License bypass for Cisco Expressway to WebEx CMR

Started by Dieselboy, August 03, 2016, 02:31:38 AM

Previous topic - Next topic

Dieselboy

To make calls to userid@*.webex.com, you will consume a Rich Media License on the expressway, per call. I've been cautious about this as my company has 5 on one pair and 2 licenses on the other pair of Expressways.

Reading through the latest Expressway 8.8 Admin Guide I have seen:

Quote from: http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/admin_guide/Cisco-Expressway-Administrator-Guide-X8-8.pdf
License Bypass for Calls to Collaboration Meeting Rooms (CMRs)
The Expressway no longer requires rich media session licenses for calls to and from cloud-based CMRs. This includes
SIP calls between Collaboration Cloud and the CMR Hybrid solution.
Note: This only applies when the dialed string does not need transformation on the Expressway (for example,
user@sitename.webex.com).

So looks like you must change the regex translation as per the CMR deployment guide (which is too vauge for me to get this working it seems, anyway)
EDIT - The "too vague" I eventually discovered after searching through logs and googling the error descriptions is because the Expressway E needs to validate webex when end to end encryption is turned on. To get this to work you have to download / save and then upload the ROOT certificates that are used by webex CMR. Why this is not in the config guide I do not know. I messaged a TAC engineer about this he says he's seen this issue many many times. CISCO - put all the details in the guides, it will alleviate your TAC!
: http://www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/solutions/cmrcloud/CMRCloudEnterpriseDeployment.pdf

So basically because I have a regex match of    "(.*)@(.*)(\.webex\.com).*" this costs me a license per call.

If I change it to the global site URI (once I find this again I'll update this post) but is something like meet@site.webex.com - this will let you enter the meeting number for the meeting you wish to join.

Another option could be something like conf1@site.webex.com (eg Conference Room 1)

According to the documentation, as long as the URI does not need translation then the license cost is bypassed.

Don't tell anyone I told you this info, else the documentation self-distructs ;)

Dieselboy

I post a photo tomorrow of my 9971 phone, dialed in to the webex CMR meeting. It's quite comical but in a good way. On my desktop I shared a screen into webex, it just had outlook maximised. I also had live video from the desktop.

On the 9971, it displayed outlook almost the entire screen of the 9971. Also it had my live video from the desktop being presented on the 9971 as a "picture in picture" set up. Of course, it will never be used this way but it shows it's working :D

deanwebb

Verrrrrrryyyy innnnnnterrrresting... but, it's in the documentation, so it's all legit!
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Dieselboy

I know right :)

I was going to explain how you could make more use of this, but I don't want someone finding it and removing the functionality.

Dieselboy


Dieselboy

Was testing this earlier. Had 5 endpoints connected, with one screensharing session from Jabber into the WebEx meeting room. Bandwidth use outbound was about 7mbps which checks out (7 / 1.5mb = ~5 devices). Of course it's 1.5mb per stream, so a single endpoint will have send and receive 1.5mbps.

I'm confused as to the licensing aspect. It seems that the phones which I've configured *01.XXXXXXXXX as the dial rule to get to XXXXXXXXX@site.webex.com where X.. is the meeting number <- only these devices were consuming a license, even though I had not explictely configured the URI which I was using to dial in from within Jabber (user.name@site.webex.com). Both of these devices would be matching the same Dial Rule on the Expressway, but only the phones consume licenses.

Going to try different dial rules in CUCM to see if I can avoid license consumption.

Dieselboy

Looking at this, I see that I have one rule on Expressway to "Transform" the dialed number from a phone, to the webex meeting site. This would explain why only these calls invoked a license. Basically, pick up a phone, dial the trunk code then the meeting number and it routes to meeting-number@site.webex.com

I have configured a speed dial on the phone, that points to the same URI address. Pick up the phone, dial speeddial 1 = no license cost.

So I don't need the "dial-rules" on Expressway, I just need to avoid Expressway needing to do a transform.  8)

How cool is that :)

deanwebb

Quite cool. Do you have any other transforms that can be hard coded to avoid the Expressway?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Dieselboy

The "Transforms" which seem to be taking licenses are on the Expressway itself, under "dial plan > Transforms".

The other section which is "Dial plan > Dial rules" allows you to configure the Expressway to do regex translations from anything to anything. When I read the doc I understood it as any of the above will incurr a license. Since the "transforms" is when the Expressway matches a set of numbers and converts it to a SIP URI, this is easily avoided. Phones can dial SIP URIs (with a speed dial), as can Jabber by me dialing the URI.

The traffic still must go through the Expressway in all cases.

My next task is to configure Business To Business calling, which means we will be able to call "person@company.com". So, from what I have discovered, doing this from jabber will not cost a license fee therefore, you can make as many calls as the bandwidth and system resources can handle.
Based on my tests, the Expressways aren't taxed very much in terms of resources per call. I guess thats because they just route the traffic and are not terminating and re-sending the traffic.

The matching config on CUCM from a phone is pretty simple. When a person dials the trunk code then the meeting number there's a route on CUCM to match trunk code then the meeting number and CUCM simply sends it to the Expressway SIP trunk.

So with this in mind, I'm tempted to set up a pair of new expressways without any licenses installed and see what's possible. I bet without any licenses installed at all, nothing is possible - but then it's still possible to use the Expressways without consuming any licenses at all so I would like to try it.

deanwebb

It basically sounds like you have to do a little extra work to avoid getting hit with a license usage. Nice to know that the enterprising young lad can still make hard work and gumption pay off!
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Dieselboy

Just got a domain and SSL cert today. If I get time I'll set up a home Expressway lab and tie it in with my cucme and see if I can make business calls (without applying licensing). I need to set up B2B calls for the business and this will let me test it anyway :) (if it works)

Unless a kind member of this forum has the ability and would like to place a video call with me as a test at some stage in the future.

deanwebb

Can I do a video call from Skype to your test lab?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Dieselboy

Does skype do sip uri dialing? Or is this business skype? I've avoided skype as never liked it - but yes a test call will be good. I'm making more progress with the real environment than I am with the lab at the moment, though :)

icecream-guy

Quote from: Dieselboy on August 09, 2016, 11:07:16 PM
Does skype do sip uri dialing? Or is this business skype? I've avoided skype as never liked it - but yes a test call will be good. I'm making more progress with the real environment than I am with the lab at the moment, though :)

FYI you are supposed to set it up in a lab, then make that the production system....   :awesome:
:professorcat:

My Moral Fibers have been cut.

deanwebb

Quote from: ristau5741 on August 10, 2016, 07:34:27 AM
Quote from: Dieselboy on August 09, 2016, 11:07:16 PM
Does skype do sip uri dialing? Or is this business skype? I've avoided skype as never liked it - but yes a test call will be good. I'm making more progress with the real environment than I am with the lab at the moment, though :)

FYI you are supposed to set it up in a lab, then make that the production system....   :awesome:

:kidwoohoo:
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.