Ask the Expert: Service Delivery Manager for Cloud Web Security with Alex Chan

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the recommended practices for Cisco Cloud Web Security (CWS). Cisco Cloud Web Security (CWS) provides industry-leading security and control for the distributed enterprise, with Cisco expert Alex Chan.
October 27, 2014 through November 7, 2014.
Learn how users are protected everywhere and anytime, when using CWS through Cisco worldwide threat intelligence, advanced threat defense capabilities, and roaming user protection. Create a virtual space to learn and ask questions about best practice when implementing Cloud Web Security offerings for various customer requirements and environments. Alex will also answer questions about Easy ID, CWS as SAML Service Provider, Deployment Options (such as ASA, ISR, WSA, Workgroup based Connector and AnyConnect Web Security agent.
Remember to use the rating system to let Alex know if you have received an adequate response.
Because of the volume expected during this event, Ali might not be able to answer each question. Remember that you can continue the conversation on the Security community, sub-community shortly after the event. This event lasts through November 7, 2014. Visit this forum often to view responses to your questions and the questions of other community members.

Cisco CWS platform is one of the Cisco products that maintain collaboration with Cisco PSIRT, and there are few security vulnerabilities related to CWS were being monitored by PSIRT, which you can find out more about in: http://tools.cisco.com/security/center/home.x#~blog.
Another Cisco entity known as "SenderBase" that is powered by Cisco Security Intelligence Operations (SIO) will provides a view into virus threat intelligence collected from CWS cloud traffics. For more information about "SenderBase", please visit this web site: http://www.senderbase.org

Similar Messages

Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

With Eric Yu and Todd Pula
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE).
Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.
Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Antonio,
Many great questions to start this series. For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent? Does the problem happen for one WLAN but not another? As it stands today, the CoA-Ack needs to be initiated by the management interface. This limitation is documented in bug CSCuj42870. I have provided a link for your reference below. If the problem happens 100% of the time, the two configuration areas that I would check first include:
On the WLC, navigate to Security > RADIUS > Authentication. Click on the server index number for the associated ISE node. On the edit screen, verify that the Support for RFC 3576 option is enabled.
On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question. On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked. When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface. Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface. As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
Bug Info: https://tools.cisco.com/bugsearch/bug/CSCuj42870
For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request. We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered. Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers. For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
As for product roadmap questions, we won't be able to discuss this here due to NDA. Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
Related Info:
Wireless BYOD for FlexConnect Deployment Guide

Ask the Expert: Identity Services Engine - 802.1x, Identity Management and BYOD

Welcome to this Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Identity Service Engine (ISE) with subject matter expert Nicolas Darchis.
Cisco Identity Service Engine is a security policy management and control platform that automates and simplifies access control and security compliance for wired, wireless, and VPN connectivity. It is primarily used to provide secure access and guest access, support BYOD initiatives, and enforce usage policies in conjunction with Cisco TrustSec.
Nicolas Darchis is a wireless and authentication, authorization, and accounting expert for the Technical Assistance Center at Cisco Europe. He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, since 2007. He also focuses on filing technical and documentation bugs. Darchis holds a bachelor's degree in computer networking from the Haute Ecole Rennequin Sualem and a master's degree in computer science from the University of Liege. He also holds CCIE Wireless certification (no. 25344).
Remember to use the rating system to let Nicolas know if you have received an adequate response.
Because of the volume expected during this event, our expert might not be able to answer every question. Remember that you can continue the conversation in the Security community under subcommunity AAA, Identity, and NAC shortly after the event. This event lasts through June 20, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi.
1) It is not "ISE loses the credentials and asks for web portal again". Once a user is authenticated, it is authenticated as long as it stays connected. Possibilities are :
-You are returning a session timeout (attribute radius 27) in the authz profile of the user. Therefore user has to reauthenticate after X seconds. But you would see a pattern, then.
-Over wireless, many clients are not capable of doing fast roaming (smartphones is the biggest example) and will therefore reauthenticate with dot1x everytime they roam. A small coverage hole would be enough for the cached credentials to disappear and web portal to show up again
-Over wired, this cannot really occur but the idea is that it's probably the switch resetting the connection and contacting ISE again. The idea to troubleshoot this is to monitor the access device (WLC/switch) and check if the port goes up/down, if the MAB session gets reset or something and why.
2) The captive bypass issue is that Apple devices will probe apple.com website to check if there is internet connectivity. If they can reach it, then fine, if they sense that they are redirected, they open a small window pop up with the login portal. The problem (and I still cannot understand why) is that this is not Safari, it's some nameless feature-less browser that doesn't work properly.
By enabling the captive bypass feature, the WLC intercepts the requests to the Apple testpage and replies with HTTP OK. The apple device then thinks "ok I have internet connectivity" and it's up to the user to bring up a real browser to login to the portal page.
It therefore does not affect non-Apple device to have the feature enabled.
The problem is that in IOS 7.x, Apple decided to not just use Apple.com anymore but a whole list of testpages on different websites.
3) "whether it would solve the issue if I added certificate authentication as a secondary option, with eap-tls as the primary"
=> This is disturbing because EAP-TLS is a certificate authentication method. But ISE message seems to imply that the user is hitting an authnetication rule that only provides PEAP or EAP-FAST with mschap or something similar ...
If you have the windows default supplicant you have close to no control on what the client will submit. I can imagine that moving from wired to wireless, the laptop would sometimes try to send password instead of certificate and/or vice-versa. Anyconnect with fixed network profiles would solve the problem elegantly.
I cannot comment on your auth policies as I do not know them :-)
Regards,
Nicolas

Solution Manager prepared for the Remote Service Delivery?

In preparation of GoingLive Session, we received a mail with some questions. Among them the following:
Is your Solution Manager prepared for the Remote Service Delivery? Yes/No
Is the solution transferred to SAP?: Yes/No
What does the first question mean? what should be done to prepare the Solman for session delivery?
How do I check if the solution is transferred to SAP?
Thanks a lot,
    Dino

Hello Dino,
The SAP Solution Manager is a platform for the delivery of services for the following areas:
●     Risk minimization
●     Optimization of SAP solutions
●     Knowledge transfer
Services in the SAP Solution Manager are services which help you to monitor and optimize the performance and availibility of your system landscapes and minimize your system operation risks.
You can have the support services performed by SAP or perform them yourself:
●     Remote Services
SAP experts deliver this service type via a remote connection (SAP Safeguarding Services, e.g. SAP GoingLive Check).
For checking whether solution manager is prepared for remote service delivery u need to check the following.
Prerequisites
You have:
●     created a solution.
●     set-up a connection to the SAP Service Marketplace (Explorer).
Procedure
       1.      Choose the transaction SOLUTION_MANAGER.
       2.      Choose Delivery of SAP Services ® Service Plan, in Operations.
       3.      Choose Order Service from SAP.
You go to the Service Catalog.
       4.      Choose the link to the service.
The system goes to the catalog entry of the service, in the SAP Service Marketplace.
       5.      Follow the procedure described in the SAP Service Marketplace.
=============================================
Solution transfered to SAP means that the u have done the configuration, testing and validation of the SAP system components and then transfered this to the satellite systems connected to Solman. Please note that solman is the central point of access for supporting implementation activities and the satellite systems are SAP systems comnected to solman in the landscape.
Hope this helps. Please assign points and let me know if u need anything specific.
Rgds
Manish

Ask the Expert: Overview of Cisco Prime Service Catalog and Process Orchestrator Solutions

Welcome to this Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the Cisco Prime Service Catalog and Process Orchestrator solutions.
Cisco expert Jason Davis will discuss Cisco’s network management products offered under the Cisco Prime framework. If you have questions about Cisco Prime infrastructure or data center automation with our Cisco Prime Service Catalog and Process Orchestrator solutions, join us on the Cisco Support Community.
Jason Davis is a distinguished services engineer in the Intelligent Infrastructure Practice team of Cisco Advanced Services. His role is to provide strategic and tactical consulting for hundreds of Advanced Services customers, lead service innovation, and assess new services and technologies. Jason's primary expertise areas are in network management systems, intelligent automation, virtualization, data center operations, software-defined networking, and network programmability.
Based out of the Research Triangle Park (RTP) campus, Jason is also responsible for administering the Research Triangle Park Network Management Lab, Cisco's largest network management lab.
Since joining Cisco in 1998, Jason has been a frequent speaker at Cisco's Networkers and CiscoLive conferences in the United States and Europe. In the past five years he has also been involved in the conference network setup and monitoring. He is a much sought-after resource by the field sales teams to assist with presales solutions and executive briefings. He has provided strategic and tactical network management consulting for several hundred customers.
Jason is a subject matter expert with the following products and features:
Cisco Prime LAN management solution
Cisco Prime infrastructure
CiscoSecure ACS
Cisco Prime Network Registrar
Cisco Process Orchestrator
Cisco Prime Service Catalog
Cisco IP SLA
Embedded Event Manager
SNMPv3
onePK and OpenFlow
Cisco UCS
Device instrumentation
VMware ESX, ESXi, and vCenter
ITIL
Jason received his bachelor of science degree in electrical engineering from the University of Miami (FL). He has been married for 20 years and has 4 children. His interests include providing audiovisual technical support for churches and conference venues, camping and biking with his family, remote-control helicopter piloting, paintball, and recreational shooting.
Remember to use the rating system to let Jason know if you have received an adequate response.
Because of the volume expected during this event, Jason might not be able to answer every question. Remember that you can continue the conversation in Data Center > Intelligent Automation under the subcommunity Cisco Prime Service Catalog shortly after the event. This event lasts through September 12, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hello Jason,
Thank you very much for welcoming me to your expert discussion :) I feel to be in the right place, at the right time. Thank you also for answering question beyond your scope here, much appreciated. The information received will help me to go further as such I have submitted a 5 start rating for your first reply.
That sounds promising about the LMS part so yes, I stay tuned and wait patiently.
Ok, now let’s revert to the actual topic discussed here. Cisco Prime Service Catalog and Process Orchestrator solutions I have briefly read up on this on CCO (where elseJ) and picked out the following quote
---- Quote from the Cisco Prime Service Catalog Data Sheet
Today’s end users want self-service and easy access to IT tools and services.
Simultaneously, organizations are seeking ways to extend their cloud management
platforms beyond self-service delivery of virtual machines and infrastructure resources
while increasing their use of cloud-based solutions to enhance business agility and effectiveness.
Cisco Prime™ Service Catalog offers tremendous benefits to organizations that want to unify the ways in
which all types of IT services are ordered and fulfilled, not just infrastructure requests
---- un quote ---
I try to understand what (at high level of course) happens in the back ground when an order is raised and which vendor solution your product can interact with.
As mentioned in the quoted text, this service catalogue goes beyond the standard infrastructure.
Let’s say, a user wants to deploy a new email services, or in your example, extends or create a new web-portal (i.e. for HR to view and manage holiday, staff absence and benefits).
Your solution will need to interact somehow with the 3rd party vendor application that is capable building such portal I believe.
Without disclosing to many information, I assume the portal is linked to backend VM,s that spin up requested resources (and more magic of course). Perhaps I am mixing this up with another cisco product where a user can go on the portal and spin up virtual Firewalls, virtual Routers can be provisioned in now time.
Out if interest; Is this product also known as Mozart? (project code within Cisco?)
I hope query is ok.
Best wishes
Markus

Ask the Expert: Cisco TelePresence for the Enterprise

Welcome to the Cisco® Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Telepresence® for the enterprise.
Cisco experts Jaret, Fernando, and Fred will be covering all Cisco TelePresence products. Topics include Cisco TelePresence endpoints and TelePresence infrastructure such as the Cisco TelePresence Video Communication Server (VCS), Cisco Expressway Series, Cisco Unified Communication Manager (CallManager), Cisco TelePresence Servers (MSE 8710, on Virtual Machine, etc.), MCU (MSE 8510, etc.), Cisco TelePresence Management Suite (TMS), and all other Cisco TelePresence related devices.
Jaret Osborne is an 8-year Cisco Advanced Services veteran. In his Advanced Services tour, Jaret has covered all aspects of Cisco Unified Communications and TelePresence products, including both enterprise and service provider verticals. Most recently Jaret has been working with global service providers supporting their Cisco TelePresence as a Service offerings while also incubating new cloud services at Cisco.
Fernando Rivas is a Cisco Advanced Services NCE, starting in the Cisco Technical Assistance Center (TAC), 2007, on the Collaboration Technology Team mastering the Cisco Unified Communication technologies and specialized in call control CUCM,VCS) and conferencing (MeetingPlace, Telepresence). In 2011, he joined Cisco Advanced Services as a member of the Cisco Collaboration team and participated in several Cisco TelePresence and video-related technologies deployments. Currently he is a member of the Video Cloud Technology Team, supporting video exchanges in several and architecting new private video cloud solutions for large enterprises. Fernando holds a routing and switching CCIE® certification (22975).
Fred Mollenkopf is a Cisco Advanced Services Network consulting engineer working at Cisco for the last 7 years. Fred has led some of the largest Cisco Unified Communication and Collaboration deployments done for Cisco customers and partners. Over 15 years’ experience in data networking with a specialization in Cisco Unified Communications in 2004. Currently he is a member of the SP Video Advanced Services Team, supporting SP video exchanges and the Cisco Telepresence solutions. Fred maintains an active CCIE® in Voice (17521).
Remember to use the rating system to let Jaret, Fernando, and Fred know if you have received an adequate response.
Because of the volume expected during this event, Jaret, Fred, and Fernando might not be able to answer every question. Remember that you can continue the conversation in the Collaboration, Voice and Video Community, under the sub-community TelePresence, shortly after the event. This event lasts through August 15, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Tenaro,
Additionally here are the most common login issues. Unfortunately this includes items related to Presence implementation but I commented where we did not use these in our lab setup for CUCM Phone Capabilities only.
Login Issues
Problem:
Jabber Unable to Sign-in Through MRA
Solution
This can be caused by a number of things, a few of which are outlined below.
1. Collaboration Edge SRV record not created and/or port 8443 unreachable
For a jabber client to be able to login successfully using MRA, a specific collaboration edge SRV record must be created and accessible externally. When a jabber client is initially started it will make server DNS SRV queries:
_cisco-uds : this SRV record is used to determine if a CUCM server is available.
_cuplogin : this SRV record is used to determine if an IM&P server is available.
_collab-edge : this SRV record is used to determine if MRA is available.
If the jabber client is started and does not receive an SRV answer for _cisco-uds and _cuplogin, and does receive an answer for _collab-edge then it will use this answer to try to contact the Expressway-E listed in the SRV answer.
The _collab-edge SRV record should point to the FQDN of the Expressway-E using port 8443. If the _collab-edge SRV is not created, or is not externally available, or if it is available, but port 8443 is not reachable, then the jabber client will fail to login.
2.  Unacceptable or No Available Certificate on VCS Expressway
After the jabber client has received an answer for _collab-edge, it will then contact the expressway using TLS over port 8443 to try to retrieve the certificate from the expressway to setup TLS for communication between the jabber client and the expressway.
If the Expressway does not have a valid signed certificate that contains either the FQDN or domain of the Expressway, then this will fail and the jabber client will fail to login.
If this is occurring, the you should use the CSR tool on the Expressway, which will automatically include the FQDN of the expressway as a Subject Alternative Name.
MRA requires secure communication between the Expressway-C and Expressway-E, and between the Expressway-E and external endpoints.
Expressway-C Server Certificate Requirements:
The Chat Node Aliases configured on the IM&P servers. This is required if you are doing XMPP federation. The Expressway-C should automatically include these in the CSR provided that an IM&P server has already been discovered on the Expressway-C.
The names in FQDN format of all Phone Security Profiles in CUCM configured for TLS and used on devices configured for MRA. This allows for secure communication between the CUCM and Expressway-C for the devices using those Phone Security Profiles.
Expressway-E Server Certificate Requirements:
All domains configured for Unified Communications. This includes the domain of the Expressway-E and C, e-mail address domain configured for Jabber, and any presence domains.
The Chat Node Aliases configured on the IM&P servers. This is required if you are doing XMPP federation.
The MRA Deployment guide describes this in greater detail on pages 17-18. (http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Mobile-Remote-Ac...
Note: In our lab for testing Phone Capabilities only, we did not include the Chat Node Aliases in the certificate as we were not using IM&P.
3.  No UDS Servers Found in Edge Config
After the Jabber client successfully establishes a secure connection with the Expressway-E, it will ask for its edge config. This edge config will contain the SRV records for _cuplogin and _cisco-uds. If these SRV records are not returned in the edge config, then the jabber client will not be able to proceed with trying to login.
To fix this, make sure that _cisco-uds and _cuplogin SRV records are created internally and resolvable by the Expressway-C
More information on the DNS SRV records can be found on page 10 of the MRA deployment guide for X8.1.1 (http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Mobile-Remote-Access-via-Expressway-Deployment-Guide-X8-1-1.pdf)
Note: In our lab for testing Phone Capabilities only, we did not include the DNS SRV for _cuplogin.
4.  The Expressway-C logs will indicate the following error: XCP_JABBERD Detail="Unable to connect to host '%IP%', port 7400:(111) Connection refused"
If Expressway-E NIC is incorrectly configured, this can cause the XCP server to not be updated. If the Expressway-E meets the following criteria, then you will likely have this issue:
Using a single NIC
Advanced Networking Option Key is installed
Use Dual Network Interfaces option is set to “Yes”
To correct this problem, change the “Use Dual Network Interfaces” option to “No”
The reason this is a problem is because the Expressway-E will be listening for the XCP session on the wrong network interface, which will cause the connection to fail/timeout. The Expressway-E listens on TCP port 7400 for the XCP session. You can verify this by using the netstat command from the VCS as root.
Note: We used a Dual Network Interface Expressway for testing but were not using XCP, so this was not applicable to us.
5.  VCE-E Server hostname/domain name does not match what is configured in the _collab-edge SRV.
If the Expressway-E Server hostname/domain name does not match what was received in the _collab-edge SRV answer, the jabber client will not be able to communicate to the Expressway-E. The Jabber client uses the xmppEdgeServer/Address element in the get_edge_config response to establish the XMPP connection to the Expressway-E.
This is an example of what the xmppEdgeServer/Address would look like in the get_edge_config response from the Expressway-E to the Jabber client:
<xmppEdgeServer>
<server>
<address>ott-vcse1.vcx.cisco.com</address>
<tlsPort>5222</tlsPort>
</server>
</xmppEdgeServer>
To avoid this, make sure that the _collab-edge SRV record matches the Expressway-E hostname/domain name. Enhancement CSCuo83458 has been filed for this.
Note: This was one of our issues when we first setup. We adjusted our Expressway-E to insure the below:
System > Administration > System Name this was the FQDN
System > DNS > System Host Name was the host portion of the FQDN
System > DNS > Domain Name was the domain portion of the FQDN
System > Clustering > Cluster Name (FQDN for Provisioning) was the FQDN
6. Unable to log into certain IM&P servers. VCS logs say "No realm found for host cups-example.domain.com, check connect auth configuration"
From the Expressway-E, go to Configuration -> Unified Communications -> IM&P Servers. Open each server and click "Save" again. Not sure exactly why this happens.
Note: This was N/A to our test and can be ignored with Phone Capabilities only.
Thanks
Fred

Ask the Experts: Single Sign-On with Cisco WebEx Meetings Server, Internet Reverse Proxy, and Enterprise License Manager Solutions

With Arun Kumar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Single Sign-On (SSO) with Cisco WebEx Meetings Server (Cisco WMS), Internet Reverse Proxy (IRP), and Enterprise License Manager (ELM) solutions.
SSO standards such as Security Assertion Markup Language (SAML) 2.0 provide secure mechanisms for passing credentials and related information between different websites that have their own authorization and authentication systems. SSO enables simplified user authentication and management.
IRP provides public access, enabling users to host or attend meetings from the Internet and mobile devices. Although IRP is optional, Cisco encourages its use because it provides a better user experience for your mobile workforce.
Example question topics include:
SSO profiles and SAML 2.0 Identity providers (IdPs) supported in Cisco WMS
Basic configuration of IdPs
Interaction between IdPs and Cisco WMS
Difference between the cloud client implementation and Cisco WMS
Meeting access behavior in a split-horizon network topology with SSO
How to enable public access to Cisco WMS
Cisco WMS ELM operations
Cisco WMS ELM compared to other unified communications ELM or standalone ELM and compatibility/inoperability between them
Arun Kumar is a team lead in the San Jose Conferencing Technical Assistance Center. He has over eight years of experience in conferencing technology and specializes in Cisco Unified Meeting Place Express and Cisco WebEx Meeting Server. He joined Cisco in 2010 as an escalation engineer for the Cisco Telepresence group. Before joining Cisco he worked for the UK's third-largest internet service provider Supanet on VoIP technology and the *Nix domain. Kumar holds a master of science degree in computer science from Sikkim Manipal University in India, and he holds CCIE (Voice) and VMware Certified Professional certifications.
Remember to use the rating system to let Arun know if you have received an adequate response.
Arun might not be able to answer each question because of the volume expected during this event. Remember that you can continue the conversation on the Collaboration, Voice, and Video community Other Subjects subcommunity shortly after the event. This event lasts through Monday May 17, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hello Mobile Service,
CWMS and Jabber integrations:
http://www.cisco.com/en/US/docs/voice_ip_comm/jabber/Windows/9_1/JABW_BK_E4CC9599_00_environment-configuration-guide_chapter_01.html#JABW_TK_SF2ED5E1_00
In above link start from section: Set Up Cisco WebEx Meetings Server on Cisco Unified Presence
then move to section: Add Cisco WebEx Meetings Server to a Profile
Once done, move to section: Specify Conferencing Credentials in the Client side. You will see above server already listed there, just go ahead and enter your username and password (pleae make sure this user already exists on your CWMS) and accept any certificate/s if presented. Jabber Integration is done and you can start testing the same.
Attached CWMS - AFDS integration doc.
Please let me know if any furhter question.
Thanks, Arun

Ask the Experts: Understanding Cisco ASR 9000 Series Aggregation Services Routers Platform Architecture and Packet Forwarding Troubleshooting

With Xander Thuijs
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn how to Cisco ASR 9000 Series Aggregation Services Routers with Cisco expert Xander Thuijs. The Cisco ASR 9000 Series Aggregation Services Routers product family offers a significant added value compared to the prior generations of carrier Ethernet routing offerings. The Cisco ASR 9000 Series is an operationally simple, future-optimized platform using next-generation hardware and software. The ASR 9000 platform family is composed of the Cisco ASR 9010 Router, the Cisco ASR 9006 Router, the Cisco ASR 9922 Router, Cisco ASR 9001 Router and the Cisco ASR 9000v Router.
This is a continuation of the live Webcast.
Xander Thuijs is a principal engineer for the Cisco ASR 9000 Series and Cisco IOS-XR product family at Cisco. He is an expert and advisor in many technology areas, including IP routing, WAN, WAN switching, MPLS, multicast, BNG, ISDN, VoIP, Carrier Ethernet, System Architecture, network design and many others. He has more than 20 years of industry experience in carrier Ethernet, carrier routing, and network access technologies. Xander holds a dual CCIE certification (number 6775) in service provider and voice technologies. He has a master of science degree in electrical engineering from Hogeschool van University in Amsterdam.
Remember to use the rating system to let Xander know if you have received an adequate response.
Xander might not be able to answer each question because of the volume expected during this event. Remember that you can continue the conversation on the Service Providers community XR OS And Platforms shortly after the event. This event lasts through Friday, May 24, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.
Webcast related links:
Slides
Webcast Video Recording
FAQ

Is there a Cisco lab available for ASR 9000
we have "XR4U" stations coming available soon when XR 511 comes alive. The plan is for a downloadable play image like that. In the interim we have 2 demo systems available, and they can be booked via your account manager representative.
How will MOD160 perform with multiple 9000NVS?
very well. the mod 160 has 4 NPU's, 2 per bay. So if you have a 4x10 MPA to serve a satellite, you effectively have a single NPU per 20 1Gigs from the satellite. The pps performance will be stellar. However it might be price technically more ideal to connect satellite with a 36x10. Since the MOD-x has native MPA's with 1G also.
2. Is there a shortcut for a Bundle-EthernetX interface, such as port-channel interface (poX), in Cisco IOS® ?.
usability enhancement is there, we are trying to push this into a new reasonable release. follow CSCuh04526
3. What is the revolutions per minute (RPM) on these hard disk drives (HDDs) compared to the solid state drives (SDDs)? Will the spinning drives be slow?
depends on the type we had avaialble at time of production, you will see different sizes and disks on the RSP2. the rpm of the HD is not so much an issue as much as the buffered writing we used to do in XR. This is fixed up with XR43 where the disk writing performance is much better. the HD/SDD is used for logging storage only (and maybe your pictures) but other then that we're not that concerned with write perf of the HD.
regards
xander

Ask the Expert: BYOD with Identity Services Engine

with Cisco Expert Bernardo Gaspar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various usage scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.

My customer is limited in his VM space. Although he would like to have a active/standby for his administration node, he doesn't need this for his logging. Is it recommended to roll this in production. With a limited HDD space, what would be the recommended space (300 GB?)
administration
monitoring
policy service
Machine VM
primary
Not enabled
enabled
Machine HW
secondary
primary
enabled

Ask the Expert: C-Series Integration with Cisco Unified Computing System Manager

Welcome to the Cisco Support Community Ask the Expert conversation. This conversation is an opportunity to learn and ask questions about Cisco C-Series Integration with Cisco Unified Computing System® Manager (Cisco UCS® Manager) with Cisco experts Vishal Mehta and Manuel Velasco.
Cisco UCS C-Series Rack-Mount Servers are managed by the built-in standalone software, Cisco Integrated Management Controller (Cisco IMC). When a C-Series rack-mount server is integrated with Cisco UCS Manager, the IMC no longer manages the server. Instead you will manage the server using the Cisco UCS Manager GUI or Cisco UCS Manager command-line interface (CLI).
Cisco UCS Manager 2.2 provides three connectivity modes for Cisco UCS C-Series Rack-Mount Server management. The following are the connectivity modes:
Dual-wire management (shared LAN On Motherboard [LOM]): Shared LOM ports on the rack server are used exclusively for carrying management traffic.A separate cable connected to one of the ports on the Payment Card Industry Express (PCIe) card carries the data traffic.
SingleConnect (Sideband): Using Network Controller Sideband Interface (NC-SI), the Cisco UCS Virtual Interface Card 1225 (VIC1225) connects one cable that can carry both data and management traffic.
Direct Connect Mode: Cisco UCS Manager Version 2.2 introduces an additional rack server management mode using direct connection to the Fabric Interconnect.
Vishal Mehta is a customer support engineer for Cisco’s Data Center Server Virtualization Technical Assistance Center (TAC) team based in San Jose, California. He has been working in the TAC for the past 3 years with a primary focus on data center technologies such as Cisco Nexus® 5000, Cisco UCS, Cisco Nexus 1000V, and virtualization. He presented at Cisco Live in Orlando 2013 and will present at Cisco Live Milan 2014 (BRKCOM-3003, BRKDCT-3444, and LABDCT-2333). He holds a master’s degree from Rutgers University in electrical and computer engineering and has CCIE® certification (number 37139) in routing and switching and service provider.
Manuel Velasco is a customer support engineer for Cisco’s Data Center Server Virtualization TAC team based in San Jose, California. He has been working in the TAC for the past 3 years with a primary focus on data center technologies such as Cisco UCS, Cisco Nexus 1000V, and virtualization. Manuel holds a master’s degree in electrical engineering from California Polytechnic State University (Cal Poly) and CCNA® and VMware VCP certifications. Remember to use the rating system to let Vishal and Manuel know if you have received an adequate response.
Because of the volume expected during this event, our experts might not be able to answer every question. Remember that you can continue the conversation in the Data Center, under subcommunity, Unified Computing, shortly after the event. This event lasts through May 23, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hello Sebastian,
The different modes of connecting C-Series with UCSM come into play depending on the type of infrastructure you already have along with C-Series and NIC model.
Cisco UCS C-Series Rack-Mount Servers are managed by the built-in standalone software, Cisco Integrated Management Controller (CIMC) .
Powerful features provided by Cisco UCS Manager can be leveraged to manage C-Series server by integrating C-Series Rack-Mount Server with UCSM.
This not only gives you rich-feature set but also one management plane to operate UCS-B Series Chassis and UCS-C Series Rack Server.
You will manage the server using the Cisco UCS Manager GUI or Cisco UCS Manager CLI.
Cisco UCS Manager 2.2 provides three connectivity modes for Cisco UCS C-Series Rack-Mount Server management.
The following are the connectivity modes:
• Dual-wire Management (Shared LOM):
Shared LAN on Motherboard (LOM) ports on the rack server are used exclusively for carrying management traffic. A separate cable connected to one of the ports on the PCIe card carries the data traffic. Using two separate cables for managing data traffic and management traffic is also referred to as dual-wire management.
http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c-series_integration/ucsm2-2/b_C-Series-Integration_UCSM2-2/b_C-Series-Integration_UCSM2-2_chapter_0100.html
This mode is recommended when you have C-Server which does not have or cannot support VIC 1225 card (such C-200 server)
• SingleConnect (Sideband):
Using Network Controller Sideband Interface (NC-SI), Cisco UCS VIC1225 Virtual Interface Card (VIC) connects one cable that can carry both data traffic and management traffic.
This feature is referred to as SingleConnect.
http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c-series_integration/ucsm2-2/b_C-Series-Integration_UCSM2-2/b_C-Series-Integration_UCSM2-2_chapter_011.html
This most recommended Integration model when using FEX and VIC 1225 card
• Direct Connect Mode:
Cisco UCS Manager release version 2.2 introduces an additional rack server management mode using direct connection to the Fabric Interconnect.
This mode will eliminate the need for FEX module as Servers are directly plugged into the base ports of Fabric Interconnect
http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c-series_integration/ucsm2-2/b_C-Series-Integration_UCSM2-2/b_C-Series-Integration_UCSM2-2_chapter_0110.html
Please let us know if you need more information. Thank you!
Thanks,
Vishal

Ask the Expert : Call Recording with Cisco Unified Communication Manager (UCM)

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Unified CM call recording solution that provides the ability to record customer conversations for compliance purpose. This topic will cover an overview, configuration and troubleshooting of the call recording feature.
Monday, January 19th, 2015 to Friday, January 30th, 2015
Harmit Singh is a technical leader with the High Touch Technical Services (HTTS) and Technical Assistance Center (TAC) Unified Communications teams based in Bangalore. He has broad experience in Cisco Unified Communications infrastructure solutions. He has 10 years of experience working with large enterprise and service provider networks. He also holds CCIE certifications (#20012) in Voice and Collaboration as well as Red Hat and VMware certifications.
Mohammed Noorulla Khan is a customer support engineer in High-Touch Technical Services (HTTS) Unified Communications teams based in Bangalore. His areas of expertise include Cisco Unified Communications Manager, Gateways, and Jabber. He has over 6 years of industry experience working with large enterprise and service provider networks. He also holds CCIE certifications (#35741) in Voice and VMware certifications.
** Remember to use the rating system to let Mohammed and Harmit know if you've received an adequate response. **
Because of the volume expected during this event, the experts might not be able to answer every question. Remember that you can continue the conversation in the Collaboration, Voice and Video community, subcommunity, IP Telephony, shortly after the event. This event lasts through January 30th 2015. Visit this forum often to view responses to your questions and those of other Cisco Support Community members.

Hi Maheshwar,
Thank you for your query. Please find my response below:
1> Do we support recording with HCS environment and which 3rd party vendors are validated with HCS based call control 10.1.1?
Answer: Whether you use a standalone UCM cluster, UCCE or HCS, call recording would be supported across the board in the same manner.
Please refer to the following link:
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/hcs-cc/10_0_1/Install_and_Config/CHCS_BK_ICC270D0_00_installing-and-configuring-cisco-hcs/CHCS_BK_ICC270D0_00_installing-and-configuring-cisco-hcs_chapter_011.html#CHCS_RF_T1105284_00
Option
Notes
Recording
All Recording applications that are supported by Unified CCE are supported on HCS for CC. For details, see Recording section in Agent and Supervisor Capabilities.
With respect to which 3rd party vendors have been validated, marketplace.cisco.com is a good place to crosscheck this info. You will find a Cisco Compatible Logo against the partners listed there. The logo is used to signify that the PARTNER product has undergone technical interoperability testing with the Cisco product specified. The interoperability testing is conducted by a third party laboratory based on testing criteria set forth by Cisco. PARTNER is solely responsible for the support and warranty of its product. Placement of the PARTNER product or information pertaining thereto, on the Cisco Marketplace website does not constitute an offer to sell the PARTNER product in any way. For further information on the PARTNER products, please visit the PARTNER company website.
Please refer to the following link and use the search field under Collaboration Technology:
https://marketplace.cisco.com/catalog/search?utf8=%E2%9C%93&search[q]=&search[technology_category_ids]=23%2C24%2C197%2C1940%2C1941%2C1921%2C1576%2C1897%2C1983%2C2418%2C26%2C198%2C1904&search[order]=tier&per_page=20&_=1421663854257&ts=1421663855441
2> Which end points are supported for recording via HCS call control?
Answer: The following link should help clarify this:
http://solutionpartner.cisco.com/web/sip/wiki/-/wiki/Main/Unified+CM+Silent+Monitoring+Recording+Supported+Device+Matrix
Please let us know if you have any follow up questions. Hope this is helpful.
Regards,
Harmit Singh.

Do we have a package App like " Ask the expert" updated for Apex 4.2?

I;m looking for a sample application like " Ask the expert" which was there in OBE some time back. The old package imported into apex 4.2 but the text search etc is not working for any new questions asked etc hence wanted to know if an upgraded version is available or why some function would not work?
is text search/intermedia search disabled in Apex 4.2?

They got rid of all of the packaged applications several months ago. For a while they said they'd bring the popular ones back. Then they changed their mind and said the packaged apps would become part of a cloud service somehow. Don't know where it stands right now, I stopped checking.
The given reason why the apps were removed is because they did not match the new best-practices Apex security standards. I know that the 4.1 upgrade broke a bunch of my pages because of the new session state restrictions. Possibly this is what broke Ask The Expert. I've never used it, so couldn't make an educated guess.

Ask the Expert: One Management with Prime Infrastructure 1.2

With Tejas Shah
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions from Cisco expert Tejas Shah on One Management with Prime Infrastructure 1.2 Combining the wireless functionality of Cisco Prime Network Control System (NCS) with the wired functionality of Cisco Prime LAN Management Solution (LMS), Cisco Prime Infrastructure simplifies and automates many of the day-to-day tasks associated with maintaining and managing the end-to-end network infrastructure from a single pane of glass. The new converged solution delivers all of the existing wireless capabilities for RF management, user access visibility, reporting, and troubleshooting along with wired lifecycle functions such as discovery, inventory, configuration and image management, automated deployment, compliance reporting, integrated best practices, and reporting.
Tejas Shah is a senior technical marketing engineer for Cisco Prime Infrastructure and Collaboration products. He has deployed Cisco Prime Collaboration Manager at various customer sites to help customers monitor and troubleshoot their video infrastructure. In addition, he is part of the Network Operations Center team at Cisco Live events for six years. Shah joined Cisco in 1995 and was in the Technical Assistance Center team supporting various network management system products for more than six years.
Remember to use the rating system to let Tejas know if you have received an adequate response.
Tejas might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Wireless Mobility sub-community discussion forum shortly after the event. This event lasts through Sept 21, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

Raun, please see my responses inline:
Can you go over the licensing method with Prime Infrastructure 1.2 please?
Raun, you can check out the following link for ordering guide at
http://www.cisco.com/en/US/products/ps12239/products_data_sheets_list.html
I currently have NCS and do NOT currently have LMS. I know I can move to Prime Infrastructure through Cisco Product Upgrade Tool. However, what I am confused about is do I still have to buy LMS to have LMS functionality in Prime Infrastructure 1.2?
==> Not at all. The converged product will give you basic management capability for routers and switches that LMS provided in this release. Feature/Functionality will keep on growing with upcoming releases.
If not, do the licenses I transfer into Prime Infrastructure 1.2 from NCS also work for devices to work under LMS?
==> Licensing is different than NCS or LMS. You don't have to transfer the license. Each install of Prime Infrastructure will have a unique UID string on which the licenses are based. A new license will be applied to the product.
Mean, can my currently 350 licenses be used for AP's as in NCS and routers in the LMS portion of Prime Infrastructure 1.2?
==> I would recommend getting a total count of your wired and wireless devices and match the right SKU based on that.
Hope this helps.. Let me know if you have any further questions,
Tejas

Ask the Expert: Upgrading Cisco Unified Communications Manager (CUCM) to Version 9.1 (Drive to 9)

Welcome to the Cisco Support Community Ask the Expert conversation. Learn from experts Vijay Rao and Amit Singh about simplified upgrade process and focused support from Cisco to migrate to version 9.1.
This is a continuation of the live Webcast
Drive to 9 is a comprehensive and holistic program designed to help you upgrade the current Cisco® Unified Communications Manager installed base to version 9.1 or higher. This upgrade will enable customers to have next-generation collaboration experiences.
During the live event, Cisco subject matter experts Vijay Rao and Amit Singh focussed on the simplified upgrade process and focused support from Cisco to migrate to version 9.1. They also talked about the changes made to the licensing model of User Connect Licensing and Cisco Unified Workspace Licensing.
Vijay Rao is a Network Consulting Engineer and is currently a unified communications (UC) consultant for Bank of America. He has been providing consulting assistance to the bank for the past 6 years. He helps design complex UC networks for large enterprise customers. He was previously part of Cisco IT in the Asia Pacific, Japan, and China (APJC) region and was instrumental in designing and implementing the Bangalore campus. He has been working with Cisco for 9 years and has 12 years of UC experience. He has a Cisco CCVP® certification.
Amit Singh is a customer support engineer at the Cisco Technical Assistance Center in Bangalore, India. He has 7 years of experience in his areas of expertise: wireless, Cisco Unified Communications Manager, multiservices, Cisco Unity®, and Cisco Unified Contact Center Express. He has been involved in various escalation requests from India, Singapore, and Australia and is currently working as a technical lead for the Voice team in Bangalore, India. He is a computer science graduate.
Remember to use the rating system to let Vijay and Amit know if you have received an adequate response.
Vijay and Amit might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Collaboration, Voice and Video sub-community forum shortly after the event. This event lasts through July 19, 2013. Visit this forum often to view responses to your questions and the questions of other community members.
Webcast related links:
Webcast Video
FAQ from the live webcast
Slides from the live webcast

Hello Robert,
Apologies for a delayed response, some days get very hectic.
In CallManager, we only define the SRST reference, and CUCM version and SRST version are independent of each other.
The only thing, which is related and will change with CUCM upgrade is Phone F/w version.
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/compat/ccmcompmatr1.pdf
You may just want to check your, phone f/w compatibility with the SRST version running on your ISR G1 Gateways:
http://www.cisco.com/en/US/products/sw/voicesw/ps2169/products_device_support_tables_list.html
For Example: SRST version 7.1
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6788/vcallcon/ps2169/data_sheet_c78-520521.html
You may want to do some lab testing with CUCM 9.1 and an SRST supported f/w on your phones.
If you decide to run the old Phone/F/w to support the SRST version, you may not be able to take advantage of new features.
Also, you can try and upgrade your phones(Wih CUCM 9.1) and test them with your SRST version.
It should work fine, but from a troubleshooting perspective, TAC may request you to come into a Cisco Supported combination.
Please, let me know if this clarifies your doubt or we can have a quick phone call.
Regards
Amit Singh

Ask the Expert: BYOD with Identity Services Engine with Cisco Expert Bern

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various use scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

Feedback will be highly appreciated
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

Ask the Expert: Service Delivery Manager for Cloud Web Security with Alex Chan

Similar Messages

Maybe you are looking for