figure shows an example of an OCS deployment, but it also applies to other Microsoft servers.

High Availability with Load Balancer for IM and Presence to Microsoft Server Request Routing

1

When routing to a Microsoft server, IM and Presence Service finds a static route that points to the OCS front-end load balancer.

2

The Microsoft server's front-end load balancer then routes onward to one of the active front-end servers within the pool.

See the following URL for a list of approved load balancers: Click Here . It is your responsibility to ensure that those load balancers are deployed and managed correctly.

Note

Cisco does not support the configuration of static routes to point to load balancers. Cisco recommends that you configure static routes to bypass the front-end load balancer.

High Availability for Microsoft Server to IM and Presence Service Request Routing

SIP static routes must be configured on Lync/OCS to enable basic intradomain federation connectivity between Microsoft server and IM and Presence Service.

However, Microsoft servers support configuration of only a single SIP static route for each domain, which means that the static route can point to just a single IM and Presence Service node.

Therefore, to achieve high availability when IM and Presence Service is integrated with a Microsoft server, you must incorporate a load balancer between the IM and Presence Service node and Microsoft server as shown in the following figure. This figure shows an example of an OCS deployment, but it also applies to the other Microsoft servers.

High Availability for Microsoft Server to IM and Presence Service Request Routing

1

The load balancer works in Active/Backup mode. It routes requests to the primary IM and Presence Service node while that server is running and uses heartbeat signaling to check if the IM and Presence Service node is alive.

2

If the IM and Presence Service fails, the load balancer ensures that all subsequent requests are routed to the backup IM and Presence Service node.

Contact Search

Partitioned intradomain federation allows for full search capabilities on both IM and Presence Service-supported clients and Microsoft Lync or Microsoft Office Communicator.

Active Directory (AD) searches by IM and Presence Service-supported clients return users regardless of where they are provisioned. Microsoft server Address Book searches continue to return all Microsoft server users and also any IM and Presence Service client users who have migrated to IM and Presence Service.

Contact Card information is available on both clients for all contacts.

Note

If an IM and Presence Service client user was never provisioned on the Microsoft server, you must perform an Active Directory update to the msRTCSIP-PrimaryUserAddress field for such users to ensure that the user is available for the Microsoft server searches.

User Migration

At a high level, the administrative flow for user migration is as follows:

1. Verify Lync/OCS SIP URI format for migrating users.

2. If applicable, rename contact IDs in IM and Presence Service contact lists.

3. License and assign migrating Microsoft server users to the IM and Presence Service.

4. Back up Microsoft server data for migrating Microsoft server users.

5. Export Microsoft server contact lists for each of the migrating Microsoft server users.

6. Disable Microsoft server user accounts for migrating Microsoft server users.

7. Delete Microsoft server user data for migrating Microsoft server users.

8. Import Microsoft server contact lists into the IM and Presence Service database for the migrated users.

9. Deploy an IM and Presence Service supported client on migrated users’ desktops.

To further aid the migration process for administrators, a number of tools are available with this feature.

One of the primary advantages of a Partitioned Intradomain Federation deployment is that it allows a seamless transition from a Microsoft server to the IM and Presence Service within an enterprise. Partitioned Intradomain Federation offers the following benefits:

- IM and Presence Service client users and Microsoft Lync or Microsoft Office Communicator users share the same presence domain.

- Users can exchange Availability and Instant Messaging within that shared domain.

- Users can search for and add contacts regardless of where the user or contact is provisioned.

- IM and Presence Service IM addresses can be set to match the Lync SIP URI (msRTCSIP-PrimaryUserAddress) so that the user's identity is maintained throughout the migration.

For more information about configuring IM addresses and user migration, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

IM Address Examples

The following table provides samples of the IM address options that are available for the IM and Presence Service.

IM and Presence Service Default Domain: cisco.com

User: John Smith

Userid: js12345

Mailid: jsmith@cisco-sales.com

SIPURI: john.smith@webex.com

IM Address Format

Directory URI Mapping

IM Address

<userid>@<domain>

n/a

js12345@cisco.com

Directory URI

mailid

jsmith@cisco-sales.com

Directory URI

msRTCSIP-PrimaryUserAddress

john.smith@webex.com

For more information about configuring IM addresses, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

User Migration Tools

IM and Presence Service provides tools for the following Lync/OCS user migration steps:

- Export Microsoft server contact lists for each of the migrating Microsoft server users.

- Disable Microsoft server user accounts for migrating Microsoft server users.

- Delete Microsoft server user data for migrating Microsoft server users.

- Import Microsoft server contact lists into the IM and Presence Service database for the migrated users.

- Rename the contact IDs of migrated users in the IM and Presence Service database.

Note

- While attempting to run any of the user migration tools you may receive the following error: "Application failed to initialize properly". The reason for this error is that you are attempting to run the user migration tools without the .NET 4.0 Framework installed. Each of the user migration tools that Cisco provides requires that at least version 2.0 of the .NET Framework is installed on the server where you are running the tool.

The .NET 2.0 Framework comes installed as standard on Windows Server 2003 R2 or newer.

- The Export, Disable and Delete tools are provided in a zip file on cisco.com. The Import tool is accessible through the Cisco Unified CM IM and Presence Administration user interface.

Export Microsoft Server Contact Lists for Each of the Migrating Microsoft Server Users

This IM and Presence Service tool allows for bulk export of contact lists from the Microsoft server. The exported contact lists are written to a comma-separated values (CSV) file that is acceptable to the IM and Presence Service Contact List Import Bulk Administration Tool (BAT). The combination of these tools allows for end-to-end administrative bulk contact list migration.

Disable Microsoft Server User Accounts for Migrating Microsoft Server Users

IM and Presence Service contains a tool to disable the Microsoft server user accounts in bulk. This tool disables Microsoft server accounts by connecting to Active Directory and modifying the user’s Microsoft server-specific attributes as required.

Delete Microsoft Server user Data for Migrating OCS Users

Microsoft server users must be deleted from the Microsoft servers to allow partitioned intradomain federation routing from the Microsoft server to IM and Presence Service. However, when users are deleted from the Microsoft servers, they are removed from the contact list of any Microsoft Lync or Microsoft Office Communicator users also. This IM and Presence Service tool deletes Microsoft server user data in bulk, while ensuring that the users are not removed from the contact list of Microsoft Lync or Microsoft Office Communicator users.

Import Microsoft Server Contact Lists into the IM and Presence Service Database for the Migrated Users

The IM and Presence Service BAT supports bulk contact list import. It takes a CSV file as input for this bulk import. When used in conjunction with the Microsoft server Export Contact List tool, it allows for contact list migration from a Microsoft server to IM and Presence Service.

Rename the Contact IDs of Migrated Users in the IM and Presence Service Database

Note

This migration tool is only required when the IM Address format on IM and Presence Service differs from the Microsoft server. From IM and Presence Service Release 10.0, it is possible to configure IM and Presence Service to ensure there is no mismatch in IM Address formats between the two systems.

The IM and Presence Service BAT supports migrations where the SIP URI formats on IM and Presence Service and the Microsoft server differ. In previous releases of IM and Presence Service, you must change the SIP URI of all the migrating Microsoft server users to match the IM and Presence Service SIP URI format before you migrate the first batch of users. With this release, you can change the SIP URI of migrating users just before you migrate each batch of users from the Microsoft server to IM and Presence Service. The Bulk Administration Tool takes a CSV file with the list of migrated users as input and updates the contact lists for all users that have the migrated users as contacts.

Note

Running the user migration tools has no affect on the capabilities of other Microsoft server users who are signed into Microsoft Lync or Microsoft Office Communicator. However, Cisco recommends that you run the user migration tools during a scheduled maintenance window to reduce the load on the Microsoft server and Active Directory system.

Chapter 2. Planning for Integration

Supported Partitioned Intradomain Federation Integrations

For partitioned intradomain federation with Microsoft Lync, you must configure TLS; TCP is not supported. See the chapter Configure Microsoft Lync for Partitioned Intradomain Federation for more information.

This chapter describes the configuration steps for enabling partitioned intradomain federation between IM and Presence Service and Microsoft Lync/OCS. The following Microsoft server platforms are supported:

- Microsoft Lync Server 2010, Standard Edition and Enterprise Edition

- Microsoft Lync Server 2013, Standard Edition and Enterprise Edition

- Microsoft Office Communications Server 2007 Release 2, Standard Edition and Enterprise Edition

IM and Presence Service does not support an ASA in partitioned intradomain federation.

Note

If you have a mixed deployment of both Lync and OCS servers, you must run the user migration tools for the Lync users, and then run the user migration tools for the OCS users.

Related References

Hardware Requirements

Software Requirements

Presence Web Service API Support

The Presence Web Service is an open interface that allows client applications to share user presence information with IM and Presence Service. Third party developers use this interface to build client applications that can send and retrieve updates about the presence state of a user. Note the following restriction about Presence Web Service API support:

- For partitioned intradomain federation, you cannot use the Presence Web Service API to obtain presence information from non-Cisco clients.

For more information about the Presence Web Service, see the IM and Presence Service Developer Guide at Click Here .

Limitations for Microsoft Lync Integrations

There are two scenarios where adding partitioned intradomain federation breaks existing Microsoft Lync integrations:

- You already have intradomain federation configured for video with Cisco VCS or Cisco Expressway and want to add partitioned intradomain federation with IM and Presence Service: Microsoft Lync is integrated with Cisco VCS or Cisco Expressway and you have a static route configured on Lync to route video and voice traffic for the local Lync presence domain to Cisco VCS or Cisco Expressway. If you modify the static route to point to IM and Presence Service (a requirement for partitioned intradomain federation) you will break the existing video integration because the traffic that is intended for Cisco VCS or Cisco Expressway would instead be routed to IM and Presence Service. You cannot have both video integration and partitioned intradomain federation to IM and Presence Service.

- You already have integration with Microsoft Exchange Unified Messaging and want to add partitioned intradomain federation with IM and Presence Service: You have a Microsoft Lync server configured for Unified Messaging to Microsoft Exchange (either on-premises, or to the cloud (Office365). If you add a static route from Lync for the local Lync presence domain to point to IM and Presence Service (a requirement for partitioned intradomain federation), Unified Messaging integration between Lync and Microsoft Exchange for the domain will be terminated because all Unified Messaging SIP traffic for that domain will be routed to IM and Presence Service. You cannot have both integration to Microsoft Exchange Unified Messaging and partitioned intradomain federation to IM and Presence Service.

Note

Neither Microsoft Exchange Unified Messaging nor Cisco VCS (or Cisco Expressway) integrations are supported with partitioned intradomain federation if you are sharing the same domain between Microsoft Lync and IM and Presence Service.

Hardware Requirements

Partitioned intradomain federation between IM and Presence Service and Lync/OCS requires the following Cisco hardware:

- IM and Presence Service node. For IM and Presence Service hardware support, refer to the IM and Presence Service compatibility matrix.

- Cisco Unified Communications Manager node. For Cisco Unified Communications Manager hardware support, refer to the compatibility information for Cisco Unified Communications Manager document available on Cisco.com.

Note

In Release 10.0(1) and later, Cisco supports only virtualized deployments of Cisco Unified Communications Manager (Unified Communications Manager) and IM and Presence Service on Cisco Unified Computing System servers, or on a Cisco-approved third-party server configuration. In Release 10.0(1) and later, Cisco does not support deployments of Cisco Unified Communications Manager or IM and Presence Service on Cisco Media Convergence Server servers.

For more information about the deployment of Cisco Unified Communications Manager or IM and Presence Service in a virtualized environment, see: Click Here .

Related References

Software Requirements

Related Information

Compatibility Information for IM and Presence Service and Cisco Unified Communications Manager

Software Requirements

The following sections outline the software required for partitioned intradomain federation between IM and Presence Service and Lync/OCS.

Server Software

The following server software is required for partitioned intradomain federation:

Cisco Software

- IM and Presence Service

- Cisco Unified Communications Manager

Microsoft Software

- Depending on the deployment, one of:

- Microsoft Lync Server 2010, Standard Edition or Enterprise Edition

- Microsoft Lync Server 2013, Standard Edition or Enterprise Edition

- Microsoft Office Communications Server 2007 Release 2, Standard or Enterprise Edition

- Depending on the deployment, one of:

- Lync Administrative Tools (optional install item available during installation of Lync)

- OCS Administrative Tools (optional install item available during installation of OCS)

- Microsoft Active Directory

Other Software

Each of the user migration tools that Cisco provides requires that at least version 2.0 of the .NET Framework is installed on the server where you are running the tool. While attempting to run any of the user migration tools you may receive the following error: "Application failed to initialize properly". The reason for this error is that you are attempting to run the user migration tools without the .NET 2.0 or newer Framework installed.

The .NET 2.0 Framework comes installed as standard on Windows Server 2003 R2 or newer.

Client Software

The client software required for partitioned intradomain federation deployment between the IM and Presence Service and Lync/OCS depends on your deployment. You can have any combination of IM and Presence Service supported clients in a partitioned intradomain federation deployment.

IM and Presence Service Supported Clients

The following IM and Presence Service clients are supported in a partitioned intradomain federation deployment between IM and Presence Service and Lync/OCS:

Cisco Software

- Cisco Unified Personal Communicator Release 8.5

- Cisco Jabber for Mac

- Cisco Jabber for Windows

- Cisco Jabber IM for Mobile (iPhone, Android, Blackberry)

- Cisco Jabber for iPad

- Cisco Jabber for Cius

Note

For version compatibility for all Cisco Jabber clients, see the appropriate Cisco Jabber client documentation.

If the Directory URI IM address scheme is used in your deployment, your client software must support Directory URI.

Third-Party Software

Third-party XMPP clients

Microsoft Server Supported Clients

Depending on the deployment, the following clients are supported:

- Microsoft Lync 2010

- Microsoft Lync 2013

- Microsoft Office Communicator 2005

- Microsoft Office Communicator 2007 Release 2

- Communicator Web Access 2005

- Communicator Web Access 2007 Release 2

Related Topic

Hardware Requirements

Integration Preparation

It is essential that you plan carefully for the configuration of partitioned intradomain federation between IM and Presence Service and Lync/OCS. Read the items in this section before you begin any configuration for this integration.

Presence Domains

Partitioned Intradomain Federation, by its nature, supports integration between IM and Presence Service and the Microsoft server within a common presence domain that is configured on both systems. Both IM and Presence Service and the Microsoft server support the configuration of multiple presence domains. However, any Microsoft Lync or Microsoft Office Communicator users that are not configured for a matching IM and Presence Service domain cannot participate in partitioned Intradomain federation communications.

For example, in the following figure, users who are configured in the synergy.online.com domain cannot share IM availability or emails withIM and Presence Service users who are configured in synergy.com and synergy.co.uk domains because the synergy.online.com domain is not configured on IM and Presence Service. You must add the synergy.online.com domain to IM and Presence Service before those users can share availability with the other users in intradomain federation.

Partitioned Intradomain Federation with Multiple Domains

User Migration

If users are being migrated from Lync/OCS to the IM and Presence Service as part of this integration, consider the information below.

If users are being migrated from Lync/OCS to IM and Presence Service as part of this integration, please be aware that IM and Presence Service maintains the Microsoft server identities of users when the Directory URI IM address scheme is configured, which can in turn be mapped to the Lync SIP URI.

Note

To use the Directory URI IM address scheme, all clients on the IM and Presence Service cluster must support Directory URI.

For more information about planning for user migration, see topics related to planning for user migration.

DNS Configuration

Domain Name System (DNS) "A" records must be published within the enterprise for all IM and Presence Service nodes and Lync/OCS servers.

Microsoft servers must be able to resolve Fully Qualified Domain Names (FQDN) and IP addresses for all IM and Presence Service nodes.

Likewise, IM and Presence Service nodes must be able to resolve FQDNs and IP addresses for all Microsoft server and pool FQDNs.

Certificate Authority Server

If TLS encryption is enabled as part of this partitioned intradomain federation integration, an external or internal Certificate Authority (CA) may be used to sign security certificates on IM and Presence Service and Lync/OCS. Cisco recommends that you use the same CA to sign the Microsoft server and the IM and Presence Service certificates. If not, the root certificates for each CA must be uploaded onto the Microsoft server and the IM and Presence Service nodes.

High Availability

You need to consider how you are going to configure availability in your partitioned intradomain federation deployment.

If you wish to make your IM and Presence Service partitioned intradomain federation capability highly available, you can deploy a load balancer in front of your designated (routing) IM and Presence Service nodes.

Note

To deploy load balancing (for example, round robin), a hardware load balancer needs to be installed. The static route in IM and Presence Service points to the load balancer.

Related Topic

High Availability for Intradomain Federation

Prerequisite Configuration for IM and Presence Service

You must complete the following tasks on the IM and Presence Service before you begin to configure partitioned intradomain federation.

1. Install and configure IM and Presence Service.

2. Perform the following checks to ensure that your IM and Presence Service system is operating properly:

- Run the IM and Presence Service System Configuration Troubleshooter.

- Check that you can add local contacts to the Jabber client of IM and Presence Service.

- Check that your clients are receiving availability states from the IM and Presence Service node.

Additional Configuration for Routing IM and Presence Service Node

In multi-server deployments, an IM and Presence Service node must be dedicated as the Routing IM and Presence Service node. This means that it is a front-end server that accepts all new inbound SIP requests from the Lync/OCS and routes them onwards to the IM and Presence Service node on which the request recipient is homed.

Cisco recommends that you do not assign any users to the Routing IM and Presence Service node; as this ensures that the Routing IM and Presence Service node has the capacity to handle the volume of SIP traffic from the Microsoft server.

Because no users are assigned to the Routing IM and Presence Service node, you can deactivate many of the feature services to free up resources on the Routing IM and Presence Service node. Deactivate the following feature services on the Routing IM and Presence Service node:

- Cisco Presence Engine

- Cisco XCP Text Conference Manager

- Cisco XCP Web Connection Manager

- Cisco XCP Connection Manager

- Cisco XCP SIP Federation Connection Manager

- Cisco XCP XMPP Federation Connection Manager

- Cisco XCP Message Archiver

- Cisco XCP Directory Service

- Cisco XCP Authentication Service

Related Topic

Configure the Routing Node

Plan Services Restarts during Off-Peak Periods

During the integration process, you need to restart the Lync/OCS server front-end services. Plan to perform the services restart during off-peak periods, such as during a maintenance window, to minimize the impact to users. For more information, see the partitioned intradomain federation configuration workflows and topics related to restarting services for your server type.

Chapter 3. Planning for User Migration

- Maintenance of User Identity During Migration

- Detailed User Migration Plan

- Duration Guidelines for User Migration Tools

Maintenance of User Identity During Migration

During migration from Lync/OCS to IM and Presence Service, Microsoft Lync and Microsoft Office Communicator users should maintain the same identity, which is their Uniform Resource Identity (URI). Maintaining the same identity during migration has the following benefits:

- It allows for the user’s availability state to be continually monitored by existing followers because the user’s identity does not change.

- It also allows for much simpler migration of a user’s contact lists because the contact lists can be directly imported from the Microsoft server to IM and Presence Service.

IM and Presence Service URIs are composed by joining the Cisco Unified Communications Manager user ID with the IM and Presence Service domain as follows:

<userid>@<domain>

If users are manually added through the Cisco Unified Communications Manager user interface or through the Cisco Unified Communications Manager Bulk Administration Tool (BAT), you must ensure that the user ID that you specified when you created the user matches the user portion of the user’s Microsoft server URI. For example, if the Microsoft user's URI is bobjones@foo.com, you should create the CUCM user with a user ID of bobjones.

If Cisco Unified Communications Manager is configured to synchronize users from Active Directory, you must ensure that the Active Directory field that is used to map to the Cisco Unified Communications Manager user ID matches the user portion of the Microsoft server URI. Note the following:

- Cisco Unified Communications Manager maps to userID from a limited number of Active Directory fields, the most common of which is sAMAccountName.

- If Cisco Unified Communications Manager maps userID to sAMAccountName, the Microsoft server URI for the migrating users must also match the format <sAMAccountName>@<domain>.

- If the sAMAccountName of Bob Jones is bjones, the Microsoft server URI must be bjones@cisco.com.

- If any Microsoft server URIs do not match the format <sAMAccountName>@<domain>, you can modify the URIs for each batch of Microsoft server users before you migrate that batch to IM and Presence Service.

- Tasks Before Migration

Tasks Before Migration

If the Lync/OCS SIP URI does not match the IM and Presence Service URI format of <userid>@<domain>, you can change the Microsoft server URI for migrating users in a phased manner. In previous releases, you had to change the URI for all migrating users before you began the migration process. With this release, you can change the URI for each batch of users just before you migrate that batch.

If you decide to change the Microsoft server SIP URIs just before you migrate each batch, then, before you migrate each batch of Microsoft server users, you must also update the contact lists on IM and Presence Service to ensure that they contain the latest SIP URI (contact IDs) for the Microsoft server users that are about to be migrated. Consider the following example.

Migration Example

John Smith and Bob Jones are Lync users and are both listed in each other’s contact list. Their Lync URIs are john.smith@example.com and bob.jones@example.com. John is being migrated to IM and Presence Service during Phase 1 of the migration and Bob is being migrated during Phase 2.

Before Migration

Phase 1 of user migration begins and John’s Lync URI is changed to jsmith@example.com. John is then migrated to IM and Presence Service. Availability and IM between John and Bob is maintained.

Phase 1 of User Migration

Phase 2 of user migration begins and Bob’s Lync URI is changed to bjones@example.com. John’s contact list on IM and Presence Service is updated with the new contact IDs for all of the users that are being migrated in Phase 2. Bob is then migrated to IM and Presence Service. Availability and IM between John and Bob is maintained.

Phase 2 of User Migration

- Microsoft Server SIP URI Change

- Contact Rename for IM and Presence Service Users

Microsoft Server SIP URI Change

If any Lync/OCS URIs do not match the IM and Presence Service Service URI format, you must change those Microsoft server URIs before you begin the migration process. For more information about how to change the Microsoft server URIs see related topics on verifying the Microsoft server SIP URI format for migrating users.

Related Tasks

Verify Microsoft Server SIP URI Format for Migrating Users

Contact Rename for IM and Presence Service Users

The IM and Presence Service Bulk Administration Tool allows you to rename the contact IDs in the contact lists of IM and Presence Service users in a phased manner. This means that you can update the IM and Presence Service contact lists each time that Lync/OCS URIs are changed.

Note

If you need to update the IM and Presence Service contact lists, you must perform the update before the Microsoft server users (with the changed URIs) are enabled for IM and Presence Service on Cisco Unified Communications Manager.

See related topics for renaming contacts IDs for more information.

Related Tasks

Rename Contact IDs in IM and Presence Service Contact Lists

Detailed User Migration Plan

The partitioned intradomain federation integration between the IM and Presence Service and Lync/OCS is designed to provide basic communication between users during a phased migration from a Microsoft server to IM and Presence Service.

However, partitioned intradomain federation integration introduces a performance overhead. Because of this, IM and Presence Service can support a maximum of 130,000 SIP intradomain federation contacts per server. To ensure that this federated contact threshold is not exceeded on any IM and Presence Service node during migration of users from the Microsoft server to IM and Presence Service, a detailed user migration plan may be required.

You can use the following calculation to get an estimate of the maximum number of IM and Presence Service users that can be supported without breaking the above federated contact threshold:

Max Supported Users = 130,000 / Average Contact List Size.

Based on this calculation, the following table gives an indication of the maximum number of IM and Presence Service users that can be supported without breaking the 130,000 federated contact threshold.

Maximum Number of Supported IM and Presence Service Users

Average Contact List Size

Maximum Supported Users (without high availability)

Maximum Supported Users (with high availability[1])

200

650

325

150

866

433

100

1300

650

75

1733

866

50

2600

1300

25

5000

2500

[1] This assumes a 2-node subcluster running in active/active mode.

You require a detailed user migration plan if the number of users to be provisioned on any IM and Presence Service node within your deployment exceeds the relevant limit above. Contact your Cisco Support representative to begin the process of defining a detailed migration plan.

Notes

1. The values for the maximum number of supported users in the table above are based on worst-case figures; that is, in the case where all contacts are federated.

With proper migration planning, the full complement of users can be deployed on an IM and Presence Service node in a phased manner, without breaking the 130,000 federated contact threshold.

2. When high availability is enabled, each IM and Presence Service node must be able to handle the load associated with all users within the IM and Presence Service 2-node subcluster because, in the event of a node failure, the second node in the cluster services all users on its own. Therefore, the limit per node must be halved.

3. If you are unsure about the average contact list size within your Microsoft server deployment, assume it to be worst-case (200 contacts) when you are deciding whether a migration plan is required.

4. The values for the maximum number of supported users in the table above assume the Cisco supported virtual platform based on the IM and Presence Service OVA template for 5000 users. The equivalent numbers for the 1000 user OVA are detailed below.

- 1000 User OVA

- 5000 User OVA

1000 User OVA

IM and Presence Service can support up to 18,000 SIP intradomain federation contacts per node with the 1000 user OVA. The following table gives an indication of the maximum number of IM and Presence Service users that can be supported without breaking the18,000 federated contact threshold.

Maximum Number of Supported IM and Presence Service Users with 1000 User OVA

Average Contact List Size

Maximum Supported Users (without high availability)

Maximum Supported Users (with high availability[1])

200

90

45

150

120

60

100

180

90

75

240

120

50

360

180

25

720

360

18

1000

500

[1] This assumes a 2-node subcluster running in active/active mode.

5000 User OVA

IM and Presence Service can support up to 90,000 SIP intradomain federation contacts per node with the 5000 user OVA. The following table gives an indication of the maximum number of IM and Presence Service users that can be supported without breaking the 90,000 federated contact threshold.

Maximum Number of Supported IM and Presence Service Users with 5000 User OVA

Average Contact List Size

Maximum Supported Users (without high availability)

Maximum Supported Users (with high availability[1])

200

450

225

150

600

300

100

900

450

75

1200

600

50

1800

900

25

3600

1800

18

5000

2500

[1] This assumes a 2-node subcluster running in active/active mode.

Duration Guidelines for User Migration Tools

Cisco provides a number of tools to allow bulk migration of users from Lync/OCS to IM and Presence Service. To allow you to plan your migration, it is important to be aware of the time required for each tool to run when you are migrating a large number of users. This section describes the expected run time for each of those tools.

Note

If you have a mixed deployment of both Lync and OCS servers, you must run the tools on the Lync users and then run the tools again on the OCS users.

- Export Contact List Tool

- Disable Account Tool

- Delete Account Tool

- Bulk Administration Tool Contact List Import

- Bulk Administration Tool Contact Rename

Export Contact List Tool

The Export Contact List tool (ExportContacts.exe) can export contacts from Lync/OCS at an average rate of 800 contacts per second (or 48,000 contacts per minute). You can use the following equation as a guide to estimate the expected run time for this tool for a set of Microsoft server users.

Time to export contacts (mins) = Number of Microsoft server users x Average Contact List Size / 48000.

The following table shows the expected run time for a number of sample cases.

Sample Expected Run Times for the Export Contact List Tool

Number of Microsoft Server Users

Average Contact List Size

Time to Export Contacts

2000

100

5 minutes

5000

75

8 minutes

15000

60

19 minutes

Disable Account Tool

The Disable Account tool (DisableAccount.exe) can disable Lync/OCS accounts at an average rate of 13 accounts per second (or 800 accounts per minute). You can use the following equation as a guide to estimate the expected run time for this tool for a set of Microsoft server users.

Time to disable accounts (mins) = Number of Microsoft server users / 800

The following table shows the expected run time for a number of sample cases.

Sample Expected Run Times for the Disable Account Tool

Number of Microsoft server users

Time to disable accounts

2000

3 minutes

5000

7 minutes

15000

20 minutes

Delete Account Tool

The Delete Account tool (DeleteAccount.exe) can delete Lync/OCS accounts at an average rate of 13 accounts per second (or 800 accounts per minute). You can use the following equation as a guide to estimate the expected run time for this tool for a set of Microsoft server users.

Time to delete accounts (mins) = Number of Microsoft server users / 800.

The following table shows the expected run time for a number of sample cases.

Sample Expected Run Times for the Delete Account Tool

Number of Microsoft Server Users

Time to Delete Accounts

2000

3 minutes

5000

7 minutes

15000

20 minutes

Bulk Administration Tool Contact List Import

The IM and Presence Service Bulk Administration Tool (BAT) can import contacts at varying rates, depending on the IM and Presence Service platform. The following table shows the expected import rate for a selection of IM and Presence Service platforms.

Import Rate for the IM and Presence Service BAT on Virtual Machines

OVA Template

Import Rate

2000 user OVA

6/sec

5000 user OVA

12/sec

15000 user OVA

22/sec

The following table shows the expected run time for a number of sample cases

Sample Expected Run Times for the BAT Contact List Import Utility

Number of Users

Average Contact List Size

Import Time (Rate = 22/sec[1])

2000

100

2hours, 32 minutes

5000

75

4 hours, 45 minutes

15000

60

11 hours, 22 minutes

[1] These estimates apply to the highest specification machines which support a contact import rate of 22/sec.

Notes

1. The calculations for the Export Contact List tool, Disable Account tool, and Delete Account tool are based on the Lync/OCS and Active Directory (AD) running on hardware with at least 2Ghz CPU processing power, and 2GB of RAM.

2. Running these user migration tools has no affect on the capabilities of other Microsoft server users who are signed into Microsoft Lync or Microsoft Office Communicator.

3. Cisco recommends that you perform user migration during a scheduled maintenance window to reduce the load on the Microsoft server and AD system.

Bulk Administration Tool Contact Rename

The Bulk Administration Tool Contact Rename utility duration rates are influenced by two primary factors:

- The number of users in the cluster with renamed contact IDs in their contact list

- The average number of renamed contact IDs for each such user

These factors vary for each deployment. For large-scale operations (over 1000 contact IDs renamed), it may take a number of hours for the job to complete. To estimate the likely job completion rate, view the job progress indicators to see the rate at which impacted users are being updated.

Chapter 4. Configuration Workflows for Partitioned Intradomain Federation

This chapter provides configuration workflows for partitioned intradomain federation with supported Microsoft servers, as well as the workflow for user migration from Lync/OCS to IM and Presence Service.

- Microsoft Lync Server (Lync) 2010

- Microsoft Lync Server (Lync) 2013

- Microsoft Office Communications Server (OCS) 2007 R2

Configuration Workflow for Partitioned Intradomain Federation with Lync

Use the following workflow to configure partitioned intradomain federation between IM and Presence Service and Microsoft Lync servers:

IM and Presence Service Configuration

1. Verify that the required presence domains are configured on all IM and Presence Service nodes in the cluster. For instructions to view the configured domains on IM and Presence Service and to add new local presence domains, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

2. For chat-only deployments with multiple nodes, configure a dedicated routing node, see Configure the Routing Node.

3. Start essential services, see Start Feature Services for Cluster.

4. Enable partitioned intradomain federation, see Configure Partitioned Intradomain Federation Options.

5. Configure static routes to Lync deployment, see Configure Static Routes to Microsoft Lync.

6. Configure Access Control Lists for Lync deployment, see Configure an Incoming Access Control List.

7. Configure TLS encryption between the IM and Presence Service and Lync:

1. Configure application listeners, see Configure Application Listener Ports.

2. Configure TLS peer subjects, see Configure TLS Peer Subjects.

3. Configure peer authentication TLS context, see Configure Peer Authentication TLS Context.

4. Import root certificate of the Certificate Authority (CA), see Import Root Certificate of Certificate Authority.

5. Request a CA signed certificate, see Generate Certificate Signing Request for IM and Presence Service.

6. Import the CA signed certificate, see Import Signed Certificate from Certificate Authority.

Note

Partitioned intradomain federation only supports back to back federation between IM and Presence Service and Microsoft Lync or OCS. A firewall (ASA) between the federated servers is not supported.

Expressway Gateway Configuration

For chat + calling deployments only. On the Expressway Gateway, configure Microsoft interoperability and enable the SIP broker. For Expressway Gateway configuration details, refer to the Cisco Expressway with Microsoft Lync Deployment Guide at:

Click Here .

Note

For chat-only deployments, you do not need to deploy the Expressway Gateway.

Lync Configuration

1. Verify that the presence domains for intradomain federation that are configured on the Lync server have matching presence domains configured on the IM and Presence Service nodes. For instructions to view the configured domains on IM and Presence Service and to add new local presence domains, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

2. On the Lync servers, configure TLS static routes that point to the Expressway Gateway (for chat+calling) or the IM and Presence Service routing node (for chat-only). For details, see Configure Static Route on Microsoft Lync.

3. Add IM and Presence Service as a trusted application. Add the IM and Presence cluster nodes to a trusted application pool, see Configure Trusted Applications for Lync.

4. Publish the topology, see Publish Topology.

5. Ensure CA root certificates are installed on each Lync server, see Install Certificate Authority Root Certificates on Lync.

6. Ensure all Lync servers have the required signed certificates, see Validate Existing Lync Signed Certificate.

7. Request signed certificate from Certificate Authority, see Request a Signed Certificate from a Certificate Authority for Lync.

8. Download the certificate from the CA server, see Download a Certificate from the CA Server.

9. Import the signed certificate, see Import a Signed Certificate for Lync.

10. Assign the certificate, see Assign Certificate on Lync.

11. Restart services, see Restart Services on Lync Servers.

Tip

Plan the restart of the front-end services during off-peak hours to minimize the impact on users.

After the server is configured, you can proceed to migrate the users.

Configuration Workflow for Partitioned Intradomain Federation with OCS

Use the following workflow to configure partitioned intradomain federation between IM and Presence Service and OCS 2007 R2:

IM and Presence Service Configuration

1. Verify that the required presence domains are configured on all IM and Presence Service nodes in the cluster. For instructions to view the configured presence domains on IM and Presence Service and to add new local presence domains, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

2. Select a cluster node to act as the routing node, Configure the Routing Node.

3. Start essential services across the cluster, Start Feature Services for Cluster

4. Enable partitioned intradomain federation, see Configure Partitioned Intradomain Federation Options.

5. Configure static routes to OCS deployment, see Configure Static Routes to Microsoft Lync.

6. Configure Access Control Lists for OCS deployment, see Configure an Incoming Access Control List.

7. (Optional) Configure TLS encryption between IM and Presence Service and OCS:

1. Configure application listeners, see Configure Application Listener Ports.

2. Configure TLS peer subjects, see Configure TLS Peer Subjects.

3. Configure peer authentication TLS context, see Configure Peer Authentication TLS Context.

4. Import root certificate of the Certificate Authority (CA), see Import Root Certificate of Certificate Authority.

5. Request a CA signed certificate, see Generate Certificate Signing Request for IM and Presence Service.

6. Import the CA signed certificate, see Import Signed Certificate from Certificate Authority.

OCS Configuration

1. Verify that the presence domains for intradomain federation that are configured on the OCS server have matching presence domains configured on IM and Presence Service nodes. For instructions to view the configured domains on the IM and Presence Service and to add new local presence domains, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

2. Enable port 5060, see Click Here .

3. Configure static routes to the IM and Presence Service deployment, see Configure Static Routes on OCS to Point to the IM and Presence Service.

4. Add host authorization for the IM and Presence Service deployment, see Add Host Authorization on OCS for IM and Presence Service.

5. (Optional) Configure TLS encryption between IM and Presence Service and OCS:

1. Ensure mutual TLS authentication is configured on each OCS server, see Configure Mutual TLS Authentication on OCS.

2. Ensure CA root certificates are installed on each OCS server, see Install Certificate Authority Root Certificates on OCS.

3. Ensure all OCS servers have the required signed certificates, see Validate Existing OCS Signed Certificate.

4. If required, request a newly signed certificate, see Signed Certificate Request from the Certificate Authority for the OCS Server.

6. Restart services, see Restart Services on OCS Front-End Servers.

Tip

Plan the restart of the front-end services during off-peak hours to minimize the impact on users.

After the server is configured, you can proceed to migrate the users.

Configuration Workflow for User Migration from Microsoft Servers to the IM and Presence Service

Use the following workflow to migrate users from Lync/OCS toIM and Presence Service:

1. Download the user migration tools—see Cisco User Migration Tools.

2. Set unlimited contact list sizes and watcher sizes onIM and Presence Service, see Set Unlimited Contact Lists and Watchers.

3. Enable automatic authorization of subscription requests, see Enable Automatic Authorization of Subscription Requests.

4. Verify the Microsoft server SIP URI format for migrating users, see Verify Microsoft Server SIP URI Format for Migrating Users

5. If applicable, rename contact IDs in the IM and Presence Service contact lists, see Rename Contact IDs in IM and Presence Service Contact Lists

6. Provision migrating users on IM and Presence Service, see Click Here .

7. Back up Microsoft server data for migrating users, see Click Here .

8. Export Microsoft server contact lists for migrating users, see Export of Contact Lists for Migrating Users.

9. Disable Microsoft server accounts for migrating users, see Click Here .

10. Verify that Microsoft server accounts have been disabled for migrating users, see Click Here .

11. Delete Microsoft server user data for migrating users, see Delete User Data from Database for Migrating Users.

12. Import contact lists into IM and Presence Service for migrating users, see Import Contact Lists for Migrating Users into IM and Presence.

13. Reset the contact list and watcher limits on IM and Presence Service, see Reset Maximum Contact List Size and Maximum Watcher Size.

Configuration Workflow for Integrating IM and Presence with Microsoft Server Interdomain Federation Capability

Note

Before you begin this workflow, you must configure partitioned intradomain federation with Lync/OCS and ensure that it is functioning correctly. See the appropriate workflow for configuring partitioned intradomain federation within your deployment.

1. Configure each federated presence domain on IM and Presence Service—see Remote Domain Setup for Interdomain Federation through Intradomain Federation Connections on Microsoft Servers

2. Configure static routes to each server hosting a remote presence domain on IM and Presence Service—see Configure a Static Route for a Remote Domain

Chapter 5. IM and Presence Service Node Configuration for Partitioned Intradomain Federation

Domain Configuration for Partitioned Intradomain Federation

Before you proceed to set up IM and Presence Service for partitioned intradomain federation, verify that all required presence domains are configured on all nodes in the IM and Presence Service cluster. Ensure that there are matching presence domains configured on the Lync/OCS servers. If necessary, use the Cisco Unified IM and Presence Administration user interface to add or update local presence domains on the nodes in the cluster.

Multiple presence domains are supported in the IM and Presence Service cluster when Directory URI is configured as the IM address scheme. All nodes in the cluster must support Directory URI to use Directory URI as the IM address scheme.

For information to set up the Directory URI IM address scheme for the cluster, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

For information to set up multiple domains for Interdomain Federation, see Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager Guide.

View IM Address Domains

All system-managed and administrator-managed presence domains across the IM and Presence Service deployment are displayed in the Presence > Domains> Find and List Domains window. A check mark in one of the information fields indicates if a domain is associated with the local cluster and/or with any peer clusters. The following information fields are displayed for administrator-managed presence domains:

- Domain

- Configured on Local Cluster

- Configured on Peer Cluster(s)

The following information fields are displayed for system-managed presence domains:

- Domain

- In use on Local Cluster

- In use on Peer Cluster(s)

Procedure

Choose Cisco Unified CM IM and Presence Administration > Presence > Domains. The Find and List Domains window appears.

IM and Presence Configuration Task Flow for Federation

Before You Begin

Verify that all required presence domains are configured on all nodes in the IM and Presence Service cluster. For details, see Domain Configuration for Partitioned Intradomain Federation.

Procedure

Command or Action

Purpose

Step 1

Configure the Routing Node

(Optional) If you have a chat-only deployment with multiple nodes, select a dedicated routing node, and deactivate nonessential services on the routing node.

Note:
For chat+calling deployments or single node deployments, you do not need a dedicated routing node and can skip this task.

Step 2

Start Feature Services for Cluster

Start essential services on your IM and Presence Service cluster nodes.

Step 3

Configure Partitioned Intradomain Federation Options

Enable partitioned intradomain federation and routing options on IM and Presence Service.

Step 4

Configure Static Routes to Microsoft Lync

Configure static routes to Lync/OCS deployment,

Note:
For Lync, create TLS static routes. For OCS, you can create TLS or TCP routes.

Step 5

Configure an Incoming Access Control List

Configure an incoming access control list on IM and Presence so that Lync/OCS servers can access IM and Presence without authentication.

Step 6

Configure Application Listener Ports

On the IM and Presence Service, change the Default Cisco SIP Proxy TLS Listener port values for both server authentication and peer authentication.

Step 7

Configure TLS Peer Subjects

Configure TLS peer subjects for the Lync/OCS servers and the Expressway Gateway (chat + calling scenarios).

Step 8

Configure Peer Authentication TLS Context

Configure peer authentication.

Step 9

Import Root Certificate of Certificate Authority

Upload the root certificate of the CA into the IM and Presence Service trust store.

Step 10

Generate Certificate Signing Request for IM and Presence Service

Request a CA signed certificate

Step 11

Import Signed Certificate from Certificate Authority

Generate and download a CSR from IM and Presence Service.

Step 12

Configure Expressway Gateway

(Optional) For chat + calling Federation with Lync, deploy the Expressway Gateway.

Note:
There is no need to deploy an Expressway Gateway in chat-only deployments, or when configuring Federation with OCS.

Configure the Routing Node

For multi-node chat-only deployments, choose an IM and Presence Service cluster node to act as the routing node. To provide extra capacity for routing, there should be no users assigned to the routing node. The routing node acts as a front-end server, accepting inbound SIP requests from Lync/OCS and routing those requests to the appropriate cluster node that homes the recipient.

Note

For chat+calling deployments with Lync, and for single-node deployments, you can skip this procedure as there is no need to configure a routing node.

Procedure

Step 1

From the Cisco Unified IM and Presence Serviceability user interface, choose Tools > Service Activation.

Step 2

From the Server drop-down menu, choose the cluster node that you want to designate as the routing node. The routing node should have no users assigned.

Step 3

Check the Cisco SIP Proxy feature service.

Step 4

Uncheck the following feature services:

- Cisco Presence Engine

- Cisco XCP Text Conference Manager

- Cisco XCP Web Connection Manager

- Cisco XCP Connection Manager

- Cisco XCP SIP Federation Connection Manager

- Cisco XCP XMPP Federation Connection Manager

- Cisco XCP Message Archiver

- Cisco XCP Directory Service

- Cisco XCP Authentication Service

Step 5

Click Save.

Step 6

Confirm that the CIsco XCP Router network service is running. Because the service is a network service it is running by default, unless you previously disabled it.

1. Choose Tools > Control Center – Network Services.

2. From the Server drop-down menu, select the routing node and click Go.

3. If the CIsco XCP Router service is not running, check the corresponding radio button, and click Start.

What to Do Next

Start Feature Services for Cluster

Start Feature Services for Cluster

Start essential feature services for your IM and Presence Service cluster nodes. If you have a multi-node chat-only deployment, complete this task for all nodes except the routing node. Otherwise, complete this task for all cluster nodes.

Procedure

Step 1

From the Cisco Unified IM and Presence Serviceability interface, choose Tools > Service Activation.

Step 2

From the Server menu, choose the cluster node and click Go.

Step 3

Check the following services:

- Cisco SIP Proxy

- Cisco XCP SIP Federation Connection Manager

Step 4

Click Save.

Step 5

Confirm that the CIsco XCP Router network service is running. Because the service is a network service it is running by default, unless you previously disabled it.

1. Choose Tools > Control Center – Network Services.

2. From the Server drop-down menu, select the routing node and click Go.

3. If the CIsco XCP Router service is not running, check the corresponding radio button, and click Start.

Step 6

Repeat this procedure for all cluster nodes, except the routing node.

What to Do Next

Configure Partitioned Intradomain Federation Options

Configure Partitioned Intradomain Federation Options

The following procedure describes how to enable partitioned intradomain federation on IM and Presence Service and choose a routing mode.

If you have a multicluster deployment, you must perform this procedure on each cluster. When you enable partitioned intradomain federation or choose a routing mode, these settings are enabled cluster-wide; therefore you only need to enable them on the IM and Presence Service publisher node within any given cluster.

Caution

Email address for federation is not supported in deployments where partitioned intradomain federation is configured. Email address for federation is also not supported for interdomain federation if your deployment uses the interdomain federation capabilities of Lync/OCS. Confirm that email address for federation is not enabled anywhere in the deployment in these deployment scenarios and ensure that the Enable use of Email Address for Inter-domain Federation option is not checked for the clusters.

Procedure

Step 1

Log in to the Cisco Unified Communications Manager IM and Presence Administration user interface. Choose Presence > Settings> Standard Configuration.

Step 2

Check the Enable Partitioned Intradomain Federation with LCS/OCS/Lync check box.

Step 3

Read the warning message and click OK.

Step 4

Choose one of the following from the partitioned intradomain federation Routing Mode drop-down list:

- Basic Routing Mode (default) when you have unlicensed IM and Presence Service request recipients within the IM and Presence Service domain. In Basic Routing mode, the IM and Presence Service routes requests for these recipients to the Microsoft server.

- Advanced Routing Mode when you have request recipients within the IM and Presence Service domain who are licensed and have a valid Microsoft Lync or Microsoft Office Communicator SIP address stored in the IM and Presence Service database. Choose Advanced Routing only if Cisco Unified Communications Manager synchronizes users from the same Active Directory that the Microsoft server uses.

Note:
The list of users synchronized from Active Directory must include all Microsoft Lync or Microsoft Office Communicator users.

Step 5

Click Save.

Step 6

After you enable partitioned intradomain federation or choose a routing mode, you must restart the Cisco XCP Router on all IM and Presence Service nodes in the cluster. To restart the Cisco XCP Router, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center – Network Services. Click the appropriate IM and Presence Service node, scroll down and select Cisco XCP Router, and click restart.
Note:
You are prompted to restart the SIP proxy when you enable partitioned federation.

What to Do Next

Configure Static Routes to Microsoft Lync

Related References

IM and Presence to Microsoft Server Request Routing

Configure Static Routes to Microsoft Lync

The following procedure describes how to configure static routes to enable partitioned intradomain federation routing between the IM and Presence Service and Lync/OCS. You must add an individual static route for each Microsoft server presence domain. Static routes can have a common next hop address. See topics related to IM and Presence Service to Microsoft server request routing, and basic and advanced routing modes for more information.

Note

If you are integrating partitioned intradomain federation with the interdomain federation capabilities of Microsoft servers, then you must configure static routes on the IM and Presence Service for each remote domain. For more information, see topics related to configuring static routes for remote domains.

Note

Perform this procedure for each Microsoft server presence domain.

For the Microsoft server presence domain static route, note the following:

- For Standard Edition Microsoft servers, the static route must point to the IP address of a specific Standard Edition server.

- For Enterprise Edition Microsoft servers, to route federation traffic from the IM and Presence Service cluster directly to one of the front-end Microsoft servers, the static route must point to the IP address of that front-end server

See the following URL for a list of approved load balancers: Click Here . It is your responsibility to ensure that those load balancers are deployed and managed correctly.

Note

Cisco does not support the configuration of static routes to point to load balancers. Cisco recommends that you configure static routes to bypass the front-end load balancer.

For high availability purposes, you can configure additional backup static routes for each Microsoft server presence domain.

The backup route has a lower priority and is used only if the next hop address of the primary static route is unreachable.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. These settings are cluster-wide; therefore you need to set them only on the IM and Presence Service database publisher node within any given cluster.

Procedure

Step 1

Log in to the Cisco Unified CM IM and Presence Administration user interface. Choose Presence > Routing > Static Routes.

Step 2

Click Add New.

Step 3

Enter the Destination Pattern value so that the domain is reversed. For example, if the domain is domaina.com, the Destination Pattern value must be .com.domaina

Step 4

In the Next Hop field, enter the IP address of the Microsoft server.

Step 5

Choose domain for the Route Type.
Note:
The default setting for Route Type is user.

Step 6

Set the Next Hop Port and Protocol Type values according to the protocol that you want to use:

- For TCP——Choose TCP as the Protocol Type and 5060 as the Next Hop Port.

- For TLS—Choose TLS as the Protocol Type and 5061 as the Next Hop Port.

Note:   For static routes to Lync, you must configure TLS routes. For static routes to OCS, you can configure TLS or TCP.

Step 7

Enter the Priority value as follows:

- For primary static routes, enter the default Priority value of 1.

- For backup static routes, enter a Priority value of greater than 1. (The lower the value, the higher the priority of the static route).

Step 8

Leave the default values for all other parameters.

Step 9

Click Save.

Step 10

Create an additional static route with the Destination Pattern FQDN in reverse order and with the Next Hop the Microsoft Lync server IP address. For example, if the domain is lyncserver.domaina.com, the Destination Pattern value must be .com.domaina.lyncserver.

What to Do Next

Configure an Incoming Access Control List

Configure an Incoming Access Control List

The following procedure describes how to configure entries in the Incoming Access Control List (ACL) to ensure that Lync/OCS servers can access the IM and Presence Service server without authentication.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. These settings are cluster-wide; therefore you need to set them only on the IM and Presence Service publisher node within any given cluster.

How you configure the Incoming ACLs depends on how strictly you wish to control access to IM and Presence Service:

- To allow open access to IM and Presence Service, you can add an entry with an address pattern of All.

- To allow access to IM and Presence Service from specific DNS domains, you can add entries with an address pattern matching the specific DNS domain. For example, to allow access from any server within the foo.com DNS domain, enter foo.com as the address pattern.

- To allow access to IM and Presence Service from specific servers, add ACL entries that have an address pattern matching the IP address and the FQDN of those servers. You must create two ACL entries for each server: one entry for the IP address and another entry for the FQDN. For example, to allow access from the server ocs1.foo.com (10.1.10.100) enter ocs1.foo.com as the address pattern in one ACL entry, and enter 10.1.10.100 as the address pattern in another ACL entry.

For partitioned intradomain federation, if you decide to restrict access to IM and Presence Service for certain Microsoft server FQDNs or IP addresses only, you must add ACL entries for the following entities:

- Each Microsoft server Enterprise Edition front-end or Standard Edition server

- Each Microsoft server pool FQDN (Enterprise Edition only)

- Gateway Expressway FQDN (chat + calling scenarios only)

If you choose to restrict access using the FQDN of the server, then you need to also add an ACL entry for any other DNS records that resolve to the same IP address as any of the front end servers or pools. For example, you can create a DNS record, such as admin.lync.com, on the Lync server to access the Lync control panel and which resolves to the same IP address as one of the Lync front end servers.

Caution

If you choose to enter a specific server FQDN or IP address for your ACL entries, failure to create all the required ACL entries as described may cause stability issues with the Lync 2013 client.

Procedure

Step 1

Log in to the Cisco Unified CM IM and Presence Administration user interface. Choose System > Security > Incoming ACL.

Step 2

Click Add New.

Step 3

In the Description field, enter a description of the entry. For example, Lync Server.

Step 4

Enter the address pattern in the Address Pattern field. You have the following options:

- Enter Allow from all to allow open access to IM and Presence Service.

- Enter a specific network domain name. For example, Allow from foo.com.

- Enter a specific IP address. For example, Allow from 10.1.10.100.

- Enter a specific FQDN. For example, Allow from admin.lync.com.

Note:
If you do not enter Allow from All as the address pattern, then you must create at least two ACL entries: one for the IP address of the server and another one for the FQDN of the server. Entering a domain name is optional.

Step 5

Click Save.

Step 6

Restart the SIP Proxy by doing the following:

1. Choose Presence > Routing > Settings

2. Click the Restart All Proxy Services button.

What to Do Next

Configure Application Listener Ports

TLS Encryption Configuration

You must complete the procedures in this section to configure TLS encryption between IM and Presence Service and Lync/OCS. TLS encryption is mandatory for partitioned intradomain federation with Lync servers.

Note

If you have a multicluster deployment, you must perform each of these procedures on each cluster. These settings are cluster-wide; therefore you need to set them only on the IM and Presence Service publisher node within any given cluster.

Configure Application Listener Ports

You must change the Default Cisco SIP Proxy TLS Listener port values for both server authentication and peer authentication.IM and Presence Service performs peer (mutual) TLS authentication on port 5062 by default. You must modify this default setting so that peer TLS authentication takes place on port 5061 and configure the server TLS authentication port value to 5062.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose System > Application Listeners.

Step 2

If they are not already displayed, click Find to display all application listeners.

Step 3

Choose Default Cisco SIP Proxy TLS Listener – Server Auth.

Step 4

Change the Port value to 5063.

Step 5

Click Save and click OK on the pop-up window that appears.

Step 6

From the Related Links drop-down list, choose Back to Find/List and click OK to return to the Application Listeners list.

Step 7

Choose Default Cisco SIP Proxy TLS Listener – Peer Auth.

Step 8

Change the Port value to 5061.

Step 9

Click Save and click OK on the dialog-box that appears.

Step 10

From the Related Links drop-down list, choose Back to Find/List and click OK to return to the Application Listeners list.

Step 11

Choose Default Cisco SIP Proxy TLS Listener – Server Auth.

Step 12

Change the Port value from 5063 to 5062.

Step 13

Click Save.

Step 14

Restart the SIP Proxy service on all IM and Presence Service nodes in the cluster. To restart the SIP Proxy service, Log in to the Cisco Unified IM and Presence Serviceability user interface, choose Tools > Control Center – Feature Services.

What to Do Next

Configure TLS Peer Subjects

Related Information

Integration Troubleshooting

Configure TLS Peer Subjects

For Peer TLS authentication, IM and Presence Service requires that the Subject Common Name (CN) from the security certificate that is presented by the peer is included in a TLS Peer Subject list. Use the Cisco Unified IM and Presence Administration user interface to add a Subject CN to this list.

Include only the Subject CN in the TLS Peer Subject list. Do not include Subject Alternative Name (SAN) entries in the TLS Peer Subject list. The following figure shows an example of a Subject CN certificate with the Subject CN highlighted.
Subject Common Name Certificate

For partitioned intradomain federation, add a TLS Peer Subject for whichever of the following entities you are deploying:

- Each Lync/OCS Enterprise Edition front-end or Standard Edition server

- Each Lync/OCS pool Fully Qualified Domain Name (FQDN) (Enterprise Edition only)

- Expressway Gateway FQDN (for chat + calling scenarios only)

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose System > Security > TLS Peer Subjects.

Step 2

Click Add New.

Step 3

Enter the Peer Subject Name.

- For a Microsoft server Enterprise Edition front-end or Standard Edition server, enter the FQDN of the server.

- For a Microsoft server pool Fully Qualified Domain Name (FQDN), enter the subject CN of the certificate that is presented to the IM and Presence Service.

- Enter the FQDN of the Expressway Gateway (for chat + calling scenarios only)

Step 4

In the Description field, enter a description of the subject, for example, OCS Server.

Step 5

Click Save.

Step 6

Restart the Cisco SIP Proxy service on all IM and Presence Service nodes in the cluster. To restart the Cisco SIP Proxy service, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center - Feature Services. Click the CUCM IM and Presence Server, select SIP Proxy and click Restart.

What to Do Next

Configure Peer Authentication TLS Context

Related Information

Integration Troubleshooting

Configure Peer Authentication TLS Context

To support TLS encryption between IM and Presence Service and Lync/OCS, you must modify Peer Authentication TLS Context configuration on IM and Presence Service.

Note

Microsoft Lync does not support EC ciphers. When selecting EC ciphers you must choose either non-EC ciphers only, or a mixture of EC and non-EC ciphers. EC ciphers must not be selected on their own.

Note

Default_Cisco_SIP_Proxy_Peer_Auth_TLS_Context, supports the selection of additional stronger ciphers. You can select the appropriate cipher based on the required configuration. You must ensure that the selected cipher list aligns with the peer's supported ciphers before configuring Intradomain Federation.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose System > Security > TLS Context Configuration.

Step 2

Click Find.

Step 3

Click the link for Default Cisco UP SIP Proxy Peer Auth TLS Context.

Step 4

Ensure that the check box for Disable Empty TLS Fragments is checked.

Step 5

In the TLS Cipher Mapping area list of Available TLS Ciphers, choose all of the ciphers and click the Move Right arrow to move these ciphers to the Selected TLS Ciphers list.

Step 6

In the TLS peer Subject Mapping area list of Available TLS Peer Subjects, choose the TLS peer subject that you configured in Configure TLS Peer Subjects and click the Move Right arrow to move this TLS peer subject to the Selected TLS Peer Subjects list.

Step 7

Click Save.

Step 8

Restart the Cisco SIP Proxy service on all IM and Presence Service nodes in the cluster. To restart the Cisco SIP Proxy service, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center – Feature Services. Click the CUCM IM and Presence Service server, select Cisco SIP Proxy and click Restart.

What to Do Next

Import Root Certificate of Certificate Authority

Related Information

Integration Troubleshooting

Import Root Certificate of Certificate Authority

All Lync/OCS security certificates are generally signed by a Certificate Authority (CA). The IM and Presence Service certificates should also be signed by the same Certificate Authority used by the Microsoft server. In order for the IM and Presence Service to use a certificate signed by the Microsoft server CA, and to accept Microsoft server certificates signed by that same CA, the root certificate of the CA must be uploaded into the IM and Presence Service trust store.

Before You Begin

Before importing the root certificate, retrieve the certificate from the certificate authority and copy it to your local computer.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence OS Administration user interface. Choose Security > Certificate Management.

Step 2

Click Upload Certificate/ Certificate Chain.

Step 3

For the Certificate Purpose drop-down list, choose cup-trust.

Step 4

In the Description (friendly name) field, enter a description for the certificate, for example, Certificate Authority Root Certificate.

Step 5

Click Browse to find the root certificate on your local computer.

Step 6

Click Upload to upload the certificate to the IM and Presence Service node.

Step 7

Restart the Cisco SIP Proxy service on all IM and Presence Service nodes in the cluster. To restart the Cisco SIP Proxy service, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center – Feature Services. Click the CUCM IM and Presence Service server, select Cisco SIP Proxy and click Restart.

What to Do Next

Generate Certificate Signing Request for IM and Presence Service

Related Information

Integration Troubleshooting

Generate Certificate Signing Request for IM and Presence Service

IM and Presence Service certificates should be signed by the same Certificate Authority (CA) that is used by Lync/OCS. You must complete the following two-step process to obtain a CA-signed certificate:

1. Generate an IM and Presence Service Certificate Signing Request (CSR).

2. Upload the CA signed certificate onto IM and Presence Service.

The following procedure describes how to generate and download a CSR from IM and Presence Service. IM and Presence Service CSRs are 2048 bit in size.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Security > Certificate Management on IM and Presence Service.

Step 2

Click Generate CSR.

Step 3

From the Certificate Purpose drop-down list, choose cup.

Step 4

Click Generate CSR.

Step 5

When the Status shows "Success: Certificate Signing Request Generated" click Close.

Step 6

Click Download CSR.

Step 7

From the Certificate Name drop-down list, choose cup.

Step 8

Click Download CSR to download the certificate to your local computer.

Step 9

After the certificate has downloaded, click Close.

What to Do Next

After you download the CSR, you can use it to request a signed certificate from your chosen CA. This can be a well-known public CA or an internal CA.

Import Signed Certificate from Certificate Authority

Related Information

Integration Troubleshooting

Import Signed Certificate from Certificate Authority

The following procedure describes how to upload the CA signed certificate to IM and Presence Service.

Before You Begin

Generate and download a CSR from IM and Presence Service. See Generate Certificate Signing Request for IM and Presence Service.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Security > Certificate Management.

Step 2

Click Upload Certificate/Certificate chain and the Upload Certificate/Certificate chain dialog box opens.

Step 3

From the Certificate Name drop-down list, choose cup.

Step 4

In the Description (friendly name) field, enter a description of the certificate, for example, CA Signed Certificate.

Step 5

Click Browse to find the certificate file on your local computer.

Step 6

Click Upload to upload the certificate to the IM and Presence Service node.

Step 7

After the certificate has uploaded, restart the Cisco SIP Proxy service on all IM and Presence nodes in the cluster. To restart the Cisco SIP Proxy service, log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Tools > Control Center – Feature Services. Click the Cisco Unified IM and Presence Service server, select Cisco SIP Proxy and click Restart.

What to Do Next

For chat+calling Federation with Lync, Configure Expressway Gateway

Otherwise, for chat-only, go to one of the following chapters:

- Microsoft Lync Configuration for Partitioned Intradomain Federation

- Microsoft Office Communications Server Configuration for Partitioned Intradomain Federation

Related Information

Integration Troubleshooting

Configure Expressway Gateway

Chat + calling deployments only. On the Expressway Gateway, configure Microsoft interoperability and enable the SIP broker. For Expressway Gateway configuration, see the Cisco Expressway and Microsoft Lync Deployment Guide at:

Click Here .

Note

For chat-only deployments, you do not need to deploy the Expressway Gateway.

What to Do Next

Microsoft Lync Configuration for Partitioned Intradomain Federation

Chapter 6. Microsoft Lync Configuration for Partitioned Intradomain Federation

To configure Microsoft Lync for partitioned Intradomain federation, you must complete the following procedures in the order they are presented. After the configuration is complete, you must restart services on Lync servers.

Note

You must configure TLS for Partitioned Intradomain Federation with Lync. TCP is not supported by Lync.

- Domain Verification for Lync Servers

- Lync Federation Configuration Task Flow

Domain Verification for Lync Servers

Before you proceed to set up IM and Presence Service for partitioned intradomain federation, verify that there are matching presencer domains configured on the Microsoft Lync servers and all nodes in the IM and Presence Service cluster.

On the Cisco Unified CM IM and Presence Administration user interface, go to Presence > Domains > Find to verify local presence domains that are configured on the IM and Presence Service, as well as the system-managed presence domains that are configured on external servers.

Lync Federation Configuration Task Flow

Complete these tasks to set up Microsoft Lync for Partitioned Intradomain Federation.

Before You Begin

IM and Presence Configuration Task Flow for Federation

Procedure

Command or Action

Purpose

Step 1

Configure Static Route on Microsoft Lync

On the Lync servers, set up a TLS static route that points to either Expressway Gateway (for chat+calling deployments) or the IM and Presence Service routing node (for chat-only deployments).

Step 2

Configure Trusted Applications for Lync

On the Lync servers, add the IM and Presence Service as a trusted application and add your IM and Presence cluster nodes to a trusted application server pool.

Step 3

Publish Topology

On the Lync servers, commit the topology.

Step 4

Configure Certificates on Lync

Set up certificates on your Lync servers.

- Configure Static Route on Microsoft Lync

- Configure Trusted Applications for Lync

- Publish Topology

- Configure Certificates on Lync

Configure Static Route on Microsoft Lync

You must create a TLS static route on the Lync servers that points to one of the following destinations:

- For chat + calling deployments, configure a static route to the Expressway Gateway

- For chat-only deployments, configure a static route to the IM and Presence Service routing node

Note

When using TLS, the FQDN used in the destination pattern of the static route must be resolvable from the Lync front-end server. Ensure that the FQDN resolves to the IP address of the Expressway Gateway or IM and Presence Service routing node.

The Lync FQDN cannot match the IM and Presence Service domain that is used for partitioned intradomain federation.

Procedure

Step 1

Log in to a computer as the domain administrator, for example, where Lync Server Management Shell is installed.
Tip:
You must log in as a member of the RTCUniversalServerAdmins group or a role-based access control (RBAC) role to which you have assigned the New-CsStaticRoute cmdlet.

Step 2

Choose Start > All Programs > Microsoft Lync Server 2010 > Lync Server Management Shell.

Step 3

Enter the following command to define a TLS route:
$tlsRoute = New-CsStaticRoute -TLSRoute -Destination fqdn_of_imp_routing_node -Port listening_port_imp_routing_node -usedefaultcertificate $true -MatchUri domain_imp

where:

Parameter

Description

-Destination

The FQDN of the Expressway Gateway (chat+calling) or the FQDN or IP address of the IM and Presence Service routing node (chat-only). For example, expGateway.example,com or impNode.example.com .

-Port

The listening port of the Expressway Gateway (default port is 65072) or the listening port of the IM and Presence Service routing node (default port is 5061).

-MatchUri

The domain for the Expressway Gateway domain (chat+calling) or lM and Presence Service (chat-only). For example, example.com.

Example:
$tlsRoute = New-CsStaticRoute -TLSRoute -Destination impNode.example.com -Port 5061 -usedefaultcertificate $true -MatchUri example.com

Note:

- To match child domains of a domain, you can specify a wildcard value in the -MatchUri parameter, for example, *.sip.com. That value matches any domain that ends with the suffix sip.com.

- If you are using IPv6 with a Microsoft Lync server 2013, the * wildcard option is not supported in the -MatchUri parameter.

Step 4

Make the newly created static route persistent in the Central Management store. Enter the following command:
Set-CsStaticRoutingConfiguration -Route @{Add=$tlsRoute}

Note:
Perform this step only for the routing IM and Presence Service node.

Step 5

If you made the new static route persistent, verify that the command was successful. Enter the following command:
Get-CsStaticRoutingConfiguration | select-object -ExpandProperty Route

Step 6

Open the Lync control panel. In the External User Access area:

1. Click New and create a Public Provider for the domain that Lync is federating with (your IM and Presence Service domain) and the FQDN of the VCS Expressway Gateway.

2. In the new Public Provider, configure the Verification level of your users to Allow all communications with this provider.

What to Do Next

Configure Trusted Applications for Lync

Configure Trusted Applications for Lync

On the Lync server, add the IM and Presence Service as a trusted application and add each IM and Presence cluster node to a trusted application server pool. This procedure applies for both Enterprise Edition and Standard Edition Lync deployments.

Procedure

Step 1

Create a trusted application server pool for the IM and Presence Service deployment using the following commands:
Tip:
You can enter Get-CsPool to verify the FQDN value of the Registrar service for the pool.

New-CsTrustedApplicationPool -Identity trusted_application_pool_name_in FQDN_format -Registrar Lync_Registrar_service_FQDN -Site ID_for_the_trusted_application_pool_site -TreatAsAuthenticated $true -ThrottleAsServer $true -RequiresReplication $false -OutboundOnly $false -Computerfqdn first_trusted_application_computer

Example:
New-CsTrustedApplicationPool -Identity trustedpool.sip.com -Registrar lyncserver.synergy.com -Site 1 -TreatAsAuthenticated $true -ThrottleAsServer $true -RequiresReplication $false -OutboundOnly $false -Computerfqdn impserverPub.sip.com

where:

Parameter

Description

-Identity

Enter the name of the trusted application pool for the IM and Presence Service deployment. This must be in FQDN format. For example: trustedpool.sip.com.

Tip:
Ignore warning messages regarding the machine not found in Active Directory and proceed to apply the changes.

-Registrar

The service ID or FQDN of the Registrar service for the pool. For example: lyncserver.synergy.com.

You can check this value using the command Get-CsPool.

-Site

The numeric value of the site where you want to create the trusted application pool.

Tip:
Use the Get-CsSite Management Shell command.

-Computerfqdn

The FQDN of the IM and Presence Service routing node. For example: impserverPub.sip.com.

- impserverPub = the IM and Presence Service hostname.

- sip.com = the IM and Presence Service domain.

Step 2

For each IM and Presence Service node, enter the following commands to add the FQDN of the node as a trusted application computer to the new application pool:
New-CsTrustedApplicationComputer -Identity imp_FQDN -Pool new_trusted_app_pool_FQDN

Example:
New-CsTrustedApplicationComputer -Identity impserver2.sip.com -Pool trustedpool.sip.com

where:

Parameter

Description

-Identity

The FQDN of the IM and Presence Service node. For example: impserver2.sip.com.

Note:
Do not add the IM and Presence Service routing node as a trusted application computer using this command.

-Pool

The FQDN of the trusted application pool that is used for the IM and Presence Service deployment. For example: trustedpool.sip.com.

Step 3

Enter the following command to create a new trusted application and add it to the new application pool:
New-CsTrustedApplication -ApplicationID new_application_name -TrustedApplicationPoolFqdn new_trusted_app_pool_FQDN -Port 5061

Example:
New-CsTrustedApplication -ApplicationID imptrustedapp.sip.com -TrustedApplicationPoolFqdn trustedpool.sip.com -Port 5061

where:

Parameter

Description

-ApplicationID

The name of the application. This can be any value. For example: imptrustedapp.sip.com.

-TrustedApplicationPoolFqdn

The FQDN of the trusted application pool server for the IM and Presence Service deployment. For example: trustedpool.sip.com.

-Port

The SIP listening port of the IM and Presence Service node. For TLS the port is 5061.

What to Do Next

Publish Topology

Publish Topology

The following procedure describes how to commit the topology.

Procedure

Step 1

Log in to the Lync Server Management Shell.

Step 2

Enter the Enable-CsTopology command to enable the topology.

What to Do Next

Configure Certificates on Lync

Configure Certificates on Lync

Complete the following tasks to install and set up certificates on your Lync servers for partitioned intradomain federation with IM and Presence Service.

Procedure

Command or Action

Purpose

Step 1

Install Certificate Authority Root Certificates on Lync

To support TLS encryption between IM and Presence Service and Lync, each Lync server must have a signed security certificate.

Step 2

Validate Existing Lync Signed Certificate

To support TLS encryption between IM and Presence Service and Lync, each Lync server must have a signed security certificate that supports Client Authentication.

Step 3

Request a Signed Certificate from a Certificate Authority for Lync

Request a newly signed certificate from the Certificate Authority (CA) and install it onto a Lync server.

Step 4

Download a Certificate from the CA Server

Download the newly signed certificate from the CA server.

Step 5

Import a Signed Certificate for Lync

Import the newly signed certificate into Lync.

Step 6

Assign Certificate on Lync

On the Lync server, assign the newly signed certificate.

Step 7

Restart Services on Lync Servers

Restart the Lync front-end services to ensure that the configuration takes effect.

- Install Certificate Authority Root Certificates on Lync

- Validate Existing Lync Signed Certificate

- Request a Signed Certificate from a Certificate Authority for Lync

- Download a Certificate from the CA Server

- Import a Signed Certificate for Lync

- Assign Certificate on Lync

- Restart Services on Lync Servers

Install Certificate Authority Root Certificates on Lync

TLS configuration must be used for partitioned intradomain federation between the IM and Presence Service and Lync servers. TCP cannot be used. To support TLS encryption between IM and Presence Service and Lync, each Lync server must have a signed security certificate. This signed certificate, along with the root certificate of the Certificate Authority (CA) that signed the certificate, must be installed on each Lync server.

Cisco recommends that Lync and IM and Presence Service servers share the same CA. If not, the root certificate of the CA that signed the IM and Presence Service certificates must also be installed on each Lync server.

Generally, the root certificate of the Lync CA is already installed on each Lync server. Therefore, if Lync and IM and Presence Service share the same CA, there may be no need to install a root certificate. However, if a root certificate is required, see the following details.

If you are using Microsoft Certificate Authority, refer to the following procedures in the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for information about installing the root certificate from the Microsoft Certificate Authority onto Lync:

- Downloading the CA Certification Chain

- Installing the CA Certification Chain

If you are using an alternative CA, the following procedure is a generic procedure for installing root certificates onto Lync servers. The procedure for downloading the root certificate from the CA differs depending on your chosen CA.

Note

The Integration Guide for Configuring IM and Presence Service for Interdomain Federation document refers to the Access Edge Server. For partitioned intradomain federation, you can replace references to the Access Edge Server with Lync Standard Edition server or Enterprise Edition front-end server.

Before You Begin

Download the root certificate or certificate chain from your CA and save it to the hard disk of your Lync server.

Procedure

Step 1

On your Lync server, choose Start > Run.

Step 2

Enter mmc and click OK.

Step 3

From the File menu, choose Add/Remove Snap-in.

Step 4

From the Add/Remove Snap-in dialog box, click Add.

Step 5

From the list of Available Standalone Snap-ins, choose Certificates and click Add.

Step 6

Choose Computer Account, and then click Next.

Step 7

In the Select Computer dialog box, check the <Local Computer> (the computer this console is running on) check box and click Finish.

Step 8

Click Close, and then click OK.

Step 9

In the left pane of the Certificates console, expand Certificates (Local Computer).

Step 10

Expand Trusted Root Certification Authorities.

Step 11

Right-click Certificates and choose All Tasks.

Step 12

Click Import.

Step 13

In the Import Wizard, click Next.

Step 14

Click Browse and navigate to where you saved the root certificate or certificate chain.

Step 15

Choose the file and click Open.

Step 16

Click Next.

Step 17

Leave the default value Place all certificates in the following store and verify that Trusted Root Certification Authorities appears under the Certificate store.

Step 18

Click Next and then click Finish.

Step 19

Repeat Step 11 to Step 18 as necessary for other CAs.

What to Do Next

Validate Existing Lync Signed Certificate

Related Information

Integration Troubleshooting

Validate Existing Lync Signed Certificate

To support TLS encryption between IM and Presence Service and Lync, each Lync server must have a signed security certificate that supports Client Authentication. If a signed certificate is already installed on the Lync server, the following procedure describes how to check if that existing signed certificate supports Client Authentication.

Verify that the certificate is assigned one of the following OID values:

- If the certificate is configured for both server and client authentication, the OID value is "1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2"

- If the certificate is configured for server authentication only, the OID value is "1.3.6.1.5.5.7.3.1"

Note

- For Standard Edition, you must perform this procedure on all Standard Edition servers.

- For Enterprise Edition, you must perform this procedure on all front-end servers.

Procedure

Step 1

On your Lync server, choose Start > Run.

Step 2

Enter mmc and click OK.

Step 3

From the File menu, choose Add/Remove Snap-in.

Step 4

From the Add/Remove Snap-in dialog box, click Add.

Step 5

From the list of Available Standalone Snap-ins, choose Certificates and click Add.

Step 6

Choose Computer Account and click Next.

Step 7

In the Select Computer dialog box, check the <Local Computer> (the computer this console is running on) check box and click Finish.

Step 8

Click Close, and then click OK.

Step 9

In the left pane of the Certificates console, expand Certificates (Local Computer).

Step 10

Expand Personal and choose Certificates.

Step 11

Find the signed certificate currently used by Lync in the right pane.

Step 12

Verify that Client Authentication is listed in the Intended Purposes column.

What to Do Next

Request a Signed Certificate from a Certificate Authority for Lync

Related Information

Integration Troubleshooting

Request a Signed Certificate from a Certificate Authority for Lync

To support TLS encryption between IM and Presence Service and Lync, each Lync server must have a signed security certificate that supports Client Authentication and Server Authentication. The following procedure outlines how to request a newly signed certificate from the Certificate Authority (CA) and install it onto a Lync server.

The following procedure is based on a Windows Server 2003 certification authority. The procedure may be slightly different on other Windows server versions.

Note

The CA must have a certificate template that supports client authentication and server authentication Extended Key Usage (EKU), and this template must be used to sign the certificate.

Verify that the certificate is assigned one of the following OID values before you install the certificate onto a Lync server:

- If the certificate is configured for both server and client authentication, the OID value is "1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2"

- If the certificate is configured for server authentication only, the OID value is "1.3.6.1.5.5.7.3.1"

Tip

If a specific template type is not specified when you generate the Certificate Signing Request (CSR), a default template format is used. The template type that you specify during the certificate enrollment process must match the template type that is specified in the certificate, otherwise the certificate enrollment process fails.

Procedure

Step 1

In the Lync Server Management Shell enter the following command to create the CSR file:
Request-CsCertificate -New -Type Default -Output filename -ClientEku $true

Note:
If you want to create a specific request for an internal or external certificate, use the -Type Internal or -Type External parameters instead of -Type Default.

If you are using a custom certificate template on your CA to sign the certificate, add the -Template template_name parameter to the command string.

Step 2

Log in to the Lync server and open a web browser.

Step 3

Open the following URL: http://ca_server_IP_address/certsrv (If it is SSL encrypted, use https instead of http.)

Step 4

Click Request a Certificate and then click Advanced Certificate Request.

Step 5

Choose Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or Submit a renewal request by using a base-64-encoded PKCS #7 file.

Step 6

Open the request file you created using a text editor.

Step 7

Select and copy all of the text from the request file and paste it into the browser in the field Base-64-encoded certificate request (CMC or PKCS #10 or PKCS #7):

Step 8

Click Submit.

What to Do Next

Download a Certificate from the CA Server

Download a Certificate from the CA Server

Complete the following procedure to download the certificate from the CA server.

Procedure

Step 1

Log into the CA server.

Step 2

Choose Start > Administrative Tools > Certificate Authority to launch the CA console.

Step 3

Click Pending Requests.

Step 4

From the right pane, right-click on the certificate request that you submitted and choose All Tasks > Issue.

Step 5

Log into the Lync server and open a web browser.

Step 6

Open the following URL: http://ca_server_IP_address/certsrv (If it is SSL encrypted, use https instead of http.)

Step 7

From View the Status of a Pending Certificate Request, choose your certificate request.

Step 8

Download the certificate.

What to Do Next

Import a Signed Certificate for Lync

Import a Signed Certificate for Lync

Complete the following procedure to import the signed certificate.

Before You Begin

Note

Verify that the certificate is assigned one of the following OID values:

- If the certificate is configured for both server and client authentication, the OID value is "1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2"

- If the certificate is configured for Server Authentication only, the OID value is "1.3.6.1.5.5.7.3.1"

Procedure

In the Lync Server Management Shell, enter the following command to import the signed certificate:
Import-CsCertificate -Path "signed_certificate_path" -PrivateKeyExportable $false

Note:
If the certificate contains a private key, use the -PrivateKeyExportable $true parameter.

What to Do Next

Assign Certificate on Lync

Related Information

Integration Troubleshooting

Assign Certificate on Lync

Complete the following procedure to assign the certificate.

Procedure

Step 1

Choose Start > Lync Server Deployment Wizard.

Step 2

Click Install or Update Lync Server System.

Step 3

Click Run Again to Request, Install or Assign Certificates.

Step 4

On the Certificate Wizard window, choose the default certificate.

Step 5

Click Assign.

Step 6

On the Certificate assignment window, click Next.

Step 7

Choose the imported certificate in the certificate store window and click Next.

Step 8

In the certificate assignment summary window click Next.

Step 9

On the executing commands window, wait for the task status to report Completed and then click Finish.

Step 10

Close the certificate wizard window.

What to Do Next

Restart Services on Lync Servers

Restart Services on Lync Servers

After you complete all the configuration steps on Lync, you must restart the Lync front-end services to ensure that the configuration takes effect.

Note

- Cisco recommends that you perform this procedure during a scheduled maintenance window.

- For Standard Edition, you must perform this procedure on all Standard Edition servers.

- For Enterprise Edition, you must perform this procedure on all front-end servers.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Services.

Step 2

Right-click the service Lync front end server and choose Restart.

Related Information

Integration troubleshooting

Chapter 7. Microsoft Office Communications Server Configuration for Partitioned Intradomain Federation

Microsoft Office Communications server configuration for partitioned intradomain federation applies only to Microsoft Office Communications Server (OCS) 2007 R2.

Domain Verification for OCS Servers

Before you proceed to set up IM and Presence Service for partitioned intradomain federation, verify that there are matching domains configured on the Microsoft OCS servers and all nodes in the IM and Presence Service cluster.

Use the Cisco Unified CM IM and Presence Administration user interface to verify local domains that are configured on the IM and Presence Service, as well as the system-managed domains that are configured on external servers.

Enable Port 5060/5061 on OCS Server

To use unencrypted TCP connections for SIP traffic between IM and Presence Service and OCS, configure the OCS server to listen on TCP SIP port 5060. For federated TLS connections, configure the OCS server to listen on TLS port 5061.

Note

- For Standard Edition, you must complete this procedure on all Standard Edition servers.

- For Enterprise Edition, you must complete this procedure on all front-end servers.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the FQDN of the Standard Edition or Enterprise Edition front-end server and choose Properties > Front End Properties.

Step 3

Click the General tab.

Step 4

If port 5060 or 5061 is not listed under Connections, click Add.

Step 5

Choose All as the IP Address Value.

Step 6

Enter the Transport and Port values.

- For TCP, enter TCP as the Transport Value and 5060 as the Port Value.

- For TLS, enter TLS as the Transport Value and 5061 as the Port Value.

Step 7

Click OK to close the Add Connection window. The port value should now be listed under the Connections list.

Step 8

Click OK again to close the Front End Server Properties window.

What to Do Next

Configure static routes on the OCS server to point to the IM and Presence Service.

Related Information

Integration Troubleshooting

Federated Link to Microsoft OCS Server Configuration Task List

The following table provides an overview of the steps to configure federated links between IM and Presence Service and Microsoft OCS servers.

If you are using direct federation from IM and Presence Service to OCS without the Access Edge server or Cisco Adaptive Security Appliance, you must configure a TLS or TCP static route for each domain on the OCS server. These static routes are to point to an IM and Presence Service node. The Cisco Adaptive Security Appliance or the Microsoft Access Edge are not required.

- For Standard Edition, you must you must configure static routes on all Standard Edition servers.

- For Enterprise Edition, you must you must configure static routes on all pools.

Task List for End-to-End Configuration of Federated Links to Microsoft OCS Server

Step

Description

Configure a static route on IM and Presence Service

TLS or TCP is supported.

For TLS, select TLS as the Protocol Type and 5061 as the Next Hop Port number.

For TCP, select TCP as the Protocol Type and 5060 as the Next Hop Port number.

Configure a static route on OCS for IM and Presence Service

TLS or TCP is supported.

For TLS, the static route port should be 5061

For TCP, the static route port should be 5060.

Important:
When using TLS with static routes on OCS, you must specify the FQDN of the IM and Presence Service node, rather than an IP address.

Verify the Peer Auth Listener port is configured as 5061 and change Server Auth Listener port.

Log in to Cisco Unified CM IM and Presence Administration, choose System > Application Listeners.

- Verify that the Peer Auth Listener port is 5061.

- If the Server Auth Listener port is configured as 5061, you must change it to another value, for example 5063.

Configure a host authorization entry for the IM and Presence Service

This procedure applies to TLS and TCP.

For TLS, you must add two host authorization entries for each IM and Presence Service node, one entry using the IP address of the IM and Presence Service node, and the second entry using the IM and Presence Service FQDN.

For TCP, only one host authorization entry using the IM and Presence Service IP address needs to be added for each IM and Presence Service node.

Configure the certificates on OCS

This procedure is only for TLS.

To retrieve the CA root certificate and the OCS signed certificate, perform the following steps:

- Download and install the CA certificate chain.

- Request a certificate from the CA server

- Download the certificate from the CA server

In the OCS Front End Server Properties, ensure the TLS listener for port 5061 on OCS is configured. (The transport can be MTLS or TLS).

From the OCS Front End Server Properties, choose the Certificates tab, and click Select Certificate to choose the OCS signed certificate.

Configure OCS to use FIPS (TLSv1 rather than SSLv3), and import the CA root certificate.

This procedure is only for TLS.

1. Open the Local Security Settings on OCS.

2. In the console tree, choose Local Polices.

3. Choose Security Options.

4. Double-click System Cryptography:Use FIPS Compliant algorithms for encryption, hashing and signing.

5. Enable the security setting.

6. Click OK.

Note:
You may need to restart OCS for this to take effect.

7. Import the CA root certificate for the CA that signs the IM and Presence Service certificate. Import the CA root certificate in to the trust store on OCS using the certificate snap-in.

Configure the certificates on IM and Presence Service

This procedure is only for TLS.

You must upload the root certificate for the CA that signs the OCS server certificates to IM and Presence Service. As well, generate a CSR for IM and Presence Service and have it signed by the CA. Then upload the CA-signed certificate to IM and Presence Service.

You must then add a TLS peer subject on IM and Presence Service for the OCS Server. See topics related to setting up certificates for detailed instructions.

Configure Static Routes on OCS to Point to the IM and Presence Service

To allow OCS to route requests to IM and Presence Service for direct federation, you must configure a TLS or TCP static route on the OCS server for each IM and Presence Service domain. These static routes are to point to an IM and Presence Service node.

Note

- For Standard Edition, you must complete this procedure on all Standard Edition servers.

- For Enterprise Edition, you must complete this procedure on all pools.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the Enterprise Edition pool name or the Standard Edition server name, as appropriate.

Step 3

Choose Properties > Front End Properties.

Step 4

Choose the Routing tab and click Add.

Step 5

Enter the domain for the IM and Presence Service node, for example, foo.com.

Step 6

Ensure that the check box for Phone URI is unchecked.

Step 7

Set the next hop transport, port, and IP address/FQDN values:

- For TCP, choose TCP as the Next Hop Transport value and enter a Next Hop Port value of 5060. Enter the IP address of the IM and Presence Service node as the Next Hop IP Address.

- For TLS, choose TLS as the Next Hop Transport value and enter a Next Hop Port value of 5061. Enter the IP address of the IM and Presence Service node as the FQDN.

Note:

- The port used for the TLS static route must match the Peer Auth Listener port that is configured on the IM and Presence Service node.

- The FQDN must be resolvable by the OCS server. Ensure that the FQDN resolves to the IP address of the IM and Presence Service node.

Step 8

Ensure that the check box for Replace host in request URI is unchecked.

Step 9

Click OK to close the Add Static Route window. The new static route should appear in the Routing list.

Step 10

Click OK again to close the Front End Server Properties window.

What to Do Next

See Verify Peer Authentication Listener in the Interdomain Federation for IM and Presence Service on Cisco Unified Communcations Manager guide.

Add Host Authorization on OCS for IM and Presence Service

To allow OCS to accept SIP requests from IM and Presence Service without being prompted for authorization, you must configure Host Authorization entries on OCS for each IM and Presence Service node.

For TCP, only one host authorization entry using the IM and Presence Service IP address needs to be added for each IM and Presence Service node.

If you are configuring TLS encryption between OCS and IM and Presence Service, you must add two Host Authorization entries for each IM and Presence Service node, as follows:

- The first entry must contain the FQDN of the IM and Presence Service node.

- The second entry must contain the IP address of the IM and Presence Service node.

If you are not configuring TLS encryption, then you add only one Host Authorization entry for each IM and Presence Service node. This host authorization entry must contain the IP address of the IM and Presence Service node.

The following procedure describes how to add the required Host Authorization entries.

Note

- For Standard Edition, you must complete this procedure on all Standard Edition servers.

- For Enterprise Edition, you must complete this procedure on all pools.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the Enterprise Edition pool name or the Standard Edition server name, as appropriate.

Step 3

Choose Properties > Front End Properties.

Step 4

Choose the Host Authorization tab and click Add.

Step 5

If you are entering an FQDN, choose FQDN and enter the FQDN of the IM and Presence Service node. For example, imp1.foo.com.

Step 6

If you are entering an IP address, choose IP Address and enter the IP address of the IM and Presence Service node. For example, 10.x.x.x.

Step 7

Ensure that the Outbound Only check box is unchecked.

Step 8

Check the Throttle as Server check box.

Step 9

Check the Treat as Authenticated check box.

Step 10

Click OK to close the Add Authorized Host window.

Step 11

Repeat Step 4 to Step 10 for each IM and Presence node.

Step 12

After you add all the Host Authorization entries, click OK to close the Front End Server Properties window.

What to Do Next

Restart Services on OCS Front-End Servers

Related Information

Integration Troubleshooting

Restart Services on OCS Front-End Servers

After you complete all the configuration steps on OCS, you must restart the OCS services to ensure that the configuration takes effect.

Note

- Cisco recommends that you perform this procedure during a scheduled maintenance window.

- For Standard Edition, you must follow this procedure on all Standard Edition servers.

- For Enterprise Edition, you must follow this procedure on all front-end servers.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the FQDN of the Standard Edition server or Enterprise Edition front-end server and choose Stop > Front End Services > Front End Service.

Step 3

After the services stop, right-click the FQDN of the Standard Edition server or Enterprise Edition front-end server and choose Start > Front End Services > Front End Service.

Related Information

Integration Troubleshooting

TLS Encryption Configuration

You must complete the procedures in this section to configure TLS encryption between IM and Presence Service and OCS.

After the TLS configuration is complete, you must restart services on OCS servers. See Restart Services on OCS Front-End Servers.

Enable Federal Information Processing Standard Compliance on OCS

To support TLS encryption between IM and Presence Service and OCS, you must enable TLSv1 on OCS servers. TLSv1 is included as part of the Federal Information Processing Standard (FIPS) compliance on Windows servers. The following procedure describes how to enable FIPS compliance.

Note

- For Standard Edition, you must perform this procedure on all Standard Edition servers.

- For Enterprise Edition, you must perform this procedure on all front-end servers.

Procedure

Step 1

On the OCS server, choose Start > Programs > Administrative Tools > Local Security Policy.

Step 2

From the console tree, choose Local Policies.

Step 3

Choose Security Options.

Step 4

Double-click System Cryptography: Use FIPS Compliant algorithms for encryption, hashing and signing.

Step 5

Enable the security setting.

Step 6

Click OK.

Step 7

Close the Local Security Settings window.

What to Do Next

Configure Mutual TLS Authentication on OCS

Related Information

Integration Troubleshooting

Configure Mutual TLS Authentication on OCS

To configure TLS encryption betweenIM and Presence Service and OCS, you must configure port 5061 on the OCS servers for Mutual TLS authentication. The following procedure describes how to configure port 5061 for Mutual TLS authentication.

Note

- For Standard Edition, you must perform this procedure on all Standard Edition servers.

- For Enterprise Edition, you must perform this procedure on all front-end servers.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the FQDN of the Standard Edition server or Enterprise front-end server and choose Properties > Front End Properties.

Step 3

Choose the General tab.

Step 4

If the Transport associated with Port 5061 is MTLS, go to Step 8.

Step 5

If the Transport associated with Port 5061 is not MTLS, click Edit.

Step 6

From the Transport drop-down list, choose MTLS.

Step 7

Click OK to close the Edit Connection window. The Transport associated with Port 5061 should now be MTLS.

Step 8

Click OK to close the Properties window.

What to Do Next

Install Certificate Authority Root Certificates on OCS

Related Information

Integration Troubleshooting

Install Certificate Authority Root Certificates on OCS

To support TLS encryption between IM and Presence Service and OCS, each OCS server must have a signed security certificate. This signed certificate, along with the root certificate of the Certificate Authority (CA) that signed the certificate, must be installed on each OCS server.

Cisco recommends that OCS and IM and Presence Service nodes share the same CA. If not, the root certificate of the CA that signed the IM and Presence Service certificates must also be installed on each OCS server.

Generally, the root certificate of the OCS CA is already installed on each OCS server. Therefore, if OCS and IM and Presence Service share the same CA, there may be no need to install a root certificate. However, if a root certificate is required, see the following details.

If you are using Microsoft Certificate Authority, refer to the following procedures in the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for information about installing the root certificate from the Microsoft Certificate Authority onto OCS:

- Downloading the CA Certification Chain

- Installing the CA Certification Chain

If you are using an alternative CA, the following procedure is a generic procedure for installing root certificates onto OCS servers. The procedure for downloading the root certificate from the CA differs depending on your chosen CA.

Before You Begin

Download the root certificate or certificate chain from your CA and save it to the hard disk of your OCS server.

Procedure

Step 1

On your OCS server, choose Start > Run.

Step 2

Enter mmc and click OK.

Step 3

From the File menu, choose Add/Remove Snap-in.

Step 4

From the Add/Remove Snap-in dialog box, click Add.

Step 5

From the list of Available Standalone Snap-ins, choose Certificates, and then click Add.

Step 6

Choose Computer Account, and then click Next.

Step 7

In the Select Computer dialog box, check the check box for <Local Computer> (the computer this console is running on), and then click Finish.

Step 8

Click Close, and then click OK.

Step 9

In the left pane of the Certificates console, expand Certificates (Local Computer).

Step 10

Expand Trusted Root Certification Authorities.

Step 11

Right-click Certificates, and choose All Tasks.

Step 12

Click Import.

Step 13

In the Import wizard, click Next.

Step 14

Click Browse and navigate to where you saved the root certificate or certificate chain.

Step 15

Choose the file and click Open.

Step 16

Click Next.

Step 17

Leave the default value Place all certificates in the following store and ensure that Trusted Root Certification Authorities appears under the Certificate store.

Step 18

Click Next, and then click Finish.

Step 19

Repeat Step 11 to Step 18 as necessary for other CAs.

Note

The Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager document refers to the Access Edge Server. For partitioned intradomain federation, you can replace references to the Access Edge Server with OCS Standard Edition server or Enterprise Edition front-end server.

What to Do Next

Validate Existing OCS Signed Certificate

Related Information

Integration Troubleshooting

Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager

Validate Existing OCS Signed Certificate

To support TLS encryption between IM and Presence Service and OCS, each OCS server must have a signed security certificate that supports Client Authentication. If a signed certificate is already installed on the OCS server, the following procedure describes how to check if that existing signed certificate supports Client Authentication.

Note

- For Standard Edition, you must perform this procedure on all Standard Edition servers.

- For Enterprise Edition, you must perform this procedure on all front-end servers.

Procedure

Step 1

On your OCS server, choose Start > Run.

Step 2

Enter mmc and click OK.

Step 3

From the File menu, choose Add/Remove Snap-in.

Step 4

From the Add/Remove Snap-in dialog box, click Add.

Step 5

From the list of Available Standalone Snap-ins, choose Certificates and click Add.

Step 6

Choose Computer Account and click Next.

Step 7

In the Select Computer dialog box, check the <Local Computer> (the computer this console is running on) check box and click Finish.

Step 8

Click Close, and then click OK.

Step 9

In the left pane of the Certificates console, expand Certificates (Local Computer).

Step 10

Expand Personal and choose Certificates.

Step 11

Find the signed certificate currently used by OCS in the right pane.

Step 12

Ensure that Server and Client Authentication is listed in the Intended Purposes column.

What to Do Next

Signed Certificate Request from the Certificate Authority for the OCS Server

Related Information

Integration Troubleshooting

Signed Certificate Request from the Certificate Authority for the OCS Server

This section describes how to install a signed certificate on a Microsoft Office Communicator Server (OCS) and how to choose the installed certificate for TLS negotiation.

Note

The procedures in this topic are only necessary if no signed certificate exists on an OCS or the existing certificate does not support Client Authentication.

To support TLS encryption between IM and Presence Service and OCS, each OCS must have a signed security certificate that supports Client Authentication. If that is not the case on any OCS, the following procedures outline how to request a newly signed certificate from the Certificate Authority and install it onto that specific OCS.

The Subject Common Name (CN) used in Certificate Signing Requests (CSR) from the OCS differs depending on the OCS deployment:

- For Standard Edition servers, use the FQDN of the Standard Edition server as the Subject CN.

- For Enterprise Edition front-end servers, use the FQDN of the pool to which the front-end server belongs as the Subject CN.

Standalone Microsoft Certificate Authority

If you are using a Standalone Microsoft Certificate Authority, see the following procedures in the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager to request a signed certificate from the CA for the OCS:

- Requesting a Certificate from the CA Server

- Downloading the Certificate from the CA Server

Note

This document refers to the Access Edge Server. For Partitioned Intradomain Federation, you can replace references to the Access Edge Server with an OCS Standard Edition or Enterprise Edition front-end server.

Enterprise Microsoft Certificate Authority

If you are using an Enterprise Microsoft Certificate Authority, see the following procedures in the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager to generate the required template on the CA and request a signed certificate from the CA for the OCS:

- Creating a Custom Certificate for Access Edge Using an Enterprise Certificate Authority

- Requesting the Site Server Signing Certificate

Alternative Certificate Authority

If you are using an alternative CA, the following is a generic procedure for installing signed certificates onto the OCS. The procedure for requesting a signed certificate differs depending on your chosen CA.

Related Information

Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager

Install Signed Certificate on the OCS Server

Before You Begin

Download the signed certificate from your CA and save it to the hard disk of your OCS server.

Procedure

Step 1

On your OCS server, choose Start > Run.

Step 2

Enter mmc and click OK.

Step 3

From the File menu, choose Add/Remove Snap-in.

Step 4

From the Add/Remove Snap-in dialog box, click Add.

Step 5

From the list of Available Standalone Snap-ins, choose Certificates and click Add.

Step 6

Choose Computer Account and click Next.

Step 7

In the Select Computer dialog box, check the <Local Computer> (the computer this console is running on) check box and click Finish.

Step 8

Click Close, and then click OK.

Step 9

In the left pane of the Certificates console, expand Certificates (Local Computer).

Step 10

Expand Personal.

Step 11

Right-click Certificates, and then choose All Tasks.

Step 12

Click Import.

Step 13

In the Import wizard, click Next.

Step 14

Click Browse and navigate to where you saved the signed certificate.

Step 15

Choose the file and click Open.

Step 16

Click Next.

Step 17

Leave the default value Place all certificates in the following store and ensure that Personal appears under the Certificate store.

Step 18

Click Next, and then click Finish.

What to Do Next

Select Installed Certificate for TLS Negotiation

Related Information

Integration Troubleshooting

Select Installed Certificate for TLS Negotiation

Regardless of which CA is used, after the signed certificate is installed onto the OCS server, you must perform the following procedure to select the installed certificate for use by OCS in TLS negotiation withIM and Presence Service.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Right-click the FQDN of the Standard Edition server or Enterprise Edition front-end server and choose Properties > Front End Properties.

Step 3

Choose the Security tab and choose Select Certificate.

Step 4

From the list of installed certificates, choose the newly signed certificate and click OK to close the Select Certificate window.

Step 5

Click OK to close the Properties window.

What to Do Next

Restart Services on OCS Front-End Servers

Related Information

Integration Troubleshooting

Chapter 8. User Migration

Cisco User Migration Tools

Cisco provides the following tools to aid the user migration process from Lync/OCS to IM and Presence Service:

- Export Contact List tool—allows you to export contact lists in bulk from the Microsoft server for migrating users

- Disable Account tool—allows you to disable the Microsoft server account of migrating users

- Delete Account tool—allows you to delete migrating users from the Microsoft server so that presence requests for these users are later routed to IM and Presence Service

These user migration tools can be collectively downloaded as a zip file from the IM and Presence Service Download Software page on cisco.com at Click Here .

The zip file contains the three tools and a text file called version.txt. The text file contains the current version number of the tools and must be saved in the same folder as the tools. If the tools are stored in different folders, you must store a copy of the text file in each location. If the text file is not in the same folder when you run a tool, you receive an error and the tool does not run.

Tip

While attempting to run any of the user migration tools you may receive the following error: "Application failed to initialize properly". The reason for this error is that you are attempting to run the user migration tools without the .NET 2.0 Framework installed. Each of the user migration tools that Cisco provides requires that at least version 2.0 of the .NET Framework is installed on the server where you are running the tool.

The .NET 2.0 Framework comes installed as standard on Windows Server 2003 R2 or newer.

Recommendations before Migration

Cisco recommends that you perform the following tasks before you begin to migrate users from Lync/OCS to IM and Presence Service:

- Set unlimited contact lists and watchers

- Enable automatic authorization of subscription requests

- Disable new subscriber notification pop-ups on Microsoft Lync

The IM and Presence Service IM addresses can be set to match the OCS/Lync SIP URI (msRTCSIP-PrimaryUserAddress) so that the user's identity is maintained throughout the migration. If that is not possible, then user rename is required.

For more information about setting the IM address value for IM and Presence Service nodes in the cluster, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

Set Unlimited Contact Lists and Watchers

Before you migrate users from Lync/OCS to IM and Presence Service, Cisco recommends that you set the Maximum Contact List Size and Maximum Watchers settings on IM and Presence Service to unlimited. This ensures that each migrated user contact list is fully imported to IM and Presence Service.

After all users have been migrated to IM and Presence Service, reset the Maximum Contact List Size and Maximum Watchers settings on IM and Presence Service to the desired values. The system default value is 200 for Maximum Contact List Size and 200 for Maximum Watchers size.

The following procedure describes how to set unlimited values for the Maximum Contact List Size and Maximum Watchers settings.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. When you change Presence settings, they are applied to all nodes in the cluster; therefore you need to set them only on the IM and Presence Service database publisher node within any given cluster.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Settings.

Step 2

For Maximum Contact List Size (per user), check the No Limit check box.

Step 3

For Maximum Watchers (per user), check the No Limit check box.

Step 4

Click Save.

Step 5

Restart the Cisco XCP Router on all IM and Presence Service nodes in the cluster. To restart the Cisco XCP Router, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center – Network Services.

Enable Automatic Authorization of Subscription Requests

To improve user experience during migration, Cisco recommends that you allow automatic authorization of subscription requests before you begin the migration process. Otherwise, each IM and Presence Service user is forced to manually authorize subscription requests each time they are imported as a contact into the IM and Presence Service. This setting should only be disabled, if desired, after all migrations are complete.

The following procedure describes how to enable automatic authorization of subscription requests.

Note

This setting is enabled by default on IM and Presence Service.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. When you change Presence settings, they are applied to all nodes in the cluster; therefore you need to set them only on the IM and Presence database publisher node within any given cluster.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Settings.

Step 2

Check the check box for Allow users to view the availability of other users without being prompted for approval.

Step 3

Click Save.

Step 4

Restart the Cisco XCP Router on all IM and Presence Service nodes in the cluster. To restart the Cisco XCP Router, log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Tools > Control Center – Network Services.

Subscriber Notification Pop-ups

When you migrate users from Microsoft Lync to IM and Presence Service, users that remain on Lync may receive subscription notification pop-ups from some of those migrated users. Such a notification only occurs when:

- the migrated user has the Microsoft Lync user in their contact list

and

- the Microsoft Lync user does not have that same migrated user in their contact list

If the Microsoft Lync user has the migrated contact in their contact list also, then there is no notification pop-up. When an individual notification pop-up has been handled by the Microsoft Lync user, it will not re-appear.

If you do not want Lync users to receive new subscriber notification pop-ups you can disable Lync pop-ups. You have two options when disabling these notification pop-ups:

- you can disable pop-ups for the entire duration of user migration

- you can disable pop-ups only during the migration of a batch of users

If you disable pop-ups, then all pop-ups for all Lync users will be disabled until you re-enable them.

Note

Disabling and enabling Microsoft Lync pop-ups requires a restart of the Lync front-end services.

Disable Microsoft Lync Pop-ups

If you want to disable all pop-ups for all Microsoft Lync users, complete the following procedure before you begin the user migration or the migration of a batch of users.

Procedure

Step 1

On the Lync front-end server choose Start > All Programs > Microsoft Lync Server 2010 > Lync Server Management Shell.
Tip:
Enter either Microsoft Lync Server 2010 or 2013, depending on your Microsoft Lync Server version.

Step 2

Enter the following powershell command:
Set-CSClientpolicy -EnableNotificationForNewSubscriber $False

Step 3

Choose Start > Programs > Administrative Tools > Services.

Step 4

Right-click the service Lync front end server and click Restart.

Restore Microsoft Lync Pop-up Behavior

To restore the previous client behavior for notification pop-ups for Microsoft Lync users complete the following procedure after user migration is complete or after the migration of a batch of users is complete.

Procedure

Step 1

Enter the following command to restore client pop-up behavior on Lync:
Set-CSClientpolicy -EnableNotificationForNewSubscribers $Null

Step 2

Choose Start > Programs > Administrative Tools > Services.

Step 3

Right-click the service Lync front end server and choose Restart.

Verify Microsoft Server SIP URI Format for Migrating Users

Use this procedure to check that the IM address format that is configured on IM and Presence Service aligns with the IM address format of the Microsoft servers.

IM and Presence Service supports two IM address schemes. If you use the Directory URI IM address scheme, the IM address format between IM and Presence Service and the Microsoft servers align. However, if you use the UserID@Default_Domain IM address scheme, misalignment of the IM address schemes is possible.

The UserID@Default_Domain IM address scheme URIs are composed by joining the Cisco Unified Communications Manager user ID with the IM and Presence Service default domain. If any Lync/OCS URIs do not match the UserID@Default_Domain IM address format, you must modify the URIs of the migrating users. You can modify a batch of Microsoft server URIs before you migrate each batch of Microsoft server users to IM and Presence Service.

Note

For releases earlier than release 10.0(1), you must modify all Microsoft server URIs before the first batch of users are migrated from a Microsoft server to IM and Presence Service.

When the Directory URI IM address scheme is used, Microsoft server users do not have to be renamed if they are from domains that differ from the domains which are configured on the Cisco Unified Communications Manager and IM and Presence Service clusters. Individual users can be assigned a different email domain. You must configure IM and Presence Service for interdomain federation with the Microsoft servers and set up the email for federation feature if the Microsoft server users are on a different domain.

For more information about the SIP URI format, see topics related to maintaining user identity during migration.

For more information about the IM and Presence Service IM address schemes, see Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

For more information about setting up interdomain federation between IM and Presence Service and Microsoft servers, see the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager guide.

Procedure

Step 1

Verify that the IM address scheme is set to Directory URI and that the directory URI maps to msRTCSIP-PrimaryUserAddress on Cisco Unified Communications Manager. If the Directory URI IM address scheme is configured and is properly mapped, then alignment is guaranteed. If it is not possible to configure IM and Presence Service to use the Directory URI address scheme, proceed to the next step.

Step 2

Check that the format of the current IM address scheme for IM and Presence Service matches the format that the Microsoft server uses. If the IM address formats do not align, then you must rename the users on the Microsoft server before migration. See the following procedures for more information about modifying the Microsoft server SIP URI.

What to Do Next

Rename Contact IDs in IM and Presence Service Contact Lists

Modify Lync SIP URI

Complete the following procedure to change the format of a Lync user's SIP URI.

Procedure

Step 1

From the Lync Control Panel, choose the Users tab.

Step 2

Search for the user that you want to change and double-click the user.

Step 3

Change the SIP address field.

Step 4

Click Commit.
Tip:
To modify SIP URIs in bulk, use the Set-CsUser cmdlet. For more information, see Click Here .

What to Do Next

Rename contact ids in the IM and Presence Service contact lists.

Modify OCS SIP URI

Complete the following procedure on the Active Directory server to change the format of the SIP URI for an OCS user.

Procedure

Step 1

On the Active Directory server, choose Start > Control Panel > Administrative Tools > Active Directory Users and Computers.

Step 2

Search for the user that you want to change and double-click the user.

Step 3

From the Properties window, choose the Live Communications tab.

Step 4

Change the SIP URI field.

Step 5

Click OK.
Note:
To modify SIP URIs in bulk, use the System.DirectoryServices that are provided by Microsoft to update the msRTCSIP-PrimaryUserAddress property for each affected user. For more information, see Click Here .

What to Do Next

Rename contact ids in the IM and Presence Service contact lists.

Rename Contact IDs in IM and Presence Service Contact Lists

Note

- This procedure is necessary only if you modified any Lync/OCS SIP URIs . For more information about URI formats, see topics related to maintaining user identity during migration.

- You must complete this procedure before the modified Microsoft server users are enabled for IM and Presence Service.

- Cisco recommends that you run this tool during a scheduled maintenance window.

Before you can rename the contact IDs for a set of users, you must upload a file containing a list of contact IDs and the corresponding new format of each of those contact IDs. The file must be a CSV file with the following format:

Contact ID, New Contact ID

where Contact ID is the user's IM address as it appears on the Presence Topology User Assignment window.

The following is a sample CSV file with one entry:

Contact ID, New Contact ID
john.smith@example.com, jsmith@example.com

Note

- It is your responsibility to compile the CSV file with the appropriate contact IDs.

- You must ensure that the header Contact ID, New Contact ID is present in all CSV files.

When you run the job, the IM and Presence Service Bulk Administration Tool (BAT) updates the contact lists of any user that referenced the old contact IDs.

Complete the following procedure to upload the CSV file and rename the contact IDs for a list of users.

Note

You must complete this procedure on each IM and Presence Service cluster.

Procedure

Step 1

Upload the CSV file with the list of contact IDs that you want to rename in all contact lists. Do the following:

1. On the IM and Presence Service database publisher node, log in to the Cisco Unified CM IM and Presence Administration user interface. Choose Bulk Administration > Upload/Download Files.

2. Click Add New.

3. Click Browse to locate and choose the CSV file.

4. Choose Contact as the Target.

5. Choose Rename Contacts – Custom File as the Transaction Type.

6. Click Save to upload the file.

Step 2

On the publisher node, log in to the Cisco Unified CM IM and Presence Administration user interface. Choose Bulk Administration > Contact List > Rename Contacts.

Step 3

In the File Name field, choose the file that you uploaded.

Step 4

Choose one of the following actions:

- Click Run Immediately to execute the Bulk Administration job immediately.

- Click Run Later to schedule a time to execute the Bulk Administration job. For more information about scheduling jobs in the BAT, see the Online Help in Cisco Unified CM IM and Presence Administration.

Step 5

Click Submit. If you chose to run the job immediately, the job runs after you click Submit.

What To Do Next
Provision of Microsoft Server Users on Cisco Unified Communications Manager

Results of the Rename Contact IDs Job

You can check the results of the Rename Contact IDs job from the Job Scheduler window (Bulk Administration > Job Scheduler). Depending on the number of entries in the CSV file, the Bulk Administration Tool processes the contents of the file in a few minutes. However, it may take several hours for all of the contact lists to be updated. The Job Status shows as Processing during this time and the current progress of the job is shown in the Job Results section.

Note

The Job Results area on the Job Scheduler window is shown only when the CSV file has been processed. The Number of Records Processed and the Number of Records Failed values do not represent the number of entries that were processed on the CSV file; these values represent the number of contact lists that have been updated and the number of failed contact list updates.

After the contact ids are renamed, you can proceed to provision Lync/OCS users on Cisco Unified Communications Manager.

Provision of Microsoft Server Users on Cisco Unified Communications Manager

The first step in migrating users from Microsoft Lync or Microsoft Office Communications Server (OCS) to IM and Presence Service is to provision the Microsoft server users on Cisco Unified Communications Manager and license them for IM and Presence Service and an IM and Presence Service supported client.

Note

After users are provisioned on Cisco Unified Communications Manager and IM and Presence Service, Cisco recommends that you complete the full user migration process during the same maintenance window. Leaving users provisioned on both IM and Presence Service and on the Microsoft servers for any time period disrupts message routing for those users.

See Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager for information about configuring new users in Cisco Unified Communications Manager and the license requirements for IM and Presence Service and supported clients.

What To Do Next

Click Here

Related Information

Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager

Backups of User Microsoft Server Contact List Information

The Lync/OCS provides a tool called dbimpexp.exe. Cisco recommends that you use this tool to back up the Microsoft server user contact list information so that you can restore this information on the Microsoft server at a later date, if needed.

For the purpose of migrating Microsoft server users to an IM and Presence Service supported client, you can use this tool to back up the contact list for an individual Microsoft server user or all users.

Related Topic

Usage of the dbimpexp.exe tool: Click Here

What To Do Next

Export of Contact Lists for Migrating Users

Export of Contact Lists for Migrating Users

Cisco provides an Export Contact List tool (ExportContacts.exe) to allow an administrator to export contact lists in bulk from Lync/OCS for migrating users. The tool uses the Microsoft server application programming interfaces (APIs) to export contact lists and output to a comma-separated values (CSV) file. This file can then be used by the IM and Presence Service Bulk Administration Tool (BAT) to import these same contact lists into IM and Presence Service at a later point in the migration.

Note

- You can run this tool against all the supported Microsoft server platforms.

- You can run the tool on any Standard Edition server or Enterprise Edition front-end server.

- To export contact lists for Lync users, the Export Contact List tool requires read access to the Lync RTC database and also read access to LDAP. You must also ensure that dbo execution account privileges are granted to the RTC database.

- Running this tool has no affect on the capabilities of other Microsoft server users who are signed into Microsoft Lync or Microsoft Office Communicator. However, Cisco recommends that you run this tool during a scheduled maintenance window to reduce the load on the Microsoft server and Active Directory system.

After you run the tool, a file that contains the exported contact lists is created in the same directory as the tool. The filename is ExportedContacts<Timestamp>.csv. A time stamp is appended to the filename when the file is created; therefore, each time you run the Export Contact List tool, it creates a unique output file.

The Export Contact List tool also creates a second file that contains the Microsoft server SIP URI of each user that you specify for the contact list export. The filename is UserList<Timestamp>.txt and it is also created in the same directory as the tool.

Note

You can use the UserList<Timestamp>.txt file as input to the Disable Account tool and the Delete Account tool.

Log File

The Export Contact List tool also creates a unique time-stamped log file in the same directory as the output file each time you run the tool. The filename for the log file is ExportContactsLog<Timestamp>.txt.

It is good practice to check the log file each time you run the Export Contact List tool. You can then scan through the log file to fix any issues. At the bottom of each log file, the following information is summarized:

- Number of users that were successfully processed

- Number of users that were not found

- Number of users that were not processed due to errors

- Largest contact list size

- Total number of contacts that were found

- Average contact list size

Run Modes

The Export Contact List tool has two run modes; NORMAL and STATSONLY. NORMAL is the standard way to run the tool. In this mode, three files are created: the CSV file that contains the exported contacts, the log file and the users’ Lync/OCS SIP URI file. In STATSONLY mode, the Export Contact List tool creates only the log file. This allows you to run the tool to discover any errors that you can fix before you create the exported contacts CSV file and the Microsoft server SIP URI file.

Input File Formats

The Export Contact List tool (ExportContacts.exe) allows you to specify an input file containing the list of migrating users. The tool then retrieves the contact lists for the users that are specified in that input file. Alternatively, you can specify a command line parameter to export contact lists for all users in the local Lync/OCS database.

Note

If you use choose to export all users with the Export Contact List tool, the resulting UserList<Timestamp>.txt file contains the contact lists of all Microsoft server-enabled users in the domain, regardless of whether they are migrating to IM and Presence Service. If you later use the UserList<Timestamp>.txt file as input to the Disable Account tool and the Delete Account tool, be aware that all user accounts in the domain are affected by the Disable Account and Delete Account tools.

If you are using an input file, the following input file formats are supported:

Input File Format 1: Microsoft server SIP URIs

Note the following:

- Each line in the input file represents a contact list owner.

- The contact list owner is represented by the owner’s Microsoft server SIP URI, for example, sip:bobjones@foo.com.

- The following is a sample input file:

sip:ann@foo.com
sip:bob@foo.com
sip:joe@foo.com
sip:chuck@foo.com

Input File Format 2: Users by Organizational Unit in Active Directory

In this input file format, you can specify the Organizational Unit (OU) in Active Directory that contains the users that you want to migrate. The input file must have the following format:

DN:OU=OrgUnit1,OU=OrgUnit2,DC=DomainComp1,DC=DomainComp2

where OrgUnit1 is an OU in the OrgUnit2 OU and DomainComp1 and DomainComp2 are the domain components. Domains usually have two domain components in AD, for example cisco and com for the cisco.com domain.

You can also specify multiple distinguished names (DNs) in a single input file to export contact lists for users from different OUs. The format of an input file with multiple DNs is as follows:

DN:OU=firstOU,DC=DomainComp1,DC=DomainComp2
DN:OU=secondOU,DC=DomainComp1,DC=DomainComp2
DN:OU=thirdOU,DC=DomainComp1,DC=DomainComp2

The following procedure describes how to export contact lists in bulk from the Microsoft server for migrating users.

Procedure

Step 1

Copy and extract the zip file containing the Cisco user migration tools to the Standard Edition server or Enterprise Edition front-end server.
Note:
After extraction, if you move any of the Cisco user migration tools to a different location on the Microsoft server, you must also copy the version.txt file to the new location to ensure that the tool prints out its current version.

Step 2

Open a command prompt and change directory to the location of the Export Contact List tool.

Step 3

At the command prompt, run the tool as follows:

If you want to...

Enter this command

Export the contact list for a list of users as specified in a Microsoft server SIP URI input file

or

Export the contact list for a list of users in an Organizational Unit in AD, as specified in a Users by Organizational Unit in AD input file

ExportContacts.exe -s/LDAPServer -f/input_file -l/logLevel -r/run_mode -i/database_instance

where:

- LDAPServer—The IP or FQDN of the AD server where Microsoft server users are stored

- input_file—A text file that contains a list of Microsoft server SIP URIs, or, a text file that contains a list of distinguished names for AD Organizational Units that contain the users that you want to migrate

- logLevel—The logging level, which must be one of the following:

- error

- info

- debug (recommended)

- run_mode—The run mode, which must be one of the following:

- NORMAL

- STATSONLY

- database_instance—The Lync datastore instance name. This parameter is required only when you are exporting contacts for Lync users.

Sample entries are as follows:

- Lync 2010 Standard Edition server: localhost\rtc

- Lync 2010 Enterprise Edition server: LyncDatastoreFqdn\rtc

- Lync 2013 Standard Edition server: localhost\rtclocal

- Lync 2013 Enterprise Edition server: AnyLyncFrontendServer\rtclocal

Export the contact list for all Microsoft server-enabled users in the domain

ExportContacts.exe -s/LDAPServer -f/ALL -l/logLevel -r/run_mode -i/database_instance

where:

- LDAPServer—The IP or FQDN of the AD server where Microsoft server users are stored

- logLevel—The logging level, which must be one of the following:

- error

- info

- debug (recommended)

- run_mode—The run mode, which must be one of the following:

- NORMAL

- STATSONLY

- database_instance—The Lync datastore instance name. This parameter is required only when you are exporting contacts for Lync users.

Note:
This command exports the contact lists for all Microsoft server enabled users in the specified domain, regardless of whether they are migrating to IM and Presence Service. If you use the UserList<Timestamp>.txt file, which is created from this command, as input to the Disable Account tool and the Delete Account tool, be aware that all user accounts in the domain are affected by the Disable Account and Delete Account tools.

Note:
To ensure correct contact list migration, the owners of the exported contact lists must be completely disabled on the Microsoft server before you import the contacts lists into IM and Presence Service.

What to Do Next

Click Here

Related References

Export Contact List Tool

Disable Users on Microsoft Servers

This section describes procedures on how to disable a Lync/OCS account for migrating users and how to verify that Active Directory updates are synchronized to the Microsoft server.

Disable Microsoft Server Account for Migrating Users

Cisco provides a tool to disable the Lync/OCS account of migrating users. This tool (DisableAccount.exe) connects to Active Directory (AD) and updates the users’ Microsoft server attributes to disable their account. Running the Disable Account tool is the first step in a two-step process that must take place to disable a migrating user on the Microsoft server:

1. Disable the Microsoft server user account for migrating user.

2. Delete the Microsoft server user data for migrating user.

After you disable the account for migrating user, wait until the Microsoft server's LDAP changes are synchronized before proceeding with the Delete utility. The LDAP synchronization can take up to 30 minutes.

Note

- You can run this tool on all supported Microsoft server platforms.

- You can run this tool on any Standard Edition server or Enterprise Edition front-end server.

- Running this tool has no affect on the capabilities of other Microsoft server users who are signed into Microsoft Lync or Microsoft Office Communicator. However, Cisco recommends that you run this tool during a scheduled maintenance window to reduce the load on the Microsoft server and Active Directory system.

The Disable Account tool accepts three inputs:

- The IP or FQDN of the AD server on which the Microsoft server users exist

- An input file containing the list of Microsoft server user accounts to disable

- The logging level, which should be one of error, info, or debug (debug is the recommended setting)

The Disable Account tool reads the list of users to disable from an input file. Each line in the input file represents a contact list owner. The contact list owner is represented by the owner’s Microsoft server SIP URI, for example, sip:bobjones@cisco.com. The following is a sample input file:

sip:ann@cisco.com
sip:bob@cisco.com
sip:joe@cisco.com
sip@chuck@cisco.com

You can create your own input file based on the above format. however, Cisco recommends that you use the UserList<Timestamp>.txt file as the input file for the Disable Account tool. The UserList<Timestamp>.txt file does not contain any duplicate, disabled, or nonexistent users.

After you run the Disable Account tool, the tool generates a unique, time-stamped log file called DisableAccountLog<Timestamp>.txt in the same directory as the tool. The log file contains details about any failures or errors that occurred.

Before You Begin

You must have read/write permission to AD to run this tool.

Procedure

Step 1

Copy and extract the zip file containing the Cisco user migration tools to the Standard Edition server or Enterprise Edition front-end server.
Note:
After extraction, if you move any of the Cisco user migration tools to a different location on the Microsoft servers, you must also copy the version.txt file to the new location to ensure that the tool prints out its current version.

Step 2

Open a command prompt and change directory to the location of the Disable Account tool.

Step 3

At the command prompt, enter the following command:
DisableAccount.exe -s/LDAPServer -f/input_file -l/logLevel

where:

- LDAPServer—The IP or FQDN of the AD server on which the users exist

- input_file—The file containing the list of Microsoft server user accounts to disable, UserList<Timestamp>.txt

- logLevel—The logging level, which must be one of error, info or debug (debug is the recommended setting)

Step 4

Check the DisableAccountLog<Timestamp>.txt log file after each execution of the Disable Account tool to ensure that all users were successfully disabled.

What to Do Next

Verify That Active Directory Updates Synchronized to Microsoft Servers

Verify That Active Directory Updates Synchronized to Microsoft Servers

After the Active Directory updates are made to disable the Lync/OCS accounts, the next step is to verify that those updates have synchronized to the Microsoft server. Verification takes place on the Standard Edition server or Enterprise Edition pool where the disabled Microsoft server account was provisioned. You must wait until the Microsoft server LDAP changes are synched before proceeding with the Delete utility.

Note

Depending on your Microsoft server deployment, it may take up to 30 minutes for these changes to synchronize to the Microsoft server.

Procedure

Step 1

Depending on your deployment, do one of the following:

- If you are using Lync Server 2010, choose Start > All Programs > Microsoft Lync Server 2010 > Lync Server Control Panel.

Tip:
Choose Microsoft Lync Server 2013 if you are using Microsoft Lync Server 2013.

- If you are using OCS 2007 R2, choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Depending on your deployment, check the following:

- For Lync, choose Users and ensure that the disabled user no longer appears in the list of users.

- For OCS, choose Users and ensure that the disabled user no longer appears in the list of enabled OCS users.

What to Do Next

Delete User Data from Database for Migrating Users

Related References

Disable Account Tool

Delete User Data from Database for Migrating Users

Note

To delete user data from the Lync/OCS database for migrating users, you must have read/write access to the Microsoft server database.

The Microsoft server provides an administrative way to delete a user from the Microsoft server database. However, if you delete a user from the database in this way, the user is removed from other users’ contact lists. To prevent the user being removed from the contact lists of other Microsoft Lync or Microsoft Office Communicator users, Cisco provides an alternative means of deleting the user from the Microsoft server database.

This alternative tool (DeleteAccount.exe) allows you to delete migrating users so that availability requests for these users are later routed to IM and Presence Service. This tool also ensures that the deleted users are not removed from the contact list of any users that remain on the Microsoft server. Running the Delete Account tool is the second step in a two-step process to disable a migrating user on the Microsoft server. The two-step process is as follows:

1. Disable the Microsoft server account for migrating user.

2. Delete the Microsoft server user data for migrating user.

After you disable the account for migrating user, wait until the Microsoft server's LDAP changes are synchronized before proceeding with the Delete utility. The LDAP synchronization can take up to 30 minutes.

Note

- You can run this tool on all supported Microsoft server platforms.

- You can run this tool on any Standard Edition server or Enterprise Edition pool.

- Running this tool has no affect on the capabilities of other Microsoft server users who are signed into Microsoft Lync or Microsoft Office Communicator. However, Cisco recommends that you run this tool during a scheduled maintenance window to reduce the load on the Microsoft server and Active Directory system.

The Delete Account tool reads the list of users to delete from an input file. Each line in the input file represents a contact list owner. The contact list owner is represented by the owner’s Microsoft server SIP URI, for example, sip:bobjones@cisco.com. The following is a sample input file:

sip:ann@cisco.com
sip:bob@cisco.com
sip:joe@cisco.com
sip@chuck@cisco.com

You can create your own input file based on the above format. however, Cisco recommends that you use the UserList<Timestamp>.txt file as the input file for the Delete Account tool. The UserList<Timestamp>.txt file does not contain any duplicate, disabled, or nonexistent users.

Running the Delete Account Tool on Standard Edition Deployments

When deleting data for a list of users, you must run this tool once on each Standard Edition server. The database is coresident on the Standard Edition server.

Running the Delete Account Tool on Enterprise Edition Deployments

When deleting data for a list of users, you must run this tool once on each Enterprise Edition pool. The Lync/OCS database instance name to which the Microsoft server's front-end connects must be specified when running the tool.

Caution

For Lync Enterprise Edition, you must run this tool first on the back-end database server and then on each front-end server. The Lync database instance name to which the Lync front-end connects must be specified in both options. The name of the database for the front-end servers is rtclocal. The default name of the database for the back-end server is rtc, but that can be changed during system installation.

For OCS Enterprise Edition, the tool must be run on only the back-end database server.

Procedure

Step 1

Ensure that you have read/write access to the Microsoft server database before you run this tool.

Step 2

Copy and extract the zip file containing the Cisco user migration tools to the Standard Edition server or one of the Enterprise Edition pool servers (front-end or back-end).
Note:
After extraction, if you move any of the Cisco user migration tools to a different location on the Microsoft server, you must also copy the version.txt file to the new location to ensure that the tool prints out its current version.

Step 3

Open a command prompt and change directory to the location of the Delete Account tool.

Step 4

At the command prompt, enter the command as follows:
DeleteAccount.exe -s/database_instance -f/input_file -l/logLevel

where:

- database_instance—The database instance name of the Lync/OCS pool

- input_file—The file containing the list of Microsoft server user accounts to delete, UserList<Timestamp>.txt

- logLevel—The logging level, which must be one of error, info, or debug (debug is the recommended setting)

Note:
After the command executes, the Delete Account tool generates a unique, time-stamped log file called DeleteAccountLog<Timestamp>.txt in the same directory as the tool. The log file contains details about any failures or errors that have occurred.

Step 5

For each Standard Edition server or Enterprise Edition pool, repeat Steps 1 to 3.
For troubleshooting tips, see Delete Account Tool

Step 6

If you are deleting user data from a Lync database you must also repeat Steps 2 to 4 on each front-end server. To access the front-end server database, the command in Step 4 must be run locally on the front-end server. In addition, you must use front-end_server_hostname\rtclocal as the value for the database instance parameter.

What to Do Next

Import Contact Lists for Migrating Users into IM and Presence

Import Contact Lists for Migrating Users into IM and Presence

You can use the IM and Presence Service Bulk Administration Tool (BAT) to import Lync/OCS user contact lists into IM and Presence Service.

Complete the following steps to import the Microsoft server user contact lists into the IM and Presence Service:

1. Upload the CSV File Using BAT.

2. Create a New Bulk Administration Job.

3. Check Results of Bulk Administration Job.

Note

The default contact list import rate is based on the server hardware type. You can change the contact list import rate by logging in to the Cisco Unified IM and Presence Administration user interface and choosing System > Service Parameters > Cisco Bulk Provisioning Service, then change the variable under Import Users Contact Rate. However, if you increase the default import rate, this results in a higher CPU and Memory usage on IM and Presence Service.

Before You Begin

The procedure to import the Microsoft server user contact lists is one of the final steps in the user migration process. Before you import the Microsoft server user contact lists, you must complete the following procedures:

1. Provision the Microsoft server users on Cisco Unified Communications Manager.

2. Ensure that the Microsoft server users are licensed and assigned to IM and Presence Service.

3. Ensure that the IM and Presence Service Maximum Contact List Size and Maximum Watchers settings are set to unlimited to ensure all contact lists are fully imported. See Set Unlimited Contact Lists and Watchers.

4. Run the Export Contact List tool to produce the ExportedContacts<Timestamp>.csv file. See Export of Contact Lists for Migrating Users.

5. Ensure that the Microsoft server users have been fully disabled on the Microsoft server. See Disable Users on Microsoft Servers.

CSV File Upload Using BAT

You must upload the ExportedContacts<Timestamp>.csv file to IM and Presence Service using the BAT. See Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager for instructions on how to upload the CSV file.

Related Topic

Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager

What To Do Next

Creation of a New Bulk Administration Job

Creation of a New Bulk Administration Job

After you upload the CSV file, you must create a new bulk administration job in the Cisco Unified CM IM and Presence Administration user interface to update the user contact lists. See Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager for instructions on how to create a new bulk administration job.

Related Topic

Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager

What To Do Next

Results of Bulk Administration Job

Results of Bulk Administration Job

When the bulk administration job is complete, the IM and Presence Service Bulk Administration Tool writes the results of the contact list import job to a log file. See Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager for instructions on how to check the results of the bulk administration job.

What To Do Next

Deploy an IM and Presence Service Supported Client on Users Desktop

Related Information

Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager

User Migration Troubleshooting

Deploy an IM and Presence Service Supported Client on Users Desktop

After you provision the Lync/OCS users on Cisco Unified Communications Manager and license them for IM and Presence Service and an IM and Presence Service supported client, you can install the client software on the users’ desktops. See Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager for information about deploying IM and Presence Service supported clients.

Related Information

Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager

Reset Maximum Contact List Size and Maximum Watcher Size

Before migrating users from Lync/OCS to IM and Presence Service, Cisco recommends that you set the Maximum Contact List Size and Maximum Watchers settings on IM and Presence Service to unlimited. This ensures that each migrated user contact list is fully imported to IM and Presence Service.

After all users have been migrated to IM and Presence Service, reset the Maximum Contact List Size and Maximum Watchers settings on IM and Presence Service to the desired values. The system default value is 200 for Maximum Contact List Size and 200 for Maximum Watchers size.

Note

If you are performing a phased migration of users from the Microsoft server to IM and Presence Service, do not reset the Maximum Contact List Size and Maximum Watchers values until all users have been migrated.

The following procedure describes how to set values for the Maximum Contact List Size and Maximum Watchers settings.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. When you change Presence settings, they are applied to all nodes in the cluster; therefore you need to set them only on the IM and Presence Service publisher node within any given cluster.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Settings.

Step 2

For Maximum Contact List Size (per user), uncheck the check box for No Limit and enter the desired limit.

Step 3

For Maximum Watchers (per user), uncheck the check box for No Limit and enter the desired limit.

Step 4

Click Save.

Step 5

Restart the Cisco XCP Router on all IM and Presence Service nodes in the cluster. To restart the Cisco XCP Router, log in to the Cisco Unified IM and Presence Serviceability user interface and choose Tools > Control Center – Network Services.

Chapter 9. Interdomain Federation and Intradomain Federation Deployment Integration

IM and Presence Service Integration with Interdomain Federation Capability of Microsoft Servers

You can integrate IM and Presence Service with the interdomain federation capability of Microsoft servers.

Microsoft servers support interdomain federation with remote enterprises or public IM providers. This interdomain federation capability is still available to Microsoft Lync or Microsoft Office Communicator users when partitioned intradomain federation is configured between the Microsoft server and IM and Presence Service.

Furthermore, you can configure IM and Presence Service so that users who migrate to an IM and Presence Service supported client can still use the interdomain federation capability that is configured on the Microsoft server.

For information about configuring interdomain federation on IM and Presence Service, see Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager.

Interactions and Restrictions

- Do not use email for federation when you have an integrated interdomain and partitioned intradomain federation deployment. Email address for federation is not supported in deployments where partitioned intradomain federation is configured. Email address for federation is also not supported for interdomain federation if your deployment uses the interdomain federation capabilities of Lync/OCS. Confirm that email address for federation is not enabled anywhere in the deployment in these deployment scenarios.

- When partitioned intradomain federation with the Microsoft server is enabled, it is also possible to configure both SIP-based and XMPP-based interdomain federation to remote domains on IM and Presence Service. However, this federation capability is available to users on IM and Presence Service supported clients only.

IM and Presence Service Integration with Interdomain Federation Capability of Microsoft Servers

You can integrate IM and Presence Service with the interdomain federation capability of Microsoft servers.

Microsoft servers support interdomain federation with remote enterprises or public IM providers. This interdomain federation capability is still available to Microsoft Lync or Microsoft Office Communicator users when partitioned intradomain federation is configured between the Microsoft server and IM and Presence Service.

Furthermore, you can configure IM and Presence Service so that users who migrate to an IM and Presence Service supported client can still use the interdomain federation capability that is configured on the Microsoft server.

For information about configuring interdomain federation on IM and Presence Service, see Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager.

Remote Domain Setup for Interdomain Federation through Intradomain Federation Connections on Microsoft Servers

IM and Presence Service users can communicate with external domains using either the existing Lync/OCS interdomain federation connections or using connections to those external domains that you configure directly on IM and Presence Service.

When you configure interdomain federation through existing Microsoft server intradomain federation connections, all requests to the remote domain are routed through the SIP interface between IM and Presence Service and the Microsoft server. You must configure the remote domain on IM and Presence Service to be a Microsoft server SIP Federation domain before you proceed to configure interdomain federation through existing intradomain federation connections. Do this for each remote domain.

See procedures related to adding a SIP federated domain in the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for detailed instructions on how to configure a SIP federation domain.

Choose the following options when you configure a SIP Federation domain for interdomain federation using existing intradomain connections that are configured on Microsoft servers:

- For Domain Name, enter the remote domain.

- For Integration Type, choose Inter-domain to OCS/Lync

- Ensure that the Direct Federation check box is checked.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. These settings are cluster-wide; therefore you need to set them only on theIM and Presence Service database publisher node within any given cluster.

What To Do Next

Configure a Static Route for a Remote Domain

Related Information

Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager

Integration Troubleshooting

Configure a Static Route for a Remote Domain

When you integrate IM and Presence Service with Lync/OCS interdomain federation capability, you must configure static routes on IM and Presence Service for each remote domain.

Caution

Email address for federation is not supported in deployments where partitioned intradomain federation is configured. Email address for federation is also not supported for interdomain federation if your deployment uses the interdomain federation capabilities of Microsoft servers. Confirm that email address for federation is not enabled anywhere in the deployment in these deployment scenarios.

For Standard Edition Microsoft servers, the static routes must point to the IP address of a specific Standard Edition server.

For Enterprise Edition Microsoft servers, the static routes must point to a specific Enterprise Edition front-end server.

If you are using a Microsoft server's front-end load balancer, note the following:

- See the following URL for a list of load balancers: Click Here . It is your responsibility to ensure that those load balancers are deployed and managed correctly. Cisco does not support the configuration of static routes to point to such load balancers.

- Cisco recommends that you configure static routes to bypass the front-end load balancer.

For High Availability purposes, you can configure additional backup static routes for each remote domain. The backup route has a lower priority and is used only if the next hop address of the primary static route is unreachable.

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. These settings are cluster-wide; therefore you need to set them only on the IM and Presence Service publisher node within any given cluster.

Procedure

Step 1

Lin to the Cisco Unified Communications Manager IM and Presence Administration user interface. Choose Presence > Routing > Static Routes.

Step 2

Click Add New.

Step 3

Enter the destination pattern value so that the domain, or FQDN, is reversed. For example, if the domain is remote.com, the Destination Pattern value must be .com.remote

Step 4

Choose domain for the Route Type.

Step 5

In the Next Hop field, enter the IP address of the next hop.

Step 6

Set the Next Hop Port and the Protocol Type as follows:

- For TLS Encryption:

- Next Hop Port number is 5061

- Protocol Type is TLS

- For TCP:

- Next Hop Port number is 5060

- Protocol Type is TCP

Step 7

Enter the Priority value as follows:

- For primary static routes, enter the default Priority value of 1.

- For backup static routes, enter a Priority value of greater than 1. (The lower the value, the higher the priority of the static route.)

Step 8

Leave the default values for all other parameters.

Step 9

Click Save.

Related Information

Integration Troubleshooting

Remove IM and Presence Service Integration with Microsoft Server Interdomain Federation Capability

At some stage, you may want to configure IM and Presence Service for interdomain federation with one of the remote domains that you previously configured on Lync/OCS. The most likely scenario for this is when all Microsoft Lync or Microsoft Office Communicator users have been migrated to IM and Presence Service. At this point, the Microsoft server deployment can be shut down, and any interdomain federation capability can instead be enabled directly from IM and Presence Service.

To remove an IM and Presence Service integration with Microsoft server interdomain federation capability, you must complete Remove Static Route for Remote Domain and Remove the SIP Federation Domain.

Remove Static Route for Remote Domain

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Routing > Static Routes.

Step 2

Choose the appropriate static route from the list provided. If no list is shown, click Find.

Step 3

Click Delete Selected.

Step 4

Click OK to confirm the deletion.

What to Do Next

Remove the SIP Federation Domain

Remove the SIP Federation Domain

Note

If you have a multicluster deployment, you must perform this procedure on each cluster. These settings are cluster-wide; therefore you need to set them only on the IM and Presence Service database publisher node within any given cluster.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Inter-Domain Federation > SIP Federation.

Step 2

Choose the domain from the list provided. If no list is shown, click Find.

Step 3

Click Delete Selected.

Step 4

Click OK to confirm the deletion.

What to Do Next

After you remove the static route to the remote domain and remove the SIP federation domain, you can proceed to configure IM and Presence Service for interdomain federation with the remote domain. See Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for more information.

Chapter 10. Integration Troubleshooting

IM and Presence Service Tracing

On the IM and Presence Service node, the SIP Proxy is responsible for SIP request routing, while the XCP SIP Federation Connection Manager is responsible for SIP Protocol Translation between Microsoft SIP and native XMPP. Therefore, these services are central to the SIP partitioned intradomain federation integration between IM and Presence Service and Lync/OCS.

The XCP Router is a core service of IM and Presence Service. It determines whether the request recipient is a Microsoft server user or an IM and Presence Service user.

The locations of the log files are as follows:

- Logs for XCP SIP Federation Connection Manager: /var/log/active/epas/trace/xcp/log/sip-cm-3_000*.log

- Logs for SIP Proxy: /var/log/active/epas/trace/esp/sdi/esp000*.log

- Logs for XCP Router: var/log/active/epas/trace/xcp/log/rtr-jsm-1_000*.log

Example of SIP Proxy Logging

2:26:18.719 |PID(25333) sip_protocol.c(5964) Received 536 bytes TCP packet from 10.53.56.17:34282SUBSCRIBE sip:ysam@implync.net SIP/2.0^M
From: <sip:fbear@implync.net>;tag=a4cdaec0-1138350a-13d8-45026-4d755b8a-2162aa7a-4d755b8a^M
To: <sip:ysam@implync.net>^M
Call-ID: a30386f0-1138350a-13d8-45026-4d755b8a-2c25871c-4d755b8a^M
CSeq: 1 SUBSCRIBE^M
Via: SIP/2.0/TCP 10.53.56.17:5080;branch=z9hG4bK-4d755b8a-926d95b4-3c330144^M
Expires: 7446^M
Accept: application/pidf+xml, application/cpim-pidf+xml^M
User-Agent: Cisco-Systems-Partitioned 8.0^M
Max-Forwards: 70^M
Event: presence^M
Contact: <sip:10.53.56.17:5080;transport=TCP>^M
Content-Length: 0^M
…
22:26:18.719 |ID(25333) sip_sm.c(4977) SIPGW Partitioned Fed UA Header found in this request
22:26:18.719 |ID(25333) sip_sm.c(5010) This is a partitioned federation request, skip User Location DB lookup
22:26:18.719 |ID(25333) sip_sm.c(5200) This is an outbound Partitioned federation request.
22:26:18.719 |Mon Mar 07 22:26:18 2011] PID(25333) mod_sip_routing.c(1435) Routing: dipping for cuplcs.net
22:26:18.719 |Mon Mar 07 22:26:18 2011] PID(25333) mod_sip_routing.c(1473) Routing: Found domain route for cuplcs.net:10.53.56.18:5061;TLS pwf 1:1:5
22:26:18.719 |ID(25333) sip_dns.c(811) "A" Query for 10.53.56.18 successful, Got 1 IP addresses
22:26:18.719 |ID(25333) sip_dns.c(139) A Record : 10.53.56.18

Example of SIP Federation Connection Manager Logging

The following is a extract from an outbound request log:

21:48:44.277 |SIPGWDir.cpp:463: [FROM XMPP] <presence from='fbear@implync.net' to='ysam@implync.net' type='probe'/>...
...
21:48:44.743 |SIPGWController.cpp:622: Skipping DNS lookup: <presence from='fbear@implync.net' to='ysam@implync.net' type='probe'/>
21:48:44.743 |SIPGWController.cpp:704: Entering _handleOutContinue: <presence from='fbear@implync.net' to='ysam@implync.net' type='probe'/>
21:48:44.743 |SIPGWController.cpp:989: _findSession (JID): local(fbear@implync.net) remote(ysam@implync.net)
21:48:44.743 |SIPGWController.cpp:999: _findSession: Session not found
21:48:44.743 |SIPHostInfo.cpp:82: hostinfo(0x09a10ce8) refInc: 3 cuplcs.net:cuplcs.net
21:48:44.743 |SIPGWSession.cpp:58: Creating SIPGWSession sess=0x09a5a090 local=fbear@implync.net remote=ysam@implync.net
21:48:44.743 |SIPGWController.cpp:1017: _findSession: Made new session: sess=0x09a5a090 local(fbear@implync.net) remote(ysam@implync.net)
21:48:44.743 |SIPGWSession.cpp:990: sess=0x09a5a090 Entering handleOut: <presence from='fbear@implync.net' to='ysam@implync.net' type='probe'/>
21:48:44.743 |SIPGWSession.cpp:1090: _createOutgoingSubs local=fbear@implync.net, remote=ysam@implync.net
48:44.744 |SIPSubs.cpp:1037: from=<sip:fbear@implync.net> to=<sip:ysam@implync.net> local_contact=sip:10.53.56.17:5080;transport=TCP remote_contact=sip:ysam@implync.net

Example of XCP Router Logging

12:29:24.762 |debug sdns_plugin-1.gwydlvm453 sdns_plugin handling:<presence type='subscribed' to='ysam@implync.net' from='bbird@implync.net'><status>Already Subscribed</status></presence>
12:29:24.762 |debug ConnectionPool.cpp:166 connection pool checkout: ccm2/dbuser (success)
12:29:24.762 |debug IdsODBC.cpp:648 Performing SQL operation select userid, jsmid from enduser, enterprisenode where my_lower(xep106userid) = my_lower(?) and primarynodeid=id
12:29:24.763 |debug ODBCConnection.cpp:315 (elapsed 0.002407) select userid, jsmid from enduser, enterprisenode where my_lower(xep106userid) = my_lower(?) and primarynodeid=id
12:29:24.763 |debug CUPDatabaseAlgorithm.cpp:311 This is probably a Partitioned OCS user ... redirecting to cm-3-sip-fed-s2s.gwydlvm453 component
12:29:24.763 |debug IdsODBC.cpp:229 (elapsed 0.000137) rollback
12:29:24.763 |debug ConnectionPool.cpp:207 connection pool checkin: ccm2/dbuser (success)
12:29:24.763 |debug sdns_plugin-1.gwydlvm453 sdns_plugin redirecting to: cm-3-sip-fed-s2s.gwydlvm453

You can enable debug tracing for the SIP Proxy, XCP SIP Federation Connection Manager and XCP Router on the Cisco Unified IM and Presence Service Serviceability user interface.

Configure Tracing on the IM and Presence Service

The following procedure describes how to configure tracing for the SIP Proxy, XCP SIP Federation Connection Manager and XCP Router services on the Cisco Unified IM and Presence Serviceability GUI. Repeat this procedure for each service that you want to configure for tracing.

Caution

Debug level tracing can affect system performance. Enable debug level tracing only when required and reset to default log settings after the investigation is complete.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Trace > Configuration.

Step 2

Choose the IM and Presence Service node, and click Go.

Step 3

Choose IM and Presence Services from the Service Group drop-down list, and click Go.

Step 4

From the Service drop-down list, choose one of the following options and click Go:

1. Cisco SIP Proxy

2. Cisco XCP SIP Federation Connection Manager

3. Cisco XCP Router

Step 5

Check the check box for Trace On.

Step 6

In the Trace Filter Settings area, choose the Debug Trace Level from the drop-down list. If you want to enable debug level tracing on the traces choose Debug.

Step 7

When you configure tracing for the SIP Proxy, there are a number of trace options under Trace Filter Settings. Check the check boxes for the following traces:

1. Enable SIP TCP Trace

2. Enable SIP TLS Trace

3. Enable Server Trace

4. Enable SIP Message and State Machine Trace

5. Enable Method/Event Routing Trace

6. Enable Routing Trace

Step 8

Click Save.
See the Cisco Unified IM and Presence Serviceability Online Help for more information about initiating debug tracing for each of these services.

Related References

Microsoft Server SIP Tracing

Microsoft Server SIP Tracing

The Lync/OCS SIP Proxy component is responsible for all SIP request routing. To debug any routing issues, you can enable debug tracing on the Microsoft server (Standard Edition or Enterprise Edition) using the method that is specific to your Microsoft server.

Enable SIP Tracing on Lync

The following procedure describes how to enable SIP tracing on Lync.

Procedure

Step 1

Choose Start > All Programs > Microsoft Lync Server 2010 > Lync Server Logging Tool.

Step 2

In the Components area, check the SIPStack check box.

Step 3

Set Logging Level to All and click Start Logging.

Step 4

When you are ready to stop the trace click Stop Logging.

Step 5

Choose Analyze Log Files to view the logs.

Step 6

For a more structured analysis of the logs, download the Snooper tool and use it to view the log files.

Related References

IM and Presence tracing

Related Information

Snooper Tool

Enable SIP Tracing on OCS

The following procedure describes how to enable SIP tracing on OCS.

Procedure

Step 1

Choose Start > Programs > Administrative Tools > Office Communications Server 2007 R2.

Step 2

Do one of the following depending on the edition:

1. If you are using Standard Edition, right-click on the OCS server name and choose Logging Tool > New Debug Session.

2. If you are using Enterprise Edition, right-click OCS pool name and choose Logging Tool > New Debug Session.

Step 3

In the Components area, check the SIPStack check box and in the Level area, click All.

Step 4

When you are ready to begin logging, click Start Logging.

Step 5

When you are ready to stop logging, click Stop Logging.

Step 6

Click Analyze Log Files to view the OCS SIP Proxy log analysis.

Related References

IM and Presence Service Tracing

Related Information

Snooper Tool

Common Integration Problems

This section describes some common integration problems.

Lync 2013 Client Repeatedly Logs out and Back in after IM and Presence Service User is Added to its Contact List

Troubleshooting Steps

1. Ensure that you have added all the required Access Control List (ACL) entries to IM and Presence Service and that the Cisco Sip Proxy service was restarted after adding any ACL entries.

2. If the problem persists, add an ACL entry of All, and then restart the Cisco SIP Proxy.

For more information about adding ACL entries, see topics related to configuring the incoming access control list.

Microsoft Server User Does Not Receive Pop-up when Added to IM and Presence Service Contact List

Troubleshooting Steps

1. If a valid availability state is shown for the contact, check whether the Microsoft Lync or Microsoft Office Communicator user previously accepted a subscription from the IM and Presence Service client user.

Microsoft server subscription authorization is permanent, which means that if an IM and Presence Service client user removes and re-adds a Microsoft Lync or Microsoft Office Communicator user, no second pop-up appears.

2. If the "Waiting for Confirmation" state is shown for the contact, perform the remaining troubleshooting steps as required.

- Ensure that the contact has a valid MOC SIP URI.

- Ensure that the Cisco SIP Proxy and Cisco SIP Federation Connection Manager services are running on each IM and Presence Service node.

- Ensure that partitioned intradomain federation is enabled on each IM and Presence Service cluster.

- Check that the partitioned federation routing mode applies to the chosen deployment.

- Advanced Routing is supported only in single-cluster IM and Presence Service deployments.

- Ensure that the IM and Presence Service static routes are correctly configured to route requests to the Microsoft server. To do this, check the SIP Proxy logs on the IM and Presence Service user home node to see whether the SIP Proxy returns a SIP 408 Request Timeout error for the SIP NOTIFY request to the Microsoft server.

Also check that an IM and Presence Service static route exists for the domain of the OCS/Lync user.

- If TLS encryption is configured, use Wireshark or an equivalent monitoring tool to verify that the TLS handshake is successful.

- If the TLS handshake is still failing, for more TLS troubleshooting steps see TLS Handshake Errors between the IM and Presence Service and Microsoft Servers.

- Ensure that a Microsoft server Host Authorization entry exists for the IM and Presence Service node that is sending the SIP NOTIFY.

- At the very least, there must be an IP address entry for each IM and Presence Service node.

- If TLS encryption is configured, a second FQDN entry is also required for each IM and Presence Service node.

Microsoft Server User Receives a Pop-up when Added to an IM and Presence Service Contact List but Has No Availability after Accepting

Troubleshooting Tip

Ensure that the IM and Presence Service Access Control List (ACL) allows requests from all Lync/OCS servers/pools. If there is an ACL issue, the following entry appears in the SIP Proxy logs of the routing IM and Presence Service node: ACL – upstream not trusted – need to authenticate.

IM and Presence Service User Does Not Receive a Pop-up when a Microsoft Lync or Microsoft Office Communicator User Adds the User to their Contact List

Troubleshooting Steps

1. If a valid availability state is shown, check whether IM and Presence Service is configured to automatically approve subscription requests from users within the local presence domain. If this feature is enabled, IM and Presence Service automatically approves the request without a pop-up to the IM and Presence Service user.

2. Otherwise, if "Status Unknown" or "Presence Unknown" is shown for the contact, perform the remaining troubleshooting steps as required.

3. Ensure that the Cisco SIP Proxy and Cisco SIP Federation Connection Manager services are running on each IM and Presence Service node.

4. Ensure that partitioned intradomain federation is enabled on each IM and Presence Service cluster.

5. Check that the partitioned federation routing mode applies to the chosen deployment.

Advanced Routing is supported only in single-cluster IM and Presence Service deployments.

6. If TLS encryption is configured, use Wireshark or an equivalent monitoring tool to verify that the TLS handshake is successful.

7. If the TLS handshake is still failing, for more TLS troubleshooting steps see TLS Handshake Errors between the IM and Presence Service and Microsoft Servers.

8. Ensure that a static route that points to the routing IM and Presence Service node is configured on each Lync/OCS Standard Edition server or Enterprise Edition pool. A static route should also be configured for each IM user domain that is configured on IM and Presence Service.

9. Ensure that each IM and Presence Service node is resolvable by Domain Name Service (DNS) from the Microsoft server deployment.

10. Ensure that a Microsoft server Host Authorization entry exists for the IM and Presence Service node that is sending the SIP NOTIFY message.

1. At the very least, there must be an IP address entry for each IM and Presence Service node.

2. If TLS encryption is configured, a second FQDN entry is also required for each IM and Presence Service node.

11. Ensure that the IM and Presence Service Access Control List (ACL) allows requests from all Microsoft servers/pools. If there is an ACL issue, the following entry appears in the SIP Proxy logs of the routing IM and Presence Service node: ACL – upstream not trusted – need to authenticate.

12. If this is a multicluster IM and Presence Service deployment, ensure that inter-cluster peering is correctly configured.

1. Log in to the Cisco Unified IM and Presence Administration user interface. Choose Presence > Inter-Clustering on the publisher node of the cluster that contains the designated routing IM and Presence Service node.

2. Ensure that the list of inter-cluster peers includes a peer for the cluster on which the IM and Presence Service user is provisioned and that the number of Associated Users for that peer is greater than 0.

3. Choose the inter-cluster peer to validate the Inter-cluster Peer Status.

4. Ensure that there are no errors highlighted.

Microsoft Server User Does Not Receive IMs Sent by an IM and Presence Service User

Troubleshooting Steps

1. Ensure that the Cisco SIP Proxy and Cisco SIP Federation Connection Manager services are running on each IM and Presence Service node.

2. Ensure that partitioned intradomain federation is enabled on each IM and Presence Service cluster.

3. Check that the partitioned federation routing mode applies to the chosen deployment.

Advanced routing is supported only in single-cluster IM and Presence Service deployments.

4. Ensure that IM and Presence Service static routes are correctly configured to route requests to Lync/OCS. To do this, check the SIP Proxy logs on the IM and Presence Service user home node to see whether the SIP Proxy returns a SIP 408 Request Timeout error for the SIP INVITE request to the Microsoft server.

Also check that an IM and Presence Service static route exists for the domain of the OCS/Lync user.

5. If TLS encryption is configured, use Wireshark or an equivalent monitoring tool to verify that the TLS handshake is successful.

6. If the TLS handshake is still failing, for more TLS troubleshooting steps see TLS Handshake Errors between the IM and Presence Service and Microsoft Servers.

7. Ensure that a Microsoft server Host Authorization entry exists for the IM and Presence Service node that is sending the SIP INVITE request.

1. At the very least, there must be an IP address entry for each IM and Presence Service node.

2. If TLS encryption is configured, a second FQDN entry is also required for each IM and Presence Service node.

IM and Presence User Does Not Receive IMs Sent by a Microsoft Server User

Troubleshooting Steps

1. Ensure that the Cisco SIP Proxy and Cisco SIP Federation Connection Manager services are running on each IM and Presence Server node.

2. Ensure that partitioned intradomain federation is enabled on each IM and Presence Service cluster.

3. Check that the partitioned federation routing mode applies to the chosen deployment.

Advanced routing is supported only in single-cluster IM and Presence Service deployments.

4. For Microsoft Lync, ensure that TLS encryption is configured.

5. If TLS encryption is configured, use Wireshark or an equivalent monitoring tool to verify that the TLS handshake is successful.

6. If the TLS handshake is still failing, for more TLS troubleshooting steps see TLS Handshake Errors between the IM and Presence Service and Microsoft Servers.

7. Ensure that a static route that points to the routing IM and Presence Service node is configured on each Lync/OCS Standard Edition server or Enterprise Edition pool.

Also check that an IM and Presence Service static route exists for the domain of the Microsoft server user.

8. Ensure that each IM and Presence Service node is resolvable by DNS from the MIcrosoft server deployment.

9. Ensure that a Microsoft server Host Authorization entry exists for the IM and Presence Service node that is sending the SIP INVITE.

1. At the very least, there must be an IP address entry for each IM and Presence Service node.

2. If TLS encryption is configured, a second FQDN entry is also required for each IM and Presence Service node.

10. Ensure that the IM and Presence Service Access Control List (ACL) allows requests from all Microsoft servers/pools. If there is an ACL issue, the following entry appears in the SIP Proxy logs of the routing IM and Presence Service node: ACL – upstream not trusted – need to authenticate.

11. If this is a multicluster IM and Presence Service deployment, ensure that inter-cluster peering is correctly configured.

1. Log in to the Cisco Unified Communications Manager IM and Presence Administration user interface. Choose Presence > Inter-Clustering on the publisher node of the cluster that contains the designated routing IM and Presence Service node.

2. Ensure that the list of inter-cluster peers includes a peer for the cluster on which the IM and Presence Service user is provisioned and that the number of Associated Users for that peer is greater than 0.

3. Click the inter-cluster peer to validate the Inter-cluster Peer Status.

4. Ensure that there are no errors highlighted.

Microsoft Server User Updates and IMs Take up to 40 Seconds to Appear

Troubleshooting Steps

The most common reason for such delays is missing DNS configuration within the deployment. IM and Presence Service performs a reverse DNS lookup of the Lync/OCS IP address from which it received the inbound SIP requests. If the IP address does not resolve to a hostname, the reverse lookup times out after approximately 20 seconds. If this occurs, the following log is generated in the SIP Proxy logs: incoming ACL check took over 2 seconds – check DNS.

To solve this problem, ensure that a DNS Pointer (PTR) record exists for each Microsoft server IP address.

When Advanced Routing Is Enabled, No Availability Is Exchanged Between IM and Presence Service and Microsoft Server

Troubleshooting Steps

1. Verify that Cisco Unified Communications Manager is synchronizing user data from Active Directory for all Lync/OCS users.

Advanced Routing is dependent on the Microsoft server SIP URI being synchronized to Cisco Unified Communications Manager from Active Directory.

2. Verify that Advanced Routing is enabled only if this is a single-cluster IM and Presence Service deployment.

IM and Presence Service User Does Not Appear in the Microsoft Server Address Book

Troubleshooting Steps

1. Ensure that a full synchronization by the Lync/OCS Address Book Service has taken place since the IM and Presence Service user was migrated from the Microsoft server. This synchronization happens nightly by default.

2. Request the Microsoft Lync or Microsoft Office Communicator user to sign out and sign in to trigger a download of the new address book. By default, it may take more than an hour to download the new address book from the Microsoft server.

3. If the IM and Presence Service user was previously a Microsoft Lync or Microsoft Office Communicator user, ensure that the IM and Presence Service user still has their old Microsoft server SIP URI populated in Active Directory (msRTCSIP-PrimaryUserAddress).

4. If the IM and Presence Service user was not previously a Microsoft Lync or Microsoft Office Communicator user or if their old Microsoft server SIP URI has been cleared from Active Directory, you must manually populate the Active Directory msRTCSIP-PrimaryUserAddress field to ensure that the IM and Presence Service user appears in the Microsoft server address book. You must enter sip:user's_uri in the msRTCSIP-PrimaryUserAddress field.

IM and Presence Service Unable to Route Interdomain Federation Requests through Microsoft Server Deployment

Troubleshooting Steps

1. Verify that the Lync/OCS deployment is correctly configured for interdomain federation. To do this, ensure that Microsoft server users can federate.

2. Ensure that the Cisco SIP Proxy and the Cisco SIP Federation Connection Manager are running on each IM and Presence Service node.

3. Ensure that IM and Presence Service is configured for interdomain federation to the external domain and that Direct Federation is enabled.

4. Ensure that a static route is configured on IM and Presence Service for the external domain and that the static route points to the Microsoft server.

5. Ensure that the external domain is included in the IM and Presence Service Access Control List (ACL).

TLS Handshake Errors between the IM and Presence Service and Microsoft Servers

Troubleshooting Steps

1. Verify that Lync/OCS has been configured to listen for mutual TLS connections on port 5061.

2. Verify that the IM and Presence Service Application Listeners have been configured such that the Presence Peer Authentication Port is set to 5061.

3. Verify that the IM and Presence Service certificate is signed by the same certificate authority as the Microsoft server.

4. Verify that none of the Microsoft server or IM and Presence Service certificates have expired.

5. Verify that the Microsoft server certificate is configured for both Server Authentication and Client Authentication.

- Such certificates have an OID value of "1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2"

- If the certificate is configured for Server Authentication only, it has an OID value of "1.3.6.1.5.5.7.3.1"

6. Verify that the IM and Presence Service TLS Peer Subjects list contains the Subject Common Name (CN) used in certificates provided by the Microsoft server during TLS handshaking.

7. Verify that the IM and Presence Service TLS Peer Authentication TLS Context is configured correctly and that all TLS Peer Subjects have been chosen.

Incorrect SIP URI Specified for Microsoft Lync or Microsoft Office Communicator Users when Added to Cisco Unified Personal Communicator Contact List

Troubleshooting Step

Verify that the Cisco Unified Personal Communicator registry configuration is correct, in particular the LDAP_AttributeName_uri and LDAP_UriSchemeName subkeys. For more information see the chapter for Configuring Active Directory for in Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager .

Display Names not Shown for Microsoft Lync or Microsoft Office Communicator Contacts on Cisco Unified Personal Communicator

Troubleshooting Step

Verify that the Cisco Unified Personal Communicator registry configuration is correct, in particular the LDAP_AttributeName_uri and LDAP_UriSchemeName subkeys. For more information, see topics related to configuring Active Directory in Configuration and Administration of IM and Presence Service on Cisco Unified Communications Manager.

User Migration Troubleshooting

This section describes user migration tracing and common user migration problems.

User Migration Tracing

This section describes tools used for user migration tracing.

Export Contact List Tool

The Export Contact List tool allows an administrator to export contact lists in bulk from Lync/OCS for migrating users. With each run the tool generates a log file called ExportContactsLog<Timestamp>.txt. The log file contains details about any failures or errors that have occurred. The log file is saved to the same location as the tool itself.

Some common reasons why errors can occur include:

- Incorrect input filename specified

- Misspellings in input file

- Users specified are not associated with the Microsoft server/pool that the tool is being run against

The following is an example of a log file for the Export Contact List tool:

>>------------------- 18/05/2011 16:59:38 ------------------->>Version: 2.1
[DEBUG] Enter>> ExportContacts.LdapConnection.CreateLdapDirectoryEntry
[DEBUG] Enter>> ExportContacts.LdapConnection.CreateDirectoryEntry
[DEBUG] Enter>> ExportContacts.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> ExportContacts.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> ExportContacts.LdapConnection.CreateDirectoryEntry
[DEBUG] Current line item is: sip:ExampleUser@dtstfedcup2.com
[DEBUG] Exit>> ExportContacts.ExportContactsUtilities.getAllSipUriFromStandardFile
[DEBUG] Enter>> ExportContacts.ExportContactsUtilities.getAndPrintContactsForUsers
[DEBUG] Total number of users found is: 1
[DEBUG] Processing user number: 1
[INFO]  Preparing to get contacts for User [sip:ExampleUser@dtstfedcup2.com]
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.getContactsAndGroupsForUser
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.getUserInstanceID
[DEBUG] Searching for userInstanceId [SELECT * FROM MSFT_SIPESUserSetting WHERE PrimaryURI = 'sip:ExampleUser@dtstfedcup2.com']
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Search results returned
[DEBUG] Found user with PrimaryURI : sip:ExampleUser@dtstfedcup2.com, InstanceId : {7D777FD5-A8F6-8243-B4D6-7F331008C58C}
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.getUserInstanceID
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.getContacts
[DEBUG] Searching for contacts [SELECT * FROM MSFT_SIPESUserContactData WHERE UserInstanceID = '{7D777FD5-A8F6-8243-B4D6-7F331008C58C}']
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Search results returned
[DEBUG] Found contact:  SIPURI : [SIP:lyncContact@dtstfedcup2.com] with GroupId: [1]
[DEBUG] Found contact:  SIPURI : [SIP:ExampleUser@dtstfedcup2.com] with GroupId: [1]
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.getContacts
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.getGroups
[DEBUG] Searching for groups [SELECT * FROM MSFT_SIPESUserContactGroupData WHERE UserInstanceID = '{7D777FD5-A8F6-8243-B4D6-7F331008C58C}']
[DEBUG] Enter>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.GetScope
[DEBUG] Search results returned
[DEBUG] Found group:  groupName : [General] with GroupId: [1]
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.getGroups
[INFO]  User Processed Successfully
[DEBUG] Exit>> ExportContacts.OcsWmiConnection.getContactsAndGroupsForUser
[DEBUG] Enter>> ExportContacts.ExportContactsUtilities.PrintContactsForUser
[DEBUG] Exit>> ExportContacts.ExportContactsUtilities.PrintContactsForUser
[DEBUG] Exit>> ExportContacts.ExportContactsUtilities.getAndPrintContactsForUsers
[INFO]  Summary:
[INFO]  1 users successfully processed
[INFO]  0 users not found
[INFO]  0 users could not be processed due to errors
<<------------------- 18/05/2011 16:59:41 -------------------<<

Related Tasks

IM and Presence Service BAT Contact List Import

Disable Account Tool

The Disable Account tool connects to Active Directory (AD) and updates the users’ Lync/OCS attributes to disable their Microsoft server account. With each run the tool generates a log file called DisableAccountLog<Timestamp>.txt. The log file contains details about any failures or errors that have occurred. The log file is saved to the same location as the tool itself.

Some common reasons why errors can occur with this tool include:

- Incorrect input filename specified

- Misspellings in input file

- User does not exist in the Microsoft server database

- The administrator who is running the tool does not have read/write permissions for the AD

- The administrator did not allow enough time for the changes applied to AD by this tool to propagate down to the Microsoft server database. The migration may fail if the administrator moves on to the next migration step without validating that the changes have taken effect in the Microsoft server database.

The following is an example of a log file for the Disable Account tool:

>>------------------- 18/05/2011 17:02:07 ------------------->>Version: 2.0
[DEBUG] Enter>> DisableAccount.LdapConnection.CreateLdapDirectoryEntry
[DEBUG] Enter>> DisableAccount.LdapConnection.CreateDirectoryEntry
[DEBUG] Enter>> DisableAccount.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> DisableAccount.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> DisableAccount.LdapConnection.CreateDirectoryEntry
[DEBUG] Enter>> DisableAccount.AccountDisable.DisableUsersInFile
[DEBUG] Enter>> DisableAccount.AccountDisable.GetSipUriFromLine
[DEBUG] Exit>> DisableAccount.AccountDisable.GetSipUriFromLine
[INFO]  Preparing to Disable Communications Server Account for User [sip:ExampleUser@dtstfedcup2.com]
[DEBUG] Enter>> DisableAccount.LdapConnection.DisableAccount
[INFO]  Searching for user [sip:ExampleUser@dtstfedcup2.com]
[INFO]  Search results returned
[DEBUG] Enter>> DisableAccount.LdapConnection.CreateLdapDirectoryEntry
[DEBUG] Enter>> DisableAccount.LdapConnection.CreateDirectoryEntry
[DEBUG] Enter>> DisableAccount.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> DisableAccount.LdapConnection.checkLdapPrefix
[DEBUG] Exit>> DisableAccount.LdapConnection.CreateDirectoryEntry
[INFO]  Found user with PrimaryURI : sip:ExampleUser@dtstfedcup2.com, DisplayName : Example User, Enabled : True
[DEBUG] Committed changes to the AD
[INFO]  User Account Disabled
[DEBUG] Exit>> DisableAccount.LdapConnection.DisableAccount
[DEBUG] Enter>> DisableAccount.AccountDisable.GetSipUriFromLine
[DEBUG] Exit>> DisableAccount.AccountDisable.DisableUsersInFile
[INFO]  Summary:
[INFO]  1 users successfully processed
[INFO]  0 users not found
[INFO]  0 users could not be processed due to errors
<<------------------- 18/05/2011 17:02:08 -------------------<<

For more information about using the Disable Account tool, see topics related to disabling Microsoft server accounts for migrating users.

Delete Account Tool

The Delete Account tool allows you to delete migrating users so that presence requests for these users are later routed to IM and Presence Service while ensuring the deleted users are not removed from the contact list of any users that remain on Lync/OCS. After you run the Delete Account tool, the tool generates a log file called DeleteAccountLog<Timestamp>.txt to the same directory as the tool. The log file contains details about any failures or errors that have occurred.

Some common reasons why errors can occur with this tool include:

- Incorrect input filename specified

- Incorrect database instance name specified

- Misspellings in the input file

- User does not exist in the Microsoft server database

The following is an example of a log file for the Delete Account tool:

>>------------------- 02/12/2013 15:13:50 ------------------->>
Version: 10.x.x-xx
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.GetCommSvrDbCon
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.GetConnection
[DEBUG] Attempting to Open connection with String : Server=lyncServer\rtclocal;Database=rtc;Trusted_Connection=yes;
[DEBUG] Connection Opened Ok
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.GetConnection
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'Resource']
[DEBUG] Found id [1077578877]
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[INFO]  Found the Resource Table, appears to be a valid Communications Server Database
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'Endpoint']
[DEBUG] No result
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'Container']
[DEBUG] Found id [1202103323]
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'HomedResource']
[DEBUG] No result
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'CertificateStore']
[DEBUG] Found id [1826105546]
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[INFO]  Found the CertificateStore table, dealing with a version of Lync.
[DEBUG] Enter>> DeleteAccount.DbConnectionFactory.tableExists
[DEBUG] SQL is [SELECT id FROM sysobjects WHERE name = 'ForestDirectory']
[DEBUG] Found id [853578079]
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.tableExists
[INFO]  Found the ForestDirectory table, Creating Lync2013 Connection
[DEBUG] Exit>> DeleteAccount.DbConnectionFactory.GetCommSvrDbCon
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.CheckConnection
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.CheckConnection
[DEBUG] Enter>> DeleteAccount.DeleteUserData.DisableUsersInFile
[DEBUG] Enter>> DeleteAccount.DeleteUserData.GetUserAtHostFromLine
[DEBUG] Exit>> DeleteAccount.DeleteUserData.GetUserAtHostFromLine
[INFO]  Preparing to Delete Communications Server Data for User [lyncUser@lyncDomain.net]
[DEBUG] Enter>> DeleteAccount.DeleteUserData.DeleteOcsUserData
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.GetResourceIdForUser
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.SqlEscape
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.SqlEscape
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.GetResourceIdForUser
[INFO]  Found user [lyncUser06@cork.com] with ResourceId [1010], proceeding to delete data
[DEBUG] Enter>> DeleteAccount.Lync2013DbConnection.DeleteResourceDirectory
[DEBUG] Enter>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Exit>> DeleteAccount.CommSvrDbConnection.GetConnection
[DEBUG] Ran dbo.RtcpDeleteHomedResourceTransaction for resource [1010]
[DEBUG] Deleted CachedContainerMember for resource [1010]
[DEBUG] Deleted ContainerMemberUser for resource [1010]
[DEBUG] Deleted PromptedSubscriber for resource [1010]
[DEBUG] Deleted Delegate for resource [1010]
[DEBUG] Ran RtcpDeleteConferenceParticipantByEnterpriseId for resource [1010]
[DEBUG] Deleted UserPolicy for resource [1010]
[DEBUG] Deleted ResourcePhone for resource [1010]
[DEBUG] Deleted RtcItem for resource [1010]
[DEBUG] Deleted PUIDDirectory for resource [1010]
[DEBUG] Deleted ResourceDirectory for resource [1010]
[DEBUG] Committing transaction for resource [1010]
[INFO]  Completed Updates for resource [1010]
[DEBUG] Exit>> DeleteAccount.Lync2013DbConnection.DeleteResourceDirectory
[DEBUG] Exit>> DeleteAccount.DeleteUserData.DeleteOcsUserData
[DEBUG] Enter>> DeleteAccount.DeleteUserData.GetUserAtHostFromLine
[DEBUG] Exit>> DeleteAccount.DeleteUserData.GetUserAtHostFromLine
[DEBUG] Exit>> DeleteAccount.DeleteUserData.DisableUsersInFile

Summary:
Users successfully processed:      1
Users not found:                   0
Users not processed due to errors: 0
<<------------------- 02/12/2013 15:13:50 -------------------<<

For more information about using the Delete Account tool, see topics related to deleting user data from the database for migrating users.

IM and Presence Service BAT Contact List Import

The IM and Presence Service Bulk Administration Tool (BAT) tool writes the results of the contact list import job to a log file. The log file contains the following information:

- The number of contacts that were successfully imported.

- The number of internal server errors that were encountered while trying to import the contacts.

- The number of contacts that were not imported (ignored). The log file lists a reason for each ignored contact at the end of the log file.

- The number of contacts in the CSV file that were unprocessed due to an error that caused the BAT job to finish early. This error rarely occurs.

To access this log file, complete the following procedure:

1. Log in to the Cisco Unified IM and Presence Administration user interface. Choose Bulk Administration > Job Scheduler.

2. Click Find, and then choose the Job ID of the contact list import job.

3. Click the Log File Name link to open the log.

If you require further detail on any BAT job, see the Bulk Provisioning Service debug logs. You can access these logs at the following location: /var/log/active/cm/trace/bps/log4j/bps000*.txt

You can enable debug logging for the Bulk Provisioning Service on the Cisco Unified IM and Presence Serviceability user interface.

Configure Bulk Provisioning Service Logging on the IM and Presence Service

The following procedure describes how to configure Bulk Provisioning Service logging on IM and Presence Service.

Caution

Debug level tracing can affect system performance. Enable debug level tracing only when required and reset to default log settings after the investigation is complete.

Procedure

Step 1

Log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Trace > Configuration.

Step 2

Choose the IM and Presence Service node and click Go.

Step 3

Choose Database and Admin Services from the Service Group drop-down list and click Go.

Step 4

Choose the Bulk Provisioning Service from the Service drop-down list and click Go.

Step 5

Choose Trace On.

Step 6

In the Trace Filter Settings, choose the Debug Trace Level. If you want to enable debug level on the traces, choose Debug.

Step 7

Click Save.

Related References

Export Contact List Tool

IM and Presence Service Bulk Administration Tool Contact Rename

The IM and Presence Service Bulk Administration Tool (BAT) allows you to rename the contact ID (JID) in user contact lists from one format to another. For example, you can rename a user’s contact ID from firstname.lastname@domain.com to userid@domain.com and the BAT updates each user’s contact list with the new contact ID.

The Bulk Administration Tool writes the results of the contact rename job to a log file. The log file contains the following information:

- The number of contacts that have been successfully retrieved.

- The number of internal server errors that were encountered while trying to retrieve the contacts.

- The number of contact rename records that were ignored. The log file lists a reason for each record at the end of the log file.

- The number of contact rename records in the CSV file that were unprocessed due to an error that caused the bulk job to finish early. This error rarely occurs.

- The number of users that were notified of their contact changes.

- The number of users that could not be notified of their contact changes.

To access this log file, complete the following procedure:

1. Log in to the Cisco Unified CM IM and Presence Administration user interface. Choose Bulk Administration > Job Scheduler.

2. Click Find and choose the Job ID of the contact rename job.

3. Click the Log File Name link to open the log.

The following are common reasons why errors occur:

- The Cisco XCP Router service is stopped on a node in the cluster.

- The format of the uploaded CSV file is incorrect. You must ensure that the format of the file is correct and that the file header is present. For more information about the file format, see the related topic regarding the rename of contact IDs.

- Contact IDs have invalid characters or exceed the maximum allowed length.

If you require more detail about any bulk administration job, see the Bulk Provisioning Service debug logs. You can access these logs at the following location: /var/log/active/cm/trace/bps/log4j/bps000*.txt.

You can enable debug logging for the Bulk Provisioning Service on the Cisco Unified Serviceability user interface. For more information, see topics related to debug logging and configuring BAT provisioning service logging.

Related Tasks

Rename Contact IDs in IM and Presence Service Contact Lists

Configure Bulk Provisioning Service Logging on the IM and Presence Service

Common User Migration Problems

This section describes some common user migration problems.

Application Failed to Initialize Properly - Error Occurs When Running Any of the User Migration Tools

Troubleshooting Steps

While attempting to run any of the user migration tools you may receive the following error: "Application failed to initialize properly". The reason for this error is that you are attempting to run the user migration tools without the .NET 2.0 Framework installed. Each of the user migration tools that Cisco provides requires that at least version 2.0 of the .NET Framework is installed on the server where you are running the tool.

The .NET 2.0 Framework comes installed as standard on Windows Server 2003 R2 or newer.

Export Contact List Tool does not Produce an Output File for Lync Users

Troubleshooting Steps

To export contact lists from a Lync server you must include the database instance parameter. If you omit the database instance parameter or enter an incorrect database parameter, an error is written to the Export Contact List log. Check the log to determine whether you omitted the database parameter or entered an incorrect parameter.

Follow these steps to find the database instance for each server/pool:

1. Open a powershell window on a front-end server in the pool.

2. Run the following cmdlet:

Get-CsManagementConnection

The database instance name is the value of the Data Source parameter in the command output.

Export Contact List Tool Log Shows getAndPrintContactsForUsers Error

Troubleshooting Steps

If you run the export tool for Lync users and see the following error in the log, "Error occurred in getAndPrintContactsForUsers", then the Export Contact List tool cannot connect to the Lync database. Verify that the user account running the tool has the appropriate read permissions for the Lync database. Verify that dbo execution account privileges are granted to the RTC database. If this doesn't solve the issue, verify that there are no typographic errors in the database instance name.

Export Contact List Tool - Log Summary Shows Several Users as Not Found

Troubleshooting Steps

1. If you are using an IM and Presence Service exported file as the input, check that the correct domain is being used for the -d/ parameter and that there are no typographic errors in the file.

2. If you are using a SIP URI file as the input, check that the users are valid (exist in Active Directory [AD] and Lync/OCS) and that they are entered correctly in the input file with the "sip:" prefix.

3. If you are not using an IM and Presence Service exported file or a SIP URI file as the input, or if you are using the OU input file, the user accounts are most likely disabled in AD. Re-enable the user accounts and run the tool again.

Export Contact List Tool - Tool Does Not Show the Progress Bar and Does Not Produce an Output File of Exported Contacts when Run in Normal Mode

Troubleshooting Steps

1. Check for the following error in the Export Contact List log: "Unable to connect to LDAP using IP/FQDN/Hostname: [some_ip_or_hostname]."

1. If the error exists, check that the address supplied for the Active Directory (AD) server is correct.

2. If the address supplied is valid, then ping the AD server to check that there is network connectivity between it and the Lync/OCS server.

3. If there is connectivity, ensure that the user has the required privileges to access the AD server.

2. Check for the following error in the Export Contact List log: "Failed to open file…."

1. If the error exists, the filename used for the -f/ parameter is misspelled or invalid.

2. Check also that the input file does not contain spaces or special characters in its filename.

3. If you are running the Export Contact List Tool on OCS, ensure that you did not enter the database instance parameter. The database instance parameter is needed to export contacts from Lync only.

Disable Account Tool - Log Shows Unable to Connect to LDAP Using IP/FQDN/Hostname

Troubleshooting Steps

1. Check that the address supplied for the Active Directory (AD) server is correct.

2. If the address supplied is valid, ping the AD server to check that there is network connectivity between it and the Lync/OCS server.

3. If there is connectivity, ensure that user has the required privileges to access the AD server.

Delete Account Tool - Unable to Find the Microsoft Server Database or Server Instance

Troubleshooting Steps

1. The Delete Account tool must be run against each database instance to ensure that the account is correctly deleted.

2. For OCS, follow these steps to find the database instance for each server/pool:

1. On the OCS management console, choose the pool name under the Enterprise Pools (Enterprise Edition) or the server name under Standard Edition Servers (Standard Edition).

2. In the right pane, choose the Database tab.

3. The database instance name is the first item under General Settings.

3. For Lync, follow these steps to find the database instance for each server/pool:

1. Open a powershell window on a front-end server in the pool.

2. Run the following cmdlet:

Get-CsManagementConnection

The database instance name is the value of the Data Source parameter in the returned output.

Delete Account Tool - Log Shows Error While Connecting to the SQL Server

Troubleshooting Steps

1. Check the Delete Account tool logs to see the reason for this error. If the error is "The user is not associated with a trusted SQL Server connection", the user running the tool does not have the required privileges to write to the Lync/OCS database.

2. Rerun the tool with a user account that has the required privileges.

BAT Contact List Update - Uploaded Contact List File Not in Drop-Down List

Troubleshooting Steps

1. Log in to the Cisco Unified Communications Manager IM and Presence Administration user interface. Choose Bulk Administration > Upload/Download Files and click Find.

2. Check that the file exists and that its function type is Import Users' Contacts – Custom File.

3. If a file exists with the incorrect function type, delete the file. If you deleted the file, or there is no file, upload the file again and ensure that its target is Contact Lists and its transaction type is Import Users' Contacts – Custom File.

BAT Contact List Update - No Log file Exists on Results Page after BAT Job

Troubleshooting Steps

If the log for the BAT import contacts job is missing from the job result page, the BAT job was run from a subscriber node. The log is accessible only from the publisher node. Log in to Cisco Unified Communications Manager IM and Presence Administration on the publisher node to view the log.

BAT Contact List Update - A User's Contacts Are Not Imported During BAT Job

Troubleshooting Steps

1. Check the job results log file for any specific errors.

2. Ensure that the user is licensed for IM and Presence.

3. Ensure that the user is assigned to a node within this cluster.

4. Ensure that the contact's domain is valid.

BAT Contact List Update - A User's Contacts Are Partially Imported During BAT Job

Troubleshooting Steps

1. Check the job results log file for any specific errors.

2. Ensure that the missing contacts are in a valid format in the CSV file.

3. Check that the user’s number of contacts does not exceed the Maximum Contact List Size on the system.

4. Check that the user’s number of watchers does not exceed the Maximum Watchers on the system.

BAT Contact List Update - No Contacts are Imported During BAT Job

Troubleshooting Steps

1. Check the job results log file for any specific errors.

2. Ensure that the import file is in a valid format.

3. Ensure that all the users are licensed for IM and Presence Service.

4. Ensure that all the users are assigned on the local cluster.

5. Ensure that the Cisco Presence Engine service is running on all nodes within the cluster.

Migrating User Status Appears as Status Unknown or Presence Unknown to Microsoft Server Users during the Migration Process

Troubleshooting Steps

1. Ensure that contacts have been fully migrated to IM and Presence Service as described in this document.

There is a period during the migration process when availability of migration contacts is not visible to Microsoft Lync or Microsoft Office Communicator users. Cisco recommends that user migration takes place during a scheduled maintenance window to reduce the occurrence of such issues.

2. Request Microsoft Lync or Microsoft Office Communicator users to sign out and sign in again.

After the migrated contacts are imported into IM and Presence Service, Microsoft server users do not see availability for these contacts until they have signed out and back in to their clients.

3. If the problem persists, ensure that the migration steps were correctly followed, as defined in this document.

- Verify that the updates that were applied by the Disable Account tool were synchronized to Lync/OCS before you ran the Delete Account tool.

- Ensure that you ran the Delete Account tool on all Standard Edition Microsoft servers or Enterprise Edition pools.

- If these steps were not performed correctly, then repeat to resolve this issue as follows:

- Run the Disable Account tool.

- Verify that the AD updates made by the Disable Account tool have synchronized to the Microsoft server.

- Run the Delete Account tool.

4. If migrated contacts are still appearing with a state of "Presence Unknown" there may be an issue with the integration between the IM and Presence Service and the Microsoft server. To help troubleshoot integration issues, see Common Integration Problems.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)