260 likes | 435 Views
Key Elements to Deploying OCS. Where to Start. OCS can seem to require an awful lot of servers _ Edge, Director, Front End, SQL, Monitoring, SQL, Archiving, SQL, Mediation, Group Chat, SQL, …
E N D
Where to Start • OCS can seem to require an awful lot of servers _ Edge, Director, Front End, SQL, Monitoring, SQL, Archiving, SQL, Mediation, Group Chat, SQL, … • Project I was working on the objectives where to reduce mobile phone spend by offering enterprise voice and reduce conferencing by offering live meeting to external users. • 80K users, 10K ent voice, UK & USA phone numbers • Phased Implementation • Lab • Pilot (7k) • Production 80K, 10K ent voice
Planning • High level planning tool is the OCS Planning Tool • Capacity largely determined by number of concurrent users • Logon rate and number of endpoints • Contention rate to PSTN • Considerations disaster recovery and resilience • Network Impact _ in particular voice and video
Key Requirements • Active Directory • Windows Server 2003 Domain functional level. DCs W2k3 SP1+ • If LCS or OCS R1. Global Settings may be in system container. If multiple domains suggest moving to config container before schema prep • Significant Certificate and DNS requirements which will be covered later • Hardware\OS 64 bit only
DNS and Certificates • The supported SIP URIs drive the DNS and certificate requirements • For each domain supported DNS records and certificates are required • Typically the SIP URI is the same as a user’s e-mail address Eg sip:alistair.keay@uk.didata.com • There are two clients Communicator and Live Meeting. Two Sets of DNS records for internal and external connection. • “meet:sip:alistair.keay@uk.data.com;gruu;opaque=app:conf:focus:id385aa8ec0fcb4879dcb40c%3Fconf-key=JvrI7t324Vx” • Federation requires _sipfederationtls._tcp.uk.didata.com • Phone edition requires _ntp._udp.uk.didata.com
Access Edge Certificates • For PIC a single FQDN of the access edge is given and this is the primary name in cert. eg acp.didata.com • Also for @didata.com • _sipfederationtls._tcp.didata.com • _sip._tls.didata.com • Now for @uk.didata.com the server offering the service for _sip._tls.uk. didata.com can NOT be acp. didata.com but must be same domain as srv record. Eg sip.uk.didata.com. This name needs to be added as a SAN to the certificate
Example of Edge Server • Cert Assigned to access Edge • Acp. didata.com • San sip.uk.didata.com, sip.fr.didata.com etc • Cert Assigned to web edge • Web.didata.com • Cert Assigned to av ege • Av.didata.com • Cert Assigned to intranet edge • Edge. didata.com (Can be internal cert. NB HLB etc)
Example of Director • When deployed • Similar to the access edge role a cert is required with typically multiple SANs • Primary cert name is that of pool • Then for each domain _sipinternaltls._tcp. didata.com will point to sip. didata.com • _sipinternaltls._tcp.uk. didata.com will point to sip.uk. didata.com
Deploying Edge Servers • Decide on redundancy requirements, dr. • Capacity will drive minimum number • Co-locate all roles unless a good reason not to do so • For single edge box it is acceptable to have a NATed AV edge server (public ip) • For load balanced edge boxes the AV edge public IP must not be NATed • The intranet IP must never be NATed but must be routable
Install Steps • Install files, activate, choose roles, account, configure IP and names,
Directors _ Are they required • No… • But they are recommended
Role Of Director • Internally • When multiple pools deployed • Deterministic Client Connection. Re-directs clients • Only point where multiple SANs required • From Outside • Next hop from access edge • Authenticates users before proxying on data