Acano solution. Deployment Planning and Preparation Guide. September E

Transcription

1 Acano solution Deployment Planning and Preparation Guide September E

2 Contents Contents 1 Introduction Single Combined Acano Server Deployment VM host Syslog to capture logs NTP for time sync LDAP for importing users Customization asset Call Detail Record Certificate requirements Security Port requirements Acano Manager requirements DNS requirements Summary of requirements Single Split Acano Server Deployment VM host Syslog to capture logs NTP for time sync LDAP for importing users API tool Customization asset Call Detail Record Certificate requirements Security Port requirements Acano Manager requirements DNS requirements Summary of requirements Scalable and Resilient Acano Server Deployments VM host VM host for cospace database cospace database Syslog to capture logs NTP for time sync LDAP for importing users API tool Customization asset Call Detail Record Certificate requirements Security Port requirements Acano Manager requirements Acano solution: Deployment Planning & Preparation Guide E Page 2

3 Contents 4.14 DNS record requirements Summary of requirements Acano solution: Deployment Planning & Preparation Guide E Page 3

4 Introduction 1 Introduction This document will help you plan the Acano solution deployment. For example it tells you which external prerequisites are required (e.g. NTP s). It also lists the requirements for the Acano solution components to work together (e.g. certificates). It provides an overview of requirements; details are sometimes in other documents because Acano s policy is to minimize repetition of material. Use the section that applies to your deployment topology (see the diagrams in each section if you are unsure): Section 2: Single combined Acano deployment Section 3: Single split Acano deployment Section 4: Scalable and resilient Acano deployments Finally, detailed steps are provided in: The two installation guides: one for an X Series, the other for virtual hosts The three deployment guides: single combined deployments, single split deployments, and the third for scalable and resilient deployments Acano documentation is available at and shown in the figure below. Figure 1 Overview of guides covering the Acano Solution Acano solution: Deployment Planning & Preparation Guide E Page 4

5 Single Combined Acano Server Deployment 2 Single Combined Acano Server Deployment This section outlines the prerequisites, and where to find details on setting up an Acano in a single combined deployment. This type of deployment requires Acano software release R1.6 or later. The Acano can be an X Series or based on a virtual (VM) host. Figure 2 shows schematically the components on an Acano. Depending on your deployment you may find that not all of these components need to be enabled and configured. The Call Bridge and the cospace database are always required Figure 2 Components on an Acano The TURN is required for media if you need NAT traversal The XMPP and Web Bridge are only required in the following circumstances: If you are using any of the Acano thick clients (PC Client. Mac Client, ios Clients) then you must install and configure the XMPP If you are using the Acano WebRTC Client you require the Web Bridge and the XMPP Note: From R1.8, a single XMPP can host multiple domains. 2.1 VM host If you are using a VM host it must comply with the host requirements provided in the Virtualized Deployments White Paper. Sizing guidelines are also provided in this document. 2.2 Syslog to capture logs The Syslog is recommended for troubleshooting and audit logging. 2.3 NTP for time sync You must configure at least one NTP to synchronize time between the Acano solution components. Using more than one NTP is recommended. 2.4 LDAP for importing users If you intend to use any of the Acano clients you must have an LDAP (currently Active Directory or OpenLDAP). User accounts are imported from the LDAP. You can create user names by importing fields from LDAP. 2.5 Customization asset If you are customizing your Acano solution deployment, you need a web that is reachable by the Call Bridge without performing any form of HTTP authentication. See the Customization Guidelines for details. 2.6 Call Detail Record The Acano solution generates Call Detail Records (CDRs) internally for key call-related events. The Acano solution can be configured to send these records to a remote system to be Acano solution: Deployment Planning & Preparation Guide E Page 5

6 collected and analyzed: there is no provision for records to be stored on a long-term basis on an Acano. All CDRs must be sent to the same receiver. If you are using Acano Manager, it must be your CDR receiver. 2.7 Certificate requirements Certificates and a certificate bundle (or intermediate certificate chain if automatically downloaded from the internet) for the: Call Bridge (If you are using Lync, this certificate will need to be trusted by the Lync Front End Server; the best way to achieve this is to sign the certificate on the CA (Certification Authority) that has issued the certificates for the Lync Front End Server) Web Bridge XMPP Web Admin Interface TURN (if using TLS connections) Note: It is possible to use the same certificate across multiple Edge s but Acano does NOT recommend it. 2.8 Security If security is paramount, then consider the following. Details are provided in the Deployment guides. User access control Common Access Cards (CAC) Online Certificate Status Protocol (OCSP) FIPS TLS certificate validation with MMP commands DSCP Single Combined Acano Server Deployment 2.10 Acano Manager requirements There are no additional requirements for this Acano to be monitored by Acano Manager. Acano Manager must be deployed on a separate ; see the specification in the Acano Manager Installation Guide DNS requirements You require a DNS. Verify that no A or SRV records already exist for any Acano host before defining the records in Table 1 on this Summary of requirements 1 Acano X Series or 1 VM host 1 Syslog 1 NTP 1 LDAP (if using Acano clients) 1 CDR receiver (Acano Manager if you are using it) 1 web for customization assets (optional) 1 DNS 1 Acano Manager 2.9 Port requirements Appendix B of the Deployment guides shows the required ports between each component of the Acano solution, and between them and external components. Acano solution: Deployment Planning & Preparation Guide E Page 6

7 Single Combined Acano Server Deployment Table 1 Required DNS records: single combined Type Example Resolves to Description SRV(*) _xmppclient._tcp.example.com The A record xmpp.example.com below. Usually this is port 5222 Used by clients to login. The SRV record must correspond to the domain used in your XMPP usernames SRV(*) _xmpp._tcp.example.com The A record xmpp.example.com below. Usually this is port 5269 Used to federate between XMPP s. The SRV record must correspond to the domain used in your XMPP usernames A xmpp.example.com IP address of the XMPP Used by clients to login. A / join.example.com IP address of the Web Bridge This record is not used by the Acano solution directly; however, it is common practice to provide an end user with an FQDN to type into the browser which resolves to the Web Bridge. There is no restriction or requirement on the format of this record. A / uk.example.com IP address of the Call Bridge Used by the Lync FE to contact the Call Bridge A / ukadmin.example.com IP address of the Web Admin Interface This record it is used purely for admin purposes; when system administrators prefer a FQDN to remember for each MMP interface SRV(*) _sipinternaltls._tcp.fe.lyncdomain.com The A record of the Lync FE or FE Pool If you have an FE pool, you can have multiple FE records pointing to individual FE s within the pool A / fe.lync-domain.com IP address of the Lync FE You will need one record for each individual FE (*) SRV records do not resolve directly to IP addresses. You need to create associated A or name records in order to satisfy the SRV requirements Acano solution: Deployment Planning & Preparation Guide E Page 7

8 Single Split Acano Server Deployment 3 Single Split Acano Server Deployment This section outlines the prerequisites and where to find details on setting up an Acano in a single split deployment. This type of deployment requires Acano software release R1.6 or later. The Acano can be an X Series or based on a virtual (VM) host. Figure 3 shows schematically the components on an Acano. Typically an X Series is used for the Core and a VM host for the Edge ; but this is not mandatory. Depending on your deployment you may find that not all of these Figure 3 Components split between components need to be enabled and configured. the Core and the Edge The Call Bridge and the cospace database are always required The TURN is required for media if you need NAT traversal The XMPP, Load Balancer and Web Bridge are only required in the following circumstances: If you are using any of the Acano thick clients (PC Client. Mac Client, ios Clients) then you must install and configure the XMPP and the Load Balancer If you are using the Acano WebRTC Client you require the Web Bridge, the XMPP and the Load Balancer Note: From R1.8, a single XMPP can host multiple domains. 3.1 VM host If you are using one or two VM hosts each one must comply with the host requirements provided in the Virtualized Deployments White Paper. Sizing guidelines are also provided in this document. 3.2 Syslog to capture logs The Syslog is recommended for troubleshooting and audit logging. Both s must be set up separately to use the same Syslog. 3.3 NTP for time sync You must configure at least one NTP to synchronize time between the Acano solution components. Using more than one NTP is recommended. Both s must be set up separately to use an NTP. 3.4 LDAP for importing users You must have an LDAP (currently Active Directory or OpenLDAP) to use the Acano solution. User accounts are imported from the LDAP. You can create user names by importing fields from LDAP. 3.5 API tool From 1.6 if you have more than one host we strongly recommend using the API to configure them. Therefore you need a login account and password for the Acano API in a web API tool (such as POSTMAN) 3.6 Customization asset If you are customizing your Acano solution deployment, you need a web that is Acano solution: Deployment Planning & Preparation Guide E Page 8

9 reachable by the Call Bridge without performing any form of HTTP authentication. See the Customization Guidelines for details. Single Split Acano Server Deployment TLS certificate validation with MMP commands DSCP 3.7 Call Detail Record The Acano solution generates Call Detail Records (CDRs) internally for key call-related events. The Acano solution can be configured to send these records to a remote system to be collected and analyzed: there is no provision for records to be stored on a long-term basis on an Acano. All CDRs must be sent to the same receiver. If you are using Acano Manager, it must be your CDR receiver. 3.8 Certificate requirements Certificates and a certificate bundle (or intermediate certificate chain if automatically downloaded from the internet) for the: Call Bridge (If you are using Lync, this certificate will need to be trusted by the Lync Front End Server; the best way to achieve this is to sign the certificate on the CA (Certification Authority) that has issued the certificates for the Lync Front End Server) Web Bridge XMPP Web Admin Interface cospace database host (s) trunk(s) between Core and Edge s TURN (if using TLS connections) Note: It is possible to use the same certificate across multiple Edge s but Acano does NOT recommend it. 3.9 Security If security is paramount, then consider the following. Details are provided in the Deployment guides. User access control Common Access Cards (CAC) Online Certificate Status Protocol (OCSP) FIPS 3.10 Port requirements Appendix B of the Deployment guides shows the required ports between each component of the Acano solution and between them and external components Acano Manager requirements There are no additional requirements for this Acano to be monitored by Acano Manager. Acano Manager must be deployed on a separate ; see the specification in the Acano Manager Installation Guide DNS requirements You require a DNS. Verify that no A or SRV records already exist for any Acano host before defining the records in the table below on this Summary of requirements 2 Acano X Series s, 1 X series and 1 VM host, or 2 VM hosts 1 Syslog 1 or 2 NTP s 1 LDAP (if using Acano clients) 1 CDR receiver (Acano Manager if you are using it) 1 web for customization assets (optional) 1 DNS 2 Acano Manager s Acano solution: Deployment Planning & Preparation Guide E Page 9

10 Single Split Acano Server Deployment Table 2 Required DNS records: single split Core and Edge s Type Example Resolves to Description SRV(*) _xmpp-client._tcp.example.com The A record xmpp.example.com below. Usually this is port 5222 Used by clients to login. The SRV record must correspond to the domain used in your XMPP usernames SRV(*) _xmpp-._tcp.example.com The A record xmpp.example.com below. Usually this is port 5269 A xmpp.example.com The Load Balancer which is configured to trunk to the XMPP Used to federate between XMPP s. The SRV record must correspond to the domain used in your XMPP usernames Used by clients to login. A / join.example.com IP address of Web Bridge This record is not used by the Acano solution directly; however, it is common practice to provide an end user with an FQDN to type into the browser which resolves to the Web Bridge. There is no restriction or requirement on the format of this record. A / ukedge.example.com IP address of the Load Balancer Used by the Core to create a trunk to the Load Balancer running on the Edge A / ukcore1.example.com IP address of the Call Bridge Used by the Lync FE to contact the Call Bridge A / ukcoreadmin.example.com ukedgeadmin.example.com IP address of the MMP interface This record it is used purely for admin purposes; when system administrators prefer a FQDN to remember for each MMP interface SRV(*) _sipinternaltls._tcp.fe.lyncdomain.com The A record of the Lync FE or FE Pool If you have an FE pool, you can have multiple FE records pointing to individual FE s within the pool A / fe.lync-domain.com IP address of the Lync FE You will need one record for each individual FE (*) SRV records do not resolve directly to IP addresses. You need to create associated A or name records in order to satisfy the SRV requirements Acano solution: Deployment Planning & Preparation Guide E Page 10

11 Scalable and Resilient Acano Server Deployments 4 Scalable and Resilient Acano Server Deployments This section outlines the prerequisites and where to find details on setting up a scalable and resilient Acano deployment. This type of deployment requires Acano software release R1.6 or later. This deployment can be based on combined s as shown in Figure 4 or on split Core and Edge deployments as shown in Figure 5. In both cases additional s can be added. Each Acano can be an X Series or based on a virtual (VM) host. Figure 4 Scalable and resilient deployment using combined s Figure 5 Scalable and resilient deployment using split s Typically an X Series is used for the Core s and a VM host for the Edge s; but this is not mandatory. Note that databases can be co-located with the Call Bridge or on a separate host usually also a VM. Depending on your deployment you may find that not all of these components need to be enabled and configured. The Call Bridges and the cospace databases are always required The TURN s are required for media where you need NAT traversal The XMPP s, Load Balancers and Web Bridges are only required in the following circumstances: If you are using any of the Acano thick clients (PC Client. Mac Client, ios Clients) then you must: install and configure the Load Balancers Acano solution: Deployment Planning & Preparation Guide E Page 11

12 Scalable and Resilient Acano Server Deployments If you are using the Acano WebRTC Client you require the Web Bridges, the XMPP s and the Load Balancers In a large split deployment with several Core s: it is not necessary, or even desirable, to have the same number of Edge and Core s. For example, one Call Bridge can manage multiple Web Bridges; those Web Bridges can be reachable externally with a single DNS name resolving to potentially multiple separate units. prior to R1.8, the Acano solution only supports one XMPP per domain; multiple XMPP s are supported if each XMPP is in a different domain. From R1.8, a single XMPP can host multiple domains. it is not necessary to have a cospace database instance for every Call Bridge; rather we recommend one at every point of presence. 4.1 VM host Any VM host must comply with the host requirements provided in the Virtualized Deployments White Paper. Sizing guidelines are also provided in this document. 4.2 VM host for cospace database Each cospace database can be co-located with other components on a Core, but it can also be an external database, probably on a VM host (see the previous section). 4.3 cospace database A minimum of 3 cospace databases is required. In a large deployment with several combined or Core s, it is not necessary to have a cospace database instance for every Call Bridge; rather we recommend one at every point of presence. 4.4 Syslog to capture logs The Syslog is recommended for troubleshooting and audit logging. Although it is possible to use more than one Syslog, if you are using split deployments or clustering, all host s must use the same one. 4.5 NTP for time sync You must configure at least one NTP to synchronize time between the Acano solution components. Using more than one NTP is recommended. Every host must be set up separately to use an NTP. 4.6 LDAP for importing users You must have an LDAP (currently Active Directory or OpenLDAP) to use the Acano solution. User accounts are imported from the LDAP. You can create user names by importing fields from LDAP. 4.7 API tool From 1.6 if you have more than one host we strongly recommend using the API to configure them. Therefore you need a login account and password for the Acano API in a web API tool (such as POSTMAN). 4.8 Customization asset If you are customizing your Acano solution deployment, you need a web that is reachable by the Call Bridge without performing any form of HTTP authentication. See the Customization Guidelines for details. Acano solution: Deployment Planning & Preparation Guide E Page 12

13 4.9 Call Detail Record The Acano solution generates Call Detail Records (CDRs) internally for key call-related events. The Acano solution can be configured to send these records to a remote system to be collected and analyzed: there is no provision for records to be stored on a long-term basis on an Acano. All CDRs must be sent to the same receiver. If you are using Acano Manager, it must be your CDR receiver Certificate requirements Certificates and a certificate bundle (or intermediate certificate chain if automatically downloaded from the internet) for the: Call Bridge (If you are using Lync, this certificate will need to be trusted by the Lync Front End Server; the best way to achieve this is to sign the certificate on the CA (Certification Authority) that has issued the certificates for the Lync Front End Server) Web Bridge XMPP Web Admin Interface cospace database host (s) trunk between Core and Edge s TURN (if using TLS connections) Note: It is possible to use the same certificate across multiple Edge s but Acano does NOT recommend it Security If security is paramount, then consider the following. Details are provided in the Deployment guides. User access control Common Access Cards (CAC) Online Certificate Status Protocol (OCSP) FIPS TLS certificate validation with MMP commands DSCP Scalable and Resilient Acano Server Deployments 4.12 Port requirements Appendix B of the Deployment guides shows the required ports between each component of the Acano solution and between them and external components Acano Manager requirements There are no additional requirements for this Acano to be monitored by Acano Manager. Acano Manager must be deployed on a separate ; see the specification in the Acano Manager Installation Guide DNS record requirements You require a DNS. Verify that no A or SRV records already exist for any Acano host before defining the records in Table 3 on this Summary of requirements 2 or more Acano X Series s, 2 or more VM hosts or a combination of X Series s and VM hosts. 1 Syslog More than one NTP 1 LDAP (if using Acano clients) 1 CDR receiver (Acano Manager if you are using it) 1 web for customization assets (optional) 1 DNS An Acano Manager for each Call Bridge that you want to manage Acano solution: Deployment Planning & Preparation Guide E Page 13

14 Table 3 Required DNS records: resilient/scalable (multiple) deployment Type Example Resolves to Resilience considerations Description SRV(*) _xmpp-client._tcp.example.com The A record xmpp.example.com below. Usually this is port One SRV record can be created for each XMPP /Load Balancer such that multiple results are returned in response to a DNS lookup. Clients choose a destination for XMPP traffic based on the priority and weight information Used by clients to login. The SRV record must correspond to the domain used in your XMPP usernames SRV(*) _xmpp._tcp.example.com The A record xmpp.example.com below. Usually this is port 5269 One SRV record can be created for each XMPP /Load Balancer such that multiple results are returned in response to a DNS lookup. Clients choose a destination for XMPP traffic based on the priority and weight information Used to federate between XMPP s. The SRV record must correspond to the domain used in your XMPP usernames A xmpp.example.com IP address of either the XMPP or a Load Balancer which is configured to trunk to the XMPP. One A record per XMPP or Load Balancer A / join.example.com IP address of Web Bridge One A and/or record per Web Bridge. The decision on which Web Bridge your browser uses is made by your web browser. Normally the choice is random This record is not used by the Acano solution directly; however, it is common practice to provide an end user with an FQDN to type into the browser which resolves to the Web Bridge. There is no restriction or requirement on the format of this record. A / ukedges.example.com nyedges.example.com IP addresses of any local Load Balancers Each Core in a given datacenter should trunk to only the Edge s within that datacenter. In our example, ukedges.example.com would return the IP address of all Load Balancers within the UK datacenter Used in split deployments only by the Core to create a trunk to a Load Balancer running on the Edge A / ukcore1.example.com nycore1.example.com IP address of the Call Bridge One record per Call Bridge. Each Call Bridge must have a unique FQDN Used by the Lync FE to contact the Call Bridge A / ukcore1admin.example.com IP address of the MMP One record per Web Admin Interface. Each MMP This record it is used Acano solution: Deployment Planning & Preparation Guide E Page 14

15 Type Example Resolves to Resilience considerations Description ukedge1admin.example.com nycore1admin.example.com interface interface must have a unique FQDN purely for admin purposes; when system administrators prefer a FQDN to remember for each MMP interface SRV(*) _sipinternaltls._tcp.fe.lyncdomain.com The A record of the Lync FE or FE Pool If you have an FE pool, you can have multiple FE records pointing to individual FE s within the pool A / fe.lync-domain.com IP address of the Lync FE You will need one record for each individual FE (*) SRV records do not resolve directly to IP addresses. You need to create associated A or name records in order to satisfy the SRV requirements Acano solution: Deployment Planning & Preparation Guide E Page 15

16 2015 Acano (UK) Ltd. All rights reserved. This document is provided for information purposes only and its contents are subject to change without notice. This document may not be reproduced or transmitted in any form or by any means, for any purpose other than the recipient s personal use, without our prior written permission. Acano is a trademark of Acano (UK) Ltd. Other names may be trademarks of their respective owners. Acano solution: Deployment Planning & Preparation Guide E Page 16