LifeSize ClearSea Administrator Guide

Transcription

1 LifeSize ClearSea Administrator Guide August 2012

2 LifeSize ClearSea Administrator Guide 2 LifeSize ClearSea Server LifeSize ClearSea is a client/server solution for desktop and mobile video collaboration. Users can connect from their desktops or mobile devices to H.323 or SIP devices, including video systems, MCUs, and gateways. This guide describes LifeSize ClearSea Server: Deployment Scenarios Initial Configuration User Call Flows Administrator Control Panel Provides an overview of common deployment scenarios, including the external firewall configuration. Guides you through the initial configuration after you have installed LifeSize ClearSea Server. Provides an overview of calling. Provides a detailed description of the administrator Control Panel. Related documentation is available from lifesize.com/support. Terminology for Users and Groups The following terms are used in this document to describe LifeSize ClearSea users and groups. These terms may differ from terms used with other LifeSize systems. Familiarize yourself with these terms to best understand the capabilities of your LifeSize ClearSea Server. server administrator - administrator role with full capabilities. user administrator - administrator role with a subset of management capabilities. user or end user - a user who connects to the VoIP network managed by LifeSize ClearSea. user account - a unique user account on the server side related to a LifeSize ClearSea Client user and/or SIP or H.323 video systems. Each user account includes a user ID and an extension. user ID - unique string representation of any user account. You can dial the string from a LifeSize ClearSea Client or select the string from the contact list to place a call. extension - unique numeric representation of any user account. You can dial the extension from any client by accessing the IVR flow. group or provisioning group - every user account belongs to one group. For each group, administrators can define how LifeSize ClearSea Client is configured. For example: enabling or disabling LifeSize ClearSea Client features, setting video and audio codecs, and limiting maximum bandwidth. contact and contact list - each LifeSize ClearSea Client user account can maintain a server side contact list.

3 LifeSize ClearSea Administrator Guide 3 Section 1: Deployment Scenarios Networking and Call Requirements LifeSize ClearSea Server is designed to work as a hub for enterprise visual communication. Users allowed to connect to LifeSize ClearSea Server can place and receive calls regardless of the physical network to which they are connected. For example, users connected to LifeSize ClearSea from the Internet can place video calls to users on the internal company LAN or external to the company LAN. LifeSize ClearSea Server manages call routing and allows users to communicate without knowing the physical location of the call recipient or which networking and VoIP protocols it supports. The LifeSize ClearSea Server must be able to connect to the master server for activation. Read more at Activation and Licensing. Either the caller or the call recipient must have a user account registered on the LifeSize ClearSea Server. Read more at User Call Flows and Accounts.

4 LifeSize ClearSea Administrator Guide 4 Standalone Deployments The following sections highlight common standalone deployments. Read about configuring standalone servers at Cluster Management. Scenario 1: Corporate LAN and Public IP LifeSize ClearSea Server integrates two Ethernet interfaces. A common deployment scenario is one interface connected to the corporate LAN, and another interface on an external network. The following diagram shows the LAN interface bound to the corporate network, while the WAN interface is assigned a public IP address that can be reached from anywhere over the Internet.

5 LifeSize ClearSea Administrator Guide 5 Internet Access without NAT In the following diagram, the LifeSize ClearSea Server is assigned a public IP address typically protected by a firewall. All LifeSize ClearSea Client users and video systems over the Internet are able to place and receive calls to and from the LifeSize ClearSea Server. Internet Access with 1-to-1 NAT This scenario is identical to the previous setup, but the WAN interface is assigned a private corporate address with a 1-1 NAT address from the Internet router. As in the previous example, a firewall system might enforce access control. In the diagram, the WAN interface is assigned the private IP that is mapped to an Internet public IP address by the router NAT.

6 LifeSize ClearSea Administrator Guide 6 Scenario 2: WAN Interface Only, Public IP In the following diagram, only the WAN interface is connected and all users are on the Internet. Scenario 3: LAN Interface Only In the following example, only the LAN interface is connected and all users are in the corporate LAN.

7 LifeSize ClearSea Administrator Guide 7 Clustered Deployments You can deploy LifeSize ClearSea in a wide range of clustered configurations. The following sections highlight the most common clustered deployments. Read about configuring clustered servers at Cluster Management. Scenario 1: Cluster for Redundancy (Dual Homed) The following deployment allows calls to and from the Internet and to and from the corporate LAN, configuring both interfaces on the LifeSize ClearSea appliance. In this case, it is possible to set up a cluster for redundancy and failover. Requirements: sub network with public IP addresses, possibly behind a firewall (public LAN) LAN Configure this scenario as follows from the LifeSize ClearSea Control Panel in SYSTEM : Network Interfaces. Field Value Internal (LAN) IP address IP address in the LAN Subnet mask LAN netmask External (WAN) IP address public IP address in the public network Subnet mask NAT IP address public network netmask default value of (to disable NAT)

8 LifeSize ClearSea Administrator Guide 8 Field Value Global Configuration DNS (primary/secondary) DNS IP address Default Gateway default gateway (if applicable) of the public network NOTE: Instead of configuring a default gateway, you can also set a proper routing rule in Control Panel : SYSTEM : Static Routes. You must open the following ports on the firewall between the Internet and the public LAN: * For the cluster setup, copy all rules for each CSS IP address. ** In this scenario it is highly recommended that you create the cluster on the corporate LAN.

9 LifeSize ClearSea Administrator Guide 9 Scenario 2: Cluster for Security (DMZ with Public IP) This deployment allows calls to and from the Internet and to and from the corporate LAN, configuring a single interface on the LifeSize ClearSea appliance. You must set up a cluster to grant security on the corporate LAN. Requirements: controlled network with public IP addresses (DMZ) LAN On each LifeSize ClearSea appliance, plug in the first interface only (LAN) on the related network. Configure the following preferences from the LifeSize ClearSea Control Panel in SYSTEM : Network Interfaces: Field Value Internal (LAN) IP address IP address in the DMZ/LAN Subnet mask DMZ/LAN netmask Global Configuration DNS (primary/secondary) DNS IP address Default Gateway default gateway (if applicable) of the public network NOTE: Instead of configuring a default gateway, you can also set a proper routing rule in Control Panel : SYSTEM : Static Routes.

10 LifeSize ClearSea Administrator Guide 10 After creating a cluster, add the following node rule on each node from the LifeSize ClearSea Control Panel in SYSTEM : Cluster Management: 1. Click the LOCAL Node Type entry and Edit Node Routes. 2. Configure the Default Destination Node with the system ID of the node in the DMZ. 3. Add a Node Route, setting the IP/Mask (CIDR notation) for the LAN and the system ID of the node in the LAN as the Destination Node. On the Internet interface, you must open the following ports on the firewall between the Internet and the DMZ: On the DMZ interface, you must open the following ports on the firewall between the LAN and the DMZ:

11 LifeSize ClearSea Administrator Guide 11 Scenario 3: Cluster for Security (DMZ with Public IP) and Redundancy This deployment allows calls to and from the Internet and to and from the corporate LAN, configuring a single interface on the LifeSize ClearSea appliance. You must set up a cluster to grant security on the corporate LAN and provide redundancy against server failures. The setup rules are the same as in Scenario 2: Cluster for Security (DMZ with Public IP), including the following: Firewall rules on the firewall between the Internet and the DMZ must be replicated for each node in the DMZ. Firewall rules on the firewall between the corporate LAN and the DMZ must be replicated to allow traffic from each node in the DMZ to each node in the corporate LAN.

12 LifeSize ClearSea Administrator Guide 12 Scenario 4: Cluster for Security (LAN and DMZ with 1:1 NAT) This deployment allows calls to and from the Internet and to and from the corporate LAN, configuring a single interface on the LifeSize ClearSea appliance. You must set up a cluster to grant security on the corporate LAN. Requirements: controlled network (DMZ) public IP LAN On the LifeSize ClearSea appliance in the DMZ, plug in the second interface only (WAN). Configure the following preferences from the LifeSize ClearSea Control Panel in SYSTEM : Network Interfaces: Field Value External (WAN) IP address IP address in the DMZ Subnet mask NAT IP address DMZ netmask public IP address for 1:1 NAT Global Configuration DNS (primary/secondary) DNS IP address Default Gateway default gateway (if applicable) of the public network NOTE: Instead of configuring a default gateway, you can also set a proper routing rule in Control Panel : SYSTEM : Static Routes.

13 LifeSize ClearSea Administrator Guide 13 On the LifeSize ClearSea appliance in the corporate LAN plug in the first interface only (LAN). From the LifeSize ClearSea Control Panel, configure the following preferences in SYSTEM : Network Interfaces: Field Value Internal (LAN) IP address IP address in the LAN Subnet mask LAN netmask Global Configuration DNS (primary/secondary) DNS IP address Default Gateway default gateway (if applicable) of the public network NOTE: Instead of configuring a default gateway, you can also set a proper routing rule in Control Panel : SYSTEM : Static Routes. After creating a cluster, add the following node rule on each node from the LifeSize ClearSea Control Panel in SYSTEM : Cluster Management. 1. Click the LOCAL Node Type entry and Edit Node Routes. 2. Configure the Default Destination Node with the system ID of the node in the DMZ. 3. Add a Node Route, setting the IP/Mask (CIDR notation) for the LAN and the system ID of the node in the LAN as the Destination Node. On the Internet interface, you must open the following ports on the firewall between the Internet and the DMZ: On the DMZ interface, you must open the following ports on the firewall between the LAN and the DMZ:

14 LifeSize ClearSea Administrator Guide 14 Scenario 5: Cluster for Geographical Load Balancing and Redundancy This deployment allows calls to and from the Internet and to and from the corporate LAN of each of the company office headquarters, balancing by geographical location and providing redundancy against server failures. The setup rules are the same as in Scenario 1: Cluster for Redundancy (Dual Homed), including the following: The two nodes are installed on the public network on the two geographical sites. The cluster is created, binding on the public IP addresses. The DNS must resolve the LifeSize ClearSea domain with the public IP addresses from both nodes. Sizing Limits Standalone Maximum number of accounts on a single LifeSize ClearSea unit: 10,000 Maximum number of concurrent registrations: 2,500 Cluster Maximum number of nodes in a LifeSize ClearSea cluster: 4 Maximum number of accounts in a LifeSize ClearSea cluster: 40,000 Maximum number of concurrent registrations in a LifeSize ClearSea cluster: 10,000

15 LifeSize ClearSea Administrator Guide 15 External Firewall Configuration This section lists the ports LifeSize ClearSea Server requires when placed behind a firewall. For LifeSize ClearSea to function properly and to be properly maintained, set the following rules on an external firewall:

16 LifeSize ClearSea Administrator Guide 16 Section 2: Initial Configuration Networking After you install your LifeSize ClearSea Server (hardware appliance or virtual machine), you must configure the network interfaces according to your production network environment. From the LifeSize ClearSea Control Panel or local console, navigate to SYSTEM : Network Interfaces. For a detailed explanation of the configuration parameters in this section, refer to Network Interfaces. The LifeSize ClearSea Server has two Ethernet interfaces: Internal (LAN) and External (WAN). If your environment includes an external firewall to control access to the LifeSize ClearSea Server interfaces, you must configure it as described in External Firewall Configuration. Once networking has been set up, proceed with activation as described in the following section. Activation and Licensing Master Server Contact the master server through the Internet to activate the main license and any other licensing option. The connection is always initiated by the LifeSize ClearSea Server toward the master server; the LifeSize ClearSea Server connects to master.mirial.com on TCP port 443 using a TLS encrypted socket. You must configure your network to allow connections from your LifeSize ClearSea Server to master.mirial.com on TCP port 443. You can configure an HTTP proxy server for connecting to the master, as described in Administrative. The master server handles all licensing options, including support, firmware upgrade notifications, periodic system health checks, and other functions that keep your LifeSize ClearSea Server running. NOTE No sensitive data or personally identifiable information is sent to the master server.

17 LifeSize ClearSea Administrator Guide 17 Activation You must activate your LifeSize ClearSea Server to manage calls. Activate LifeSize ClearSea Server in Control Panel : MAINTENANCE : License and Options. NOTE The local console does not include a licensing section. You must access the Control Panel to perform the activation. If you have a physical appliance, LifeSize activates the system. If you must activate your system, enter your activation code in the License and Options dialog box. Your activation request is sent to the master server and if it is successful, the following occurs: A message appears: Your ClearSea Server is activated. All active licensing options appear in this Control Panel section. A system ID is assigned to your LifeSize ClearSea Server. The system ID is displayed in the upper right corner of the Control Panel. All Control Panel sections are enabled. The ClearSea VoIP service starts. Checkpoint The LifeSize ClearSea Server and master server exchange information periodically. This type of interaction between the two servers is called checkpoint. Upgrade Notifications When a new LifeSize ClearSea Server release is available, an alert appears in the Control Panel. For more information about product upgrade and downgrade refer to Software Upgrade. License Options The checkpoint also performs license option checks and automatically updates your licensing options based on your contract status. To manually force a checkpoint to update your license, select Control Panel : MAINTENANCE : License and Options : Update License.

18 LifeSize ClearSea Administrator Guide 18 Configuring the LifeSize ClearSea Service After the system has been activated, the administrator must configure basic service parameters to test service functionality. Configure the LifeSize ClearSea Domain Domain Name in Control Panel : SERVICE : General is one of the following values: Either the LAN or WAN interface IP address. This does not require setting up the DNS and is recommended for simple network scenarios. A fully qualified domain name such as sea.mycompany.com. The DNS of the client video systems must resolve the domain name to the IP address of the target LifeSize ClearSea network interface (LAN or WAN). Configure One or More Users To complete basic setup and be able to place a call, you must add at least one user in Control Panel : SERVICE : Accounts. Click Add Account to enter the user s information. LifeSize ClearSea Client LifeSize ClearSea Client is a software-only video phone used with LifeSize ClearSea Server. LifeSize ClearSea Client is available for both Windows and Mac OS X operating systems and for ios or Android devices. Downloading the LifeSize ClearSea Desktop Client Users can download the LifeSize ClearSea desktop client with a web browser from where <address> is one of the IP addresses or DNS names assigned to the unit. For example: clearsea.mycompany.com. Users select either the Windows or Mac OS X installation package. NOTE Download mobile clients for ios and Android devices from the Apple AppStore and the Android Market. Installing the LifeSize ClearSea Client 1. Launch the installation package you downloaded. 2. Log in with the example user and example password you created in Configure One or More Users.

19 LifeSize ClearSea Administrator Guide 19 The ClearSea Server field is set to the same address (hostname or IP address) you used to download the client. The LifeSize ClearSea Client displays the address of the last server to which it was connected; however, you can change this server address. All user data, such as contacts and history, is stored independently on each LifeSize ClearSea Server. Multiple LifeSize ClearSea Clients using the same user account may be simultaneously connected to the same LifeSize ClearSea Server (example: one at the office and one at home). The first to answer an incoming call establishes the connection. With a connection established, LifeSize ClearSea Server ignores the call on another client. For a detailed description of how to install, run, and configure the LifeSize ClearSea Client, refer to the LifeSize ClearSea User Guide.

20 LifeSize ClearSea Administrator Guide 20 Section 3: User Call Flows Test Calls Placing a test call provides feedback about VoIP functionality and call quality at the far end. LifeSize ClearSea records the caller s audio and video and plays the recording for the user to preview. To place a test call, from the LifeSize ClearSea Client, click ClearSea Test Call in the list of contacts. You can also enter testcall in the search box. Any SIP or H.323 video system that can signal to the LifeSize ClearSea Server an alphanumeric alias as the dialed party name can call testcall. The test call procedure is timed and requires approximately one minute. IVR The interactive voice response (IVR) allows callers to dial the numeric extension of a specific user. This is particularly useful when the caller is not capable of dialing alphanumeric aliases such as name@domain. Every LifeSize ClearSea user account is assigned an extension that is a unique number used to reach the user account via a guided IVR flow. To activate the IVR, a user dials the LifeSize ClearSea Server IP address or hostname (for example: sea.mydomain.com) without specifying any user account alias or number. The IVR allows the caller to dial the desired extension by using DTMF tones (keypad buttons). Once the extension is dialed and confirmed with the # key, the LifeSize ClearSea Server attempts to contact the called user account. When trying to connect to the dialed extension, one of the following cases can occur: The called user account answers the call. The called user account rejects the call (busy signal). The called user account does not answer the call (timeout). The dialed extension is not available (wrong extension number or the user account is not currently available). Direct Two-Way Calls The LifeSize ClearSea Server processes calls to and from the following devices: LifeSize ClearSea Client: The software client for Windows, Mac OS X and ios or Android devices. Video system associated with a LifeSize ClearSea user account: SIP or H.323 equipment specified in the Endpoint List of a user account.

21 LifeSize ClearSea Administrator Guide 21 SIP video system registered to the LifeSize ClearSea Server using credentials from a user account. H.323 video system using LifeSize ClearSea Server as a gateway, authenticated using credentials from a user account. Video system not associated with a LifeSize ClearSea user account: SIP or H.323 equipment whose IP address is not configured in the Endpoint List of a user account. NOTE Either the caller or call recipient must have a LifeSize ClearSea user account for the call to be successful. LifeSize ClearSea connects users on different networks: Both the caller and call recipient are in the company LAN. The caller is in the LAN, and the call recipient is in the WAN (or vice-versa). Both the caller and call recipient are in the WAN. Additionally, if callers are not using the same communications protocol (SIP or H.323), LifeSize ClearSea performs protocol conversion to connect the callers. Read more at Standalone Deployments and Clustered Deployments. User Account with Multiple LifeSize ClearSea Clients or Registered Video Systems Any LifeSize ClearSea user account can have multiple instances of the LifeSize ClearSea Client running on separate Windows, Mac OS X, ios, or Android devices; or registered SIP or authenticated H.323 video systems, all simultaneously connected to the same LifeSize ClearSea Server. With multiple LifeSize ClearSea Clients, when a call is received, it rings on all LifeSize ClearSea Clients and registered SIP and authenticated H.323 video systems. You can answer the call on any system. Once the call is answered (or ignored), all other clients and video systems stop ringing. MCU The LifeSize ClearSea Server offers the following MCU capabilities: Conferences hosted by the MCU embedded in LifeSize ClearSea Server or an external MCU. Read more at MCU Management. Multiway conferencing with configured Conference Rooms.

22 LifeSize ClearSea Administrator Guide 22 Section 4: Administrator Control Panel The LifeSize ClearSea administrator manages LifeSize ClearSea Server from the Control Panel. User Roles Two administrator users can access the following areas of the Control Panel: The server administrator has full access to all Control Panel sections. The user administrator has access only to Control Panel sections related to user management. - Alerts - STATUS : Active Calls - STATUS : Registered ClearSea Clients - SERVICE : Groups - SERVICE : Accounts Logging In The integrated web server manages the Control Panel. Access the Control Panel as follows: 1. Open a web browser and enter the following URL for plain text access: Enter the following URL for encrypted access: Where <address> refers to one of the IP addresses assigned to the unit. 2. Enter your username and password. Default credentials: User Username Password Server administrator admin admin User administrator uadmin uadmin NOTE Login credentials are case-sensitive. Modify these passwords in the SYSTEM : Administrative section of the Control Panel or the local console.

23 LifeSize ClearSea Administrator Guide 23 Alerts Alerts that are created either locally by LifeSize ClearSea or remotely by the master server appear in the Alerts section of the Control Panel. Each alert contains the following information: ID Level Time Text Incremental alert unique identifier. Possible values: FATAL, ERROR, WARN, INFO. Date and time the event occurred. of the event that generated the alert. Remove an alert from the list by clicking Dismiss selected. To remove all alert messages, click Dismiss All. NOTE If you do not dismiss an alert, it appears each time you log in.

24 LifeSize ClearSea Administrator Guide 24 STATUS View the status of your LifeSize ClearSea Server from the Control Panel in STATUS. System Active calls Active conference rooms Active MCUs Registered users Read more at System Status. Read more at Active Calls. Shows the number of participants and duration of active conference rooms. Learn how to add a conference room in Conference Rooms. Shows details of active MCUs, including IP address, resolution, maximum and active ports, initialization date, and duration. Learn how to configure MCUs in MCU Management. Read more at Registered Users. System Status View system status and shut down or reboot the server in Control Panel : STATUS : System Status. The following fields are available: Field Service Status Version Build Number Ports (current/max) Provisioned Users (current/max) Registered Users Server Shutdown Server Reboot Core service status. Normal status is RUNNING. You must activate the LifeSize ClearSea Server for this button to be functional. LifeSize ClearSea product version in the form major.minor.patch LifeSize ClearSea build number. Current used ports and maximum licensed ports. If the maximum number of used ports is reached, new calls fail. Ports are related to the call legs: a call between user A and user B includes two call legs and uses two ports. Ports used for test calls are not accounted for in this field. Number of provisioned (created) user accounts and maximum supported user accounts. Number of users with LifeSize ClearSea Client logged in to the LifeSize ClearSea Server. Shuts down the hardware appliance. Reboots the hardware appliance. Active Calls View active calls on the LifeSize ClearSea Server in Control Panel : STATUS : Active Calls. For each call, the following fields appear: Field Caller ID Caller IP Caller ID from signaling. Caller signaling IP.

25 LifeSize ClearSea Administrator Guide 25 Field Caller Endpoint Caller Status Dial String Called ID Called IP Called Endpoint Duration Details Drop Caller vendor ID and product ID. Caller's call status. Dialed alias, number, or address. Called ID from signaling. Called signaling IP. Called vendor ID and product ID. Call duration (time since call connection). Shows additional details about the call. Allows you to end the call. The table is updated automatically in real time. To disable or enable auto updates, click the three circles in the lower left corner of the grid. The search text field in the top right corner filters the table to show only rows containing the searched text in any field. Registered Users View the list of LifeSize ClearSea Clients currently logged in and registered to the LifeSize ClearSea Server in Control Panel : STATUS : Registered Users. For each client, the following fields appear: Field User ID User IP Status User Endpoint OS Info System ID Duration Unregister LifeSize ClearSea Client user ID. IP address from which the LifeSize ClearSea user account is logged in. LAN or WAN appears, depending on the server interface to which the user is connected. The SIP registration status. Vendor ID and product ID. Information about the operating system of the LifeSize ClearSea Client, if available. The system ID of the cluster node to which the user is connected. Elapsed time since the user logged in. Allows you to manually unregister the user. If the user is in a call, the call is ended as soon as the registration check is performed on the LifeSize ClearSea Client. NOTE: In a clustered deployment, this action is available only on the cluster node to which the user is connected.

26 LifeSize ClearSea Administrator Guide 26 SYSTEM This section allows you to configure the local LifeSize ClearSea system. Network Interfaces CAUTION Ensure that you check the embedded firewall settings before changing network parameters. If the embedded firewall is enabled, incorrect network settings might prevent the administrator from accessing the system from the service adapter. Refer also to Firewall. Access network information in Control Panel : SYSTEM : Network Interfaces. This page shows details for each Ethernet interface. NOTE Modifying field values marked with a red * (asterisk) might require you to restart the LifeSize ClearSea service. Restarting the LifeSize ClearSea service ends all active calls and causes all client registrations to be lost. Parameter Status MAC address Enable DHCP IP Address Subnet Mask Ethernet cable connection/disconnection status. Hardware MAC address of the Ethernet interface. This master switch enables or disables DHCP. If DHCP is enabled, you cannot manually configure the IP address or the Subnet Mask parameter. The IP address assigned to the network interface. The IP subnet mask assigned to the network interface. NAT IP Address (WAN only) Enable external H.323 conferencing H.323 Endpoint bandwidth (kbps) Enable external SIP conferencing SIP Endpoint bandwidth (kbps) When the LifeSize ClearSea Server is located behind a router or a firewall in a 1-to- 1 NAT configuration, this field must contain the public IP address. This master switch enables or disables calls to and from external H.323 video systems (if licensed). This does not affect LifeSize ClearSea Clients. Maximum bit rate allowed for the H.323 video systems (if licensed). This does not affect LifeSize ClearSea Clients. The default depends on licensing options. This master switch enables or disables calls to and from external SIP video systems. This does not affect LifeSize ClearSea Clients. Maximum bit rate allowed for the SIP video systems (if licensed). This does not affect LifeSize ClearSea Clients. The default depends on licensing options.

27 LifeSize ClearSea Administrator Guide 27 Parameter Enable Control Panel access Enable Media Encryption This master switch enables or disables access to the Control Panel. NOTE: You must enable Control Panel access to at least one interface. If you disable access on both interfaces, the system automatically re-enables it on the LAN interface. This master switch enables or disables the media encryption on the specified network interface. By disabling this feature, all the calls through the specified network interface do not use media encryption, overriding the LifeSize ClearSea Client and user group media encryption settings. Read more at Group Properties. NOTE: If media encryption is not licensed, this feature is not enabled and this master switch is locked. The Global Configurations section lists network settings that are applied globally: primary DNS secondary DNS default gateway Firewall Access firewall information in Control Panel : SYSTEM : Firewall. LifeSize ClearSea embeds a simple firewall to restrict administrative access to specified hosts or subnets. The firewall filters access to the administrative Control Panel and to other management services. Include IP addresses or subnets in CIDR format. CAUTION Ensure that you include the IP address or subnet from which you access the Control Panel before enabling the firewall and saving the settings. If you cannot access the Control Panel, you can disable the firewall from the local console. Date and Time Configure the system date and time in Control Panel : SYSTEM : Date and Time. Field Current Date and Time Enable automatic synchronization with NTP NTP Server Time Zone This read-only field displays the current date and time in YYYY-MM-DD HH:mm:ss format. Master NTP server switch. LifeSize strongly recommends that all production systems are synchronized with the same NTP server. The NTP server IP or hostname. System time zone.

28 LifeSize ClearSea Administrator Guide 28 Field Automatically adjust clock for daylight saving changes Change settings manually New date New time Depending on the time zone, this setting automatically adjusts the clock for daylight saving changes depending on your time zone. Select this option if you want to change the system date and time manually. NOTE: If the NTP server is enabled, this option is disabled. When changing the system clock manually, enter the date in YYYY-MM-DD format. When changing the system clock manually, enter the time in HH:mm:ss format. Hosts Edit host file entries to override the DNS resolution in Control Panel : SYSTEM : Hosts. For each hostname or domain name, include the IP address to which the hostname or domain name resolves. Static Routes Manage IP static routes in Control Panel : SYSTEM : Static Routes. For each configured static route, the following fields are available. Field IP/Mask The destination IP address or subnet in CIDR format. For example: /16 Gateway The gateway to the specified destination. Administrative Modify access criteria to the administrative Control Panel in Control Panel : SYSTEM : Administrative. Passwords Encryption SNMP HTTP proxy Modify passwords for the server and user administrators in Server Administrator Password and User Administrator Password. Passwords must meet these criteria: The password cannot be empty. The maximum length is 15 characters. Allowed characters are alphanumeric (a-z, A-Z, 0-9), underscore (_), dot (.), and dash (-). Read more at Encrypted Access. Use the SNMP Configuration section to enable or disable SNMP functionality. The exposed MIBs are those implemented by Microsoft Windows XP machines. Refer to support.microsoft.com/kb/237295/en-us?fr=1. In Master Server Access, configure an HTTP proxy for contacting the master server. When enabled, all communication with the master server is performed using the specified HTTP proxy server. Specify the hostname or IP address and port of the proxy. If you use proxy server authentication, include the username and password for authentication. LifeSize ClearSea Server must be able to contact the master server to perform activation and checkpoints.

29 LifeSize ClearSea Administrator Guide 29 Encrypted Access Configure encrypted access in HTTPS Control Panel Access (Port 8801): By default, an internally generated self-signed certificate is used. Setting SSL Certificate to CUSTOM allows you to set a custom certificate/private key pair. The following fields are available: Field Always Redirect HTTP to HTTPS SSL Certificate Certificate Private Key When enabled, every attempt to access the Control Panel at port 8800 is redirected to the encrypted Control Panel at port Allows you to change the certificate used for encryption. Visible only when you choose CUSTOM from SSL Certificate. Paste the contents of a signed certificate in X.509 PEM format in the box. Visible only when you choose CUSTOM from SSL Certificate. Paste the contents of an RSA private key in PKCS#8 PEM format in the box. To restore the default certificate, choose INTERNAL and click Save.

30 LifeSize ClearSea Administrator Guide 30 Cluster Management Clustered configuration provides service scalability and fault tolerance. All systems in a cluster share the same SERVICE settings. SYSTEM : Cluster Management shows the current clustering status of the server. The most important status parameter is Clustering Mode, which can be Standalone (not part of a cluster), Candidate (waiting for the cluster join request to be accepted), or Replicated (part of a cluster). Depending on the current clustering mode, you can do the following: Create a new cluster Request to join this system to an existing cluster Accept or reject another system s request to joint the cluster Remove the local system from the cluster Remove a remote system from the cluster This option is available only if the current clustering mode is Standalone. In Create Cluster, select the local Bind Address for cluster interconnection and click Create new Cluster. After the new cluster is created, the system is ready to accept join requests from other systems. The clustering mode of this server is now Replicated. This option is available only if the current clustering mode is Standalone. In Join Cluster, select the local Bind Address for cluster interconnection and enter the IP address of another LifeSize ClearSea system that is already part of the cluster in IP address of a node in the cluster. Click Join Cluster to send the join request to the other LifeSize ClearSea system. If the clock of the local system is not synchronized with the cluster, the join request is rejected. To avoid this issue, use the same NTP server for all systems in the cluster. The clustering mode is set to Candidate until the request is accepted by the administrator on the remote node to which the request has been sent. CAUTION: This procedure replaces all SERVICE settings on the candidate node with the settings from the cluster. This option is available only if the current clustering mode is Replicated and one or more remote systems requested to join the cluster and are waiting as cluster candidates. Cluster Nodes contains a row for every remote server that requested to join the cluster. Click Add all candidates to accept all join requests or Reject all candidates to reject all join requests. This option is available only if the current clustering mode is Candidate or Replicated. Click Revert to standalone to revert the system to Standalone mode. This option is available only if the current clustering mode is Replicated. In SYSTEM : Cluster Management, select the remote system and click Remove Node: this removes the selected remote systems from the cluster and reverts to Standalone. CAUTION: This procedure resets all SERVICE settings on the removed node you remove from the cluster.

31 LifeSize ClearSea Administrator Guide 31 Editing Node Routes NOTE This option is available only if the current clustering mode is Replicated. In SYSTEM : Cluster Management, select the system and click Edit Node Routes to open Routes for node<systemid>. Use this window to define specific call routes for given subnets. You can also add, edit, or delete node routes. When you add a node route, define the following parameters. Field IP/Mask Destination Node Defines the subnet IP interval to match the called IP address. Defines the destination node to place the call if the route matches. Node routes are evaluated after local call routing. Refer to Call Routing for details on configuring local call routing rules. Node routes are evaluated as a classic routing table, choosing the first more specific subnet. If no node route matches (or no node route is defined), the Default Destination Node is used to place the call (it acts as a default gateway). NOTE If a node route matches and the call fails on the matched node, no fallback is performed and the call fails. Node routes are applied only to external unregistered video systems; registered video systems are always called through the node to which they are registered.

32 LifeSize ClearSea Administrator Guide 32 SERVICE Configure LifeSize ClearSea service settings in Control Panel : SERVICE. Domain Configuration and Authentication Configure LifeSize ClearSea Client authentication and optional HTTP redirects in Control Panel : SERVICE : General. The following fields are available: Field Domain Name Call Setup Timeout Clients Authentication Mode LDAP Version LDAP Host LDAP Port LDAP over SSL enabled (LDAPS) The LifeSize ClearSea domain. This field is required for proper LifeSize ClearSea SIP functionality. Set to the fully qualified domain name or one of the IP addresses of the LifeSize ClearSea Server. Examples: mcs.company.com or The timeout in seconds that applies to all outbound calls. The LifeSize ClearSea Server ends the call as Unanswered if the far end does not answer within the configured timeout. The default value is 30 seconds. NOTE: Editing the value of Call Setup Timeout might affect call routing rules. Specifies whether LifeSize ClearSea Client authentication is handled internally or by an external LDAP server: INTERNAL authentication requires a user ID and password associated with the user account. Accounts without local credentials are not allowed to log in or register with SIP and H.323 video systems. Read more at Local credentials. LDAP bind authentication uses LDAP credentials. LifeSize ClearSea Server sends an LDAP bind request to an external LDAP server. If this bind succeeds, the user is authenticated. LDAP search authentication performs an LDAP search on an external LDAP server. A user is authenticated only if the LDAP search returns at least one account and an LDAP bind using the retrieved account succeeds. Use this authentication method to authorize a subset of the LDAP users. If you use LDAP authentication, note the following distinction between client types: LifeSize ClearSea Client users can log in with either their LDAP or local credentials. Users registering with other SIP or H.323 video systems must log in with their local credentials. Specifies the protocol version of the external LDAP server. The external LDAP server host or IP address. Example: ldap.mycompany.com The external LDAP server port. The LDAP default port is 389, or 636 if SSL is enabled. Specifies if communication with the LDAP server is protected with SSL on the configured port (LDAPS). No validation is performed on the SSL certificate provided by the server.

33 LifeSize ClearSea Administrator Guide 33 Field LDAP bind DN LDAP bind password LDAP search DN LDAP search filter LDAP search scope Automatic Import of LDAP Accounts Imported Accounts Default Group LDAP Attribute for "Group" LDAP Attribute for "Extension" DN when authenticating (using LDAP bind) on the external LDAP server. This string may contain one or more of the following wildcards: <U> is replaced with the username of the LifeSize ClearSea Client user who is authenticating. <P> is replaced with the plain text password of the authenticating user. <P-MD5> is replaced with the MD5 hash of the user's password, in LDAP userpassword format: {MD5} followed by base64 encoding of the hash. <P-SHA> is replaced with the SHA-1 hash of the user's password, in LDAP userpassword format: {SHA} followed by base64 encoding of the hash. This option is available only when Clients Authentication Mode is set to LDAP bind or LDAP search. Password for authenticating (using LDAP bind) on the external LDAP server when performing an LDAP search request. This option is available only when Clients Authentication Mode is set to LDAP search. DN for performing an LDAP search on the external LDAP server. This string can contain the same wildcards as LDAP bind DN. This option is available only when Clients Authentication Mode is set to LDAP search. Search filter for performing an LDAP search on the external LDAP server. This string can contain the same wildcards as LDAP bind DN. This option is available only when Clients Authentication Mode is set to LDAP search. The starting point of an LDAP search and the depth of the search from the base DN. If enabled, new user accounts are automatically created for users that do not have a user account but who provide correct credentials for the LDAP domain. All parameters configured in the Imported LDAP Accounts are applied to user accounts after each successful login. This option is available only when LDAP integration is enabled. Specifies the user group to configure for user accounts that log in successfully on the LDAP server and do not specify an attribute for Group. This option is available only when Automatic Import of LDAP Accounts is enabled. Specifies an LDAP Attribute to retrieve through the LDAP search. This attribute configures a user account's Group after each successful login. This option is available only when Automatic Import of LDAP Accounts is enabled and Clients Authentication Mode is set to LDAP search. This option can be left empty. Specifies an LDAP Attribute to retrieve through the LDAP search. This attribute configures a user account's Extension after each successful login. This option is available only when Automatic Import of LDAP Accounts is enabled and Clients Authentication Mode is set to LDAP search. This option can be left empty.

34 LifeSize ClearSea Administrator Guide 34 Field LDAP Attribute for "Display Name" LDAP Attribute for " address" LDAP Attribute for "" Enable Redirect Redirect URL Specifies an LDAP Attribute to retrieve through the LDAP search. This attribute configures a user account's Display Name after each successful login. This option is available only when Automatic Import of LDAP Accounts is enabled and Clients Authentication Mode is set to LDAP search. This option can be left empty. Specifies an LDAP Attribute to be retrieved through the LDAP search. This attribute is used to configure a user account's address after each successful login. This option can be left empty. Specifies an LDAP Attribute to be retrieved through the LDAP search. This attribute configures a user account's after each successful login. This option is available only when Automatic Import of LDAP Accounts is enabled and Clients Authentication Mode is set to LDAP search. This option can be left empty. If enabled, all HTTP requests to the root of the public web server (port 80) are redirected to the external web server specified in Redirect URL. NOTE: If LifeSize ClearSea Server is behind a firewall with a NAT configuration, you must redirect HTTP requests to Redirect URL. URL of an external web server to which HTTP requests are redirected. If the authentication mode is set to LDAP bind or LDAP search, the LDAP connection is checked as soon as the settings are applied; if the LDAP connection is not functional, an alert appears. Example 1: Configuration of LDAP Authentication The following example shows authentication managed by Microsoft Active Directory, allowing all users to log in to LifeSize ClearSea with their Active Directory credentials. Clients Authentication Mode LDAP Version LDAP Host LDAP bind LDAPv2 mydomain LDAP Port 389 LDAP over SSL enabled (LDAPS) LDAP bind DN Automatic Import of LDAP Accounts LDAP Accounts Group Disabled <U>@mydomain Enabled Default

35 LifeSize ClearSea Administrator Guide 35 Example 2: Configuration of LDAP Authentication The following example shows authentication managed by Microsoft Active Directory through LDAP search. In this example, the server has SSL enabled (LDAPS) and access is granted only to members of a group named CN=ClearSea Users,CN=Users,DC=MyDomain. When a user logs in, LifeSize ClearSea binds on the LDAP server using a configured administrator s account credentials. An LDAP search request is performed, and if the search request returns at least one account, LifeSize ClearSea Server binds again using the retrieved account and the password entered by the user. The user login succeeds only if all steps are completed successfully and the final bind succeeds. Clients Authentication Mode LDAP Version LDAP search LDAPv3 LDAP Host LDAP Port 636 LDAP over SSL enabled (LDAPS) LDAP bind DN Enabled admin@mydomain LDAP bind password ****** LDAP search DN LDAP search filter LDAP search scope Automatic Import of LDAP Accounts Imported Accounts Default Group LDAP Attribute for "Group" LDAP Attribute for "Extension" LDAP Attribute for "Display Name" LDAP Attribute for " address" LDAP Attribute for "" CN=Users,DC=MyDomain (&(samaccountname=<u>)(&(objectclass=organizationalperson) (memberof= CN=ClearSea Users,CN=Users,DC=MyDomain))) Subtree Enabled Default group extension displayname mail description

36 LifeSize ClearSea Administrator Guide 36 Groups Each user account belongs to only one group. Create and manage groups and group contacts from the Control Panel in SERVICE : Groups.The following options are available: Add a group and edit group settings. Read more at Group Properties. Edit the group s contact list. Each group has its own contacts. User accounts belonging to this group inherit these contacts in their LifeSize ClearSea Client address book. Read more at Group Contact List. Delete a group (after confirmation). The Default group cannot be deleted. Group Properties Click Edit Group to customize the settings for a selected group. Depending on the licensing options, some codecs, resolutions, or settings might not be available. Edit the following fields in General: Field Name Enable Allow client to save user password locally Chat Call recording Group name used in the Control Panel. The group name does not appear to LifeSize ClearSea Client users. Enables or disables the group. NOTE: The Default group is always present and cannot be disabled. Enabled by default. Clear the checkbox to require users to enter a password each time they log in to LifeSize ClearSea Client Enables or disables chat functionality between provisioned LifeSize ClearSea Clients for this group. Enables or disables call recording (and the recorder window) for LifeSize ClearSea Clients in the group. By default, enabled. Manage the provisioned banner images in Banners for both desktops (Banner (8.x desktop client)) and mobile devices (Banner (8.x mobile client)): Field Image file Uploads the image that is displayed on the LifeSize ClearSea Client for this group. Valid formats are.gif,.jpg,.jpeg,.png,.bmp. Size constraints: maximum height 90 pixels for the desktop LifeSize ClearSea Client banner, maximum height 140 pixels for the mobile LifeSize ClearSea Client banner. Larger images are not allowed. After you upload the image, an image preview appears with Alignment, Background color and Remove banner image controls. PNG images can optionally include the alpha channel; GIF images can include optional transparency and can be animated on the desktop LifeSize ClearSea Client only. LifeSize recommends that you use PNG images, but avoid using animated GIF images. NOTE: Only JPEG files support the RGB color space. The CMYK color space is not supported.

37 LifeSize ClearSea Administrator Guide 37 Field Alignment Background color Remove banner image Aligns the banner image in the LifeSize ClearSea Client banner space. This setting is available only when a valid banner image is loaded. Sets the background color for the banner image in the LifeSize ClearSea Client banner space. Valid values are HTML color codes in hexadecimal notation. For example: #FF0000. This setting is available only when a valid banner image is loaded. This option is available only when a valid banner image is loaded. In Contacts, configure which user accounts are added to the contact list of LifeSize ClearSea Clients in this group: Field Remove ClearSea Test Call entry All accounts from server All accounts from selected groups None Allows you to provision user accounts in this group without the ClearSea Test Call Contact. By default, this option is not selected. NOTE: When registered to a LifeSize ClearSea Server, all users can dial testcall to ensure that LifeSize ClearSea Client is configured correctly. Adds all active user accounts on the server to the contact list of LifeSize ClearSea Clients in this group. NOTE: Because large contact lists increase loading times on LifeSize ClearSea Client, especially for mobile devices, use this option with caution. When selected, shows a list of all server user groups. Selecting a group adds all active user accounts in that group to the contact list of LifeSize ClearSea Clients in this group. NOTE: Because large contact lists increase loading times on LifeSize ClearSea Client, especially for mobile devices, use this option with caution. This is the default setting for newly created user groups. Adds no user accounts to the contact list of LifeSize ClearSea Clients in this group. NOTE To enhance client performance and reduce network traffic, LifeSize ClearSea Server sends no more than 1000 contacts to a LifeSize ClearSea Client at login. The number of call history entries for a LifeSize ClearSea Client is limited to 20. Both values cannot be changed. Notifications of the status of a contact s presence might be unreliable if more than 200 contacts are online at the same time for a specific group. Avoid this condition by reducing the number of total contacts configured in Contacts and leveraging the server search feature configurable in Search, enabling the user to find anyone on demand on the server or in specific groups.