Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1)
Configure interdomain federation to Microsoft OCS/Lync within an enterprise
Download this chapter
Configure interdomain federation to Microsoft OCS/Lync within an enterpriseConfigure interdomain federation to Microsoft OCS/Lync within an enterprise
Download the complete book
Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1)Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1) (PDF - 5 MB)
 Feedback

Configure interdomain federation to Microsoft OCS/Lync within an enterprise


Note

Refer to Federation and subdomains for information about federation and subdomains. However, once the OCS and IM and Presence domains are different, you can configure federation within the enterprise. You do not have to use subdomains; separate domains are equally applicable.

Add a Microsoft OCS domain within an enterprise

When you configure a federated domain entry, IM and Presence automatically adds the incoming ACL for the federated domain entry. You can see the incoming ACL associated with a federated domain on IM and Presence Administration, but you cannot modify or delete it. You can only delete the incoming ACL when you delete the (associated) federated domain entry.

Procedure
    Step 1   Select Cisco Unified CM IM and Presence Administration > Presence > Inter-Domain Federation > SIP Federation.
    Step 2   Select Add New.
    Step 3   Enter the federated domain name in the Domain Name field.
    Step 4   Enter a description that identifies the federated domain in the Description field.
    Step 5   Select Inter-domain to OCS/Lync.
    Step 6   Check Direct Federation.
    Step 7   Select Save.
    Step 8   After you add, edit or delete a SIP federated domain, restart the Cisco XCP Router by selecting Tools > Control Center - Network Services in Cisco Unified IM and Presence Serviceability. When you restart Cisco XCP Router, this causes a restart of all XCP services on IM and Presence.

    Configuration of static routes using TCP for federation with Microsoft OCS domain

    This section describes how to configure statics routes using TCP for direct federation between IM and Presence and Microsoft OCS. The Cisco Adaptive Security Appliance or the Microsoft Access Edge are not required.


    Caution

    The domain portion of the Routing Proxy FQDN parameter value cannot be the same as the Microsoft OCS domain. To view or edit the Routing Proxy FQDN parameter, select Cisco Unified CM IM and Presence Administration > System > Service Parameters, and select the Cisco SIP Proxy service.

    Configure static route on IM and Presence for OCS server

    To configure IM and Presence Service to use TCP when exchanging IM and presence with a federated Microsoft OCS domain, you must configure a static route on IM and Presence Service that points to the OCS server (and not the external edge of Microsoft Access Edge).

    You must add an individual static route for the OCS domain. The OCS domain static route should point to the IP address of a specific OCS Enterprise Edition front-end server or Standard Edition server.

    For high availability purposes, you can configure additional backup static routes to each OCS domain. The backup route has a lower priority and is used only if the next hop address of the primary static route is unreachable.

    Procedure
      Step 1   Select Cisco Unified CM IM and Presence Administration > Presence > Routing > Static Routes.
      Step 2   Select Add New.
      Step 3   Enter the destination pattern value so that the domain, or FQDN, is reversed. For example:
      • If the domain is domaina.com, the Destination Pattern value must be .com.domaina.
      • If the FQDN is name1.name2.domain.com, the Destination Pattern value must be .com.domain.name2.name1.
      Step 4   Enter the remaining parameters as follows:
      1. The Next Hop value is the OCS FQDN or IP address.
      2. The Next Hop Port number is 5060.
      3. The Route Type value is domain.
      4. The Protocol Type is TCP.
      Step 5   Select Save.
      What to Do Next

      Configure static routes on OCS for IM and Presence Service.

      Configure static routes on OCS for IM and Presence Service

      If you are using direct federation from IM and Presence Service to OCS without the Access Edge server or Cisco Adaptive Security Appliance, then you need to configure a static route from OCS to IM and Presence Service.

      Procedure
        Step 1   ClickStart > Programs > Administrative Tools > Microsoft Office Communicator Server 2007on OCS.
        Step 2   Right-click on the Front End server.
        Step 3   Select Properties > Front End Properties.
        Step 4   Click the Routing tab.
        Step 5   Click Add.
        Step 6   Enter the domain for the IM and Presence Service node, for example 'cisco.com'.
        Step 7   Enter the IP of the IM and Presence Service node for the Next Hop IP address.
        Step 8   Select TCP for the Transport value.
        Step 9   Enter 5060 for the Port value.
        Step 10   Click OK.
        What to Do Next

        Related Tasks

        Adding a Host Authorization entry for the IM and Presence server

        Procedure
          Step 1   Click on the Host Authorization tab on OCS.
          Step 2   Perform one of the following steps:
          1. Enter the IP address of the authorized host if you configured a static route on OCS that specifies the next hop computer by its IP address.
          2. Enter the FQDN of the authorized host if you configured a static route on OCS that specifies the next hop computer by its FQDN.
          Step 3   Click Add.
          Step 4   Select IP.
          Step 5   Enter the IP address of the IM and Presence server.
          Step 6   Check Throttle as Server.
          Step 7   Check Treat as Authenticated.
          Note   

          Do not check Outbound Only.

          Step 8   Click OK.

          Enable port 5060 on OCS server

          Procedure
            Step 1   SelectStart > Programs > Administrative Tools > Microsoft Office Communicator Server 2007 on OCS.
            Step 2   Right-click on the FQDN of Front End server.
            Step 3   Select Properties > Front End Properties and select the General tab.
            Step 4   If port 5060 is not listed under Connections, select Add.
            Step 5   Configure port 5060 as follows:
            1. Select All as the IP Address Value.
            2. Select 5060 as the Port Value
            3. Select TCP as the Transport Value
            Step 6   Select OK.

            Static route configuration using TLS for federation with Microsoft OCS domain

            Step

            Notes

            Configure a static route on IM and Presence for OCS

            Use the procedure Configure static route on IM and Presence for OCS server as a guide.

            When you configure the static route on IM and Presence, select the protocol type TLS, and make sure that the static route points to port 5061.

            Configure a static route on OCS for IM and Presence

            Use the procedure Configure static routes on OCS for IM and Presence Service as a guide.

            When you configure the static route on OCS, select the protocol type TLS, and make sure that the static route points to port 5061 (the default is 5062).

            Note   

            When using TLS with static routes on OCS, you must specify the FQDN of the IM and Presence server, rather than an IP address.

            On IM and Presence, you must also configure the Peer Auth Listener port on OCS as 5061. You configure this by selectingCisco Unified CM IM and Presence Administration > System > Application Listeners. Verify that the Peer Auth Listener port is 5061. You can configure the Server Auth Listener port to be 5062.

            Configure a host authorization entry for the IM and Presence FQDN

            Use the procedure Adding a Host Authorization entry for the IM and Presence server as a guide.

            Configure the certificates on OCS

            Configure OCS to use FIPS (TLSv1 rather than SSLv3), and import the CA root certificate.

            1. Open the Local Security Settings on OCS.
            2. In the console tree, select Local Polices.
            3. Select Security Options.
            4. Double-click System Cryptography:Use FIPS Compliant algorithms for encryption, hashing and signing.
            5. Enable the security setting.
            6. Select OK.
              Note   

              You may need to restart OCS for this to take effect.

            7. Import the CA root certificate for the CA that signs the IM and Presence certificate. Import the CA root certificate in to the trust store on OCS using the certificate snap-in.

            Configure the certificates on IM and Presence

            • On IM and Presence, upload the root certificate for the CA that signs the OCS certificate. Note the following:
            • Generate a CSR for IM and Presence so that the IM and Presence certificate can be signed by a CA. Upload the CSR to the CA that will sign your certificate.
            • When you have retrieved the CA-signed certificate and the CA root certificate, upload the CA-signed certificate and the root certificate to IM and Presence. Note the following:
              • Upload the root certificate as a cup-trust certificate.
              • Upload the C-signed IM and Presence certificate as a cup certificate. Specify the root certificate .pem file as the root certificate.
            • Add a TLS Peer subject on IM and Presence for the OCS server. Follow these steps Create new TLS peer subject to create the peer subject for the OCS server. Use the FQDN of the OCS server.
            • Add the TLS Peer to the Selected TLS Peer Subjects list. Follow these steps Add TLS peer to selected TLS peer subjects list to add the TLS Peer to the Selected TLS Peer Subjects list. Note the following:
              • Make sure that the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher is selected for the TLS Context Configuration.
              • Make sure that you disable empty TLS fragments.

            Static route configuration for interdomain federation to Microsoft Lync within enterprise


            Note

            For interdomain federation with Microsoft Lync, you must configure TLS between IM and Presence Service and Microsoft Lync if there is more than one Lync front-end server.

            This procedure uses the following sample configuration parameters:

            • IM and Presence Service Server FQDN (routing IM and Presence Service node): cupserverPub.sip.com

              Note

              Ensure the FQDN can resolve to the correct IP address.

            • IM and Presence Service Server IP Address (routing IM and Presence Service node): 10.53.57.10
            • IM and Presence Service Server TCP port: 5060

              Note

              The TCP port value must match that configured under Cisco Unified CM IM and Presence Administration > System > Application Listeners > Default Cisco SIP Proxy TCP Listener.

            • IM and Presence Service Server TLS port: 5062

              Note

              The TLS port value must match that configured under Cisco Unified CM IM and Presence Administration > System > Application Listeners > Default Cisco SIP Proxy TLS Listener - Peer Auth.

            • IM and Presence Service Server domain: sip.com
            • Lync Registrar server: lyncserver.lync.net

            For more information about configuring static routes for Interdomain Federation to Microsoft Lync within an enterprise, see http:/​/​technet.microsoft.com/​en-us/​library/​gg558664.aspx

            Step

            Instructions

            Define a TCP/TLS route

            Note   

            You must create a static route to the IM and Presence Service routing node only. It is not necessary to create static routes to subscriber nodes, nor any intercluster peer nodes even if your IM and Presence Service deployment has multiple clusters.

            1. Sign into a computer where Lync Server Management Shell is installed. You must sign in as a member of the RTCUniversalServerAdmins group or a role-based access control (RBAC) role to which you have assigned the New-CsStaticRoute cmdlet.
            2. Select Start > All Programs > Microsoft Lync Server 2010 > Lync Server Management Shell.
            3. For TLS, enter the following command: 
              $tlsRoute = New-CsStaticRoute -TLSRoute 
-Destination <FQDN of IM and Presence 
routing node> -Port <listening port of 
IM and Presence routing node> 
-usedefaultcertificate $true -MatchUri 
<destination domain>
              Example: $tlsRoute = New-CsStaticRoute -TLSRoute -Destination cupserverPub.sip.com -Port 5062 -usedefaultcertificate $true -MatchUri sip.com
              Note   

              To match child domains of a domain you can specify a wildcard value in the MatchUri parameter, for example, *.sip.com. That value matches any domain that ends with the suffix sip.com.

              If you set -usedefaultcertificate to false, you must specify the TLSCertIssuer and TLSCertSerialNumber parameters. These parameters indicate the name of the certification authority (CA) that issue the certificate used in the static route and the serial number of the TLS certificate, respectively. See the Lync Server Management Shell for more information about these parameters.

            4. For TCP, enter the following command: 
              $tcpRoute = New-CsStaticRoute 
-TCPRoute -Destination <IP address or FQDN of 
IM and Presence routing node> 
-Port <SIP listening port of 
IM and Presence routing node> 
-MatchUri <destination domain>
              Example: $tcpRoute = New-CsStaticRoute -TCPRoute -Destination 10.53.57.10 -Port 5060 -usedefaultcertificate $true -MatchUri *sip.com

            Persist the route

            Note   

            This step is only necessary for the routing node.

            1. To persist a newly created static route in the Central Management store, run one of the following: For TLS: 
              Set-CsStaticRoutingConfiguration -Route @{Add=$tlsRoute}
              For TCP: 
              Set-CsStaticRoutingConfiguration -Route @{Add=$tcpRoute}
            2. To verify that the command was successful, enter 
              get-CsStaticRoutingConfiguration

            Create trusted application server pool

            Note   

            You must create a trusted application server pool for all IM and Presence Service nodes, including the routing IM and Presence Service node.

            1. Enter the following command to obtain the Site ID: 
              get-cssite
            2. For TLS, enter the following command: 
              New-CsTrustedApplicationPool -Identity 
<FQDN of IM and Presence node> 
[-Registrar <Service ID or FQDN of the next hop>] 
-Site <Site ID for the site where you want to 
create the trusted application pool> 
TreatAsAuthenticated $true -ThrottleAsServer $true
              Example: 
              New-CsTrustedApplicationPool -Identity 
cupserverPub.sip.com -Registrar LyncServer.lync.net 
-Site co1 -TreatAsAuthenticated $true -ThrottleAsServer $true
            3. For TCP, enter the following command: 
              New-CsTrustedApplicationPool -Identity 
<IP address of IM and Presence node> 
[-Registrar <Service ID or FQDN of the next hop>] 
-Site <Site ID for the site where you want to 
create the trusted application pool> 
TreatAsAuthenticated $true -ThrottleAsServer $true
              Example: 
              New-CsTrustedApplicationPool -Identity 10.53.57.10 
-Registrar LyncServer.lync.net -Site co1 
-TreatAsAuthenticated $true -ThrottleAsServer $true

            Add application servers to the created pool

            Note   

            You must add application servers to the created pool for all IM and Presence Service nodes, including the routing IM and Presence Service node.

            1. For TLS, enter the following command: 
              New-CsTrustedApplication -ApplicationID 
<application name> -TrustedApplicationPoolFqdn 
<FQDN of IM and Presence node> 
-Port <SIP listening port of IM and Presence 
node>
              Example: 
              New-CsTrustedApplication -ApplicationID cupPub1 
-TrustedApplicationPoolFqdn cupserverPub.sip.com -Port 5062
            2. For TCP, enter the following command: 
              New-CsTrustedApplication -ApplicationID 
<application name> -TrustedApplicationPoolFqdn 
<IP Address of IM and Presence node> 
-Port <listening port of IM and Presence 
node> -EnableTcp
              Example: 
              New-CsTrustedApplication -ApplicationID cupPub1 
-TrustedApplicationPoolFqdn 10.53.57.10 -Port 5060 -EnableTcp

            Configure the Lync Server listen port

            1. In the Lync Server Management Shell enter the following command to verify the current system configuration: 
              Get-CSRegistrarConfiguration
            2. Enter the following command to set the Lync server listening port: 
              Set-CsRegistrar registrar:<Lync_server_FQDN> 
-SipServerTcpPort 5060
            3. Verify the new system configuration by entering the Get command from Step 1 again.

            The parameters that you use to configure the Lync server listen port are as follows:

            • Set-CsRegistrar - internal command that sets the Lync server port.
            • registrar: - FQDN of the Lync Server
            • -SipServerTcpPort - SIP listening port of the Lync server. The default value is typically 5060.

            Enable the topology

            1. Before you enable the topology, ensure that you have completed the following:
            2. Define a TCP/TLS route for the routing IM and Presence Service node.
            3. Persist the new static route for the routing IM and Presence Service node.
            4. Create a trusted application server pool for all IM and Presence Service nodes.
            5. Add application servers to the created pool for all IM and Presence Service nodes.
            6. Enter the following command to implement the changes you have made to the topology: 
              Enable-CsTopology

            Define Gateway IP Address

            Note   

            This step applies only to TCP.

            1. Sign into the computer where Topology Builder is installed. You must sign in as a member of the Domain Admins group and the RTCUniversalServerAdmins group.
            2. Select Start > All Programs > Microsoft Lync Server 2010 > Lync Server Topology Builder
            3. Select the option to download an existing topology.
            4. Expand the Trusted applications servers node.
            5. Right-click the trusted application pool that you created and select Edit Properties.
            6. Uncheck Enable replication of configuration data to this pool.
            7. Select Limit service usage to selected IP addresses and ensure that it is set to Use all configured IP addresses.
            8. In the Primary IP address field, enter the IP address of the SIP gateway.
            9. To update the topology in the Central Management store, in the console tree, select Lync Server 2010 and from the Actions pane, select Publish.