Not supported by SBC SWe Lite in this release.

READ BEFORE BEGINNING

You must follow these steps completely and in the order shown. Failure to do so increases the risk of node failure.

In this section...

For details on troubleshooting, see Troubleshooting Cloud Connector.

Before You Start

CCE Deployment Scenarios

The following diagram shows typical CCE deployment scenarios on a PSTN site. The PSTN site is a combination of Cloud Connector instances, deployed at the same location, and with common PSTN gateways pool connected to them. PSTN sites allow you to:

  • Provide connectivity to gateways that are closest to your users.

  • Allow for scalability by deploying multiple Cloud Connector instances within one or more PSTN sites.

  • Allow for high availability by deploying multiple instances of Cloud Connector within a single PSTN site.

 

CCE Deployment Scenarios



Scenario 1 and Scenario 2 are covered in Configuring the SBC Edge for a Single CCE. This document contains steps for Scenario 3 and Scenario 4.

Prerequisites

A public domain name prepared and mapped with your Office 365 tenant (for example, "mydomain.com"). See Create an Office 365 Tenant.
An entry on your public domain name that points to the fixed IP address of your SBC Edge (for example, myccesite1.mydomain.com" with an IP address of "nn.nn.mm.nn").

An Office 365 tenant with an E5 license or E3 + Cloud PBX.

You must have the Global Administrator role for your O365 tenant account.

A public certificate authority ready to sign a certificate for the SBC Edge.

Important!  Read the steps outlined in Certificate Requirements at Microsoft Technet.

A properly configured firewall. See Ports and Protocols at Microsoft Technet.

MANDATORY!

Latest System Release SBC Firmware and SbcComms Firmware

Important!

  • Refer to the SBC Edge Release Information page for instructions on obtaining the latest firmware.
  • Failure to update to the latest firmware could lead to deployment failure.
  • Make sure to use the latest sustaining release.
Microsoft Cloud Connector Edition image on ASM recovery partition.

Network Settings

We recommend deploying both Appliances on the same subnet with a resilient connection.

For the purposes of this document, the CCE is deployed in the following network:

Typical Deploments

 

 

 

Firewall Settings

In this best practice the router/firewall is configured with the following rules:

Internal Firewall Rules for CCE

Source IP

Destination IP

Source Port

Destination Port

Cloud Connector Mediation component – 192.168.210.123 & 192.168.210.117

Internal clients

TCP 49 152 – 57 500*

TCP 50,000-50,019 (Optional)

Cloud Connector Mediation component – 192.168.210.123 & 192.168.210.117

Internal clients

UDP 49 152 – 57 500*

UDP 50,000-50,019

Internal clients

Cloud Connector Mediation component – 192.168.210.123 & 192.168.210.117

TCP 50,000-50,019

TCP 49 152 – 57 500*

Internal clients

Cloud Connector Mediation component – 192.168.210.123 & 192.168.210.117

UDP 50,000-50,019

UDP 49 152 -57 500*

External Firewall Rules for CCE

Source IP

Destination IP

Source Port

Destination Port

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

Any

TCP 5061

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

Any

TCP 80

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

Any

UDP 53

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

Any

TCP 53

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

TCP 50,000-59,999

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

UDP 3478

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

UDP 50,000-59,999

Any

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

TCP 5061

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

TCP 443

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

TCP 50,000-59,999

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

UDP 3478

Any

Cloud Connector Edge External Interface – 192.168.211.81 & 192.168.211.86

Any

UDP 50,000 - 59,999

 

 

Host Firewall Rules - Internal or External Access

Source IP Destination IPSource PortDestination Port
ASMAnyAnyTCP 53
ASMAnyAnyTCP 80
ASMAnyAnyTCP 443

DNS Settings

Make sure that CCE FQDN is resolving to the SBC Edge Public IP address. To do so, login to your DNS server and create the relevant entries.

Preparing Your Node

Preparing the SBC Edge for Initial Setup

Update the SBC Edge firmware to the latest release version.

  • Ensure the Node FQDN is definitive. Changing this information requires the CCE to be redeployed.
  • Ensure that an NTP server is configured.

Ribbon recommends starting with a clean and empty configuration.

 

Ensure That the Node's FQDN is Correct


 

Optional

When configuring a secondary SBC Edge in your environment, make sure to have the secondarySBC Edge network interface is configured accordingly to be able to reach out to CCE's internal/corporate network.

Preparing the ASM

If your ASM has been used previously, reinitialize it following the steps  in Re-Initializing the ASM.

Confirm that the ASM is ready to deploy the CCE by following these steps.

Perform these steps on both SBC Edge systems.

StepAction
1Login to the WebUI of the SBC Edge.
2Click the Task tab, and then click Operational Status.
3

Verify that:

  • The ASM Board Status is Up
  • The appropriate Service Status is Running
  • The Service is the latest version. If the service version (SBC Communications Service) is not the latest, update it by following the steps in Installing an ASM Package.

 

4

Change the ASM Admin password:

    1. Login to WebUI of both SBC Edge systems
    2. Click the Task tab and then click Change Admin Password.
    3. Enter the desired password twice and then click OK.

 

 

Deploying the CCE

Deploying the CCE on the SBC Edge consists of two steps:

  1. Prepare the CCE deployment on the SBC Edge using the section below.
  2. Using Ribbon Cloud Link Deployer via Remote Desktop on the ASM Module:
    1. Register all the CCE appliances.
    2. Install and publish the CCE Appliance Master.
    3. Install the CCE Appliance Slave.
  • If this is a re-deployment of a CCE deployment, complete the steps in Redeploying the CCE to clean up previously entered data in O365 before proceeding with the following section.

Configuring the CCE Through the WebUI

Configuring the ASM

Perform these steps on both SBC Edge systems.

StepAction
1

Login to the WebUI of each SBC Edge.

2

Navigate to Tasks  > Office 365 Cloud Connector Edition> Setup.

3

Click the ASM Config tab and configure/verify the Network and IP settings of your ASM as shown below.

4From the Remote Desktop Enabled drop down list, select Yes (to enable Remote Desktop) or No (to disable Remote Desktop).
5From the Windows Firewall Enabled drop down list, select Yes (to enable Windows Firewall) or No (to disable Windows Firewall).
6From the Proxy Enabled drop down list, Enables use of the Proxy Server on the ASM. Select from the drop down list: Yes (enables Proxy Server on the ASM) or No (disables Proxy Server).
7From the Proxy Address drop down list, select Yes (to enable the IP address for the Proxy Server in IPv4 format). This field is available only when Proxy Enabled is set to Yes.
8From the Proxy Port drop down list, select Yes (to enable the port in which the Proxy Server connects). Valid entry: Valid entry: 1 - 65000. This field is available only when Proxy Enabled is set to Yes.
9Configure/verify the Network and IP settings of your ASM.
10

Click Apply. After receiving the activity status as successfully completed, click the Generate CSR tab.


 

Configuring the ASM – CCE-1

Configuring the ASM – CCE-2

Generating the CSR

This process is required only if you don't have a public certificate for your deployment. If you already have a certificate, proceed to Import Certificate.

Perform these steps on only one of theSBC Edge systems.

Step Action
1Login to the WebUI of one of the SBC Edge.
2

Navigate to Tasks  > Office 365 Cloud Connector Edition> Setup.

3Click the Generate CSR tab.
4

Generate the CSR as shown below with following information.

Note: This example uses aepsite1.sonusms01.com and sip.sonusms01.com as common name and SAN.

To ensure creating a valid CSR for Cloud Connector Edition usage, please see the section "Certificate requirements" on https://technet.microsoft.com/en-us/library/mt605227.aspx.

Generate CSR

Set CCE Public Certificate

Perform these steps on both SBC Edge systems.

StepAction
1Login to the WebUI of the SBC Edge.
2

Navigate to Tasks > Office 365 Cloud Connector Edition and click the CCE Public Certificate tab.

3

On SBC-1, click the Action drop-down list and select the appropriate option:

  • Import X.509 Signed Certificate. This option is used if you generated a Certificate Request (CSR) and this is the initial deployment. Paste the certificate in the window and click OK.
  • Import PKCS12 Certificate and Key. Imports a certificate you created. Enter the password, select the file (certificate) to import, and click OK.
  • Export PKCS12 Certificate and Key. Export the CCE certificate for backup purposes. Enter password and click OK.
  • Transfer Public Certificate to Edge. Transfers the public certificate to the CCE (after deployment).
  • Display Certificate. Displays the current SBC Edge certificate.
4

On SBC-2, click the Action drop-down list and select the appropriate option:

  • Import X.509 Signed Certificate. This option is used if you generated a Certificate Request (CSR) and this is the initial deployment. Paste the certificate in the window and click OK.
  • Import PKCS12 Certificate and Key. Imports a certificate you created. Enter the password, select the file (certificate) to import, and click OK.
  • Export PKCS12 Certificate and Key. Export the CCE certificate for backup purposes. Enter password and click OK.
  • Transfer Public Certificate to Edge. Transfers the public certificate to the CCE (after deployment).
  • Display Certificate. Displays the current SBC Edge certificate.
5

After receiving the activity status as successfully completed, click on Configure CCE tab.

SBC 1 - CCE Public Certificate


 

SBC 2 - CCE Public Certificate

 

Configuring the CCE

Perform these steps on both SBC Edge systems.

If you configure TLS and downgrade the system to a release prior to Release 7.0, the Exchange CA Certificate for TLS will be unavailable; you must re-deploy or upgrade to Release 7.0. Along with TLS configuration on the CCE, the TLS capability requires a loaded Root CA certificate and a signed certificate on the SBC.

Any changes to the Configure CCE tab requires the CCE to be redeployed.

StepAction
1Login to the WebUI of the SBC Edge.
2Navigate to Tasks  > Office 365 Cloud Connector Edition> Setup.
3Click the Configure CCE tab.
4

Configure all necessary information and then click OK.

TLS 1.2 is supported; the following fields are required to configure TLS:

  • Primary SBC Transport Protocol. Options: TCP or TLS (supports TLS 1.2).
  • Secondary SBC Transport Protocol (optional). Options: TCP or TLS (supports TLS 1.2).

If TLS is configured as the Primary SBC Transport Protocol, you must run the Synchronize CCE/SBC CA Certificate task to allow a successful TLS handshake between CCE and SBC Edge. However, if TCP is configured as the Primary SBC Transport Protocol the Synchronize CCE/SBC CA Certificate task is not mandatory. See Managing Cloud Connector Edition Private Certificates.

Configuring the ASM – CCE-1

Configuring the ASM – CCE-2

 

Note: Enter the ASM's IP address in the HA Master IP Address field. The Slave uses the same root certification as the Master, and this location contains the shared folder that contains the Root CA of the Master.

5

To increase Fast Failover (which shortens the time where certain ported numbers have a long delay from ITSP PSTN provider) configure Trunk Information:

Refer Support. Indicates whether Gateways support Refer for a Call Transfer scenario. Valid entries: Enable (the Gateway(s) supports Refer which can handle call transfer) or Disable (the Gateway does not support Refer and the Mediation Server handles call transfer).

Fast Failover Timer. Determines whether outbound calls that are not answered by the gateway within ten seconds will be routed to the next available trunk; if there are no additional trunks, the call will automatically be dropped. Valid entries: Enable or Disable.

Forward Call History. Indicates whether call history information is forwarded through the trunk. Valid entries: Enable or Disable.

Forward PAI. Indicates whether the P-Asserted-Identity (PAI) header will be forwarded along with the call. Valid entries: Enable or Disable.

6After receiving the activity status as successfully completed, click the Prepare CCE tab to continue.

 If the deployment environment consists of multiple-site with a single certificate, or a wild card certificate, ensure the CCE Site Name and the Edge Server Public Hostname are correct before proceeding.

Verifying and Updating the CCE Configuration INI File 

You must verify (and possibly correct) the CCE Configuration INI File after configuring the CCE.

When deploying a High Availability (HA) systems, it is important to have Management IP Prefix unique on each HA system. For instance, if your HA Master CCE system has 192.168.213.x as the Management IP Prefix, you need to be sure to configure this attribute differently on HA Slave system. While doing this, also make sure that subnet that you are defining in this field does not conflict in your IP infrastructure.

Perform these steps on both SBC Edge systems.


Follow these steps to verify and correct values in the  CCE Configuration INI File.

StepAction
1Login to the WebUI of the SBC Edge.
2Click the Configure CCE tab and then click Click to re-configure CCE application.
3Click OK on the popup dialog box.
4

Click the Raw (INI) Config drop-down list, and select an option:

  • Edit. Configurable fields are displayed for editing. Modifications to the CCE configuration requires redeployment of the CCE VM, and this action takes approximately two hours.
  • Export. Exports the .ini file.
  • Import. Imports the .ini file.
5

Verify/correct the values in the CCE Configuration INI File and then click OK.


Preparing the CCE 

Perform these steps on both SBC Edge systems.

StepAction
1Login to the WebUI of both SBC Edge systems.
2Navigate to Tasks  > Office 365 Cloud Connector Edition> Setup.
3Click the Prepare CCE tab.
4

Click the Prepare CCE button. Enter the requested password. A confirmation will request you to enter the password again. The same password should be used on all Appliances in the site. Click OK as shown below.

5

To complete the deployment, continue with  Activating the CCE.

Customizing the CCE VM

This step stores the two Microsoft product keys, and customizes the CCE VM (which is not yet activated).

Perform these steps on both SBC Edge systems.

Each CCE requires four VMs; each Microsoft Product Key activates two VMs.

StepAction
1Login to the WebUI of each SBC Edge.
2Navigate to Tasks  > Office 365 Cloud Connector Edition> Setup.
3Click the Cutomize CCE VMs tab.
4

In Domain Controller and Central Management Store VM > Windows Product Key 1, enter the first Microsoft Product Key. To identify the Product Key, see Identify Microsoft Product Key.

5In Under Mediation Server and Edge Server VM >  Windows Product Key 2, enter the second Microsoft Product Key.To identify the Product Key, see Identify Microsoft Product Key.
6From the Proxy Usage drop down list, select Enabled (enables the Proxy Server on the DMZ facing the internal network) If you select Disable, the Proxy Server is disabled.
7In the Proxy Server IP Address field, enter the server IP address for the Proxy Server in IPv4 format. This field is available only when Proxy Usage is set to Enabled.
8In the Proxy Server Port field, enter the port number for the Proxy Server. Valid entry: 1 - 65535. This field is available only when Proxy Usage is set to Enabled.
9Click Apply.
10Access Tasks> Operational Status to verify Windows Activation.
11

To complete the deployment, continue with Installing the CCE Appliance using Ribbon Cloud Link Deployer.

 

 

Activate the CCE

 

Identify Microsoft Product Key

To identify the Microsoft Product Key:

  1. Access the bottom of the SBC unit and locate the two Microsoft Certificate of Authenticity stickers.
  2. Locate the Microsoft Product Key for each.

    Sample Microsoft Certificate of Authenticity Sticker
Activation - Troubleshooting Tips

If activation fails, check the following:

  • If access to the Microsoft Server fails, verify IP and Firewall configuration. 
  • Verify each Product Key has not reached the allowed limit of 15 activations.
  • Verify correct entry of the Product Key.

See Managing Cloud Connector Edition Private Certificates for the following setup options:

  • Synchronize the CCE and SBC CA Certificate
  • Renew the CCE CA or CCE Certificate

 

Installing the CCE Appliance using Ribbon Cloud Link Deployer

 

CCE Deployment - What to Expect
  • The CCE deployment may exceed two hours.
  • The CCE deployment status is visible only on the Remote Desktop to the ASM. The WebUI indicates that the CCE is running while the deployment process is in progress.
  • While the CCE deployment is running, you should not perform any actions on the ASM via the WebUI (i.e., Shut Down/Reset/Reboot/Reinitialize/Install etc.).
  • If the Office 365 PSTN Site already exists in your tenant, ensure the other Appliance is removed, and the CCE Auto-Update time window is properly configured. If you are in a time window dedicated to the Auto-Update, see Managing Update Schedule and Creating and Modifying PSTN Hybrid Site to configure the PSTN Hybrid Site and configure Auto-Update to false. Replication of the information may take up to 30 minutes.

Using Ribbon Cloud Link Deployer via Remote Desktop on the ASM Module:

  1. Register all the CCE Appliance.
  2. Install and publish the CCE Appliance Master.
  3. Install the CCE Appliance Slave.

Registering the CCE Appliance

Perform these steps on only one of theSBC Edge systems.

Step

Action

1

Remote desktop to the ASM of the SBC Edge System 1.

2

Launch the Ribbon Cloud Link Deployer from icon on the desktop.

3

Check the first two actions:

  • Transfer Password from SBC: This step imports the password that has been set during the Preparing the CCE.
  • Register Appliance: This step registers this new appliance on your Ofiice365 tenant.
4Click Apply.
5

After successful execution, remote desktop to the ASM of the SBC Edge System 2.

6

Launch the Ribbon Cloud Link Deployer from icon on the desktop.

7

Check the first two action.

  • Transfer Password from SBC: This step imports the password that has been set during the Preparing the CCE.
  • Register Appliance: This step registers this new appliance on your Ofiice365 tenant.
8Click Apply.

 

Install-CcAppliance on the HA Master Node

Step

Action

1

Remote desktop to the ASM of the SBC Edge System 1.

2Launch the Ribbon Cloud Link Deployer from icon on the desktop.
3

Check the last two actions:

  • Install Appliance: This step deploys the CCE.
  • Publish Appliance (HA Only): This will extract the required information from the HA Master.
4Click Apply.

 

Install-CcAppliance on the HA Slave Node

StepAction
1

Remote desktop to the ASM of the SBC Edge System 2.

2Launch the Ribbon Cloud Link Deployer from icon on the desktop.
3

Check the third action:

  • Install Appliance: This step deploys the CCE.
4Click Apply. The Installation time depends on the bandwidth between the Master and the Slave.
5After configuring the SBC Edge for CCE, refer to Managing Your Office 365 Tenant to configure CCE update time and user.

 

Integrating SBC Edge With CCE

After the CCE is deployed, integrate the SBC Edge and allow calls from/to O365 clients. In this example, the following steps will set up the SBC Edge for:

 

SIP Provider (193.168.210.103) – SBC Edge (193.168.210.125)  – CCE (mediation Server: 193.168.210.123) – O365 Cloud

Building Your SBC Edge-1 Configuration

StepAction
1Login to the WebUI of SBC Edge-1.
2Navigate to Tasks > SBC Easy Setup and then click the Easy Configuration Wizard.
3

Follow steps 1, 2, and 3 and then click Finish.

The wizard configures the necessary settings for SBC Edge-1 and CCE integration, after which you can see all relevant configuration items in Settings tab.

 

Building Your SBC Edge-2 Configuration

StepAction
1Login to the WebUI of SBC Edge-2.
2Navigate to Tasks > SBC Easy Setup and then click the Easy Configuration Wizard.
3

Follow steps 1, 2, and 3 and then click Finish.

The wizard configures the necessary settings for SBC Edge-2 and CCE integration, after which you can see all relevant configuration items in Settings tab.

 

Basic Call Verification after CCE Deployment and SBC Edge Integration

With the preceding settings, an endpoint from the SIP provider side can dial the number of a Skype For Business (O365) client and reach out to it over SBC Edge. The call flow for this call is shown below:

 

Call Flow
Similarly, a Skype For Business (O365) client can dial the number of an endpoint off of ITSP and reach out to it over SBC Edge. The call flow for this call is shown below:

 

Call Flow

O365 Known Issue and Workarounds for CCE

Redeploying the CCE

Configuration changes to the CCE in the WebUI per Tasks > Setup Cloud Connector Edition> Configure CCE requires the CCE to be re-deployed.

Backup the Public Certificate per Tasks > Setup Cloud Connector Edition> Import Certificate.

 

Clean Office 365 tenant

If the CCE was previously deployed, previously installed information must be cleared in O365. To do so, follow the steps below:

StepAction
1Remote Desktop to the ASM system
2

Connect the Office365 Tenant through a series of commands as follows:

a. Execute the following command:

Import-Module skypeonlineconnector
$cred = Get-Credential
b. When prompted, execute the credentials for O365 Admin Tenant.
c. Execute the following command:
$Session = New-CsOnlineSession -Credential $cred -Verbose
Import-PSSession $session
3Display all the Appliances assigned to your tenant, identify the Appliance you just re-initialized, and copy the identity into your clipboard.

Get-CsHybridPSTNAppliance

4

Execute the following command to remove the appliance:

Unregister-CsHybridPSTNAppliance -Identity <paste the identity here> -Force

5

Execute the following command to verify that the appliance has been removed:

Get-CsHybridPSTNAppliance

6

This completes the cleanup.

Re-Initializing of the ASM

The ASM must be re-initialized with the image that contains the latest CCE software . To do so:

StepAction
1Login to the WebUI of the SBC Edge.
2Click the Task tab, and then click Reinitialize in the navigation pane.
3

Select the appropriate image from the drop-down list and then click Apply.

Updating the CCE Password

Follow these steps if you need to update the O365 tenant admin password or account.

StepAction
1On the WebUI, click Tasks and select the Prepare CCE tab (see Preparing the CCE).
2Click Prepare CCE.
3From the Password Setting drop down list, select Change Password. Keep the same passwords for the Edge Server, CCE Service and CA Backup File, but change the passwords for Tenant Account User and Tenant Account Password.
4

On Remote desktop, start the Ribbon Cloud Link Deployer, and check Transfer Password from SBC to reset the credentials.