Release Notes for SIP Enablement Services Release 3.1.2 Service Pack 2 Target Products: SIP Enablement Services Release 3.1.2 Release Notes Issue 1.0 August 4, 2008 What s Fixed in Service Pack 2 What s Fixed in Service Pack 1 Installation and Upgrade Notes What s Fixed in Service Pack 2 SIP Enablement Services Service Packs are cumulative. Service Pack 2 addresses following updates and improvements in addition to all of the updates and improvements contained in earlier SES 3.1.2 service packs: Software enhancements were implemented to support 160GB replacement hard disks. Improved the robustness of SipServer when improperly formatted SIP messages are received. Previously, both servers in a redundant pair must be powered on to perform a software upgrade. This has been corrected. Previously, importing a trusted certificate could fail with a Permission denied error or cause avccsppmresourceerror alarms. This has been corrected. This service pack resolves the following Avaya Security Advisories. Go to http://support.avaya.com/security for more details about the advisories. ASA-2008-151 Avaya SIP Enablement Services Release 3.1.2 was found ASA-2008-268 to contain input validation vulnerabilities. This could potentially allow for a user to execute arbitrary code. What s Fixed in Service Pack 1 The updates and improvements in Service Pack 1 address the following issues: Daylight Savings Time (DST) rules are updated for the US Energy Policy Act, including Canada, plus the rules change for Western Australia (Australia/Perth). A memory leak has been fixed that might occur when calls were directed to a disconnected telephone. An issue has been corrected in which the value of the "Replace URI" field was ignored on the "Edit Host Map Entry" administration screen. A condition has been resolved whereby the PPM server software could generate an alarm for invalid users (those without valid user IDs on the system). When connecting via PPP dialup to the services modem, a minor alarm may have been generated even though the connection was successful. This has been resolved.
The handling of some exceptions that may have caused the avccsppminiterror reported in the SES logs has been fixed. An administration issue when freeing an extension for the second time was resolved. A communication error was resolved which resulted in possible dropped inbound calls from a SIP Service Provider. Data in the SAR report which is more that 30 days old now is automatically removed. For backups, pccard_format also now supports the format of USB flash drives. Installation and Upgrade Notes Restoring R3.1 Data to SES R3.1.2 If you are upgrading from release SES R3.1, please note that this is a "full" install that requires a fresh software installation, backup, and restore. You should always use established procedures for Avaya server(s) to backup and then transfer your data for safekeeping before you start to perform any full install. (You will need to know your database password to do this.) If you need to transfer and restore existing data from a release 3.1 database to a R3.1.2 database, note that you must configure the server the same way (for example, with the same IP address) in R3.1.2 as it had been configured in 3.1. After you have fully installed and upgraded to the latest 3.1.2 server software, and then successfully created the new, empty database, you will be able to transfer and restore your existing data. SES R3.1.2 only supports the S8500A platform in a simplex configuration. Prior to installing R3.1.2 onto an existing R3.1 S8500B server, disable the SAMP boot timers as specified on page 38 of Using the Avaya Server Availability Management Processor (SAMP), document number 03-300322, which can be found at the following link: http://support.avaya.com/elmodocs2/comm_mgr/r3_1/pdfs/03_300322_3.pdf IMPORTANT: To maintain system integrity, do NOT restore "Server and System" files. NOTE: The upgrade procedure for SES R3.1.1 to SES R3.1.2 can be found in Installing and Administering SIP Enablement Services, document number 03-600768, which can be found at the following link: http://support.avaya.com/elmodocs2/sip/03_600768_2_1.pdf Known Issues and Workarounds Upgrades If a WEB timeout occurs while upgrading the SES server software, simply log in again to continue monitoring the upgrade progress. Best Practices Daylight Savings Time Changes Changes to the Daylight Savings Time rules are supported in SIP Enablement Services R3.1.1 and later releases. For more information about how to implement Daylight Savings Time on Avaya servers, see PSN1187u found at the following link: http://support.avaya.com/japple/css/japple?page=openpage&temp.template.name=dlt2007.
Installation and Administration Guide (SIP Enablement Services R3.1.2) Before beginning any installation or upgrade, always check that all your SIP Enablement Services documentation is the most current issue/date listed for Release 3.1.2 on Avaya's website at http://www.avaya.com/support. Server Availability Management Processor (SAMP) firmware and operations When installing a new S8500B or S8500C as an SES server, the SES installation software will load the proper version of the Server Availability Management Processor (SAMP) firmware. It is recommended for proper operation of an SES server that you do not upgrade the SAMP firmware by other means, even if a newer version is available. NOTE: For proper operation after a power failure, the SAMP card in the SES server should be plugged into the same power feed as the SES server itself. Communication Manager Failover Service/Avaya Enterprise Survivable Server (ESS) configurations The default network connection between servers running SES R3.1.2 and Communication Manager is SSH (secure shell protocol). Communication Manager configurations with ESS use the C-LAN s IP address to connect upon ESS failover. C-LANs support only telnet, which requires that you must make the following edit in SES. To edit the saw.ini file: 1. Login with superuser permission. 2. Enter cd /opt/mvap/web/sms. 3. Edit the file saw.ini, using any text editor. 4. Change the port number in line 11 from CMPort=5022 to CMPort=5023. 5. Change the options in line 13 from ProxyOptions=-n to ProxyOptions=-n -T 6. Save the file. For environments with ESS (CLAN connectivity with the server running Communication Manager) and Conference Server Extensions, edit the SmsClient.class.php file:: 1. Enter cd /opt/ecs/web/admin/share/libadmin/utils. 2. Edit the file SmsClient.class.php, using any text editor. 3. Change the port number in line 21 from var $smsport = '5022'; to var $smsport = '5023' 4. Save the file. Root Certificates
When importing a root certificate into SES, the filename must have the file extension.crt. If you use a different file extension (e.g.,.cer,.pem, etc.), the hash file link is not created and the certificate will not be recognized as a CA certificate. SNMP administration on duplex systems Administer SNMP destinations at both the Primary and the Backup servers of a duplex system through the Maintenance web pages. Remember to connect to the backup server using the physical IP address of the backup server. To access the Maintenance Web Pages on the backup server, enter the physical IP address of the backup server in your web browser. For example, http://999.16.99.201/admin, where 999.16.99.201 is the physical IP address of the backup server. Not performing interchanges during a host update or force all You may correctly choose to do force all in these situations: Import of a provision xml file following a migrate home/edge IP address of a server has changed, usually with Edit Host screen A database error is seen during an Update All. If an individual Force for a home fails After an upgrade, if data verity seems suspicious. If you are performing a force all for any of these reasons, your duplex configuration may undergo an interchange of service between the primary machine and the backup machine as part of the high-availability feature. If the interchange occurs during a Force All, you must repeat the Force All. NTP configuration issue When configuring NTP no file needs to be loaded. Configure by entering the IP address or DNS host name of the external NTP server and submit the change. However, the NTP config screen (SES Maint -> Configure Server -> Configure Time Server) does contain an option (at the end of the Configure Time Server Screen) to allow the user to install the keys file. This option is for Communication Manager only. It doesn t apply to SES. It should be ignored and Do not install a new keys file should be selected. Starting Event Server after restoring security files Whenever you restore security files, manually restart the Event Server. The administrator must manually start the Event Server on the Services page (SES Admin -> Services). This step is needed only on the SES server that has the security files restored, no matter if the server is an Edge, Home or Home/Edge. Security files can be restored to a Home/Edge, Edge or Home. Find this screen for starting the event server in the Admin interface with the click path SES Admin -> Services Trusted hosts The SES server authenticates incoming SIP requests for enhanced security. If the SIP request comes from a "trusted host", SES will not authenticate requests from that host. In configurations where the SES server interoperates with a third-party SIP proxy, SES should be configured to
recognize that proxy as a trusted host. Then SES will assume that the trusted third-party proxy has already authenticated SIP requests it sends to SES. NOTE: Foreign domain proxy servers are not authenticated and so should not be configured as trusted hosts. A foreign domain proxy is any proxy whose SIP domain differs from the "SIP Domain" value configured on the "Edit Systems Properties" screen of SES Master Administration. On the left frame, click Server Configuration, then System Properties. A command, trustedhost, is available to manage trusted hosts. Trusted hosts must be administered using the IP address of the trusted host and the IP address of the SES server that will "trust" that trusted host. The trustedhost command is used on the SES server running the Master Administrative interface (the edge server in a multiple-server configuration or the combined home/edge in a single-server configuration). IMPORTANT NOTE: after adding or deleting a trusted host, the administrator must use "Update" in the Master Admin web interface to propagate the change(s) to the affected home servers. Changes to trusted host administration will not be effective until the Update has been performed. trustedhost usage: trustedhost -L # list all 3rd party trusted hosts currently configured trustedhost -a trusted-host-ip-address -n trusting-ses-ip-address [ -c comment-text ] # add new trusted host trustedhost -d trusted-host-ip-address -n trusting-ses-ip-address # delete a trusted host Devices for backup/restore A server or compact flash is the recommended device for backup/restore. A USB flash drive that was used for backup/restore on SES past releases may also be used on SES R3.1.2. New USB flash drives must be formatted. This must be done from the "Format PC Card" link on the Maintenance Web Page before scheduling a backup, or by clicking the "Format CompactFlash Card" checkbox on the "Backup Now" page. A USB flash drive only has to be formatted once. Configuring and operating Communication Manager with SES To minimize synchronization issues between SES servers in a duplex configuration, the Communication Manager administrator should increase the default value for the SIP Session Refresh Interval Timer to 600 for SIP trunks. You only have to increase the value on systems running Communication Manager, versions 3.1.x and prior. To do this, start the SAT and set the value of this field on page 2 of the Trunk screen for each SIP trunk: Preferred Minimum Session Refresh Interval (sec): 600 If you have TTI or PSA turned on and you try to administer a bridged appearance on the first call appearance button of a phone, you will cause data corruption on the server running Communication Manager. For example, if you want button 1 to be a bridged appearance, you must have TTI and PSA turned *OFF* before attempting this administration. *** WARNING: Do NOT turn on PSA or TTI on any server running Communication Manager on which you want to administer anything other than "call-appr" on button 1 of a phone. *** When installing a WebLM license using Internet Explorer on a PC with a non-u.s. version of Microsoft Windows (for example, Japanese Windows), be sure that the full path name to the license file contains ASCII characters only and no international characters. New login required in Communication Manager 4.0 configuration Changes in the administrative login procedures for Communication Manager require that the standard logins (craft, init) cannot be used for the Communication Manager Admin login on server(s) connecting to SES. Customers must create customer logins via SAT or now from the
Communication Manager Maintenance pages. NOTE: These steps must be performed during the installation or upgrade of Communication Manager 4.0. The login type must be a member of the susers group and a member of a profile group with sufficient permission, such as prof18 or prof19, which are the default options. The procedure to create these logins is described below. 1. Connect to the Communication Manager web page. 2. Click "Launch Maintenance Web Interface". 3. On left frame, under Security, click "Administrator Accounts". 4. Enter the new administrator user name, eg. "sesuser". Click "Add login", and "Submit". 5. Enter the following information on the "Administrator Logins Add Login" form. login group: susers additional groups: prof18 6. Click the password radio button, and enter the password for this account. 7. In the shell access section, click the no shell access radio button. 8. Accept the remaining defaults. 9. Click "Add". Presence is case sensitive Presence will not be reported properly if the case of a handle in the SIP SoftPhone buddy list does not exactly match the case of the administered user handle. Ensure that user handles administered on the Admin web pages and the SIP SoftPhone contact information are using the same case characters. Configuration considerations for SIP phones The "Bridged Calls" field on page 2 of the "off-pbx-telephone station-mapping" screen in Communication Manager should be set to the "None" value unless the SIP station supports the Avaya extensions for bridged appearances.. If this field has a value other than None, then a call to your SIP phone goes immediately to coverage without ringing if another SIP phone that is not registered has a bridged appearance on your phone. Avaya 4600-series SIP Telephones will not be able to register in an SES system unless they can obtain the correct SIPDOMAIN setting from the 46XXsettings.txt file. Always configure the SIPDOMAIN setting for the phones in the file named "46XXsettings.txt" and then ensure that the phones transfer settings from the file (via tftp or http) during bootup. The line in the file for this setting is: SET SIPDOMAIN = "yoursipdomainname.com" When you make a call from a Cisco 7940/7960 phone with the local Caller ID Block feature enabled, the called endpoint still displays your number. To work around this issue, use the Calling Number Block FNE in Avaya Communication Manager instead of the local feature in the phone. Check compatibility Make sure all your components are upgraded to the latest available. For maximum compatibility and interoperability between VoIP resources, such as the TN2602AP IP Media Resource 320 and Avaya SIP Enablement Services, you must ensure that the TN circuit pack firmware has been upgraded to the latest vintage available for your release of Communication Manager. Visit the Downloads section of the Avaya Support website.
Trace Logger Trace Logger is off by default. If Trace Logger is enabled for debugging purposes, the SES server may experience a process reset, which automatically recovers. During the recovery time, some degradation in server performance may be noticed. The character "*" can now be used as a valid expression to match "anything" for TraceLogger. Trace Logger message display When Trace Logger logs messages for SIP client transactions, the logged IP address is displayed as Unavailable. These are the messages marked as "Send Request" and "Recv Response". The IP data for server transactions ("Recv Request", "Send Response") are correct and reliable. This does not affect the SIP message being logged, just the associated network connection information.