Call manager
| Cisco Unified Communications Manager (Call Manager) | |
|---|---|
| Basic data
|
|
| developer | Cisco Systems, Inc. |
| Current version | 12.6 (1) (19.06.2019) |
| operating system | Linux |
| category | VoIP (software) |
| License | proprietary |
| German speaking | Yes |
| Cisco Unified Communications Manager | |
The Cisco Unified Communications Manager (Callmanager) (short: CUCM) is software for controlling and switching telephone systems based on the Internet Protocol . Such a system is also known as an IP telephony solution or Voice-over-IP ( VoIP ) system. The CallManager server takes on the essential functions of a classic telephone system and increasingly integrates video, mobility, CTI and collaboration applications. Other manufacturers often use the term soft PBX .
history
In 1994 "Multimedia Manager 1.0" was published on HP-UX , which was used to switch video calls. After porting to Windows NT 3.51 and renaming it "Selsius Callmanager", the softswitch has been optimized for the switching of voice-only calls. The company "Selsius" was bought by Cisco Systems in 1998 . The then renamed product "CallManager" was sold from then on as Cisco CallManager . On March 6, 2006, Cisco CallManager was renamed Cisco Unified CallManager . Version 6 of the IP-PBX, released in March 2007, was renamed Cisco Unified Communications Manager . A descendant of this, which has also been available since then, is the Cisco Unified CallManager Business Edition , which, in addition to the well-known services , also unifies Unified Messaging on a server that can be operated under one interface. A special server, the MCS7828, is required for this.
Functions
The CUCM controls all the necessary components and functions of an IP telephony system (VoIP). The components essentially include IP telephones, voice gateways , application servers and conference bridges . All settings, operating states and evaluations are saved by the CUCM in an Informix database. Several CUCMs can be interconnected to form a CUCM group ( cluster ) in order to increase operational reliability, separate individual CUCMs for special tasks (TFTP server) and / or increase performance. In a cluster, configuration changes are generally only made on one CUCM. The (changed) configuration information of this database is regularly replicated to the rest of the CUCM in the cluster. This is CUCM as publishers , other than CUCM Subscriber ( participants called).
Performance characteristics
- Scalability:
- Up to 10,000 users per server
- Up to nine servers per cluster (one publisher + eight subscribers = 80,000 users / cluster)
- Management of over 1,000,000 participants at over 100 locations with a network of several clusters
- System requirements:
- Virtual server (VMware vSphere ESXi 5.0 U1, 5.1, 5.5, 6.0) on Cisco UCS Blade Center as Tested Reference Configuration or "specs-based" hardware from other manufacturers
Administration and configuration
The CUCM is configured primarily via a graphical user interface . Microsoft Internet Explorer (version 5.x or higher) and Mozilla Firefox are supported as browsers . The Bulk Administration Tool (BAT) is available for extensive imports, exports and changes , a Microsoft Excel template, e.g. B. import or change a variety of user or phone number data. In addition to the administrative GUI , users can use a personalized interface to e.g. B. to maintain personal phone books or call diversions.
As of CUCM version 5.x, access to the operating system ( Red Hat Linux ) or the database ( Informix ) is no longer possible. There is a simplified Command Line Interface (CLI) with a restricted set of commands for troubleshooting or for querying system and database information.
The Cisco Unified Communications Manager (CUCM) can also be operated by provisioning systems such as the Cisco Unified Provisioning Manager (CUPM) or products from third-party manufacturers such as the Telephone Interface Communications Manager (TiM). These programs simplify and automate repetitive tasks. Provisioning systems use the Extensible Markup Language XML-based Application Programming Interface (API) of the CUCM.
Cisco Unified Call Manager security features
A historical overview
The (Windows-based) Callmanager 4 offered a hardened system, https (web access), SLDAP (Secure LDAP, or LDAP via SSL, also called “LDAPS”), certificate-based TLS and SRTP to telephones and MGCP gateways later also SRTP for H.323 gateways and SRTP support for fall-back telephony.
These functions have been taken over and expanded in Unified Call Manager 5. Some security features have been added with regard to the SIP terminals and the appliance platform.
Unified Call Manager 5 / Unified Communications Manager 6 to 11: Platform and application
From version 5, Red Hat Enterprise Linux is used as the operating system . Along with this, aspects of OS hardening (guest accounts, switching off unused services, ...), the concept of "Least Privilege" and the security passphrase (with checking the complexity, ...) have been addressed. Direct root access by the user / administrator to the operating system with Red Hat Linux tools (shell etc.) is not permitted. A proprietary command line (CLI) is available to the administrator for basic services. Most of the configuration is done with a web browser on websites.
Informix from IBM is used as the database management system (DBMS) .
However, since no application that has network access can be started on the CUCM from a shell, file system or console, virus and worm attacks are significantly more difficult. There is a dedicated mechanism that enables the Cisco TAC to create a privileged remote access account for troubleshooting work. For this purpose, the user executes a CLI command that creates a server-specific account that is limited in time and can then be used by the Cisco TAC.
Previously accessible services such as DHCP , DNS , PING , log file access etc. are now only accessible via the GUI via https or the CLI via SSH . The images for the Unified Call Manager are digitally signed. This ensures that only images from Cisco that have not been changed can be installed on the Unified Callmanager during updates. The CCM5 / 6 uses a dynamic firewall that limits intra-cluster traffic to known devices only. Therefore, during an installation (in contrast to the CCM4), the publisher must first run completely before further servers can be added to the cluster. With a few exceptions, the interfaces of the CCM5 / 6 are secured by encryption (HTTPS, SLDAP, SSH, SFTP, SNMPv3). Web applications are specially secured (30 min auto log-off in the event of inactivity, ...) The security-relevant log files (Security / Event / CSA Agent) are only accessible by the "Real-Time Monitoring Tool" (RTMT), which is only available via SSH communicates with the CCM5 / 6, retrievable. SFTP is an alternative to this.
The Cisco Security Agent (CSA)
In the pre-CCM5 / 6 era it was possible to install the CSA as a managed CSA. Since the client is compiled by the management console for this, the CCM5 / 6 no longer support this variant. This is done so that the policy and the public key of the management console can be inserted into the client image. The newer CallManagers only accept signed images, which means that only the COP files directly provided by Cisco are available for updates and policies of the CSA. At the same time, specially optimized policies are designed by Cisco, the application of which avoids incorrect configurations by the administrators and simplifies their work.
IPSec philosophy
The newer Cisco Unified CallManagers only support authenticated or authenticated and simultaneously encrypted IPSec connections to remote devices (pre-shared keys or certificates). This applies to gateways (MGCP and H.323) as well as to inter cluster trunks. Corresponding commands are available both on the CLI and in the GUI. With their help, certificates can be managed, "own certificates" created or "third-party certificates" entered and external Certificate Authority (CA) created. The "Simple Certificate Enrollment Protocol" (SCEP) still used in the Unified Call Manager 4 has been supplemented by the CSR (Certificate Signature Request) protocol, with which a request from the CA, e.g. B. to generate a certificate, can be signed.
Extensions to SRTP and TLS
Cisco uses a bidirectional exchange of the X.509v3 certificates as the basis of the mutual trust relationship. A CTL file ( Certificate Trust List ) is generated and transmitted to the telephones, in which the certificates and a list of trusted devices is contained. For example, the TFTP service is included, as is the CAPF server. However, the telephones must also know the certificates of the eTokens that bring the certificates with which the CTL file is signed by the administrator. Correspondingly, however, the Unified CallManager, TFTP server and various services must also be able to trust the telephones. So-called LSCs (Locally Significant Certificates), which are generated by the CAPF (Certificate Authority Proxy Function) (or are routed to the CA), and MSCs (Manufacturer Signed Certificates) form the basis for this. They are transmitted to the Unified Call Manager via a secure TLS connection. IPSEC is used for security in gateways. Once authenticated and authorized, a “preshared master secret” is generated from which the various SALT and HMAC values are derived. From then on, a relationship of trust is established for all devices. Different modes for the certificate exchange can be selected, as well as different combinations for authentication. It is thus possible to configure a mixed operation authenticated / encrypted optional / mandatory in the network. This means that mixed constellations can also be implemented, depending on the technology used. The "Cisco Callmanager Capacity Tool" is able to carry out capacity calculations for TLS-operated telephones. In general, phones use 36 kB more memory and 3–5% more CPU on the CCM than phones without TLS. With the Unified CallManager 5.1, however, there was also a mechanism that outsourced the TLS memory allocation and thus made the entire process even more scalable.
Firewall / NAT traversal
If the voice (better: the signaling traffic for voice) is encrypted, a firewall can no longer monitor the signaling traffic and dynamically open / close or convert ports. The same applies to session border controllers. With the CCM 5.1 and Cisco's firewall family (PIX / ASA since version 8.0) there is a special function to “listen” to the traffic by writing a certificate from the firewall to the CTL file. This means that the firewall is seen as trustworthy and can terminate the TLS session between the telephones and the CCM5.1 + as “man in the middle”. At the same time, you can take the load off the CCM in large networks because it no longer has to terminate the sessions itself. The corresponding feature is called "TLS proxy".
The trouble shooting of such techniques can be very complex. Cisco has built various aids into the CCM5 + specifically for this, as well as interfaces to access session keys via secure CTI interfaces in "Packet Capture Mode". This is also used in connection with lawful interception ("voice recording") to provide authorized servers with the ability to record encrypted conversations.
Unified Call Manager 5- / 6-LDAP security
Unified CallManager versions prior to 4.0 had a built-in LDAP directory. With version 5.0 a method was added to query LDAP directories and to save the users in the internal database of the Unified CallManager (not an internal LDAP, for example). This made it possible to integrate into external LDAP directories using two separate processes: 1. Synchronization, 2. Authentication. Unique search strings and multiple search instances allow the dedicated extraction of only the really required user names in the external directory. An authentication process (called "Identity Management System", IMS) determines whether authentication requests are either answered by the internal database or forwarded to the external directory via SLDAP. The Unified Callmanager 5+ knows two types of users: "End user" and "Application user". The difference is that application users are always authenticated against the internal directory database, whereas end users are also parsed against external LDAP directories. Precautions have been taken for the simplified integration in directories such as Microsoft's AD, Netscape, iPlanet, SUN ONE, which benefits an extremely simplified configuration for these directories for synchronization, moves adds and changes and data security for migration tasks and network problems. Many applications such as Unity, Meeting Place and IPCC are also integrated here, which is equivalent to authentication against the same credentials and therefore simplifies administration.
Configuration tools
- Web browser for administration and user websites (Internet Explorer / Firefox / Chrome / Safari)
- Command line (VMWare console or SSH)
swell
- ↑ Archive link ( Memento of the original from October 7, 2008 in the Internet Archive ) Info: The archive link was inserted automatically and has not yet been checked. Please check the original and archive link according to the instructions and then remove this notice.
- ↑ RFC 3711
- ↑ RFC 2246
