1 Report Information

The Cisco TelePresence Video Communication Server (VCS) software simplifies session management and control of telepresence conferences. It provides flexible and extensible conferencing applications, enabling organizations to benefit from increased employee productivity and enhanced communication with partners and customers.

The VCS delivers exceptional scalability and resiliency, secure communications, and simplified large-scale provisioning and network administration in conjunction with Cisco TelePresence Management Suite (Cisco TMS).

The VCS interworks transparently with Cisco Unified Communications Manager (Unified CM), bringing rich telepresence services to organizations with Unified CM. It also offers interoperability with third-party unified communications, IP telephony networks, and voice-over-IP (VoIP) systems.

The VCS supports on-premises and cloud applications and is available as a dedicated appliance or as a virtualized application on VMware, with additional support for Cisco Unified Computing System (Cisco UCS) platforms.

You can deploy the VCS as the VCS Control for use within an enterprise and as the VCS Expressway for business-to-business and remote and mobile worker external communication. An alternative solution, suited to small to medium-sized businesses (SMBs), is the VCS Starter Pack Express.

Optional packages that you can deploy include FindMe, Device Provisioning, and Advanced Networking (VCS Expressway only).

1.1 Report Summary

This report was generated with the following settings.

1.2 Presenter

1.3 Client

2 Information

The following section provides details of the software, hardware, and time settings of the Expressway.

3 System

This section shows network services and settings related options that appear under the System menu of the web interface. These options help to configure the VCS in relation to the network in which it is located, for example its IP settings, firewall rules, intrusion protection and the external services used by the VCS (for example DNS, NTP and SNMP).

3.1 Administration

The System Administration shows the name of the Cisco TelePresence Video Communication Server system and methods by which the system may be accessed by administrators. Although you can administer the Cisco TelePresence Video Communication Server through a PC connected directly to the unit with a serial cable, you may want to access the system remotely over IP. You can do this using the web interface via HTTPS, or through a command line interface via SSH. Configurable options are for:

• System Name
• Ephemeral Port Range
• Services
• Session Limits
• System Protection
• Web Server Configuration

3.2 Network Interfaces

This section shows settings for:

• Ethernet
• IP
• Static Routes

3.2.1 Ethernet

This section shows configuration of speed for the connections between the Expressway and the Ethernet networks to which it is connected. The speed and duplex mode must be the same at both ends of the connection. If you installed the Advanced Networking option, you can configure the speed and duplex mode for each Ethernet port. The default Speed is Auto, which means that the Expressway and the connected switch will automatically negotiate the speed and duplex mode.

3.2.2 IP

The IP section shows configuration of the IP protocols and network interface settings of the Expressway. Expressway can be configured to use IPv4, IPv6 or Both protocols. The default is Both.

• IPv4: it only takes calls between two endpoints communicating via IPv4. It communicates with other systems via IPv4 only.
• IPv6: it only takes calls between two endpoints communicating via IPv6. It communicates with other systems via IPv6 only.
• Both: it takes calls using either protocol. If a call is between an IPv4-only and an IPv6-only endpoint, the Expressway acts as an IPv4 to IPv6 gateway. It communicates with other systems via either protocol.

All IPv6 addresses configured on the Expressway are treated as having a /64 network prefix length.

3.2.3 Static Routes

This section shows Static Routes from the Expressway to an IPv4 or IPv6 address range.

Static routes are sometimes required when using the Advanced Networking option and deploying the Expressway in a DMZ. They may also be required in other complex network deployments.

3.3 DNS

The Domain name is used when attempting to resolve unqualified server addresses (for example ldapserver). It is appended to the unqualified server address before the query is sent to the DNS server. If the server address is fully qualified (for example ldapserver.mydomain.com) or is in the form of an IP address, the domain name is not appended to the server address before querying the DNS server.

3.4 Time

The Time section shows configuration of the Expressway's NTP servers and the local time zone. An NTP server is a remote server with which the Expressway synchronizes in order to ensure its time is accurate. The NTP server provides the Expressway with UTC time. Accurate time is necessary for correct system operation.

3.5 SNMP

This section shows the Expressway's SNMP settings. Tools such as Cisco TelePresence Management Suite (Cisco TMS) or HP OpenView may act as SNMP Network Management Systems (NMS). They allow monitoring of network devices, including the Expressway, for conditions that might require administrative attention. The Expressway supports the most basic MIB-II tree (.1.3.6.1.2.1) as defined in RFC 1213. The information made available by the Expressway includes the following:

• system uptime
• system name
• location
• contact
• interfaces
• disk space, memory, and other machine-specific statistics

By default, SNMP is Disabled, therefore to allow the Expressway to be monitored by an SNMP NMS (including Cisco TMS), alternative SNMP mode must be selected.

3.6 Clustering

An Expressway can be part of a cluster of up to six Expressways. Each Expressway in the cluster is a peer of every other Expressway in the cluster. When creating a cluster, the cluster name should be defined and one peer must be nominated as the master from which all relevant configurations are replicated to the other peers in the cluster. Clusters are used to:

• Increase the capacity of your Expressway deployment compared with a single Expressway.
• Provide redundancy in the rare case that an Expressway becomes inaccessible (for example, due to a network or power outage) or while it is in maintenance mode (for example, during a software upgrade).

3.7 Protection

The Protection section shows settings for intruder protection, used to detect and block malicious traffic and to help protect the VCS from dictionary-based attempts to breach login security.

The Automatic Detection works by parsing the system log files to detect repeated failures to access specific service categories, such as SIP, SSH and web/HTTPS access. When the number of failures within a specified time window reaches the configured threshold, the source host address (the intruder) and destination port are blocked for a specified period of time. The host address is automatically unblocked after that time period so as not to lock out any genuine hosts that may have been temporarily misconfigured.

The report shows the Automated Detection Configuration, Exemptions and Blocked Addresses.

3.7.1 Automated Detection

The automated protection service can be used to detect and block malicious traffic and to help protect the VCS from dictionary-based attempts to breach login security.

It works by parsing the system log files to detect repeated failures to access specific service categories, such as SIP, SSH and web/HTTPS access. When the number of failures within a specified time window reaches the configured threshold, the source host address (the intruder) and destination port are blocked for a specified period of time. The host address is automatically unblocked after that time period so as not to lock out any genuine hosts that may have been temporarily misconfigured.

3.7.1.1 Configuration

The Configuration is used to enable and configure the VCS's protection categories, and to view current activity.

Automated protection should be used in combination with the Firewall Rules feature - use automated protection to dynamically detect and temporarily block specific threats, and use firewall rules to permanently block a range of known host addresses.

3.7.1.2 Exemptions

The Exemptions section shows IP addresses that are to be exempted always from one or more protection categories.

3.8 Quality of Service

The Quality of Service (QoS) shows configuration of QoS options for outbound traffic from the Expressway. This allows the network administrator to tag all signalling and media packets flowing through the Expressway with one specific QoS tag and hence provide the ability to prioritize video traffic over normal data traffic. Management traffic, for example SNMP messages, is not tagged.

3.9 External Manager

The External Manager shows the configuration of Expressway's connection to an external management system. An external manager is a remote system, such as the Cisco TelePresence Management Suite (Cisco TMS), used to monitor events occurring on the Expressway, for example call attempts, connections and disconnections, and as a place for where the Expressway can send alarm information. The use of an external manager is optional.

4 Configuration

This section shows settings for:

• Protocols
• Registration
• Authentication
• Call Routing
• Local Zone
• Zones
• Dial Plan
• Bandwidth
• Traversal
• Call Policy
• Unified Communications

4.1 Protocols

This section provides information about how to configure the Expressway to support the SIP and H.323 protocols.

• Configuring H.323
• Configuring SIP
• Configuring domains
• Configuring SIP and H.323 interworking

4.1.1 H.323

The H.323 shows configuration for H.323 settings on the Expressway, including whether H.323 is enabled or not, Gatekeeper and Gateway settings.

4.1.2 SIP

The SIP section shows the configuration for SIP settings on the Expressway, including:

• SIP functionality and SIP-specific transport modes and ports
• Certificate revocation checking modes for TLS connections
• Registration Controls
• Authentication
• Advanced settings with SIP Maximum Size and the TCP Connect Timeout.

4.1.3 Interworking

The Interworking section contains configurations indicating whether or not the Expressway acts as a gateway between SIP and H.323 calls. The translation of calls from one protocol to the other is known as "interworking".

4.2 Registration

For an endpoint to use the VCS as its H.323 gatekeeper or SIP registrar, the endpoint must first register with the VCS. The VCS can be configured to control which devices are allowed to register with it by using the following mechanisms:

• A device authentication process based on the username and password supplied by the endpoint
• A registration restriction policy that uses either Allow Lists or Deny Lists or an external policy service to specify which aliases can and cannot register with the VCS
• Restrictions based on IP addresses and subnet ranges through the specification of subzone membership rules and subzone registration policies

These mechanisms can be used together. For example, authentication can be used to verify an endpoint's identity from a corporate directory, and registration restriction to control which of those authenticated endpoints may register with a particular VCS.

4.2.1 Registration Configuration

The Registration configuration page is used to control how the VCS manages its registrations, with the Registration Policy setting to be used while determining which endpoints may register with the system.

• None: no restriction.
• Allow List: only endpoints attempting to register with an alias listed on the Allow List may register.
• Deny List: all endpoints, except those attempting to register with an alias listed on the Deny List, may register.
• Policy service: only endpoints that register with details allowed by the remote policy service may register. This option comes with its own settings
• Default: None

4.2.2 Registration Allow List

The Registration Allow List shows the endpoint aliases and alias patterns that are allowed to register with the VCS. Only one of an endpoint's aliases needs to match an entry in the Allow List for the registration to be allowed. A Restriction policy must be selected to use the Allow List.

4.2.3 Registration Deny List

The Registration Deny List section shows the endpoint aliases and alias patterns that are not allowed to register with the VCS. Only one of an endpoint's aliases needs to match an entry in the Deny List for the registration to be denied. A Restriction policy must be selected to use the Deny List.

4.3 Authentication

This section provides information about the VCS's authentication policy with the Outbound Connection Credentials and Devices.

4.3.1 Outbound Connection Credentials

The Outbound Connection Credentials section shows the username that VCS will use whenever it is required to authenticate with external systems.

4.3.2 Devices

Device authentication is the verification of the credentials of an incoming request to the Cisco TelePresence Video Communication Server (VCS) from a device or external system. It is used so that certain functionality may be reserved for known and trusted users, for example the publishing of presence status, collection of provisioning data, or the ability to use resources that cost money like ISDN gateway calling.

When device authentication is enabled on a VCS, any device that attempts to communicate with the VCS is challenged to present its credentials (typically based on a username and password). The VCS will then verify those credentials, or have them verified, according to the authentication method, and then accept or reject the message accordingly.

VCS authentication policy can be configured separately for each zone and subzone. This means that both authenticated and unauthenticated devices could be allowed to register to, and communicate with, the same VCS if required. Subsequent call routing decisions can then be configured with different rules based upon whether a device is authenticated or not. See Configuring VCS authentication policy for more information.

4.3.2.1 Local Database

The local authentication database is included as part of VCS system and does not require any specific connectivity configuration. It is used to store user account authentication credentials. Each set of credentials consists of a name and password.

The credentials in the local database can be used for device (SIP and H.323), traversal client and TURN client authentication.

Same credentials can be used by more than one device.

4.3.2.2 Active Directory Service

Active Directory database (direct) authentication uses NTLM protocol challenges and authenticates credentials via direct access to an Active Directory server using a Kerberos connection.

It can be enabled at the same time as local database and H.350 directory service authentication. This is because NTLM authentication is only supported by certain endpoints. Therefore, for example, Active Directory (direct) server method can be used for Jabber Video, and the local database or H.350 directory service authentication for the other devices that do not support NTLM.

If Active Directory (direct) authentication has been configured and NTLM protocol challenges is set to Auto, then NTLM authentication challenges are offered to those devices that support NTLM. Devices that do not support NTLM will continue to receive a standard Digest challenge.

The VCS embeds NTLMv2 authentication protocol messages within standard SIP messages when communicating with endpoint devices, and uses a secure RPC channel when communicating with the AD Domain Controller. Users' Windows domain credentials and the AD domain administrator credentials are not stored on the VCS.

4.3.2.3 H.350 Directory Service

This section shows the Device authentication H.350 configuration for connection via LDAP to an H.350 directory service. An H.350 directory service lookup can be used for authenticating any endpoint, SIP and H.323.

4.4 Call Routing

One of the functions of the VCS is to route calls to their appropriate destination. It does this by processing incoming search requests in order to locate the given target alias. These search requests are received from:

• Locally registered endpoints
• Neighboring systems, including neighbors, traversal clients and traversal servers
• Endpoints on the public internet

There are a number of steps involved in determining the destination of a call, and some of these steps can involve transforming the alias or redirecting the call to other aliases.

It is important to understand the process before setting up dial plan so that circular references can be avoided, where an alias is transformed from its original format to a different format, and then back to the original alias. The VCS is able to detect circular references. If it identifies one it will terminate that branch of the search and return a "policy loop detected" error message.

4.5 Local Zone

This section shows collection of all endpoints, gateways, MCUs and Content Servers registered with the VCS makes up its Local Zone. The Local Zone is divided into subzones. These include an automatically created Default Subzone and up to 1000 manually configurable subzones. When an endpoint registers with the VCS it is allocated to an appropriate subzone based on subzone membership rules. These rules specify the range of IP addresses or alias pattern matches for each subzone. If an endpoint's IP address or alias does not match any of the membership rules, it is assigned to the Default Subzone. The Local Zone may be independent of network topology, and may comprise multiple network segments. The VCS also has two special types of subzones:

• The Traversal Subzone, which is always present
• The Cluster Subzone, which is always present but only used when the VCS is part of a cluster

4.5.1 Default Subzone

This section shows Default Subzones used to place bandwidth restrictions on calls involving endpoints in the Default Subzone, and to specify the Default Subzone's registration, authentication and media encryption policies.

When an endpoint registers with the VCS, its IP address and alias is checked against the subzone membership rules and it is assigned to the appropriate subzone. If no subzones have been created, or the endpoint's IP address or alias does not match any of the subzone membership rules, it is assigned to the Default Subzone (subject to the Default Subzone's Registration policy and Authentication policy).

The use of a Default Subzone on its own (without any other manually created subzones) is suitable only if uniform bandwidth available between all endpoints. Note that if a Local Zone contains two or more different networks with different bandwidth limitations, separate subzones for each different part of the network should be configured.

4.5.2 Traversal Subzones

The Traversal Subzone is a conceptual subzone. No endpoints can be registered to the Traversal Subzone; its sole purpose is to control the bandwidth used by traversal calls.

The Traversal Subzone allows to place bandwidth restrictions on calls being handled by the Traversal Subzone and to configure the range of ports used for the media in traversal calls.

4.5.3 Subzones

The Local Zone's subzones are used for bandwidth management and to control registration and authentication policies.

The Subzones lists all the subzones that have been configured on the VCS, and allows one to create, edit and delete subzones. For each subzone, it shows how many membership rules it has, how many devices are currently registered to it, and the current number of calls and bandwidth in use. Up to 1000 subzones can be configured.

After configuring a subzone, the Subzone membership rules should be set up to control which subzone an endpoint device is assigned to when it registers with the VCS as opposed to defaulting to the Default Subzone.

4.5.4 Subzone Membership Rules

The Subzone membership rules section shows configuration of the rules that determine, based on the address of the device, to which subzone an endpoint is assigned when it registers with the VCS.

The page lists all the subzone membership rules that have been configured on the VCS, and lets one to create, edit, delete, enable and disable rules. Rule properties include:

• rule name and description
• priority
• the subnet or alias pattern matching configuration
• the subzone to which endpoints whose addresses satisfy this rule are assigned

Note that if an endpoint's IP address or registration alias does not match any of the membership rules, it is assigned to the Default Subzone. Up to 3000 subzone membership rules can be configured.

4.6 Zones

The Zone status lists all of the external zones on the VCS. It shows the number of calls and amount of bandwidth being used by each zone.

The list of zones always includes the Default Zone, plus any other zones that have been created.

4.6.1 Zones

A zone is a collection of endpoints, either all registered to a single system or located in a certain way such as via an ENUM or DNS lookup. Zones are used to:

• Control through links whether calls can be made between your local subzones and these other zones
• Manage the bandwidth of calls between local subzones and endpoints in other zones
• Search for aliases that are not registered locally
• Control the services available to endpoints within that zone by setting up its authentication policy
• Control the media encryption and ICE capabilities for SIP calls to and from a zone

4.7 Domains

The Domains lists the SIP domains managed by this VCS.

A domain name can comprise multiple levels. Each level's name can only contain letters, digits and hyphens, with each level separated by a period (dot). A level name cannot start or end with a hyphen, and the final level name must start with a letter. An example valid domain name is 100.example-name.com.

Note that values shown in the Index column correspond to the numeric elements of the %localdomain1%, %localdomain2%, . . . %localdomain200% pattern matching variables.

Up to 200 domains can be configured.

4.8 Unified Communications

This section shows configuration for the VCS Control and VCS Expressway for Unified Communications functionality, a core part of the Cisco Collaboration Edge Architecture. The section show settings for:

• Configuration
• Deployments
• Unified CM servers
• IM and Presence Service Nodes
• Unity Connection Servers
• Jabber Guests

4.8.1 Configuration

This section shows the settings for Unified Communications mode and related attributes.

4.8.2 Deployments

A deployment is an abstract boundary used to enclose a domain and one or more Unified Communications service providers, such as Unified CM, Cisco Unity Connection, and IM and Presence Service nodes.

The purpose of multiple deployments is to partition the Unified Communications services available to mobile and remote access (MRA) users. This enables different subsets of MRA users to access different sets of services over the same VCS pair.

4.8.3 Unified CM Servers

The VCS Control must be configured with the address details of the Unified Communications services/nodes that are going to provide registration, call control, provisioning, voicemail, messaging, and presence services to MRA users.

4.8.4 IM and Presence Service Nodes

This section lists any IM and Presence Service nodes that have already been discovered.

4.8.5 Unity Connection Servers

This section lists any Cisco Unity Connection nodes that have already been discovered.

4.8.6 Jabber Guest Servers

Cisco Jabber Guest is a consumer to business (C2B) solution that extends the reach of Cisco's enterprise telephony to people outside of a corporate firewall who do not have phones registered with Cisco Unified Communications Manager.

It allows an external user to click on a hyperlink (in an email or a web page) that will download and install (on first use) a H.264 plugin into the user's browser. It then uses http-based call control to "dial" a URL to place a call to a predefined destination inside the enterprise. The user is not required to open an account, create a password, or otherwise authenticate.

To enable the call to be placed, it uses the Expressway solution (a secure traversal zone between the VCS Control and VCS Expressway) as a Unified Communications gateway to traverse the firewall between the Jabber Guest client in the internet and the Jabber Guest servers inside the enterprise to reach the destination user agent (endpoint).

4.9 Dial Plan

This section shows the structure of the Dial Plan. The Dial Plan determines the aliases assigned to the endpoints, and the way in which the VCSs are neighboured together. The choice of solution will depend on the complexity of the system. The section is divided into:

• Configuration
• Transforms
• Search Rules
• Policy Services

4.9.1 Configuration

The simplest approach to configure dial plan is to assign each endpoint a unique alias and divide the endpoint registrations between the VCSs. Each VCS is then configured with all the other VCS as neighbour zones. When one VCS receives a call for an endpoint which is not registered with it, it will send out a Location Request to all the other neighbour VCSs.

While conceptually simple, this sort of flat dial plan does not scale very well. Adding or moving a VCS requires changing the configuration of every VCS, and one call attempt can result in a large number of location requests. This option is therefore most suitable for a deployment with just one or two VCSs plus its peers.

4.9.2 Transforms

Transforms are used to modify the alias in a search request if it matches certain criteria. An alias can be transformed by removing or replacing its prefix, suffix, or the entire string, and by the use of regular expressions.

This transformation can be applied to the alias at two points in the routing process: as a pre-search transform and as a zone transform.

• Pre-search transforms are applied before any Call Policy or User Policy are applied and before the search process is performed.
• Zone transforms are applied during the search process by each individual search rule as required. After the search rule has matched an alias they can be used to change the target alias before the search request is sent to a target zone or policy service.

4.9.3 Search Rules

The Search rules section contains configuration showing how the VCS routes incoming search requests to the appropriate target zones (including the Local Zone) or policy services.

4.9.4 Policy Services

This section shows the media encryption policy settings which enables one to selectively add or remove media encryption capabilities for SIP calls flowing through the VCS. The system is configured such that, for example, all traffic arriving or leaving a VCS Expressway from the public internet is encrypted, but is unencrypted when in private network.

4.10 Bandwidth

This section describes how to control the bandwidth that is used for calls within your Local Zone, as well as calls out to other zones. The section includes:

• Configuration
• Links
• Pipes

4.10.1 Configuration

The Bandwidth configuration is used to specify how the VCS behaves in situations when it receives a call with no bandwidth specified, and when it receives a call that requests more bandwidth than is currently available.

4.10.2 Links

Links connect local subzones with other subzones and zones. For a call to take place, the endpoints involved must each reside in subzones or zones that have a link between them. The link does not need to be direct; the two endpoints may be linked via one or more intermediary subzones.

Links are used to calculate how a call is routed over the network and therefore which zones and subzones are involved and how much bandwidth is available. If multiple routes are possible, your VCS will perform the bandwidth calculations using the one with the fewest links.

4.10.3 Pipes

Pipes are used to control the amount of bandwidth used on calls between specific subzones and zones. The limits can be applied to the total concurrent bandwidth used at any one time, or to the bandwidth used by any individual call.

To apply these limits, you must first create a pipe and configure it with the required bandwidth limitations. Then when configuring links you assign the pipe to one or more links. Calls using the link will then have the pipe's bandwidth limitations applied to them.

4.11 Call Policy

This section contains the rules used to control which calls are allowed, which calls are rejected, and which calls are to be redirected to a different destination. These rules are known as Call Policy (or Administrator Policy).

If Call Policy is enabled and has been configured, each time a call is made the VCS will execute the policy in order to decide, based on the source and destination of the call, whether to:

• Proxy the call to its original destination
• Redirect the call to a different destination or set of destinations
• Reject the call

4.11.1 Configuration

The Call Policy mode controls from where the VCS obtains its Call Policy configuration. The options are:

• Local CPL: uses locally-defined Call Policy.
• Policy service: uses an external policy service.
• Off: Call Policy is not in use.

4.12 Traversal

To traverse a firewall, the Expressway must be connected with a traversal server (typically, an Expressway-E).

In this situation your local Expressway is a traversal client, so you create a connection with the traversal server by creating a traversal client zone on your local Expressway. You then configure the client zone with details of the corresponding zone on the traversal server. (The traversal server must also be configured with details of the Expressway client zone.)

This section shows settings for:

• Ports
• TURN
• Endpoints

4.12.1 Ports

The Expressway-E has specific listening ports used for firewall traversal. The correct ports must be set on the Expressway-E, traversal client and firewall in order for connections to be permitted. Rules must be set on your firewall to allow connections to these ports. In most cases the default ports should be used.

The following ports are configured:

4.12.2 TURN

TURN (Traversal Using Relays around NAT) services are relay extensions to the STUN network protocol that enable a SIP or H.323 client to communicate via UDP or TCP from behind a NAT device.

TURN relay services are only available on the Expressway-E. To use TURN services you need the TURN Relay option key (this controls the number of TURN relays that can be simultaneously allocated by the TURN server). This section lists the Expressway-E's TURN settings.

4.12.3 Locally registered endpoints

For an endpoint to use the Expressway as its H.323 gatekeeper or SIP registrar, the endpoint must first register with the Expressway. The Expressway can be configured to control which devices are allowed to register.

The following are the settings for endpoints to register.

5 Applications

This section provides information about each of the additional services that are available under the Applications menu of the VCS. The report shows:

• Conference Factory
• Presence
• FindMe

5.1 Conference Factory

The Conference Factory shows whether the Conference Factory application is enabled and disabled, and the alias and template it uses.

The Conference Factory application allows the VCS to support the Multiway feature. Multiway enables endpoint users to create a conference while in a call even if their endpoint does not have this functionality built in.

Multiway is supported in Cisco TelePresence endpoints including the E20 (software version TE1.0 or later) and MXP range (software version F8.0 or later).

5.2 Presence

Presence is the ability of endpoints to provide information to other users about their current status - such as whether they are offline, online, or in a call. Any entity which provides presence information, or about whom presence information can be requested, is known as a presentity. Presentities publish information about their own presence status, and also subscribe to the information being published by other presentities and FindMe users.

Endpoints that support presence, such as Jabber Video, can publish their own status information. The VCS can also provide basic presence information on behalf of endpoints that do not support presence, including H.323 endpoints, as long as they have registered with an alias in the form of a URI.

5.3 FindMe

FindMe is a form of User Policy, which is the set of rules that determines what happens to a call for a particular user or group when it is received by the Expressway.

The FindMe feature lets you assign a single FindMe ID to individuals or teams in your enterprise. By logging into their FindMe account, users can set up a list of locations such as "at home" or "in the office" and associate their devices with those locations. They can then specify which devices are called when their FindMe ID is dialled, and what happens if those devices are busy or go unanswered. Each user can specify up to 15 devices and 10 locations.

6 Users

This section provides information about how to configure administrator and FindMe user accounts, and how to display the details of all active administrator and FindMe sessions. This section shows the following:

• Password Security
• Administrator Accounts
• Administrator Groups
• LDAP Configuration

6.1 Password Security

The Password security controls whether or not local administrator account passwords must meet a minimum level of complexity before they are accepted.

If Enforce Strict Passwords is set to On, all subsequently configured local administrator account passwords must conform to the following rules for what constitutes a strict password.

6.2 Administrator Accounts

The Administrator Accounts section lists all the local administrator accounts on the VCS.

In general, local administrator accounts are used to access the VCS on its web interface or API interface, but are not permitted to access the CLI.

6.3 Administrator Groups

The Administrator Groups section lists all the administrator groups that have been configured on the VCS, and allows to add, edit and delete groups.

Administrator groups only apply if remote account authentication is enabled.

When logged in to the VCS web interface, the credentials are authenticated against the remote directory service and assigned access rights associated with the group to which one belongs. If the administrator account belongs to more than one group, the highest level permission is assigned.

6.4 LDAP Configuration

The LDAP configuration is used to configure an LDAP connection to a remote directory service for administrator account authentication. It can also provide user account authentication if using FindMe without Cisco TMS.

7 Maintenance

The Maintenance section of the report contains:

• Logging Configuration
• Maintenance Mode
• Language
• Diagnostics

7.1 Logging Configuration

The VCS provides syslogging features for troubleshooting and auditing purposes.

The Event Log is a rotating local log that records information about such things as calls, registrations, and messages sent and received.

7.2 Maintenance Mode

Maintenance mode is typically used to upgrade or take out of service a VCS peer that is part of a cluster. It allows the other cluster peers to continue to operate normally while the peer that is in maintenance mode is upgraded or serviced.

7.3 Language

The Language controls which language is used for text displayed in the web user interface. The default language used on the web interface.

7.4 Diagnostics

This section shows diagnostic log configuration.

7.4.1 Incident Reporting

The incident reporting feature of the VCS automatically saves information about critical system issues such as application failures.

7.4.1.1 Configuration

This section shows the Incident Reporting settings.

7.4.2 Advanced

This section shows settings for the following:

• Network Log Configuration
• Support Log Configuration

7.4.2.1 Network Log Configuration

This section shows the Network Log configuration used to configure the log levels for the range of Network Log message modules.

7.4.2.2 Support Log Configuration

This section shows Support Log configuration used to configure the log levels for the range of Support Log message modules.