Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 First Published: 2017-01-10 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 © 2017 Cisco Systems, Inc. All rights reserved. CONTENTS CHAPTER 1 Overview of this Integration 1 Basic Federated Network 1 SIP Federation with AOL 4 Limitation with AOL Federation 4 Intercluster and Multinode Deployments 5 SIP Federation Deployments 5 XMPP Federation Deployments 5 High Availability and Federation 6 High Availability for SIP Federation 6 High Availability for XMPP Federation 7 Cisco Adaptive Security Appliance Deployment Options 9 Presence Subscriptions and Blocking Levels 10 Availability State Mappings 12 Availability State Mappings for Microsoft OCS 12 Availability State Mappings for Microsoft Lync 14 Availability State Mappings for AOL Instant Messenger 15 Availability State Mappings for XMPP Federation 16 Instant Messaging 18 Instant Message Flow for SIP Federation 18 Availability and Instant Message Flow for XMPP Federation 20 Federation in Deployments with Multiple Domains 21 Federation and Subdomains 21 CHAPTER 2 Preparations for this Integration 23 Supported Interdomain Federation Integrations 23 Presence Web Service API Support 24 Hardware Requirements 24 Software Requirements 25 Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 iii Contents Integration Preparation 26 Routing Configuration 26 Public IP Address 26 Public FQDN 27 AOL SIP Access Gateway 27 Redundancy/High Availability 28 DNS Configuration 28 Certificate Authority Server 30 Prerequisite Configuration Tasks for this Integration 31 Configure the IM and Presence Service for Integration 31 Configure the Cisco Adaptive Security Appliance for Integration 31 CHAPTER 3 Configuration Workflows for Interdomain Federation 33 Configuration Workflow for SIP Federation with Skype for Business 33 Configuration Workflow for SIP Federation with Microsoft Lync 34 Configuration Workflow for SIP Federation with Microsoft OCS 35 Configuration Workflow for SIP Federation with Microsoft Lync — with ASA Firewall 36 Configuration Workflow for SIP Federation with Microsoft OCS — with ASA Firewall 37 Configuration Workflow for Cisco Adaptive Security Appliance for SIP Federation 38 Configuration Workflow for SIP Federation with AOL 38 Configuration Workflow for XMPP Federation 39 CHAPTER 4 IM and Presence Service Configuration for SIP Federation 41 Add a SIP Federated Domain 41 Routing Configuration on IM and Presence Service 42 DNS Configuration for SIP Federation 42 Configure Static Routes Using TLS 44 Configure Federation Routing Parameters 45 Configuration of Security Settings on IM and Presence Service 46 Create a New TLS Peer Subject 46 Add TLS Peer to Selected TLS Peer Subjects List 47 Routing Information Configuration for AOL Federation 47 Route SIP Requests for SIP Federation with AOL 47 Change the Default Federation Routing Domain for SIP Federation with AOL 48 Turn On the SIP Federation Service 49 Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 iv Contents CHAPTER 5 SIP Federation Security Certificate Configuration with Cisco Adaptive Security Appliance 51 Security Certificate Exchange Between IM and Presence Service and Cisco Adaptive Security Appliance 51 Generate Key Pair and Trustpoints on the Cisco Adaptive Security Appliance 51 Generate Self-Signed Certificate on the Cisco Adaptive Security Appliance 52 Import Self-Signed Certificate onto the IM and Presence Service 53 Generate a New Certificate on the IM and Presence Service 54 Import an IM and Presence Service Certificate into the Cisco Adaptive Security Appliance 54 Security Certificate Exchange Between Cisco Adaptive Security Appliance and Microsoft Access Edge (External Interface) with Microsoft CA 55 CA Trustpoints 56 Configure a Certificate on the Cisco Adaptive Security Appliance Using SCEP 56 Configure a Certificate on the Cisco Adaptive Security Appliance Using Manual Enrollment 58 Certificate Configuration for the External Access Edge Interface 59 Download CA Certification Chain 59 Install a CA Certification Chain 59 Request Certificate from CA Server 60 Download Certificate from CA Server 61 Upload a Certificate onto Access Edge 62 Create Custom Certificate for Access Edge Using Enterprise Certificate Authority 62 Create and Issue a Custom Certificate Template 63 Request Site Server Signing Certificate 64 Security Certificate Configuration on Lync Edge Server for TLS Federation 64 Security Certificate Exchange Between Cisco Adaptive Security Appliance and the AOL SIP Access Gateway 65 CHAPTER 6 Cisco Adaptive Security Appliance Configuration for SIP Federation 67 Cisco Adaptive Security Appliance Unified Communication Wizard 67 External and Internal Interface Configuration 68 Configure Static IP Routes 68 Port Address Translation (PAT) 69 Port Address Translation for This Integration 69 PAT for Private to Public Requests 71 Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 v Contents Static PAT for New Requests 72 NAT Rules in ASDM 73 Sample Static PAT Commands 74 PAT Configuration for Routing the IM and Presence Service Node 74 PAT Configuration for Intercluster or Intracluster IM and Presence Service Nodes 75 Cisco Adaptive Security Appliance Upgrade Options for Existing Deployments 77 CHAPTER 7 TLS Proxy Configuration on the Cisco Adaptive Security Appliance 79 TLS Proxy 79 Access List Configuration Requirements 80 Configure TLS Proxy Instances 82 Associate Access List with TLS Proxy Instance Using Class Maps 83 Enable TLS Proxy 84 Configure Cisco Adaptive Security Appliance for an Intercluster Deployment 84 CHAPTER 8 Interdomain Federation with Skype for Business 87 Skype for Business Interdomain Federation 87 Skype for Business Interdomain Federation Task Flow 87 Assign DNS SRV for IM and Presence 88 Add Federated Domain to IM and Presence 89 Restart Cisco XCP Router 89 Configure Static Route on IM and Presence 90 Add Expressway as a TLS Peer 90 Add Expressway to Access Control List 91 Configure Expressway for Federation with Skype for Business 91 Configure User Trust Settings 92 Configure Global Federation Access Settings 92 Add IM and Presence as Allowed Domain 93 Add Expressway as SIP Federated Provider for IM and Presence 93 Exchange Certificates 94 CHAPTER 9 Interdomain Federation to Microsoft Lync 97 Interdomain Federation to Microsoft Lync within an Enterprise 97 Configuration Task Flow for Microsoft Lync Federation 98 Add a Microsoft Lync Domain Within Enterprise 99 Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 vi Contents Configure Static Routes from IM and Presence to Lync 99 Configure Expressway Gateway for Microsoft Lync Federation 100 Configure Static Route from Lync to Expressway Gateway 100 Configure a Static Route from Lync to IM and Presence 102 Configure Trusted Applications on Lync Server 104 Publish Topology 106 Set up Certificates on IM and Presence for Federation with Lync 106 CHAPTER 10 Interdomain Federation to Microsoft OCS 109 Interdomain Federation to Microsoft OCS within an Enterprise 109 Configuration Task Flow for Microsoft OCS Federation 110 Add a Microsoft OCS Domain Within Enterprise 111 Configure Static Route on IM and Presence Service for Microsoft Servers 112 Configure Static Routes on OCS to Point to the IM and Presence Service 112 Verify Peer Authentication Listener 113 Adding a Host Authorization Entry for the IM and Presence Service Node on OCS 114 Configure Certificates on OCS for Interdomain Federation 115 Enable Port 5060/5061 on the OCS Server 115 Configure OCS to use FIPS 116 Set Up Certificates on the IM and Presence Service Node for Federation with Microsoft Server over TLS 117 CHAPTER 11 External Server Component Configuration for SIP Federation 119 Microsoft Component Configuration for SIP Federation 119 Requirements for SIP Federation with AOL 122 License Requirements for AOL Federation 122 AOL Routing Information Requirements 123 AOL Provisioning Information Requirements 123 CHAPTER 12 Load Balancer Configuration for Redundancy for SIP Federation 125 About the Load Balancer 125 IM and Presence Service Node Updates 125 Cisco Adaptive Security Appliance Updates 126 Static PAT Message Updates 127 Access List Updates 128 Interdomain Federation Guide for IM and Presence Service on Cisco Unified Communications Manager, Release 11.5(1)SU2 vii Contents TLS Proxy Instance Updates 130 CA-Signed Security Certificate Updates 130 Security Certificate Configuration Between the Load Balancer and Cisco Adaptive Security Appliance 131 Security Certificate Configuration Between the Load Balancer and IM and Presence Service Node 131 Microsoft Component Updates 132 AOL Component Updates 132 CHAPTER 13 IM and Presence Service Configuration for XMPP Federation 133 External XMPP Federation through Cisco Expressway 133 Configure General Settings for XMPP Federation 135 XMPP Federation Overview 135 Important Notes about Restarting Services for XMPP Federation 136 Turn On XMPP Federation on a Node 136 Configure Security Settings for XMPP Federation 136 DNS Configuration for XMPP Federation 138 DNS SRV Records for XMPP Federation 138 DNS SRV Records for Chat Feature for XMPP