OCS 2007 DNS Splitting for unique domain for Internal and External login

Here you are the Scenario that I see in all my implementation:

 

• you have organization that its internal domain name is Contoso.local
• then you install an Exchange Server whether 2003 or 2007  and you create  E-mail Policy for your public external domain which is for example @contoso.com,
• you want to implement OCS where users will log in to communicator client with a unique login address whether from internally or externally  using username@contoso.com 

OK …to accomplish this there are some tricky actions you need to do but let us first understand how things usually work so that we would better understand what exactly we need to change.

 

Certificates

·         OCS 2007 generally depends on Certificates like the air to us, so rule number one always check the certificate. Certificates are what the OCS uses to assure a secure communication between different OCS servers and also with the clients.

·         The Idea behind a certificate is simply that you create a certificate for a computer with an identity of the FQDN of the server  which is in our case here is ocsserver.contoso.local

·         Upon communication between 2 OCS Servers or between OCS servers and client , the first thing that happens is that they both exchange certificates together , the certificate assures the name of the server and must be issued from a trusted CA issuer .

DNS

·         OCS 2007 also uses the DNS SRV records whether  internally or externally to identify the OCS Server name , this is only required for the Automatic login for the OCS users , if you want to bypass this then you will manually define the OCS Server pool internally and externally for all clients using Group policy and you will just need the A records for the server name .

 

Ok now we understood the basics for the OCS, let us see what happens normally internally when communicator client trying to login, if you understood this part then you will be able to identify alone how to reconfigure this for another domain.

1.       Communicator client opens and you write an email for the login which is username@contoso.local

2.       Communicator goes to DNS to ask for the domain contoso.local and request from the DNS if there are any SRV records for this domain.

3.       If yes then the communicator retrieve the OCS server name which is serving this domain

4.       It lookup with the DNS for an A record for that OCS FQDN server

5.       When it finds it , the communicator tries to communicate with the server MTLS secure communication over 5061 port, this is secure channel where the server has to present a certificate to the client matching the FQDN which was presented by the DNS

6.       When this is confirmed then authentication completes and communicator logs in.

This way is the same whether you want to login from inside or from outside your network through edge.

Now finally let us see what we need to change here in order to make the users able to login with username@contoso.com  internally and externally

·         From the Active directory domains and trusts let us first create a new domain name prefix called contoso.com  , this will provide us with the ability to change the active directory login name from user@contoso.local to user@contoso.com   . don’t worry this will not affect the user by anyway .

·         Secondly we need to create identification for this new domain contoso.com inside our DNS servers internally and externally. So we create a new Zone inside the DNS servers with Contoso.com and make an A record for the OCS FQDN server in it OCSServer.contoso.local  and you might also need to create A record for the OCS FQDN server with the format of OCSserver.comtoso.com  . both A records will point to the same IP

·         Then the SRV record inside this zone and pointing to the OCS server

·         From the OCS Server, on the Global configuration you have to add contoso.com to the SIP domains served by the OCS.

·         Last thing now to do to make this work would be the certificate , because we need the certificates to be presented with the domain ID of contoso.com not contoso.local

 The certificate must match the FQDN returned by any DNS SRV query. Therefore, the certificate must contain multiple entries. We call these SANs (Subject Alternate Name) and the certificate must include the FQDN of the pool and one entry for each supported SIP domain.

Subject Name:  OCSSRV.contoso.local

 Subject Alternate Name:   Sip.contoso.local,sip.contoso.com,ocsserver.contoso.local,ocsserver.contoso.com

·         Now return to OCS deployment and choose configure certificate wizard,Choose to assign existing certificate and choose the new certificate you created

·         Assign the certificate in the IIS and restart IIS and OCS Front end service

·         For the external access, do the DNS part and the Certificate part again but pointing to the access edge server.

 

Now you can sign In with user@contoso.com  J  from anywhere

Appendix: How to configure a CA to accept a SAN attribute from a certificate request

By default, a CA that is configured on a Windows Server 2003-based computer does not issue certificates that contain the SAN extension. If SAN entries are included in the certificate request, these entries are omitted from the issued certificate. To change this behavior, run the following commands at a command prompt on the server that runs the Certification Authority service.

Certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

Tanjay (LG-Nortel) “Cannot download certificate because domain is not accessible. If the problem persists, contact your system administrator”

I had this problem with the Tanjay new phone when I plugged it to my DHCP network and i was not able to find the problem .

However after little trials i found the below solution.

 Normally there is two ways to logon to Active Directory:

1.       Domain\username

2.        username@domain.local

 

I was getting this certificate error because I was trying username@domain.local  however I have found that if you log into the phone using domain.local\username

 

The phone is able to find the domain and download the certificate.

 

I found this out while doing a packet trace on the phone one day and found this search behavior

 

Netbios AD name: test

UPN Suffix: test.local

DNS Suffix: abc.com – this is given to the phone via DHCP

 So the DNS queries from the phone was this

 

Away from all these complicated trace like stuff, if you want to solve this problem just login with domain.local\username   and it will work fine  J

Microsoft UC Virtual Technology Solutions Professional ( TSP )

CONGRATULATIONS

Today We have Passed Microsoft assessment and Became officially UC Voice Partner  to be listed on Microsoft website http://www.microsoft.com/uc/partners/voice.mspx

Yes Officially on Microsoft UC Page along with Nortel , Siemens ,Gold System and other Big Boys

We are also officially now part of highest UC technical program, Microsoft Technical Adoption Program (TAP).

More Info here: http://msdn.microsoft.com/en-us/isv/bb190413.aspx

Also our team has been selected by name from Microsoft MEA to become some of few virtual resources within the Microsoft Virtual Technology Solutions Professional (TSP), to deliver on the same level of quality on critical workloads within the MEA region.

Special thanks for Katherine Green and Keith Hanna from Microsoft for their time and support

Let Everyone Know …They are playing with the Big Boys now

OCS 2007 R2 Response Group Service

Below are some snapshots from our LAB to represent how the response group service will look like from the agent side.

I have configured a group with memebers , also i have configured a call workflow to ask whether for English language or arabic language .

In the below snapshot , both fady and Rami are two help desk agents who are logged in . when the call comes both parties recieve the call.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

when Rami answers the call , it gives him information about the call flow that the client used in order to get connected to him . on the other hand Fady recieves a confirmation that Rami has answered the call .

New services in front end server of OCS 2007 R2

I will be posting in details about those features which we have tested in the LAB here, including details about the CRM integration. The below are just a summary for the new stuff.

Office Communications Server 2007 R2 front end server also includes the Application server.

The OCS 2007 R2 Application Server has following services:

·         Conferencing Attendant

·         Conferencing Announcement Service

·         Outside Voice Control

·         Response Group Service

Following services are still installed on the R2 version of OCS 2007.

·         Front End Service

·         IM Conferencing Service

·         Telephony Conferencing Service

Additionally OCS 2007 R2 Front End server installs the following service.

·         QoE agent service

 

Note: OCS 2007 R2 is now available in 64 bits. It’s not available in 32 bits. With OCS 2007 R2, we can install Communicator Web Access 2007 R2 can be installed on the OCS 2007 R2 Front End Server.

OCS 2007 Audio/Video bandwidth calculation

Medium	Min	High Quality
Data	56kbps	56kbps
Voice	50kbps	80kbps
Video	50kbps	350kbps
RoundTable (Conference video phone)	50kbps	350kbps

Note that the requirements are cumulative –

Data + Voice + Video =

56 + 50 + 50 = 156kbps (Minimum Quality)

or

56 + 80 + 250 = 386kbps (High Quality)”

Here are some calculations I have used. however the 300KBps is only video stream single direction.  Bidirectional video consists of two streams..

The following formula can provide rough bandwidth consumption estimates for conferencing with Audio / Video.

Note:  Calculation results will be displayed in Mbps

CC = Concurrent Conferences

PPC = Participants Per Conference

 

Conference Type	Bandwidth Consumption Mbps
Audio with Application Sharing	(((CC * PPC)*14KBps)+((CC *PPC)*90KBps))*10^-3
Audio and Video	(((CC * PPC)*14KBps)+((CC *PPC)*600KBps))*10^-3

Another OCS 2007 Audio Bandwidth Calculation

Audio Codec	Frame Size [ms]	Codec payload bit rate [bits / sec]	Total payload bit rate [bits / sec]	Actual bit rate [bits / sec]
				Without redundancy	With redundancy
RTAudio@16KHz	20	24000	29000	45000	74000
RTAudio@16KHz	40	24000	26500	34500	61000
RTAudio@16KHz	60	24000	25666	31000	56667
RTAudio@16KHz	20	18000	21000	37000	58000
RTAudio@16KHz	40	18000	19500	27500	47000
RTAudio@16KHz	60	18000	19000	24333	43333
RTAudio@8KHz	20	8800	11800	27800	39600
RTAudio@8KHz	40	8800	10300	18300	28600
RTAudio@8KHz	60	8800	9800	15133	24933

Microsoft OCS 2007 R2-New Version ( Updated )

There will be a new version announced in November 2008 and released in January 2009, this will be Office Communications Server 2007 R2and one major difference will be it’s transition to a 64bit ONLY platform a la Exchange 2007. This version will transpose your voicemails to text so you can still access them even if in a meeting (or the quiet car of a train..) among other new features.

OCS 2007 R2 will also have more Telephony style features including the ability to hunt groups…

There will then be a completely new version-OCS 2009/2010 (probably 2010)-released to coincide with the availability of Office 14. This along with the expected release of Sharepoint 2010, will help bring a more unified feel to the Office family. It is also expected that this new version will contain inbuilt translation services so if you receive an email in say Spanish, Exchange can read it back to you in English

 

Updated :

Office Communications Server 2007 R2 Features:

The most exiting feature, is the “one number calling” concept. It has been introduced in the original Unified Communications wave in the fall of 2007, but in the R2 build, it should be here. What to expect is not to say, but as I understand it will be a more simplified process of calling UC enabled users. I expect there to be more logic in OCS to how one person can be contacted.

LiveMeetin dial-in is another requested feature, which should allow users to have a choice of using the LiveMeeting client audio or dialing direct to the meeting to get Audio access.
We will see more presence information in more applications

The Communicator Web Access will be upgraded to allow application sharing the within the web application (however this is done…..)

We are also looking at an “attendant console” which will be some kind of switchboard for forwarding calls and so on. This is a feature often used by a front desk or service desk, and will give them the joy of presence information and VoIP.

Also a telephony queue system should be included, and will give people dialing in to the system, access to a touchtone menu to have their calls forwarded to the right department/person and so on.

The TAP program has started June 2008, and the new R2 version will be released to companies in the program.

The OCS 2007 R2 product should be released December 2008 or January 2009

Wave 13
This is the internal name for Office Communications Server 2007 R2 at Microsoft. The “wave” indicates that we can expect more than just e few additional features in this release, and from what i have seen and heard so far, this will be true. Wave 14??? Yes there is also a Wave 14, most likely to be OCS 2009.

64-bit
Its official now. The OCS team is now openly discussing the next release on their blog, and its confirmed that OCS 2007 R2 will be 64 bit only. Rumor has it that some components might still need to be 32 bit, like the Communicator Web Access.

BETA
There has been rumors of an public beta of Office Communications Server 2007 r2, but there is none out there yet. I am not sure we will see a public beta of OCS 2007 R2, because of the limited time until its release. The current beta program is running as an TAP program (Technology Adoption) and is out there for selected customers mostly in the US. There have been inside rumors of a second program, but I’m not sure this will be public.

Source: Richard Gibbons  on http://richfrombechtle.wordpress.com/2008/10/06/microsoft-ocs-2007-r2-new-version

What is UC ?

 

The computer starts to work like a phone

To call someone, you just click on his or her name. The computer places the call. It doesn’t matter whether you see their name in e-mail, inside Microsoft Office Word, or on a Microsoft Windows SharePoint Services site: their contact information and the ability to reach them is always present.

Presence is one of the key benefits of unified communications because it unites all the contact information stored in Active Directory with all the ways people communicate: phone, conferencing, instant messaging, e-mail, calendaring. People’s availability, their contact information, and the ability to communicate with them are integrated and always just a click away.

 

The phone starts to work like a computer

Try this with a standard office phone: call someone, then add someone else to the call. Okay, now add ten people. Now, turn it into a live video call. Could you do it? Is it even possible?

With Microsoft unified communications technologies, you click to call. Click again and you can launch a conference call. Need video? It’s a click away. It’s that easy.

 

Voice mail becomes e-mail

Voice mail arrives in your Microsoft Office Outlook inbox, right beside your e-mail. That might not sound impressive, but have you ever tried to forward voice mail using the touchtone keypad on a telephone? When voice mail becomes e-mail, you can forward it just like any e-mail: to one person, a work team, or an entire department.

 

On the back end, things are even better

Change like this usually means a lot of new hardware, extra work for IT, and a vastly more complex infrastructure. But not with Microsoft unified communications technologies.

 

VoIP as you are

You don’t need a forklift to install Microsoft unified communications technologies because Microsoft uses software instead of hardware. Microsoft Office Communications Server 2007—the server that delivers presence, instant messaging, and audio- and videoconferencing—integrates smoothly with your existing telecommunications infrastructure, including your current PBX.

 

Unified communications streamline infrastructure

Microsoft unified communications technologies use Active Directory to unify the entire corporate directory—names, PBX extensions, e-mail addresses, and logons. This simplifies IT administration.

 

Use speech technology for self-service via the telephone

Voice portals offer callers an easy way to get to information they need using naturally spoken language from any phone, 24 hours a day, 7 days a week.

The powerful speech-enabled Interactive Voice Response (IVR), Speech Server, which is a part of Microsoft Office Communications Server 2007, can help businesses deliver significant value through speech-enabled self-service applications via the telephone at a very attractive price.

Such applications can be both inbound, like the above mentioned voice portals, as well as outbound applications, like quality surveys or notifications via the telephone.

 

Phone calls become digital assets

Just like e-mail. Which means they can be logged, reviewed, published, and archived. Having a complete record and recording of every phone call is increasingly critical as businesses struggle to comply with stricter federal and international regulations.

 

Flexible and future-ready

By using a software solution to deliver unified communications, your business can stay flexible and embrace innovations as they come. The Microsoft unified communications platform of powerful APIs enables developers to extend that software solution with security-enhanced and productivity-enhancing applications that span all modes of communications. When emerging technologies and changing business needs require your communications infrastructure to adapt, all you have to do is extend or upgrade your software, not your hardware