For redundancy and high-availability purposes, you can
incorporate a load balancer into the federated network. Cisco recommends the
Cisco CSS 11500 Content Services Switch, which is placed between the
IM and Presence server and the
Cisco Adaptive Security Appliance (see
High availability for SIP federation).
The load balancer terminates incoming TLS connections from
Cisco Adaptive Security Appliance, and initiates a new TLS connection to route the content to
the appropriate backend
IM and Presence server.
IM and Presence server updates
When using a load balancer for redundancy, you must update
settings on the
IM and Presence publisher and subscriber nodes.
Procedure
Task
Procedure
Update the federation routing parameter
Select
Cisco Unified CM IM and Presence
Administration > System > Service
Parameters > Cisco SIP Proxy
from the Service menu and enter these values:
Virtual IP
Address - enter the virtual IP address set on the load balancer
Server
Name - set to the FQDN of the load balancer
Federation Routing IM and Presence FQDN -
set to the FQDN of the load balancer.
Create a new TLS peer subject
Select
Cisco Unified CM IM and Presence Administration > System > Security > TLS
Peer Subjects.
Click
Add New
and enter these values:
Peer
Subject Name - enter the external FQDN of the load balancer
Description - enter the name of
the load balancer
Add the TLS peer to the TLS peer subjects list
Select
Cisco Unified CM IM and Presence
Administration > System > Security > TLS
Context Configuration.
When using a load balancer, the foreign domain still sends messages to the public IM and Presence address, but the Cisco Adaptive Security Appliance maps that address to a virtual IP address on the load balancer. Thus, when the Cisco Adaptive Security Appliance receives messages from the foreign domain, it forwards it to the load balancer. The load balancer then passes it on to the appropriate IM and Presence servers.
To support this configuration, you must make some changes to the Cisco Adaptive Security Appliance:
Change the static PAT to use an arbitrary, unused port for the public IM and Presence address.
Change: static
(inside,outside) tcp
<Public
IM and Presence
IP address>
5061 <Routing
IM and Presence
private IP address>
5062 netmask
255.255.255.255
to:
static (inside,outside)
tcp <Public
IM and Presence
IP
address> 55061 <Routing
IM and Presence
/Publisher private
IP address> 5062
netmask 255.255.255.255
object service obj_tcp_
source_eq_5061# service
tcp source eq 5061
nat (inside,outside)
source static
obj_host_<Routing
IM and Presence
Private IP address>
obj_host_<public
IM and Presence ip
address> service
obj_tcp_source_eq_5062
obj_tcp_source_eq_5061
to
object service obj_tcp_
source_eq_55061#
service tcp source eq
55061
nat (inside,outside)
source static
obj_host_<Routing
IM and Presence
Private IP address>
obj_host_<public
IM and Presence ip
address> service
obj_tcp_source_eq_5062
obj_tcp_source_eq_55061
Add a new static PAT to allow messages sent to the public IM and Presence address to be forwarded to the virtual port address (on whichever port the load balancer is listening for TLS messages).
static (inside,outside)
tcp <Public
IM and Presence
address> 5061 <Load
Balancer VIP> 5062
netmask
255.255.255.255.
object network
obj_host_<Loadbalancer
VIP>#host <routing
IM and Presence
private address>
object service obj_tcp_
source_eq_5061
# service tcp source eq
5061
nat (inside,outside)
source static
obj_host_<LoadBalancer
VIP> obj_host_<public
IM and Presence
ip address> service
obj_tcp_source_eq_5062
obj_tcp_source_eq_5061
Changes Required for IM and Presence Subscriber
Add a new access list for the load balancer virtual IP address. You must add an access list for each foreign domain that IM and Presence needs to access.
access-list ent_lber_to_foreign_ocs extended
permit tcp host <subscriber private ip address>
host <foreign domain public IP address> 5061
access-list ent_lcs_to_lber_routgcup extended
permit tcp host <foreign domain public ip
address> host
<IM and Presence public ip address> 65061
Add a new access list for a foreign domain to initiate messages to a IM and Presence server when the load balancer virtual IP address is in place. You must add an access list for each foreign domain that needs to access IM and Presence.
To support the load balancer, you also need to update the access lists on the Cisco Adaptive Security Appliance specific to your deployment scenario.
Note
The IM and Presence public IP address refers to the public IP address of the IM and Presence domain as configured on Cisco Adaptive Security Appliance, and as it appears in the DNS record. This record shows the FQDN of the load balancer containing the public IP of Cisco Adaptive Security Appliance.
Procedure
Deployment Scenario
Task
Configuration Example
An IM and Presence server federating with one or more foreign domains
Add a new access list for the new load balancer virtual IP address. You must add an access list for each foreign domain that IM and Presence needs to access.
Publisher:
Cisco Adaptive Security Appliance Release 8.2 and 8.3 Command:
access-list ent_lber_to_foreign_ocs extended permit tcp host <Virtual IP address> host <foreign domain public IP address> eq 5061
Add a new access list for a foreign domain to initiate messages to a IM and Presence server when the load balancer virtual IP address is in place. You must add an access list for each foreign domain that needs to access IM and Presence.
IM and Presence to IM and Presence Federation, where the foreign domain has added one or more intercluster IM and Presence servers
The foreign domain ASA must allow access to the arbitrary ports which have been chosen for our local domain publisher and the subscriber.
access-list ent_cup_to_foreignPubcupwlber extended permit tcp host <foreign domain private CUP address> host <public CUP address of our local domain> 55061
access-list ent_cup_to_foreignSubcupwlber extended permit tcp host <foreign domain private CUP address> host <public CUP address of our local domain> 65061
For each access list, add a new class to incorporate the new access list.
For each class, make an entry in the policy-map global_policy.
When adding the load balancer to the configuration, you must also generate CA-signed security certificates between the load balancer and the Cisco Adaptive Security Appliance and IM and Presence server as described in these sections:
Security certificate configuration between load balancer and IM and Presence server
This topic provides an overview of the required steps for configuring the security certificate between the load balancer and the IM and Presence nodes.
Procedure
Task
Procedure
Generate a CA-signed certificate on both the publisher and subscriber nodes.
Follow the instructions to exchange certificates using CA-signed certificates.
Import the CA-signed certificates (from the publisher and subscriber nodes) to the load balancer
Use the copy ssl and ssl associate commands.
Microsoft component updates
You must update some Microsoft components with the load
balancer details.
Procedure
Task
Procedure
Update all instances of the FQDN to correspond to
the load balancer FQDN.
Update the domain name in the IM Provider list
with the load balancer.
If you incorporate a load balancer into your AOL federation deployment, you must provide AOL with some details about the load balancer. Refer to the section in the Related topics for details.
This topic gives an overview of the necessary tasks for
configuring the Cisco CSS 11500 Content Services Switch for this integration.
The Cisco CSS 11500 Content Services Switch must have an SSL Accelerator Module
installed and configured in back-end SSL mode.For detailed information on each
task, refer to the Cisco CSS 11500 Content Services Switch documentation at the
following URL:
Configure certificate exchange between Cisco CSS
11500 Content Services Switch and
IM and Presence.
CA or
self-signed certificates can be used in the SSL module.
You need to
generate a certificate for the Cisco CSS 11500 Content Services Switch, and
import this onto the remote server.
You need to
import the certificate from the remote server onto the Cisco CSS
11500 Content Services Switch.
Configure certificate exchange between Cisco CSS
11500 Content Services Switch and
Cisco Adaptive
Security Appliance.
You must define a virtual SSL server in an SSL
proxy list for an SSL module to properly process and terminate SSL
communications from the client and initiate a HTTP connection to the server.
You must specify
the IP address and port number that the
Cisco Adaptive
Security Appliance points to.
You must specify
the name of the existing certificate and key pair for the
Cisco Adaptive
Security Appliance.
Create a Back-End SSL server entry in SSL Proxy
List for each
IM and Presence server.
You must specify
the
IM and Presence server address. Note that the
IM and Presence servers (back-end servers) must be on a different subnet
than the VIP address.
The back-end
server connection can be a different TLS cipher suite than the front-end, or
can be TCP.
You must specify
the port to receive the TLS traffic on the Cisco CSS
11500 Content Services Switch.
You must specify
the port to send the TLS traffic to the
IM and Presence servers.
Create an SSL service for SSL termination for each
IM and Presence server.
When specifying
the keepalive port, ensure that the port number is the same as those you
configured for the Back-End SSL server entries.
The keepalive
message type value should be "tcp".
Create the SSL module.
You must specify
the physical slot number of the SSL module. Use the CSS command "show chassis"
to retrieve this slot number.
In the SSL
module you must associate a
IM and Presence server with an SSL service, for example add ssl-proxy-list
called
ssl_list1.
Create an internal content rule to route the
decrypted data from the ASA to IM and Presence server.
Create content rule to route TLS data to the SSL
module for decryption and load-balancing.
Create a NAT association between the VIP and the
back-end
IM and Presence servers.
When using a Cisco CSS
11500 Content Services Switch directly between
IM and Presence and Microsoft OCS (no
Cisco Adaptive
Security Appliance), you must be able to resolve the certificate
Subject Common Name for the
IM and Presence server to
IM and Presence IP address from OCS. Also each
IM and Presence server Subject Common Name must be in the OCS host
authorization list.
Feedback
