VQConferenceManager€¦ · VQConferenceManager:ReleaseNotes20-1064-H Page1 Contents 1 Introduction 6 1.1 NetworkPortUsage 6 1.2 ChangesinVQ ConferenceManager3.3 7 1.3 ChangesinVQ

VQ Conference ManagerRelease Notes

(VQCM 3.3)

March 09, 2020

20-1064-H

VQ Conference Manager: Release Notes 20-1064-H Page 1

Contents

1 Introduction 61.1 Network Port Usage 61.2 Changes in VQ ConferenceManager 3.3 71.3 Changes in VQ ConferenceManager 3.2.3 81.4 Changes in VQ ConferenceManager 3.2.2 81.5 Changes in VQ ConferenceManager 3.2 81.6 Multi node operation 91.7 CMS compatibility 91.8 Outlook Add-in compatibility 101.9 Outlook Plug-in compatibility 101.10 Standards based Authentication (OAuth2, OIDC and SAML2) 101.11 Enabling API Service Clients (Outlook Add-in/Plug-in, iOS andWindowsAuth) 111.12 VQCM requires Fully Qualified Domain Names 121.13 CMS workswith Fully Qualified Domain Names or IP addresses 131.14 iOS App status 141.15 iOS App and Certificates 14

1.15.1 Installing a self-signed root CA certificate onto an iPhone for testing 141.16 VQ ConferenceManager 3 onWindows 151.17 Costs associated with new VQCM3.x functionality 151.18 VQ ConferenceManager 3.x resiliency 151.19 Outlook Plug-in functionality 151.20 Outlook Add-in functionality 161.21 Blast Dial (Reactive Calls) 18

2 Host requirements for VQ ConferenceManager 3.3 19

3 Known limitations for VQ ConferenceManager 3.3 20

4 Tenant, CMS bandwidth, CMS license consumption and CMS Alarms data is not displayedin Kibana 22

4.1 Success criteria 244.2 Failure criteria 244.3 Advanced Customers 25

5 Before you start 27

6 Installing VQ ConferenceManager 286.1 Deploying theOVF Template 286.2 Installing VQ ConferenceManager 3.3 28

6.2.1 Begin Installation 28


6.2.2 Set root password 306.2.3 Network configuration 30

6.3 Install process: SystemConfiguration (Master Node) 326.3.1 Cluster Node Configuration 336.3.2 Administrator credentials for VQCM-Admin: 336.3.3 Administrator credentials for VQCM: 346.3.4 Master Initialization 346.3.5 Time Server 356.3.6 Certificate 356.3.7 System initializes 356.3.8 AuthenicationMode 366.3.9 Finished 37

7 Logging in with a self-signed (untrusted) certificate 39

8 Adding a second node 42

9 Upgrade process 479.1 VQCMVersion numbering 479.2 Before you start 479.3 Upgrade Paths 489.4 Multi-Node upgrade process 509.5 Unexpected Authentication Error 519.6 Checking for “Incomplete Installation” 51

10 Applying Hotfix 3 (Jan 19) to VQCM3.0.2 54

11 VQCM-Admin; re-running the installation 56

12 VQCM-Admin; Restarting VQCM 57

13 VQCM-Admin; Configuration Settings changes via the VQCMdatabase 60

14 Kibana Dashboards 6114.1 LegacyDashboards 6614.2 Dashboard, Visualization and Searchmaintenance and update Policy 6614.3 Updating Dashboards or creating your own. 6614.4 Elastic data improvements 6714.5 Elastic data population 67

14.5.1 SystemState 6814.5.2 Tenant State 7114.5.3 Call Bridge State 7214.5.4 CMS AlarmState 75


14.5.5 Call Analytics Index 7614.5.6 Participant Analytics Index 79

14.6 Cost Codes 8214.7 Legacy records and “Missing” values 8214.8 Participant RemoteAddress, CallingNumber and NumberToCall 8314.9 Kibana filter changes 83

15 Kibana FAQ's 8515.1 Are the searches case sensitive? 8515.2 Do you include Skype/MS Teams participants? 8515.3 What is required to enable Kibana exporting Dashboards as pdf and send permail? 8515.4 How do you add external sources to Kibana? I have setup nodejs to pull Cisco CEvideo endpoints analytics and data such as people count, people presence, mediachan-nels, packet loss etc. Is this something that can be integrated into VQand Kibana? 8515.5 Is it possible to add CDRs fromExpressway to VQ’s Kibana? 8515.6 Does VQConferenceManager manage Spaces and room configuration in CMS?Is the primary function is a reporting andmonitoring platform? 8515.7 How do you handle quality for video calls in VQCM? 8615.8 How many reports are there in Kibana? And is there anyway of customizingones? 8615.9 Further information 86

16 Configuring VQ-Admin to work with Okta, Duo andOneLogin SAML2 8716.0.1 Example Okta SAML 2 settings: 8716.0.2 Example OneLogin/Duo settings: 88

16.1 Whitelist for the Outlook Add-in 89

17 User Identities when using SAML2 91

18 ConfiguringMicrosoft ADFS SAML2 9218.1 VQCM: configuring ADFS SAML2 9918.2 Things to watch out for 10018.3 Alternative Configuration 100

19 Installing VQ Windows Identity Server 101

20 User Identities when usingWindowsAuthentification 102

21 Enabling Single Sign-On 103

22 Running the VQCM Windows Identity Server 3.x installer 104

23 Fixed issues 116


23.1 VQ ConferenceManager 3.3 11623.2 VQ ConferenceManager 3.2.3 11823.3 VQ ConferenceManager 3.2.2 11823.4 VQ ConferenceManager 3.2 12123.5 VQ ConferenceManager 3.1.3 12523.6 VQ ConferenceManager 3.1.2 12623.7 VQ ConferenceManager 3.1 12723.8 VQ ConferenceManager 3.1 Beta 128

24 Fixed in Outlook Plug-in 3.1.16 130

25 Known limitations for the Outlook Add-in 131

26 Known limitations for the Outlook Plug-in 132

27 More information on the new Generator functionality 133

28 Appendix A 13428.1 Outlook Add-in installation 13428.2 Getting started 13728.3 Adding “How to join mySpace” details to emails or calendar Appointments 14128.4 Adding Space Details to an Email 14228.5 Adding Space Details to an Appointment 14328.6 Space passcodes 14428.7 Changing the text injected into Emails and Appointments 14428.8 Controlling whether Add-in users can create new Spaces 14528.9 Outlook Add-in and Internet Explorer 11 Compatibilitymode 14528.10 Outlook Add-in and External Identity Providers 147

29 Appendix B 14929.1 Preparing theOutlook Plug-in to work with your VQCMsystem 14929.2 Installing the Outlook Plug-in 14929.3 New buttons in Outlook Plug-in 15029.4 Scheduling a call using theOutlook Plug-in 15029.5 Updatingmeetings 15229.6 Cancellingmeetings fromOutlook 15329.7 Outlook Plug-in Email Scripting 154

30 Appendix C 15830.1 Jabber Add-in Pre-requisites 15830.2 VQ ConferenceManager Admin Settings 15830.3 VQ ConferenceManager Settings 15830.4 Log in to your VQConferenceManager. 158


30.5 VQCMJabber URI 15930.6 Configuring with Cisco Unified CM (CUCM) Administration 15930.7 Browser Plugin Configuration 16030.8 Assign Service Profile 160

31 Appendix D 16231.1 Additional documentation 162

31.1.1 User Guide 16231.1.2 Commissioning and Test Plan 16231.1.3 Configuration Options 16231.1.4 Generator Keywords 16231.1.5 Outlook Plug-in Installer Configuration 16231.1.6 Import Emailer 16231.1.7 Bulk Emailer Utility 16231.1.8 TemplateManager 16231.1.9 PinManager 16231.1.10 Endpoint Importer 16331.1.11 Blast Dial/Reactive Calls Configuration 16331.1.12 Automated LDAP Import 16331.1.13 Space List 16331.1.14 Outbound Call Routing 16331.1.15 Watcher Setup in Kibana 16331.1.16 Automatically Renaming Logfiles 163

32 Open Source Software 164

1 Introduction


1 IntroductionThis document provides guidance for :

VQ ConferenceManager (VQCM) 3.3

Outlook Add-in for Office 2016 or Office 365

Outlook Plug-in 3.1.16 (or above) for Outlook 2013 or above

iOS App

Appendix D provides a full list of VQCMdocumentation

1.1 Network Port Usage

VQ ConferenceManager only accepts traffic on ports 443 (HTTPS), 80 (HTTP), 22 (SSH) (if SSHis enabled via VQCM-Admin) and 6443 (Kubernetes API).

HTTP Port 80 is open as a convenience for browsers that default URIs to HTTP. A HTTP requeston port 80 is automatically redirected to HTTPS on 443.

The Kubernetes API Port 6443 can only be accessed with a valid service account bearer token(signed JSONWeb Token) derived from a certificate generated at system install.

CAUTION: If you are hosting VQCMwith public access to the Internet, please ensure only ports 443and 80 (see note above) are open. All other ports should be closed.

1 Introduction


1.2 Changes in VQ Conference Manager 3.3VQCM3.3 ismostly incremental refinements and putting things in place for upcoming changes to theActivity page that should start to appear in VQCM3.4.

We’ve added a Jabber Add-in; this is essentially the same as theOutlook Add-in. For documentationon how to configure, please see “Appendix C”.

We’ve also extended the list of supported SAML2 providers to includeMicrosoft “ADFS” (ActiveDirectory Federated Services”). For details on how to configure, please read section “ConfiguringMicrosoft ADFS SAML2”.

With the introduction of Microsoft ADFS support in VQCM3.3, the recommended path to enableSingle Sign-On usingWindowsAuthentication is to take theMicrosoft ADFS route. Using ADFSremoves the requirement for the VQWindows Identity Server package and that customers shouldtherefore start the process of migrating to ADFS. VQWindows Identity Server will not be available inthe VQ3.4 product.

Microsoft ADFS is simpler to configure, requires less firewall port configuration and does not requiresoftware on an additional server.

The upgrade process has also received a lot of love; it has been substantially reworked and is nowfaster andmore robust.

Issue Number formatFromVQCM3.3, we’vemoved to a new engineering tool that consolidatesmultiple tools into one.Issue numbers now have the form of a 6 digit, alpha-numeric value. The issue numbers span all VQcomponents and have ascending values.

Known issues with planned fixes for 3.3.1 and 3.3.2:Outlook Add-in intermittently logs the user out after injecting text into amail/meeting invite;planned 3.3.1

Outlook Add-in does not load and the panel appears white, blank.

l Details: Office 365 version 16.0.11629 andWindows 10 version 1903 or later. Theembedded browser isMicrosoft EdgeWebView. This version behaves differently withrespect to caching than either older versions ofWindows using the IEWebView or MacOS using the SafariWebView.

l Planned fix: 3.3.1

TheOutlook Plug-in doesn’t currently support automatic updates; planned 3.3.1

Improved co-existence with Cisco TMS. TMS creates a pool of Spaces that are assigned on around-robin basis to TMS scheduled calls. VQCM currently does not detect the Space renameperformed by TMS when it assigns a Call to one of the Spaces in its pool of Spaces. VQCM3.3.2 will detect the Space range used by TMS and automatically perform an extra lookup onSpaceswithin the TMS pool when new Calls start to obtain the new Space name. As a shorttermwork-around, briefly turning on the Call Statistics from the Activity page will result inVQCMgetting the updated Space name fromCMS and correctly displaying the correct Spaceand Call name.

Tenant, CMS bandwidth, CMS license consumption and CMS Alarms data is not displayed in

1 Introduction


Kibana

l “Metrics Digester” sometimes fails to start after an upgrade or rebalance (restart). TheMetrics Digester takes data from the core VQ services and writes it to Elastic Search. Itfailing to start results in no data being written to Elastic Search. A classic example of howit manifests itself is that the CMS Dashboard in Kibana does not show data for the 5minutes leading up to the current time.

l The problemwas found at a late stage of the 3.3 release cycle and rather than hold, wedecided to release with the issue. The problem is planned to be fixed in 3.3.2.

For more information and recommended course of action, please read the Tenant,CMS bandwidth, CMS license consumption and CMS Alarms data is not displayed inKibana chapter

3.3.1 is planned to follow 3.3 very quickly. 3.3.2 is a bigger change and will therefore be availablesome time later but before 3.4.

1.3 Changes in VQ Conference Manager 3.2.3VQCM3.2.3 is a patch release for 3.2.2; it fixes a critical problem (#15) that caused the LDAP/ActiveDirectory code to only read the first 500 users from LDAP/Active Directory and, where there weremore than 500 users in the LDAP/AD group, resulted in all remaining Users and Spaces beingdeleted.

VQCM3.2.3 is a “must” upgrade. It fixes the issue found in 3.2.2 and contains the 3.2.2 fixes for alogging/storage problem that could be very painful if you were on the receiving end of it (see 3.2.2Fixed Issue #4075).

Please read the Fixed issues sections 3.2.3 and 3.2.2 (in the release notes) to get the complete listof changes in VQCM3.2.3.

In case you are worried youmissed VQCM3.2.1 or 3.2.2, don’t worry, we didn’t release 3.2.1 and3.2.2 waswithdrawn 1 day after being released.

1.4 Changes in VQ Conference Manager 3.2.2VQCM3.2.2 is a “must” upgrade. It fixes a logging/storage problem that could be very painful if youwere on the receiving end of it (see Fixed Issue 4075).

Please read the Fixed issues section (in the release notes) for the complete list of changes in VQCM3.2.2. In case you are worried youmissed VQCM3.2.1, don’t worry, we didn’t release it and all thechanges are included in 3.2.2.

1.5 Changes in VQ Conference Manager 3.2The headline changes in 3.2 are:

Restructure the data VQCMwrites into Elasticsearch; replace complex and difficult to navigatedata objects with simpler ones, more useful and consistent ones. Dashboards have also been

1 Introduction


updated. More details on the structure of this data can be found in section “Elastic dataenhancements”.Update the Outlook Add-in such that username is cached (but not password) making it quickerto sign in.

Blast Dial/Reactive Calls from 3.2 supports the option of prompting a recipient with an audiomessage and prompting them “press 1” to join the call.Refinements to VQCM-Admin including better support for chained certificates.

Cisco Duo SAML2 authentication has been added to the list of supported SAML2 providers.The Two factor authentication process is very neat!

Bug-fixes and refinements.

Improved tooling for connecting to CMS and discovering CMS Space state and converting allCMS Spaces to VQCM “Role” based Spaces. This work is being done in conjunction withCisco as part of the ongoing process to improve co-existence between VQCMandCiscotooling. The initial version of this tool is command line based; future versionswill be UI driven.

BulkEmailer tool has been updated to support auto configuring of the iOS application.

Utilities and theOutlook Plug-in fromVQCM3.2 all work with 3.3.

Please read sections “OIDC Authentication” and “VQCM requires Fully Qualified Domainnames” before upgrading or installing VQCM . If you are upgrading, please read section “Upgradeprocess” and be aware that the certificate requirements fromVQCM3.1 have changed; thecertificates, from before VQCM3.1 will be updated and replaced with temporary ones.

The changes introduced fromVQCM3.1 to support Single Sign-On (“SSO”) mean that all previousgenerations of utilities (e.g., PinManager, TemplateManager, LdapEmailer, BulkEmailer andEndpointImporter) are not compatible with VQCM3.1 or above. All have been updated to work withthe new Authenticationmodel that makes SSOpossible and will be available from vqcomms.com.For more details, please read section “OIDC Authentication”.

1.6 Multi node operationAlthough VQCM3.3 ismulti node capable, we do not recommend users configure their system inthismode. There are several reasons:

At VQCM3.3, there is very little benefit

Communication between the nodes is not encrypted

We expect VQCM3.5 to be the first version supporting beneficial and securemulti node operation.

1.7 CMS compatibilityVQCM3.1 and above is not compatible with earlier versions of CMS; a Header set in HTTPSPOSTS being sent byCMS when passing CDR State change events was proprietary and didn’tconform to standards. Thismight sound arcane but it prevented the HTTPS POSTS fromCMS

http://vqcomms.com/

1 Introduction


being routed by the Kubernetes proxy. This has been fixed in later CMS versions and the Headersare now standards compliant.

CMS Version Incompatible with VQCM 3.1 and above Compatible with VQCM 3.1 and above

2.2 All versions to 2.2.13 All versions from 2.2.14

2.3 All versions to 2.3.7 All versions from 2.3.8

2.4 2.4.0 All versions from 2.4.1

2.5 2.5 beta All versions from 2.5.0

2.6 - All versions from 2.6.0

2.7 - All versions from 2.7.0

If you try to connect to an incompatible version of CMS, the CMS node will not come online and youwill see an error of "UnsupportedSoftwareVersion".

1.8 Outlook Add-in compatibilityTheOutlook Add-in is compatible with VQCM3.1 and above. For earlier versions please follow theprocess for downloading theOutlook Add-in manifest and updating Exchange as described inAppendix A.

1.9 Outlook Plug-in compatibilityVQCM3.1 added support for the Outlook Plug-in; please read sections "Preparing the OutlookPlug-in to work with your VQCM system in Appendix B.

VQCM3.3 is compatible with the 3.1.xOutlook Plug-in.

1.10 Standards based Authentication (OAuth2, OIDC and SAML2)The authenticationmodel changed at 3.1 and is now based on anOpen Id Connect (“OIDC”)certified Identity Server that is now part of the standard VQCMproduct.

OIDC is an additional layer that “wraps” the OAuth2model andmakes it more appropriate (andsecure) for use with modern web-architecture applications and services.

The onboard “Identity Server” is responsible for handling the question of whether a user isauthenticated or not. It works with “Identity Providers” that are responsible for the authenticationprocess. The supported Identity Providers that VQCMwill work with are Active Directory/LDAP,WindowsAuthentication (Single Sign-On) and four variants of SAML 2: Okta, OneLogin, Duo andMicrosoft ADFS (Active Directory Federated Services).

For details on configuring Okta, Duo andOneLogin SAML2, please see section “Configuring VQ-Admin to work with Okta, Duo andOneLogin SAML2” and for ADFS, please see section“ConfiguringMicrosoft ADFS SAML2”.

1 Introduction


All of the VQCMAPI work with the OIDC authentication flows. The API clients are all the things thatuse the VQCMAPI namely: the web-based user interface, the Outlook Add-in, Outlook plug-in, iOSapp, Kibana and utilities such as TemplateManager etc.

The default authenticationmode is Active Directory/LDAP as the Identity Provider. However, thesystem can also authenticate against SAML 2 providers (Okta, OneLogin, Duo andMicrosoft ADFShave been tested so far) andWindowsAuthentication.

With the introduction of Microsoft ADFS support in VQCM3.3, the recommended path to enableSingle Sign-On usingWindowsAuthentication is to take theMicrosoft ADFS route. Using ADFSremoves the requirement for the VQWindows Identity Server package and that customers shouldtherefore start the process of migrating to ADFS. VQWindows Identity Server will not be available inthe VQ3.4 product.


1.11 Enabling API Service Clients (Outlook Add-in/Plug-in, iOS andWindows Auth)By default, theWeb based User Interface and access to Kibana are enabled.

The VQCM-Admin portal controls whether API clients such as theOutlook Add-in, Outlook Plug-in,iOS App and remoteWindows Identity Server are enabled.

The default mode for the Outlook Add-in, Outlook Plug-in, iOS App and remoteWindows IdentityServer is disabled.

Theymust be explicitly enabled; this is performed from the VQCM-Admin Authenticate Clients page:

If you are running utility applications (such as TemplateManager, ImportEmailer or BulkEmailer),add new ClientID and Secret valueswhich can then be entered into the config files for the utilities.

1 Introduction


Each utility can have their own API key or they can be shared; from a control point of view, eachhaving their own is our recommendation.

If you do not enable the specific application (API Consumer), authentication requests from theapplication will fail with an error message "Unexpected authentication error" along with someexplanatory text and an error instance number.

1.12 VQCM requires Fully Qualified Domain NamesFrom 3.1, VQCMonly workswith FQDNs. It is no longer possible to configure VQCM to use IPaddresses.

TheOIDC authentication process and trust model is based on certificates; IP addresses are out andFQDNs are in.

VQCMwill work with self-signed, non-trusted certificates and will detect and prompt for non-standard actionswhen they are used.We recommend, however, using trusted certificates; there is agrowing trend by suppliers to only work with trusted certificates. A good example of this can be seenwith the latest Chrome browsers. You can work with untrusted certificates but it will becomeincreasingly difficult. It is also less secure.

DNS A-recordswill need creating before VQCM is installed; the install process prompts for them soplease have them ready before you start installing.

If you enter FQDNswithout having setup DNS A-Records or entered an IP address, the installprocesswill complete but VQCMwill not initialize at the end of phase 1 and you will see Pod statuserrors (they’ll display in the red error state rather than the green, good, state). You will need torestart the install process.

Theminimum requirement is for a single node VQCM instance with the default, on-board, IdentityServer:

1 Introduction


FQDN Description

vqcm.mydomain.com User friendly URI for VQCM

login.vqcm.mydomain.com Allows API clients to find the VQCM OIDCIdentity Server

kibana.vqcm.mydomain.com Admin friendly URI to access Kibana

NOTE: “login” and “kibana” are examples, you can use any value that aremeaningful in yourenvironment. In some environments, wild-card certificates and sub domains cannot be used. Inthese situations, assign a single domain FQDN (and associated A-Record) to each node. Forexample:

FQDN Description

vqcm.mydomain.com User friendly URI for VQCM

loginvqcm.mydomain.com Allows API clients to find the VQCM OIDCIdentity Server

kibanavqcm.mydomain.com Admin friendly URI to access Kibana

For example, if you host the VQWindows Identity Server on aWindowsServer that’s also acting asyour domain name controller (and has the node name dnc.mydomain.com), the FQDN for VQCM’sWindow Identity Server would be dnc.mydomain.com.

In a default environment using AD/LDAP as the Identity Provider, the IP address assigned to thelogin FQDN will be the same as that for the vqcom and kibana URIs.

A multi-node systemwill require a FQDN for each node. TheMaster node will have the user friendlyFQDN.

If you are running inWindowsAuthenticationMode, the VQWindows Identity Server systemwill beinstalled on aWindowsServer and therefore have a different hostname than the VQCMmasternode.

1.13 CMS works with Fully Qualified Domain Names or IP addressesFrom 3.1, VQCMwill connect to CMS nodes via IP address or FQDN andwill accept trusted or self-signed, non-trusted, certificates.

If your CMS nodes use FQDNs, please ensure you have DNS A-records defined for each node.Wedo see the occasional support ticket where customers have issues connecting their CMS nodeswithVQCMand the issue is that no DNS A-records have been defined for the CMS nodes.

The other problem that can cause issues is that the CMS nodes have not been configured with aDNS server. This causes problems because it means that CMS cannot resolve the address ofVQCMwhen posting CDR records to VQCM.

Background: when a new Call Bridge node is added to VQCM, VQCMwrites the FQDN address ofits CDR Listener to the CMS node. The CDR events posted byCMS to VQCMpass state changeinformation between the two systems; without them, VQCMdoes not know about call starts orparticipant joins/leaveswith the result that nothing is displayed in the Activity page.

1 Introduction


1.14 iOS App statusThe iOS app will initially be available on an ‘early adopter’ program. Testing has been successful butwe’d like to get a bit more real-world data on how it works in the field.

We’ll therefore initiallymake it available in limited numbers per system; mail [email protected] request early adopter licenses.We’ll then send you a link which enables you to download theapp onto your phone and be updated with any new versions as they become available. It’s prettyslick.

The early access version will not be charged for but once we’re comfortable its working well, we’llmove to a paid licensemodel.

Note: The iOS App contains a crash handler and will prompt the user to submit a log file via emailshould it detect problems. The log file contains no user information.

1.15 iOS App and CertificatesThe iOS App requires trusted certificates.

1.15.1 Installing a self-signed root CA certificate onto an iPhone for testingThe iOS operating systemwill not allow connections to non-trusted sites. For testing or forcustomerswith their own certificates that are not based on root certificates already in the phone’scertificate store, you will need to install a root certificate onto your phone.

To establish trust for self-signed server certificate, youmust install the root Certificate Authority (CA)certificate onto your iPhone. Please note that only the root CA certificatemust be installed, othercertificates such as intermediaries do not need to be installed onto the device.

Download the certificate

Once the certificate is on the device, navigate toSettings > Profile Downloaded

Install the certificate, accepting the warning that will appear

To check that the certificate was properly installed, navigate toSettings>General>Profiles>Configuration Profiles, where the root CA will appear

Manually installed certificates are not automatically trusted by iOS. Navigate toSettings>General>About>Certificate Trust Settings and under “Enable full trust forroot certificates,” turn on trust for the certificate.

Apple documentation on the last step, here: https://support.apple.com/en-us/HT204477_

Note: These notes are for guidance only. VQ is unable to provide support on this process; pleasecontact your Apple supplier/support if you require assistance.

mailto:[email protected][email protected]

https://support.apple.com/en-us/HT204477

1 Introduction


1.16 VQ Conference Manager 3 on WindowsWedo not envisage producing aWindows version of VQ ConferenceManager 3 in the foreseeablefuture, if ever.

The level of innovation in the Open Source, Linux and Cloud worlds is now so far ahead ofWindowsthat we no longer see it being viable to offer aWindows version of VQ ConferenceManager 3.

From 3.1, VQCM introduces support for WindowsAuthentication; this will allow a Linux based VM toauthenticate withWindows and provideWindowsSingle Sign-On. That works for new customers.

Customers already using aWindows version of AcanoManager 2.3 will have to wait for VQCM3.3;we plan to offer tooling as part of VQCM3.3 that will move the data from theWindows version overto the VQCM3.3 database and thereby, provide a cleanmigration path retaining key data likePins/passcodes and Call Ids.

1.17 Costs associated with new VQCM 3.x functionalityThere will be no licensing costs associated with migrating fromAcanoManager 2.x toVQ ConferenceManager 3.x on a “like for like” basis

There will be no licensing costs associated with multi-node cluster configurations

New functionality; specifically, the Outlook Add-In, iPhone App and the Elastic subscriptionpack functionality will require additional licensing and will be subject to additional licensing fees

1.18 VQ Conference Manager 3.x resiliencyVQCM3 is a cluster of Docker Containers; the cluster ismanaged, or orchestrated, by Kubernetes.Each Container contains specific functionality; for example, theWeb Server (VQCMPortal), thedatabase (PostgreSQL), themain VQCM3.0 service, themessage bus etc.

At VQCM3, the cluster will consist of up to two VMs. There will be a singlemaster node. If any of theContainers fail, Kuberneteswill recreate it on either of the available VMs. The database will remainon theMaster; there is therefore the risk that if theMaster node or database fails, there is noresilience on the database and the systemwill fail.

For later versions of VQCM3, wewill configure the cluster so that the database replicates betweennodes. If a node fails, Kuberneteswill recreate the failing Container and pick up the replicateddatabase.

We plan to add support for KubernetesMaster Node replication in future VQCM3.x versions; if theMaster node fails, the role will be assumed by a replicaMaster node and the systemwill continuefunctioning. Our objective is to Zero Down Time.

1.19 Outlook Plug-in functionalityTheOutlook Plug-in functionality available in AcanoManager 2.x is available fromVQCM3.1.

Functionality is almost identical to that available on the AM2.x platform although API changes inVQCM3mean that the Outlook Plug-in (version 1.2.48) fromAM2.x is not compatible with VQCM3.1 and above.

1 Introduction


The difference in functionality between the VQCM3 and legacy 2.x version is that the 3 version usesthe “default Space” for the user; this can be configured by the user via the user settings page on theuser portal. (The user’s name appears as a clickable link just above the logout button in themenu onthe right hand side). The default value of the default Space setting is the Space created for the userduring the LDAP/AD import process as the user is provisioned.

Please also note the difference in naming:

Microsoft added support for Add-ins fromOutlook 2016 andOffice 365. Add-ins are hosted ina browser integrated within Outlook and work on theWindows, Mac andOWA versions ofOffice.

Plug-ins only work onWindows and are the previous generationmechanism for extendingOutlook functionality.

1.20 Outlook Add-in functionalityTheOutlook Add-in requiresOffice 2016 or Office 365. It works on theWindows andmacOSplatforms.

With the Outlook Add-in users can:

View current state of their (and those they aremembers of) Spaces (participant count, time thecall has been running)

Who is in their call and be able tomute, change layouts or remove participants

Create, Delete or update Spaces. This includes Passcode changes

Inject Space details into emails and appointment bodies from any of the Spaces they own/aremembers of

Outlook Add-in screenshot showing active Spaces:

1 Introduction


1 Introduction


For information on how to install the Outlook Add-in, please refer to Appendix A.

1.21 Blast Dial (Reactive Calls)VQCM3.1 introduced “Blast Dial” or “Reactive Call” functionality where a Participant dialing into aninactive Space results in a pre-defined list of Participants being called.

This first version of ReactiveCalls does not contain a user interface; the functionality is configured bya simple command line tool. Please download “Configuring Blast Dial/Reactive Calls” fromvqcomms.com.

There are no limits to the number of Spaces that are configured to be “Reactive”; if you areconsidering using Reactive Calls with a larger rather than smaller number of Spaces, please [email protected] beforehand and we’ll run your numbers passed one of our engineers.

A further refinement is included fromVQCM3.2; Reactive Calls can be configured to play amessage to the participant on call pick-up that states they’ve been invited to join a call and to ‘press 1’to continue and join the call.

https://www.vqcomms.com/login/

mailto:[email protected]

2 Host requirements for VQ Conference Manager 3.3


2 Host requirements for VQ Conference Manager3.3Workload 1-8 Call Bridges ("Normal to Large")

Calls permonth

Less than 1,000,000 Participant Joins/Month

RecommendedServer

Intel Xeon E5 class processor; 2.4Ghz or above

ProcessorCores

4

Memory 16 GB RAM per VM

Disk 350 GB (SSD recommended) Do not use slow disks (7,200 RPMor below); Elastic is an I/O intensive component and slow diskscan cause slow system loads or even prevent system load.

VMs 1 2

Concurrentusers access-ing the API(using eitherthe Web UI,Outlook Add-in,Outlook Plug-inor iOS App)

125* 250*

*This value is expected to increase substantially with VQCM 3.3 and later versions.

Workload Very Large/Extreme

Calls permonth

More than 1,000,000 Participant Joins/Month

Currently notcertified

We do not recommend using VQCM 3 for Very Large/Extremeworkloads yet. We plan work on VL/Extreme topologies as part ofthe VQCM 3.3 release; it might take several releases for this workto complete. Customers running VL/Extreme workloads shouldremain on AM 2.3 MR7/8.

Memory, VMand Diskrequirements

Details will be made available as VQCM 3.3 gets closer to release

Disk space planning: 10million calls = 10Gbyte

3 Known limitations for VQ Conference Manager 3.3


3 Known limitations for VQ Conference Manager 3.3Recurring Calls are not supported

LDAP has not been tested against a Global Catalog

l Certain types of calls are not displayed in VQCM:

l Skype for Business gateway calls via CiscoMeeting Server to SIP endpoints

l AVMCU calls

l Dual homed conference

Tenant, CMS bandwidth, CMS license consumption and CMS Alarms data is not displayed inKibana.

l “Metrics Digester” sometimes fails to start after an upgrade or rebalance (restart). TheMetrics Digester takes data from the core VQ services and writes it to Elastic Search. Itfailing to start results in no data being written to ElasticSearch. A classic example of howit manifests itself is that the CMS Dashboard in Kibana does not show data for the 5minutes leading up to the current time.

l The problemwas found at a late stage of the 3.3 release cycle and rather than hold, wedecided to release with the issue. The problem is planned to be fixed in 3.3.2. For moreinformation and recommended course of action please read the Tenant, CMSbandwidth, CMS license consumption and CMS Alarms data is not displayed in Kibanachapter

Number Description Summary

#3ee23p Entering an invalid CIDR for Firewall in VQCM-Admin (CM-Admin->Manage->Firewall) results in the VQCM-Admin firewall policybeing deleted.

Please also see the note in “Networking Ports” stating that port1234 used by VQCM-Admin should be blocked from the publicinternet.

Fix scheduled for 3.3.1

3702 VQCM generated adhoc calls (created from the Call coApp) willprematurely shutdown when a participant leaves if a CMS node isoffline

Will be fixed in VQCM 3.4 orabove

3695 Can still access Kibana after logging out of VQCM

3690 Load testing shows the system performance degrades between 12and 18 million calls (participant joins). We will investigate thecause after release

Our acceptance criteria for anew release is to successfullycomplete 10 million calls (orapprox. 10 months workloadon our largest customer’s sys-tems)

3 Known limitations for VQ Conference Manager 3.3


Number Description Summary

3675 Importer; clicking on previous syncs doesn't display the loggingcontent

3658 Tenant List does not stick to Alphabetical order; it seems to movearound with update order

3657 Trying to delete an LDAP config can sometimes give an error

3614 Sometimes it appears that the Kibana token appears to time-outafter 15-20 minutes and content will not display or error messageswill be displayed. Reloading the page clears the condition

3610 Space Secret isn't always available for Temporary Spaces

2553 Filter date range picker should default auto-fill to 00:00 – 23:59 or00:00 AM – 11:59 PM

2507 Analytics/Analytics 2/CDRs; replace Acano device type with CMA

2396 The data imported into Elasticsearch/Kibana will be extended toinclude processor, memory and network usage

Processor memory andnetwork usage dashboardswill be added in a futureversion.

2305 Audit log records do not contain references to Space URIs, Spacename or Owner

388 Ensure all data is encrypted between Pods. On a multi nodedeployment, traffic between nodes could be intercepted and read

Will be fixed in 3.4 or above

221 Add the Cluster Test script to the VM

4 Tenant, CMS bandwidth, CMS license consumption and CMS Alarms data is not displayed in Kibana


4 Tenant, CMS bandwidth, CMS licenseconsumption and CMS Alarms data is not displayedin Kibana“Metrics Digester” sometimes fails to start after an upgrade or rebalance (restart). TheMetricsDigester takes data from the core VQ services and writes it to ElasticSearch. It failing to start resultsin no data being written to ElasticSearch. A classic example of how it manifests itself is that the CMSDashboard in Kibana does not show data for the 5minutes leading up to the current time.

The problemwas found at a late stage of the 3.3 release cycle and rather than hold, we decided torelease with the issue. The problem is planned to be fixed in 3.3.2.

Once the upgrade or rebalance (restart) process has completed, open up Kibana and go to the CMSDashboard. Please note that the time taken to upgrade or rebalance takes varying amounts of timedepending on system size and disk speeds. On fast disks, it can take a few minutes and on slowdisks, it can take 30minutes. The URI of Kibana on your system is typically something like:kibana.yourFQDN.com. You can find the URI for your Kibana from the bottom of the VQCM-AdminWelcome page.

Having opened Kibana on the CiscoMeeting Server Dashboard, the time range selected will defaultto the last 15minutes.

What we’re looking for is something like we see in the graphs below: The graph updates from theright – the screenshot below was taking at 17:07 (5.07 PM).

The screenshot shows the right-hand side of the “CMS Total (all nodes) bandwidth usage” and“CMS Bandwidth per node” panels from the CiscoMeeting Server dashboard:



The dark blue line is zero; if nothing is happening you will still see that so that’s not what you’relooking for. The green and pink lines show voice and audio bandwidth consumption; those are thethings you want to see.

If there’s a possibility that nobody is in call on your CMS, put a system into a call to generate somebandwidth consumption. Normally, it takes about 10-15 seconds for data to get through the systemand become visible.

Tomake this even easier, click on the “Auto-refresh” menu item and select 5 seconds. The pagewill automatically refresh every 5 seconds:



Setting 5 seconds and you should then see the following in themenu:

Once you’re complete, set the refresh interval to “off”:

4.1 Success criteriaIf you see a graph like we showed above with values displaying from the right (you’re not looking atold data), you don’t have a problem: Metrics Digester is passing data fromVQand is writing it toElasticSearch.

4.2 Failure criteriaIf you wait 10minutes and you still don’t see graphs, Metrics Digester has not started successfully.

Please now restart VQCM. This is done by performing a “rebalance” command from theVQ-Admin>Manage>Clustering page.The “rebalance” button looks like this:



Once the system has rebalanced (restarted), please repeat the process outlined above and checkthat Metrics Digester is running by using the Kibana CiscoMeeting Server dashboard.

If the condition doesn’t clear after a couple of attempts, please contact [email protected].

4.3 Advanced CustomersFor customerswho aremore comfortable with using Kibana, the quickest way to identify the issue asfollows:

1. Load Kibana

2. Click on the “Discovery” navigation option

3. Check that the time range is “Last 15minutes”

4. Select “callbridge*” from the index selector

5. If you see records (see below), you don’t have the problem

6. If you don’t see records, you have the problem. In that case, perform a rebalance fromCM-Admin (as described in section ‘failure criteria’) and then repeat from step 1 in this list. [email protected] if the condition doesn’t clear after 2 attempts

This screenshot shows records in the “callbridge*” index (18:04:31.969 and 18.04.30.968). Thissystem does not have the problem:





5 Before you start


5 Before you startBack up VQ ConferenceManager and Call Bridge databases, so that if required, you can restoreback to your original state.

6 Installing VQ Conference Manager


6 Installing VQ Conference ManagerVQ ConferenceManager runs as a virtualized application on a vSphere client.

To install VQCM3.3, download theOVF, then follow the instructions below to deploy the OVFtemplate and run the VQCM3.3 installer.

6.1 Deploying the OVF Template1. Log in to your host using your VMware vSphere client.

2. In the topmenu, select File>Deploy OVF Template….

3. In theSource screen, browse to the vqcm.ovf file and selectOpen.4. TheOVF Template Details screen is there for information only; go directly to the next screen.5. In theName and Location screen, type a unique name for your new VM in theName field.6. In theStorage screen, select the virtual disk storage you want to use for the deployment.7. In theDisk format screen, select provisioningmethod.8. In theNetwork Mapping screen, select destination network.9. In theReady to Complete screen, select thePower on after deployment check box.

Note: Alternatively, you can power on the VMmanually when you have run the AM Installer.

10. Select Finish.A dialog box appears showing the progress of the deployment.

11. Wait for the deployment to complete, then selectClose.

6.2 Installing VQ Conference Manager 3.31. Select your new VM in themenu and go to the VMConsole.

Note: The screen is black for 30 seconds or more.

6.2.1 Begin InstallationThe Installer menu appears as in the screen shot below.



2. Navigate to theBegin Installation button and pressReturn.

Note: You do not need the Emergency Shell during installation. The Emergency Shell lets youtroubleshoot VQ ConferenceManager using BusyBox commands.

Note: In the VQ ConferenceManager installer, use the Tab key tomove from one field to thenext, and use the Return key to select buttons. If you need to use your mouse, pressCtrl+Alt.

3. When prompted, pressENTER to begin.



6.2.2 Set root password

4. Please provide a Root user password for the Linux operating system on the VM.

6.2.3 Network configuration5. In theNetworking Configuration screen, enter a hostname and name server.

Note: The console assumesUS keyboard layout. Be aware when you want to type specialcharacters. For instance, if you have a UK keyboard, type SHIFT+2 to type@



6. Set up the details and press Forward:Please note that VQCM runs as a Cluster consisting of one or more VMs. The Cluster consistsof a collection of Pods, each of which can consist of multiple LinuxContainers and each onehas its own IP address. The Cluster IP addresses exist on an internal vLAN spanning theCluster. The vLAN address ranges used are 10.115.0.0/23 and 10.115.2.0/23.



7. Transition to the Browser based installation and configuration process

The final stage of the Network Configuration processwill have displayed themessageEnablingWeb Server followed byPlease continue the installation process in your browser athttps://<your server address>:1234.Please open a browser and contine the installation using the URI provided (HTTPS).

6.3 Install process: System Configuration (Master Node)After initializing the VM and setting the network configuration, the installation process transitions tothe browser based "Stage 2: System Configuration" pages. Once the process has beencompleted, access to the VQ ConferenceManager Administration pages requires authentication.

Having installed VQCM, please then upgrade it to the latest upgrade image for the release.

The following screen shots take the reader through the install (single node) setup:



6.3.1 Cluster Node Configuration

Next

6.3.2 Administrator credentials for VQCM-Admin:

Next



6.3.3 Administrator credentials for VQCM:

Next

6.3.4 Master InitializationThe system initializes; wait for "installation complete". This can take several minutes.

Next



6.3.5 Time Server

Next

6.3.6 Certificate

NOTE:when uploading certificates, please ensure you upload all certificates in the trust chainincluding intermediate and root CA certificates that are already in the client store.

During the install process, a temporary, self-signed certificate is generated based on the FQDNsentered during configuration.

Use the VQCMAdminManage>Certificates page to upload signed certificates once they areavailable. The certificate page allows the uploading of certificates in various formats and alsosupports certificate chaining.

Next

6.3.7 System initializesWait for the system to initialize; watch the Pods go “green”:



Next

6.3.8 Authenication Mode

Next



6.3.9 Finished

Finish

Log back in using the VQCM-Admin credintials you provided:

Continue

Scroll down to see:



At this stage, the system is running on an untrusted, self-signed, certificate which can be updatedlater.

Please continue reading into the next section; if describes how to login and negotiate through thecertificate exceptions.

7 Logging in with a self-signed (untrusted) certificate


7 Logging in with a self-signed (untrusted)certificateIf you try and access VQCMwith a non-trusted certificate, you’ll will have to negotiate a path ofcertificate exceptions. Please read on:

Access VQCMvia it's URI or via the VQCM-Admin welcome page “Conference Manager tile” andyou’ll see:

Clicking "proceed to...." will result in the followingmessage being displayed:



This looks a bit scary; Don’t panic and follow the instructions. Click on “Visit login page” (this willaccess the Login server and allow you to add the certificate exception to your browser); once thatprocess is complete, we come back and try again via “retry”…this is what that process looks like:

You will then normally see this error:



Remember the "don't panic" instruction. At this point, close the active brower tab.

You should now be back at this page:

Click the “Retry” button. Youmight see a page flash and should then see:

8 Adding a second node


8 Adding a second nodePlease note:

Adding a second node at VQCM3.3 offers little benefit. We expect to start seeing value innodes 2 and above fromVQCM4.

At VQCM3.3, communication between nodes is not encrypted. This is amajor reason not tohavemultiple nodes at VQCM3.3. Please wait for VQCM4.x before configuringmultiplenodes.

SelectGet Started:



SelectNode and clickNext:

Provide credentials for the VQCM-Admin user account. ClickNext.The details required to complete this page are obtained from theMaster nodeVQCM-Admin>Manage>Cluster page.To add the new node into the cluster, you’ll need to create a new access Token on theMaster node.

Tip: Do this in a new browser tab; you’ll then be able to copy/paste values.

Switching to a new browser tab, go to yourMaster Node URI>VQCM-Admin>Manage>Cluster,scroll down and you’ll see the following:



Create a new Token

Note: Tokens have a 24-hour time-to-live (TTL). After 24 hours, you will need to create a newToken.

Click onCreate new token:

The Token details are then used to identify the new node and allow it to be added to the Cluster.

Switching back to the new Node install process:Copy/paste the Token values from theMaster node:



Click Next:

Wait for the process to complete. ClickNext:

Add a time server. ClickNext:



ClickNext:

As the note on the page states, at this stage, remember to rebalance the cluster from theMasternodeVQCM-Admin Cluster page.

9 Upgrade process


9 Upgrade process

9.1 VQCM Version numberingVQCMversions are numbered according to the “Semantic Versioning” convention (see:https://semver.org/).

Version numbers consist of 3 components: theMajor, Minor and Patch versions.

TheMajor Version changeswith major changes in functionality and compatibility

TheMinor number changeswith small or non-breaking changes in functionality

The Patch version changeswith bug fixes

Historically, we’ve been poor at how we’ve used theMajor version. A good example is the changesintroduced with Identity Server at 3.1; this should really have been labelled 4 rather than remainingat 3.

We introduced new engineering processes at 3.2 which includemaintaining conformance withSemantic Versioning.

9.2 Before you startBefore reading the Upgrade Paths table , please be aware of the following:

1. Take VMSnapshot backups of your VQCMand backup your CMS nodes.

2. From 3.1, VQCM is not compatible with earlier CMS versions. Please read section “CMSCompatibility”.a. The upgrade process checks the CMS version and will prevent an upgrade if the CMS

version is incompatible. There is currently no user interfacemechanism during theupgrade process that allows an error message to be displayed; the only way you cancheck is to check the CM-Admin welcome page and if the VQCMversion number hasn’tchanged, check your CMS version number.

3. The upgrade process from 3.0.2 generates a new set of self-signed certificates (see notes inthe "Upgrade Paths" table).a. Thismeans that when the upgrade process is complete, the trust relationship between

the browser and VQCM-Admin is broken (because the certificates that were in usewhen the upgrade process started get replaced by the new ones generated by theupgrade process) and the code running in the browser is unable to get the state of theVQCM instance; it therefore cannot determine when the upgrade process is complete.

b. The upgrade process therefore ends in a rather unceremoniousway (in the sense that itnever completes). The recommended process is to start the upgrade process and thenclose the browser (or tab) and walk away from the system. On a normal (fast) system, itnormally takes between 20 and 30minutes for the upgrade to complete. On slower

https://semver.org/

9 Upgrade process


systems, it will take longer. The normal main contributor to the time is disk speed; SSD’stypically take closer to 20-30mins and slower, spinning disks, can take a lot longer.

c. You will know when the upgrade process is complete when you see a login prompt.

d. If you feel you’ve waited so long that somethingmust have gone wrong, [email protected] andwe can check it for you.

9.3 Upgrade Paths

Upgrade from Process

AM 2.3 1. Install the 2.3 “Acano Manager 2.3 Export to 3.0 Upgrade IMG (September2018)” upgrade to your AM 2.3 MR7 or MR8 version. The file can be downloadedfrom the “downloads” section for version 3.x (where x is the latest version) undertab “VQ Conference Manager Install”. The tool lets you export the database from2.3 suitable for loading into 3.x.

2. Export the AM 2.3 database

3. Rename the export file extension from .pgdump to .bak

4. Power down your AM 2.3 VM

5. Create a new 3.x VM

6. Before you perform the install, make sure you have defined DNS A-records forthe FQDNs you will be using – see section “VQCM 3.x requires Fully QualifiedDoman Names”.

7. Install VQCM 3.x OVF

8. Upgrade to the newest 'patch' version of 3.x (e.g., assuming 3.2 was installed atstep 7, upgrade to 3.2.3) using the 3.x.y IMG upgrade file

9. Import the database exported from AM 2.3

10. Once the upgraded system is running, run the Importer for each LDAP group toforce the population of a “Distinguished Name” (“DN”) value stored against eachuser imported. Adding a DN against each user is an improvement added at 3.1 thatimproves the authentication time by removing a lookup against AD/LDAP.Authentication will fail if you do not perform this one-off import action post-upgrade.

11. The 3.x installation process generates untrusted, self-signed, certificates for theVQCM, Login and Kibana components. If your 2.3 system previously had signedcertificates, you will need to generate new ones for all three components which isperformed from the VQCM-Admin Manage>Certificate page from where you cangenerate Certificate Signing Requests and upload the new, signed, certificates.

12. The authentication process for 3.x is designed to be secure and relies ontrusted certificates; please read section “Logging in with a self-signed(untrusted)certificate”.

VQCM 3.0 or 3.0.1 Upgrade to 3.0.2, apply Hotfix 3 (Jan, 2019) and then directly upgrade to target3.x.y


9 Upgrade process



VQCM 3.0.2 1. Make sure you have applied Hotfix 3 (Jan 2019) to your 3.0.2 system.Running HF3 will set your VM version to 1.0.10 (you can check the VMversion number from the VQCM-Admin Welcome page - the VM version is inthe table at the bottom of the page). See section “Applying Hotifx3 (Jan,2019) to VQCM 3.0.2” for details on Hotfix3 and how to apply it.

2. Also note, if you have already applied HF3 and you did it more than 3months ago, please contact [email protected] who will provideguidance on how to re-run the re-indexing process. Re-applying Hotfix 3cleans up the indexes generated between the time HF3 was originallyapplied and the current date; 3.1, and above, will then keep the indexesclean.

3. Before you perform the upgrade, make sure you have defined DNS A-records for the FQDNs you will be using – see section “VQCM requiresFully Qualified Doman Names”.

4. Once those actions have been completed, the process is a standard “dragand drop” upgrade using the 3.x (where x is the latest version) IMG upgradeimage from VQCM-Admin.

5. The upgrade process from 3.0.2 to 3.x automatically generates FQDNs and,self-signed, certificates for the VQCM, Login and Kibana components in theform yourdomain.com, login.yourdomain.com and kibana.yourdomain.com.

a. If you previously had a signed certificate, you will need to generatenew ones for all three which is performed from the VQCM-AdminManage >Certificate page from where you can generate CertificateSigning Requests and upload the new, signed, certificates.

b. If you require FQDNs that differ from those automatically generatedby the upgrade process, re-run the install process from VQCM-Adminand enter the FQDNs required. Completing the installation processwrites the updated FQDNs to the component parts of VQCM enablingthem all to communicate with one-another. Check the VQCM-AdminWelcome Page to see whether “Installation Complete” needsclicking.

6. If you are upgrading a multi-node VQCM cluster, please read section “Multi-node upgrade process” and apply the process to each worker node onceyou have upgraded your Master node.

7. The authentication process is designed to be secure and relies on trustedcertificates; please read section “Logging in with a self-signed(untrusted)certificate”.

8. Once the upgraded system is running, run the Importer for each LDAPgroup to force the population of a “Distinguished Name” (“DN”) valuestored against each user imported. Adding a DN against each user is animprovement added at 3.1 that improves the authentication time byremoving a lookup against AD/LDAP. Authentication will fail if you do notperform this one-off import action post-upgrade.


9 Upgrade process



VQCM 3.1 Beta 1. Perform a Standard ‘drag and drop’ upgrade.

2. Once the upgrade is complete, please go back to the "VQCM-AdminCertificates" page and click the “Apply Certificate Changes” button – thisreplaces the temporary, self-signed certificates generated by the upgradewith the certificates automatically saved from the 3.1 beta, pre-upgrade,state.

3. If you are upgrading a multi-node VQCM cluster, please read section “Multi-node upgrade process” and apply the process to each worker node onceyou have upgraded your Master node.

VQCM 3.1 and above Standard ‘drag and drop’ upgrade process.

NOTE: If you have installed the Windows Identity Server package, you will have toun-install it and re-install the latest version.

9.4 Multi-Node upgrade process

Note: Please read the advisory words in section "Multi node operation".

Please use the following process for upgrading amulti-node cluster:

1. Snapshot the VMmaster node

2. Snapshot the worker node(s)

3. Upgrade your master node with the upgrade IMG file

a. The upgrade processwill remove each worker node from the VQCMcluster (eachworker node VMwill not be automatically deleted)

4. Power down and delete each worker node VM

a. Note: the certificates on the worker node will be lost and will need recreating.5. For each worker node

a. Deploy a new VQCM (same version as the upgradedMaster node) VM

b. Go through the installation process for the new VM setting it up as a node with theupdatedMaster node (fromStep 3)

6. Rebalance the cluster from the Cluster page on theMaster node VQCM-Admin UI

7. Perform the following checks

a. All nodes are displayed on themaster node VQCM-Admin UIWelcome page

b. All the pods are green on themaster node VQCM-Admin UIWelcome page

c. There are no version warnings on themaster mode VQCM-Admin UIWelcome page

If you have any questions or doubts about upgrading, contact [email protected] andwe’ll gothrough the upgrade processwith you.


9 Upgrade process


9.5 Unexpected Authentication Error

This error message comes from the on-board Identity Server; it therefore indicates something fairlymajor has gone wrong in an authentication request.

Normal causes for this can include:

1. A-Records haven’t been defined for the FQDNs being used.

2. The Installation Process/Setup process is incomplete. A potential cause for the incomplete setupis that the FQDN values have been changed (for example, after having re-run the install process toreplace the auto generated, self-signed, certificates with your target certificates). For more details onhow to check for an incomplete installation, see the following section “Checking for IncompleteInstallation”.3. If you’ve checked and neither of the above apply, please contact [email protected].

9.6 Checking for “Incomplete Installation”Incomplete Installation is indicated on the following two pages.

“Installation Complete” button from theVQCM-Admin Manage > page:


9 Upgrade process


“Installation Complete” will also be prompted from theVQCM-Admin Welcome page:

9 Upgrade process


If you have any questions or doubts about upgrading, contact [email protected] andwe’ll gothrough the upgrade processwith you.


10 Applying Hotfix 3 (Jan 19) to VQCM 3.0.2


10 Applying Hotfix 3 (Jan 19) to VQCM 3.0.2What’s the problem?At VQCM3.0.2 the Elasticsearch database is currently indexed by the hour; thismeans that overtime, a large number of indexes are generated causing the system to slow and eventually fail “out ofmemory”.

What does the hotfix do?It re-indexes the current Elasticsearch data from hourly indices to daily indices.

How long does it take?It typically takes several hours.

Do I need to take my system down to apply the hotfix?Yes, the system is rebooted twice as part of the process.

Is it a permanent fix?No. it’s a sticking plaster fix to prevent systems failing now. It’ll give systems at least 6months ofheadroom.We’re testing the longer-term solution currently and will add it into an update to 3.0.x andit is included from 3.1. The longer term fix re-indexes the data on a daily basis as opposed to thehotfix one-time re-index; it’s all working as expected, we just want to havemore testing time to becertain there are no longer term issueswemight havemissed.

Anything else that needs to be considered?In the initial set of systemswe’ve updated, we’ve seen disk space problems on some of the hostingVMHosts. If the hosting VMware Host Server runs out of disk space, the update fails and the VQCMVMwill need restoring from a snap-shot.

Please therefore:1. Ensure you take a VM snapshot of your VQCMand backup your CMS call bridge(s)

2. Check that the VMware Host Server has at least 200GB of free disk space

Do I need to apply this hotfix?Yes, you do need to apply it. This is a non-optional hotfix update. Your VQCMsystemwill eventuallyfail if you don’t apply it.

I‘ve seen previous advisories and wasn’t sure whether I needed to apply them andtherefore didn’t. What do I do now?Apply hotfix-3 (Jan 2019) and ignore the previous hotfixes. These hotfixeswill be addressed in theupgrade to 3.1 or later 3.0.x releases/hotfixes.

How do I apply the Hotfix?TheHotfix is supplied as an upgrade image (IMG). Download and apply the upgrade in the normal“drag and drop” manner.

After applying the hotfix, check the “Welcome back” page in VQCM-Admin and check that the VMversion number is 1.0.10

10 Applying Hotfix 3 (Jan 19) to VQCM 3.0.2


If you have any questions or would like assistance performing the Hotfix update, please [email protected].


11 VQCM-Admin; re-running the installation


11 VQCM-Admin; re-running the installationFromVQCM3.1, it is now possible to re-run the installation process to, for example, change FQDNnames, change the NTP server or if you forgot to set DNS A record values before running theinstaller the first time.

Clicking on “Run Installer again” from theVQCM-Admin Welcome page gives the followingwarning:

The data that will be lost includes:

The current set of certificates and the cluster topology information; if you havemultiple nodes,you will need to go through the process of adding worker nodes

A new set of self-signed certificates will be generated

12 VQCM-Admin; Restarting VQCM


12 VQCM-Admin; Restarting VQCMRestarting VQCMVMwhich can be achieved via the VQCM-Admin>Manage>Cluster page andperforming a “rebalance cluster”:

“Rebalance” results in all the Pods in VQCMbeing shutdown and restarted; it can take severalminutes. Use the VQCM-Admin home page tomonitor progress.

The “rebalance” process has just started and all Pods have been shutdown and have not yetrestarted:



Sometime later (several minutes):

Sometime later (several moreminutes):



In the “all-green” state, the system is running.

13 VQCM-Admin; Configuration Settings changes via the VQCM database


13 VQCM-Admin; Configuration Settings changesvia the VQCM databasePrevious generations of VQCM required settings to be changed via the command line. From 3.1,VQCM-Admin contains the following page that enables database changes via the user interface.

CAUTION: Onlymake changes under supervision fromVQor based on guidance fromdocumentation.

The following documents are available that explain available configuration options:

• Blast Dial/Reactive calls Configuration

• Configuration Options

Both are available for download from the vqcomms.com


14 Kibana Dashboards


14 Kibana DashboardsVQCM3.2 completed amajor reworking of Analytics and the data that’s stored in Elasticsearch.Details of the changes can be found in “Elastic data improvements”.We plan further minor changes in a future release to handle the CMS licensing changes introducedat version CMS 2.6.We need to change how we request licensing data and the new content.

The default Dashboard from 3.2 looks like this (truncated screenshot):

There are 7 groupings:

Tile Description

Usage Patterns View usage over time; includes monthly, day of week, hour of day and by device type (Video,Audio Only, WebRTC/CMA and Skype)

Operations View which Participants were in calls/Spaces and a variant that provides visibility on Par-ticipant Alarms and call quality.

Cisco MeetingServer

View CMS bandwidth consumption per node; CMS license consumption and CMS mediaprocessing load.

Participants View Participant data such as number of Active Participants, Top Participants, Participantsby Cost Code and Disconnect Reasons

Users View number of Active Users, the Top Users (by in call time on their Spaces) and by CostCode



Tile Description

Spaces View Active number of Spaces, Top Spaces by in call time

Internal VQCMdiagnostics

Internal data for VQ Support

Some representative screenshots

Usage Patterns



Operations

Participants and Alarms:

Find Participant in Call Bridge

In this example, note how Space 42 has been selected as a filter:



CiscoMeeting Server

Participants



Users

Spaces



14.1 Legacy DashboardsThe legacy VQCMdashboards from earlier versions can be accessed via the VQdashboardhomepage. Accessing the Kibana dashboard is also possible from the VQCMdashboard homepage(IndexCardWelcomeDashboard).The real-time dashboards carried over fromAcanoManager 2.3 will be retained for some time butwe do eventually plan to remove them from the product; the functionality available in Analytics 2 is farmore attractive.

14.2 Dashboard, Visualization and Search maintenance and updatePolicyThe VQCMupgrade tool will replace VQCMdashboards, visualizations and searches if updates areavailable.

Please, therefore, copy (clone) our dashboards, visualizations and searches if you want to makechanges.

To edit dashboards, open a Dashboard, click “edit” from themenu and then “save”; on the “save”,you will have the option to “save as a new file”. Remember that Dashboards consist of one or moreVisualizations. The easiest way of finding the visualizations is to edit the dashboard and then click onthe cog icon against each visualization. Edit the visualization and save as a new visualization (if youneed to change the visualization). Edit and save your new copy of the Dashboard before editing andrenaming visualizations.

14.3 Updating Dashboards or creating your own.Updating a Dashboard is easy; open a Dashboard and click “edit” from themenu. Then clickMenu>Add and add the visualization[s] required. Drag and drop them to position and resize as



required.

Please read section “Dashboard, Visualization and Searchmaintenance and update Policy”.

14.4 Elastic data improvementsThe data VQCMwrites into Elastic has had amajor reworking. The indexes that contain VQCMdataare the following:

SystemState

Tenant State

CallBridge State

CMS Alarms

Call Analytics

Participant Analytics

The following indexes remain but will be phased out once there is sufficient equivalent data in thereplacement indexes (for example, in 12months-time).

Transformed stats (aka "Session Statistics")

l Replaced by SystemState

TransformedCustomer (Customer/Tenant usage summary)

l Replaced by Tenant State

TransformedMCU (Call Bridge/CMS node data)

l Replaced byCall Bridge State

l Additional new Index,CMS Alarms added

14.5 Elastic data populationThe core VQCMprocesses collect a variety of data and write it into Elastic. The data is writtenapproximately every second. Elasticsearch is an object store and is unlike a conventional database;it trades performance for some of the features traditionally associated with a “classic” (or relational)database. There are no, for example, relationships between tables (or indexes).

The VQCM “metrics digester” process (Pod) collects the data fromVQandwrites a collection ofdocuments to the database every time slice. Each document is written with the same time stamp; thetime stamp is then used to group all the data associated with the same point in time.

So, for example, if your system has 3 CMS Nodes, VQCMwill write a “state” document for eachCMS node on your system every time slice. Looking in the “Discover” panel of Kibana (havingselected the “Call bridge States” index) , you’d see 3 documents in “Call Bridge States” at 09:00:00,another 3 at 09:00:01 and another 3 at 09:00:02.

The data in the Indexes can be processed by Searches or Visualizations; the results are displayed inDashboards.



The following sections describe the contents of the VQCM indexes:

14.5.1 SystemStateAs the name suggests, this is a snapshot of the current state of VQCM. The data includes totals forkeyCMS data such as bandwidth consumption and licensing.

“System” contains an overview of VQ’s state; how long its been running, software version, numberof call bridges, online call bridges, number of Tenants, Users and Endpoints. It also contains data onhow the system is performing, how long its taking keyCall Data Record (“CDR”) processing paths toexecute (msecs) and how the database is performing (save times/msec).

“Cms” contains summary data for the CMS nodes in the system. Status is the real-time number ofhow manyCall Legs (Participants) are active. Multipoint Licensing is the aggregated (Sum/Total)value of theMultipoint licensing information returned from each call bridge node. Note that thislicensing data differs from the status information in that it is not real time. It can be up to 5minuteslate. Also note that the licensing data collection process has changed at CMS 2.6 and we need toupdate VQ to support the new mechanisms; this data will therefore change in a future release.Bandwidth is the aggregated value of from all call bridges.

“CallsAndParticipants” breaks down the types of call currently running into Scheduled Calls andSpace based Calls. A Scheduled Call is one that has been created via “New Meeting” and runs fora specific duration. A “Space Call” is one that was created by a Participant joining a Space and theSpace instantiating a new Call. The total number of Calls and Active Participants are provided aswell as the breakdown by type (and within each type, themix of audio only or video).

Don’t be too alarmed by the fact we’re showing JSON data below. Kibana has really nice auto-complete type-aheads on field names – start typing in the name of the field you’re looking for andKibana will find it (for example, start typing “bandwidth” and it’ll findmatching names and pre-fill with“system.cms.”

Example SystemState data (JSON format):







14.5.2 Tenant StateTenant State provides a snapshot on the state of each Tenant.

Activity on the Tenant is broken down into Active Calls and Active Participants with a furtherbreakdown into Space and Scheduled Call based activity.



14.5.3 Call Bridge StateCall bridge State provides a snapshot on the state of each Call Bridge.



Please note that “status” is the real-time value. License info updates periodically and can be up to 5minutes out of date. Themechanism for gathering licensing data changed at CMS 2.6 and thereforethis data will change in a future release tomatch the new mechanisms.





14.5.4 CMS Alarm StateCMS Alarm state provides a snapshot of the Alarm conditions on each CMS Node.



14.5.5 Call Analytics IndexTheCall Analytics Index provides details for each Call started on a Space. A Call starts on the Spaceeither as the result of a Meeting being scheduled (VQCMexplicitly creates the Call on the Space atthe required start time) or automatically by CMS when the first participant calls onto the Space.

A Call may have one or more Participants (Call Legs in CMS terminology). The Call Analytics recorddoes not contain individual Participant records – they are available on the Participant Analyticsindex. The Call record does, however, contain themaximumParticipant concurrency experiencedwhilst the call executed (themaximumnumber of Participants in call at any point in time; this is notthe same as the total number of participants who joined the call – Participantsmay join several timesbecause, for example, of connection drops).



UtcStartTime and UtcStopTime is the UTC time the Call started and terminated in a hard-codedUTC format. StartTime and StopTime is the Start and Stop time of the call in ISO formatted time; thisis then displayed by Kibana in the viewer’s local time.

PacketLoss, Excessive Round Trip delay and Jitter values are themaximum values across allParticipants in the call (in other words, the worst case data from any of the Participants in the call).The values are not the packetloss, high round trip or Jitter percentages (as in “packet loss was 5%”);they are the percentage of time in the call where the associated alarm condition was true (“thePacket loss Alarmwas set for 5% of the call time”).

The Participant Records (see note above about Elastic not being a Relational Database) for the callcan be found by searching using the “id” key value (in the record below, 458).

Please use the “coSpace URI” field rather than “URI” for the URI.





14.5.6 Participant Analytics IndexThe Participant Analytics Index provides details for Participant that joined a call on a Space. Thedata is generated by VQCMbased on CDR (Call Data Record) state change events produced byCMS.

The example below is for an audio only Participant and for that reason, details like video geometrydetails and video codec are not set.

UtcStartTime and UtcStopTime is the UTC time the Call started and terminated in a hard-codedUTC format. StartTime and StopTime is the Start and Stop time of the call in ISO formatted time; thisis then displayed by Kibana in the viewer’s local time.

“Calling Number” and “Number to Call” values are retained for backwards compatibility. Thereplacement values to use are “Uri” (or coSpace URI) and Remote Address. URI is the address ofthe Space and Remote Address is the address of the device that’s in-call with the Space.

CallId is the Identifier of the Call in the Call Analytics Table. coSpaceCallId is the Identifier used toroute Participants onto a Space via the IVR.

Events: the states the Participant has taken. Typically, joining, incall, disconnected.

The time the Participant spent connected is obtained via duration, durationSeconds,DurationMinutes or DurationHours. Duration has been retained for backwards compatibility and isthe legacy “seconds” value and has been superseded by durationSeconds.

PacketLoss, Excessive Jitter and High Round Trip time are not loss values. They are the percentageof time the Alarm condition was true over the duration of the call.

MaxParticipantConcurrency gives themaximumnumber of concurrent Participants in the call (it’sincluded on the Participant record to remove the requirement to access the Call Anaytics index).







14.6 Cost CodesCost Codes are configured via the "LDAP Configuration" page with values being imported fromLDAP/AD.

Each User can be imported with a Cost Code; the Cost Code is associated with any Space createdby the User. This is the “Space Owner Cost Code”.A default Cost Code can be defined on each Tenant; this value will be used if no Cost Code isassigned during the Import Process. The Tenant Cost Code will be applied to any Spaces“Discovered” on CMS for the Tenant that were not created by VQCM.

Participant Cost Codes are associated with Endpoints; Endpoints can be created automatically foreach User as part of the Import process or are created at run-time as new Participants are added tocalls.

Each Participant in a Call will therefore either be based on an Endpoint associated with a User (andtherefore pick up the User’s Cost Code) or will be a new/discovered Participant. New/DiscoveredParticipants will be assigned the Cost Code of the owning User of the Space.

The Endpoint Importer tool has been updated to support Cost Codes.

14.7 Legacy records and “Missing” valuesParticipant and Call records that used to only contain “duration” (seconds) valueswill, from 3.1,also contain DurationHours and DurationMinutes values.When producing reports from historicalrecords, these new valueswill not be present.



Be aware that some of the dashboardsmight therefore contain results that include a subset ofrecordswith DurationHours/Minutes values. Youmight, therefore, see values that initially don’t lookright in that the reported number of duration (seconds) doesn’t match the duration in hours orminutes. This is because the data contains amixture of new and old records.

TheMediaType value was added in 3.1; youmight therefore see “Missing” for theMediaType valuefrom earlier records.

14.8 Participant RemoteAddress, CallingNumber and NumberToCallTheRemoteAddress value was added in 3.1 to simplify the identification of Participants. For eachParticipant record, CoSpaceURI identifies the Space URI and RemoteAddress identifies theaddress of the device. RemoteAddresswill appear as “Missing” in records generated before 3.1.Before the addition of RemoteAddress at 3.1, we had CallingNumber and NumberToCall.Depending on whether the call was an outbound call from theMCU(CMS) or an inbound (to theMCU/CMS), the CallingNumber would either be the Space URI (an outbound call from a Space onCMS) or CallingNumber would the device number (Because it was calling into a Space).

Thismade reporting awkward (and difficult to explain); RemoteAddress simplifies thingssubstantially. We’vemadeNumberToCall and CallingNumber available in some of the filters toenable searching of legacy records.

14.9 Kibana filter changesPrevious versions of Kibana allowed values to be filtered via the +/- icons. They can still be used onsearches but themodel has changed on charts:

It now works as follows:



15 Kibana FAQ's


15 Kibana FAQ's

15.1 Are the searches case sensitive?No.

15.2 Do you include Skype/MS Teams participants?Yes. If they are Participants joining a call on a Space.

15.3 What is required to enable Kibana exporting Dashboards as pdfand send per mail?It requires the Elastic Subscription pack. This allows exporting data asCSV and/or PDFs.Watchers(triggering events on specific conditions), a SQLConnecter (Connect to Elastic from software thatsupports SQL connecters).

15.4 How do you add external sources to Kibana? I have setup nodejsto pull Cisco CE video endpoints analytics and data such as peoplecount, people presence, mediachannels, packet loss etc. Is thissomething that can be integrated into VQ and Kibana?One of the great benefits of Elastic is that this sort of thing is relatively easy. It’s on our roadmap; thechallenge at themoment is we have a current set of priorities we need to do first. If you’d like to workwith us and potentially help speed this up, we’d love to talk.

15.5 Is it possible to add CDRs from Expressway to VQ’s Kibana?In principal yes; we’d need to pull the CDR data fromExpressway and then inject it into Elastic (andtherefore be visualized by Kibana). It’s something we’d like to do and it’s on our roadmap. If you’d liketo work with us and potentially help speed this up, we’d love to talk.

15.6 Does VQ Conference Manager manage Spaces and roomconfiguration in CMS? Is the primary function is a reporting andmonitoring platform?VQ ConferenceManager doesmanage Spaces on CMS (provisioning, meetingmanagement,scheduling, self-service apps).

15 Kibana FAQ's


15.7 How do you handle quality for video calls in VQCM?Currently, we store details like packet loss, jitter, high roundtrip, video geometry and codec details(audio/video) into VQ’s CDR records that can be processed after the event by Kibana. VQalso hasthe ability to present operators real-time call quality data via the Statistics option on the Activity page.We are looking at persisting this additional information into Elastic; the issue is that the CMS API islimited in terms of requests per second and so there’s a complication of doing this in amanner thatworks and doesn’t kill a systemwith large numbers of concurrent calls. We are working on a new toolthat applies AI/Machine learning techniques to processing a range of factors on calls that will allow‘good’ or ‘bad’ calls to be identified.

15.8 How many reports are there in Kibana? And is there any way ofcustomizing ones?There are currently 7major dashboard panels. Each panel contains between 4-6 visualizations. So,somewhere in the region of 40-50. Kibana has very good inbuilt support for creating newvisualizations and dashboards or taking existing ones and customzing.

15.9 Further informationIf you have any further questions please don’t hesitate to get in touch ([email protected])


16 Configuring VQ-Admin to work with Okta, Duo and OneLogin SAML2


16 Configuring VQ-Admin to work with Okta, Duoand OneLogin SAML2The process required for Okta, OneLogin and Duo is essentially the same: The first step is that theapplication is registered for use with the SAML2 Service Provider. The Registration processrequires details on the Identity (certificate based FQDN URI) that the application uses to identifyitself and provides a URI (certificate based FQDN) that the application will use to interface with theSAML2 Service Provider. In the case of Okta, the Service Provider also provides aMetadata URIthat the application should use to obtain details about accessing the SAML2 service.

On enabling SAML2, the SAML 2 text boxeswill be enabled.

The Identity ID is the Login FQDN for your VQCMwith a postfix of “/Saml2”. For example, if yourlogin FQDN is login.vqcm.mydomain.com, the Identity ID needs setting tohttps://login.vqcm.mydomain.com/Saml2.

CAUTION:We strongly recommend copy/pasting the Entity ID fromVQCM into your SSOprovider’s settings to reduce the risk of hard to identify problems.

The certificate used to sign the certificate used by VQCMneeds to be from a public CertificateAuthority. For customerswho use privately generated certificates from a non-public root, the rootcertificate will need to be added to VQCM’s public certificate store via the VQCM-Admin portal.

Summary of differences betweenOkta, OneLogin and Duo:

• OneLogin and Duo require the Provider Issuer URI only

• Okta requires both the Provider Issuer URI andMetadata URI

16.0.1 Example Okta SAML 2 settings:



16.0.2 Example OneLogin/Duo settings:

Note that OneLogin and Duo automatically resolves theMetadata URI as part of the handshake thattakes place between the VQCM Identity Server and theOneLogin/Duo Identity Provider.



16.1 Whitelist for the Outlook Add-inThe "whitelist" is a list of good URLs that the Outlook Add-in will talk to, preventing it rejecting therequest because of the risk of "cross site scripting".

The "whitelist" needs setting when using an external autherisation provider (i.e. normally anyoneusing SAML2). It needs setting to the domain that users get redirected to, to login.

For example:

https://yourdomain.okta.comwould be theOkta domain

https://yourdomain.onelogin.comwould be the onelogin domain

As the first part of the domain is different for every customer it needs setting for each customer.

An example with values for a Duo setup:

https://xxxxx.okta.com/

https://xxxxx.dev.onelogin.com/



17 User Identities when using SAML2


17 User Identities when using SAML2One of the key concepts to understand when using SAML2 is “how does VQCMknow who the useris”?

From 3.1, when a user authenticates, VQCMhas absolutely no visibility on the process. All VQCMknows is that a user is authenticated and the identity of the user. VQCM knows nothing about thecredentials presented; that’s all handled by the Identity Servers. We don’t even know ifauthentication fails; we only know about successful authentications. In the case authentication issuccessful, the result of the process includes the identity of the authenticated user. VQCM then usesthat identity to do a lookup on the users imported fromAD/LDAP; we’ll find amatch and know theuser and from that, details such as their Tenant and Space details.

When using SAML2, you therefore need to do the following (this is a generalized overview):

1. Provision your SAML2 Service Provider with users from your AD/LDAP source of truth.

2. Provision VQCMusing the same AD/LDAP settings

3. Ensure that the Identity returned by successful SAML2 authenticationmatches the useridentity (login name) configured in VQCM’sLDAP Config page. As an example, this wouldnormally be either “sAMAccountName” or “uid” on anOpenLDAP system and result invalues of (for example) “mike6666” being imported fromAD/LDAP and returned from theSAML2 successful authentication.

18 Configuring Microsoft ADFS SAML2


18 Configuring Microsoft ADFS SAML2This configuration was tested against a windows 2012 R2 server.

1. OpenMicrosoft Management Console by runningmmc.exe in either a powershell terminal orcommand prompt terminal.

2. Select File > Add/Remove Snap-in and addAD FS Management

3. From theActionsmenu on the right hand side select “Add Relying Party Trust”4. Click “Start” on the first page of the wizard5. Select “Enter data about the relying party manually” and click next



6. For “Display Name” enter in “VQ Conference Manager” and add any notes you require.Then clickNext

7. Select “AD FS Profile” and then clickNext



8. Ignore the optional token certificate page and clickNext9. Select “Enable support for the SAML 2.0 Web SSO protocol” and enter in the following

addresswhere <login_fqdn> is the login fqdn of your VQCM installation. https://<login_fqdn>/Saml2/Acs. ClickNext



10. Enter in the following addresswhere <login_fqdn> is the login fqdn of you VQCM installation.https://<login_fqdn>/Saml2. Click “Add” and then clickNext



11. Select “I do not want to configure multi-factor authentication settings for this relyingparty trust at this time” and clickNext

12. Select “Permit all users to access this relying party” and clickNext13. Review the options you have selected and clickNext . (You should not need to add any

additional data on this page. The relying party trust can be configured further after initial testingif required.)

14. Make sure “Open the Edit Claim Rules dialog for this relying party trust when thewizard closes” is selected and clickClose

15. In the “Edit Claim Rules” window make sure you have the “Issuance Transform Rules” tabselected and click the “Add Rule” button



16. Select “Send Ldap Attributes as Claims” and clickNext17. Enter in the following fields:

a. “Ldap Email” as the claim rule name

b. “Active Directory” as the attribute storec. “E-Mail-Addresses” as the Ldap Attributed. “E-Mail Address” as the Outgoing Claim

Then clickFinish



18. Click Add Rule again and this time select “Transform an Incoming Claim” and clickNext19. Enter in the following fields:

20. a. “Email to Name ID transform” as the claim rule name

b. “E-mail Address” as the incoming claim type

c. “Name ID” as the outgoing claim type

d. “Email” as the outgoing name ID format

e. Select “Pass through all claim values”ClickFinish



18.1 VQCM: configuring ADFS SAML21. Navigate to the vqcm-admin interface (https://<vqcm_fqdn>:1234) and then navigate to

Manage > CM Configuration2. On theCM Configuration pageCheck the Saml2 check box and enter the following fields

where <login_fqdn> is the login fqdn of your VQCM installation and <adfs_server_fqdn> is thefqdn of your adfs server:

a. “loginId” as the SAML2 username field.b. https://<login_fqdn>/Saml2 as the Entity IDc. http://<adfs_server_fqdn>/adfs/services/trust as the Identity Provider Issuer URLd. https://<adfs_server_fqdn>/FederationMetadata/2007-

06/FederationMetadata.xml as theMetadata Uri

Then clickSave



You should now be able to navigate to the VQCM fqdn and login using your windows credentials.

18.2 Things to watch out for1. Make sure you are using themail ldap attribute as the username field for your users in the ldap

config. This will then bematched against the Name ID claim from the adfs server which alsocontains the ldapmail attribute.

2. If your ADFS server service certificate is signed by an internal certificate authority, then youwill need to contact VQ support to help you configure the VQCM identity server component totrust your internal CA. This processwill be available through CM-Admin in the future.

18.3 Alternative ConfigurationIf you wanted to use another unique ldap attribute other than email to use as the Name ID claim thenyou could do this bymodifying the 2 claim rules to use this alternative ldap attribute instead of theemail attribute. You would also need to configure your ldap config in VQCM to use this alternativeattribute as the username field.

19 Installing VQ Windows Identity Server


19 Installing VQ Windows Identity ServerWith the introduction of Microsoft ADFS support in VQCM3.3, the recommended path to enableSingle Sign-On usingWindowsAuthentication is to take theMicrosoft ADFS route. Using ADFSremoves the requirement for the VQWindows Identity Server package and that customers shouldtherefore start the process of migrating to ADFS. VQWindows Identity Server will not be available inthe VQ3.4 product.


For customerswho are unable to switch to ADFS in the 3.3 time-frame, please use the followingprocess:

1. Please read the document “Windows Identity Server Check List process”, which can bedownloaded from vqcomms.com

2. Perform a normal VQCM installation using VQCMAdmin and when you get to the“Authentication Mode” step of the wizard, select “Yes” to the “Are you going to use anexternal VQ CM Windows Identity Server to perform authentication?” question

3. Continue running through the Install Wizard process

4. You will eventually get to the point where the system indicates the process is complete andprompts to login again as VQCM-Admin

5. Once you have done step 4, you will need aWindowsServer (Server 2012 R2 or above)machine which is running as part of the sameDomain as your authentication Domain NameController

6. On theWindowsServer system, run the VQCMWindows Identity Server 3.x installer as a userwith administrative privileges (the installer will prompt for them). For more details see“Running the VQCM Windows Identity Server 3.x installer “

7. Once the VQCMWindows Identity Server 3.x installer has been successfully installed, go backto VQCM-Admin and from theAuthetication Clients page, click the “InstallationComplete” button

8. From the VQCM-AdminWelcome page, access the “Manual Login” (below the systemFQDNs) and login with VQCMas the administrator. Provision your CMS nodes, Tenants,LDAP Configuration settings and run the LDAP importer to import a set of users that can beused to test authentication against Windows

9. Check that at least one of the VQCM Users imported at step 8 can log in to VQ andsuccessfully authenticate

a. Please read “User Identities when using Windows Authentication”

http://vqcomms.com/login

20 User Identities when using Windows Authentification


20 User Identities when using WindowsAuthentificationOne of the key concepts to understand when usingWindowsAuthentication is “how does VQCMknow who the user is”?

The good news is that the process is almost identical to that described for SAML2 (see “UserIdentities when using SAML2”). TheWindowsAuthentication process returns an“authenticated” result containing the Identity of the user.When usingWindowsAuthentication, you therefore need to do the following:

1. Provision VQCMUsers via LDAP Config settings from your Active Directory Service

2. Ensure that the User Identity (login name) attribute configured in VQCM’s LDAPConfiguration page will deliver the same set of Windows Login user identities that will be usedwhen users sign-in toWindows. For example, “mike6666” being imported fromAD/LDAP andreturned from theWindows successful authentication.

21 Enabling Single Sign-On


21 Enabling Single Sign-OnSSO is, by default, disabled.

Remember, that when you enable SSO, all non VQCM-Admin authentication is performed by theremote Identity Provider (e.g., WindowsAuthentication or a SAML2 service) rather than locally onthe VQCMcluster. The VQCMAdministrator account created during install will therefore stopworking (because it is not a SSOuser).

The following sequence should be applied:

1. Create your Tenants

2. Configure LDAP settings as required for your user, Operator and Administrator user groups

3. Import the users from LDAP/AD

4. Enable SSO

a. Remember, at this point, all authentication switches to the external Identity Provider andthe local on-board authentication for VQCMAdministrator will stop working

5. Test a representative set of users can authenticate and sign-in in each of the groups you haveconfigured (User, Administrator, Operator or any custom ones you have created)

6. If they can’t, log back in to VQCM-Admin (as the VQCMAdmin), disable SSO

7. Login as the VQCMAdministrator. Check your LDAP settings. Common causes of problemsare:

a. The user name field in LDAP Settings does not match the SSOuser name. e.g., IdProvider returns: [email protected] but the VQ login name provisioned via thesettings on the LDAP Config page [email protected]

b. The SSOuser name does not exists in the list of users in VQ (for example,[email protected] exists on the ID Provider but the user name hasn’t be provisionedin VQ)

8. If you can see no obvious cause for the problem, contact [email protected] andwe’llwork with you to figure out what the problem is


22 Running the VQCM Windows Identity Server 3.x installer


22 Running the VQCM Windows Identity Server 3.xinstallerWith the introduction of Microsoft ADFS support in VQCM3.3, the recommended path to enableSingle Sign-On usingWindowsAuthentication is to take theMicrosoft ADFS route. Using ADFSremoves the requirement for the VQWindows Identity Server package and that customers shouldtherefore start the process of migrating to ADFS. VQWindows Identity Server will not be available inthe VQ3.4 product.






Insert your VQCM-Admin credentials and the FQDN of your VQCMsystem (Master node):

The CIDR whitelist defines the IP address range the VQ Identity Server will receive authenticationrequests from. To whitelist all IP addresses, use: 0.0.0.0/0 (strongly NOT recommended).





The FQDN for your Windows Identity Server will have been configured via VQCM-Admin (loginFQDN). Please ensure you also update the DNS A-Record for the login FQDN tomake sure itpoints to the correct host IP address.

We also recommend that you set the DNS A-Record TTL (“Time To Live”) value as low as possiblebefore changing the record to ensure that it is propagated quickly so the value in use is up-to-date.

The following links provide useful information on how to view Certificates in theWindowsCertificateStore using theMMC snap-in and how to retrieve a Certificate Thumbprint:

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-retrieve-the-thumbprint-of-a-certificate

We recommend two certificates on theWindows Identity Server; the first is for the FQDN of theIdentity Server.

The Second is the signing key; this decouples the signing process from the FQDN of the hostingserver; if you change the host name at some point in the future, the signing key remains the same.

It also enables you to use different security levels (for example, longer keys) for the signing cert.









The first thumbprint is for the FQDN Certificate. Select the required thumbprint (see “how toretrieve a thumbprint for a certificate") from the drop-down.





The second thumbprint is for the Signing Certificate (The signing key is used to generate signedauthentication responses). Select the required thumbprint (see “how to retrieve a thumbprint fora certificate") from the drop-down.







23 Fixed issues


23 Fixed issues

23.1 VQ Conference Manager 3.3Issue Number formatFromVQCM3.3, we’vemoved to a new engineering tool that consolidatesmultiple tools into one.Issue numbers now have the form of a 6 digit, alpha-numeric value. The issue numbers span all VQcomponents and have ascending values.

IssueNumber

Description Summary

3cj9bv Outlook Add-in does not load and the panel appears white, blank

The Microsoft office-js library used by the Outlook Add-in needs updating to supportthe very latest version of Outlook

Fixed in3.3

4206 Improve importer URI clash error messages. The message now states that the newURI clashes on CMS with a URI that was not created by VQ

Fixed in3.3

4204 LDAP Config page; Unchecking "Create Endpoint for User" when Endpointsalready exist results in “Error Deleting Endpoint: Unable to resolve type” errorsbeing reported when the import is run

Fixed in3.3

4200 Attempting to schedule a call with no participants resulted in an error being dis-played and the schedule failing

Fixed in3.3

4194 HTTP 404 error on deleting a UX Profile Fixed in3.3

4190 When creating a new call using a multi-Role Space Template, adding a participantto a call via the Call coApp correctly uses the Participant Role for the first participantadded but for subsequent participants, incorrectly uses the Host Role

Fixed in3.3

4189 Add config for SIP domain to Tenant in order to allow Jabber Add-in to call intoSpaces. Note, in a future release, we’ll also expose the Tenant sipDomain as a prop-erty accessible via Invite Template scripts and therefore remove the requirement tomanually replace “mydomain” with the actual Sip Domain value

New in3.3

4134 When scheduling a call on an existing Space as a user, the Space typehead returnsall Spaces at the user's ACL rather than only the Spaces the user is the owner or amember of

Fixed in3.3

4109 Allow Owner and Access Control Id of a Space to be set via UI. This functionalityallows, for example, Operators to create Spaces on behalf of other people

Fixed in3.3

4011 UX Profile coApps incorrectly referencescCoApps (Logging, Certificate andUpgrade) that have been moved to VQCM-Admin

Fixed in3.3

3723 Changing VQ Portal’s SMTP settings resulted in audit records being written to thedatabase rather than Elastic

Fixed in3.3

23 Fixed issues


IssueNumber

Description Summary

2942 Search can result in a confusing set of double results as VQ and Google Chrome“auto-complete” both show results

Fixed in3.3

427 A small number of systems experienced issues where CMS reported delays pro-cessing Call Data Records; users and utility applications experienced timeoutswhen authenticating

Fixed in3.3

424 Changing the User's Tenant on the User page does not enable the "Done" button.

If you try to change the Tenant for a User using the User page you can select thenew tenant but the "Done" button doesn't get enabled. Changing other fields doenable the "Done" button

Fixed in3.3

414 Jabber Add-in functionality added.

This is, essentially, the same functionality available in the Outlook Add-in. Jabbermust be running 12.7 or greater

New in3.3

410 Rework VQCM navigation menu bar to be always shown and nicer. Like 407, this isone of the first visible “Activity 2” changes

New in3.3

409 VQ Conference Manager User Interface. We have a long-term objective of makingthe CM UI more accessible. In 3.3, we’ve made an initial step and have enabledscreen readers

Background reading:

https://www.w3.org/WAI/standards-guidelines/aria/

https://blog.angular.io/accessibility-in-angular-e84f73a223f

New in3.3

407 Add breadcrumbs navigation to VQCM.

This is a one of the first visible changes coming as part of the “Activity 2” changes

New in3.3

399 When buttons are disabled, display the “not-allowed” cursor Fixed in3.3

395 Long Space names in the meeting list page overwrite and become unreadable Fixed in3.3

368 Add a VQCM Admin "credits" page New in3.3

https://www.w3.org/WAI/standards-guidelines/aria/

https://blog.angular.io/accessibility-in-angular-e84f73a223f

23 Fixed issues


23.2 VQ Conference Manager 3.2.3

IssueNumber

Description Summary

15 LDAP paging control identification error caused LDAP/AD Paged Searches to fail.

A change to the NameSpace used within the LDAP library to enable it to be packaged asa NuGet package (so other Open Source consumers could use it) resulted in the lookupcode for LDAP controls failing.

This resulted in the “Paged Search” control not being found with the result that VQCM3.2.2 could only fetch the first 500 (first Page block) users from LDAP/AD

Fixed in3.2.3


IssueNumber

Description Summary

4138 An LDAP import can, in certain circumstances fail, with a "size limit exceeed" error whenimporting from Microsoft Active Directory

Fixed in3.2.2

4120 After an upgrade, endpoints imported using the Endpoint Importer utility cannot be addedinto a call

Fixed in3.2.2

4092 VQCM sends a license expiry message for a legacy feature Fixed in3.2.2

4090 Use the same time stamp for all Kibana SystemState related indexes Fixed in3.2.2

4075 Unable to save Kibana visualization changes OR the system would fail to initialize after arestart with the Elastic Pod failing OR the system would run out of disk space

Fixed in3.2.2

4074 On systems with large numbers of Tenants (>300), the volume of data written to Elasticbecame excessive and led to a disk full situation

Fixed in3.2.2

4069 Kibana Call data Records (and Alarm variant) visualizations did not include Durationvalues

Fixed in3.2.2

4065 Dashboard Statistics (incallParticipants.vmr.max.combined) shows zero when it shouldn’tbe

Fixed in3.2.2

4064 Meeting list filter datetime picker not working Fixed in3.2.2

4062 Unable to create a Space on an engineering version of CMS Fixed in3.2.2

4057 API endpoint missing security check Fixed in3.2.2

23 Fixed issues


IssueNumber

Description Summary

4056 VQCM-Admin; re-running the installer and changing the system FQDN resulted in sub-sequent attempts to login failing

Fixed in3.2.2

4054 Kibana Participant records have a high frequency of cases where the MaxCon-currentParticipant field is not set

Fixed in3.2.2

4052 The CMS details page has been changed to rename “Call Bridge Name” to “Call BridgeUnique Name” and therefore is now consistent with the naming used on CMS. This will,hopefully, reduce the number of cases where CMS clusters are configured in VQCM withincorrect node names

Fixed in3.2.2

4051 LDAP Configuration page; fix inconsistencies in field names Fixed in3.2.2


4042 Kibana Participant records do not include video codecs Fixed in3.2.2

4041 Elastic Participant records did not always contain video geometry data. A bug has beenfixed but, for example, if only one Participant is in a call, CMS sends no video andtherefore there is no video geometry data in the Call Leg End Call Data Recordgenerated by CMS

Fixed in3.2.2

4029 Call coApp places outbound calls to all configured members when outbound call to anamed device initiated from an idle Space

Fixed in3.2.2

4028 Add ability to bind SAML2 user identities to loginId or Email Fixed in3.2.2

4026 UX Profile Schedule Form page doesn’t show/hide the “Space Type” and “Participant”fields

Fixed in3.2.2

4025 UX Profile Schedule Form page shows an incorrect horizontal separator line Fixed in3.2.2

4019 UX Profile Alerts page shows duplicate “Invalid License” row Fixed in3.2.2

4014 Activity page; in certain circumstances, Space coApps can start to flicker Fixed in3.2.2

4006 “Browser Issue” detected page shows a link rather than a button (UI consistency) Fixed in3.2.2

4005 LDAP importer logging contained many legacy terms Fixed in3.2.2

4004 Space Templates page; small gap appears under Role tabs Fixed in3.2.2

4003 LDAP Pages; “Done” button not correctly aligned Fixed in3.2.2

23 Fixed issues


IssueNumber

Description Summary

4002 LDAP Configuration page; required fields are not marked “mandatory” Fixed in3.2.2

3989 Improve Error messages in Metrics Digestor Fixed in3.2.2

3988 Correct logging error in Metrics Digestor Fixed in3.2.2

3956 Outlook Add-in does not work in Outlook Web App (“OWA”). Fixed in3.2.2

3689 Participant and Call records written to Elastic can span indexes and lead to double count-ing

Fixed in3.2.2


406 Add Modsecurity and rate limiting keys (defaulted to false) in the NGINX HTTP proxyYAML configuration file. The intention is to allow customers requiring rate limiting to beable to enable this functionality. Future releases will move this into the VQCM-Admin UI

Fixed in3.2.2

401 "localhost" resolved to IPV6 preventing access to Kibana Fixed in3.2.2

400 NGINX HTTP Proxy logs do not contain the Remote IP address for HTTP requests Fixed in3.2.2

391 CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowingauthorized users sending malicious YAML or JSON payloads to cause kube-apiserver toconsume excessive CPU or memory, potentially crashing and becoming unavailable.

For more details see: https://github.com/kubernetes/kubernetes/issues/83253

Fixed in3.2.2

366 If the VQCM-Admin database is unavailable the system is in a broken state. Display anerror message with an action requesting the user contacts [email protected]

Fixed in3.2.2

361 VQCM-Admin; allow Certificates to be exported Fixed in3.2.2

355 VQCM-Admin; usability improvement. On the Certificates page, pre-fill Subject AlternativeName (“SAN”) fields using the system FQDN values

Fixed in3.2.2

349 VQCM-Admin “incomplete authentication client” message shows until page refreshed Fixed in3.2.2

341 VQCM-Admin; clicking on one of the system URI links automatically opens the page in anew tab

Fixed in3.2.2

https://github.com/kubernetes/kubernetes/issues/83253


23 Fixed issues


23.4 VQ Conference Manager 3.2

IssueNumber

Description Summary

3965 Typo in UxProfile coApp page (CoApp->coApp) Fixed in3.2

3940 Improve Identity Server logging Fixed in3.2

3917 LDAP Config page; sequencing of property fields broken and page is too complex. TheLDAP Config page has been restructured to be tabbed and now has tabs for General,LDAP and User

Fixed in3.2

3911 The non-trusted certificate authentication process has been refined with the pagesautomatically closing and redirecting to login once the non-trusted certificate has beenaccepted

Fixed in3.2

3901 Limit access to Kibana to users who have Admin ACL and the Analytics coApp enabled intheir UX Profile

Fixed in3.2

3839 Provide a configuration option to disable TLS when connecting to an SMTP server Fixed in3.2

3836 AM 2.3 -> VQCM 3.x upgrade; in cases where a URI validation rule had been applied toSpace Template, the validation rule was incorrectly applied to all Spaces Templates andresulted in Saves to Spaces failing with an “Invalid URI” message

Fixed in3.2

3830 Endpoints imported using the Endpoint Importer would not successfully connect into calls Fixed in3.2

3825 SAML2 authentication failed when upper case characters were contained in the pass-word

Fixed in3.2

3823 LDAP Config Page; incorrect reference to Acano Manager Fixed in3.2

3822 LDAP Config page; Space Secondary URI field is not displaying Fixed in3.2

3821 LDAP Config page; inconsistent use of "fields" on Mapping properties Fixed in3.2

3820 Space Templates page; Passcodes/Streaming & Recording properties. References toCMS 2.0. CMS 2.0 no longer is listed as a supported CMS version in the release notes

Fixed in3.2

3817 System Alerts page; Add modal view to full text of Alert Fixed in3.2

3814 Add "Media Encryption" column with values “Encrypted” and “Unencrypted” into Par-ticipant CDR record written to Elastic

Fixed in3.2

3811 Disabling a series on the Participants Statistics page clears on the next page refresh Fixed in3.2

23 Fixed issues


IssueNumber

Description Summary

3810 Allow users to change Login-Id without the change resulting in the user being deleted onnext-LDAP import. When importing users from LDAP, VQCM 3.2 saves each user’sdistinguished name (“DN”) and associates it with the user’s Login Id.

This solves two problems:

1. It removes the requirement for the clumsy “Domain name on LDAP property” (nowremoved) on the LDAP settings page

2. It allows Login Ids to be changed (more accurately stated: the attributes selected viathe LDAP Config page can be changed/resequenced) and the resulting change doesn’tresult in the user being deleted from VQCM (because the lookup on DN still results insuccess). This can be a very useful feature when, for example, switching to a SAML2Identity provider and the format of Login Ids change slightly and you don’t want todelete/recreate all users (and the associated pain of loosing Pins/Passcodes, Call Idsand Secrets)

Fixed in3.2

3807 Add ’user not found’ logging to SSO authentication paths to improve maintainability Fixed in3.2

3804 The User Interface can crash if two meetings are scheduled on the same space at thesame time

Fixed in3.2

3798 If a meeting was scheduled on a dynamically created Space, it was possible to join thecall from the point in time of scheduling rather than only shortly before the call’s start time

Fixed in3.2

3796 The list of tags contained within an ACL Service object returned to the user interfacecould contain information that wasn’t appropriate to other users at the ACL level (forexample, Tenant names)

Fixed in3.2

3790 “Object not found” error logged on LDAP import after 3.1 upgrade Fixed in3.2

3788 Add ability to disable participant selection from the call scheduling options page Fixed in3.2

3785 Automatically set “/Saml2” postfix in CM-Admin/Config page if SAML2 enabled Fixed in3.2

3784 After running the CM-admin reinstall process, Kibana needs to be disabled/enabled fromthe CM-Admin/Clients page

Fixed in3.2

3782 . Inconsistent search criteria between Search and Participant selection search. The Par-ticipant “type-ahead” selector now supports consistent * wild card characters. *abc findsstrings ending “abc”, “abc*” finds string starting “abc” and “*abc*” finds strings containing“abc”

Fixed in3.2

3766 Legacy Analytics file export/download failed with a 401 error Fixed in3.2

3764 The system crashed on load if calls were active on CMS as VQCM was starting Fixed in3.2

23 Fixed issues


IssueNumber

Description Summary

3761 Better handling of when an ad-blocker stops Analytics working Fixed in3.2

3758 Copyright in bottom left of CM should be 2019 Fixed in3.2

3753 VQ posting the wrong “CanPostMessage” value to CMS for a Space Member that can res-ult in the wrong Chat permissions for a CMA client user

Fixed in3.2

3748 Email templates - add preview HTML option Fixed in3.2

3746 Call coApp not starting a call when trying to dial any URI or User on an inactive Space Fixed in3.2

3734 Space created calls shutdown if participant leaves with a CMS node offline Fixed in3.2

3726 Activity page; change "Last Active" heading to "Expires/Last Active" Fixed in3.2

3703 Changing a Space from one template to another results in the Address field being hid-den. This results in the Address field being set to the user’s name plus a number

Fixed in3.2

3700 The Default Tenant’s default Space Template was set to Default Template. This has beenchanged to default to “Huddle Room”

Fixed in3.2

3699 Outlook Add-In manifest needs to contain an external login domain (OTKA/OneLogin etc.)whitelist entry to avoid problems with Cross Site references

Fixed in3.2

3698 LDAP Importer log entries contain "to to" when the importer encounters an error Fixed in3.2

3697 Incorrect reference to "Acano Manager" in LDAP Importer logs Fixed in3.2

3693 Outlook Add-in; persist the username client side so the user doesn’t have to re-enter itevery time

Fixed in3.2

3688 Creating a new too-long space template name generates an incorrect error message Fixed in3.2

3682 Change default precision on Kibana to 2dp from the default 3dp. Numbers are displayingwith 3 digits of precision

Fixed in3.2

3680 Unable to schedule a call on a temporary space with a URI generator Fixed in3.2

3677 Create Space on a tenant; +/layout icon formatting issues and unable to create Space Fixed in3.2

3674 Disabling UxProfile coApp also disables Default Tenant coApp Fixed in3.2

23 Fixed issues


IssueNumber

Description Summary

3673 Users can get a "request rejected" error when updating or deleting a Space Fixed in3.2

3667 Creating and cancelling a call very quickly can result in an error message that the McuUrireservation state is ’creating’

Fixed in3.2

3659 When creating a new Space, the Call ID field is disappearing if the Space Type ischanged

Fixed in3.2

3655 LDAP Config settings can lose their “Secure” setting on Save Fixed in3.2

3654 When Creating/Saving a new Space Template, the Secondary Call ID option can dis-appear on Save

Fixed in3.2

3649 When using an ad-blocker the offline dialog can appear and get stuck Fixed in3.2

3564 Date/Times in Elasticsearch data for Participant and Call CDR records are not stored in atimezone friendly manner and always show as UTC

Fixed in3.2

3492 LDAP Importer. Log user local time as well as UTC Fixed in3.2

3446 Rework Elastic SessionStats data to a simpler model (replaced by SessionState) Fixed in3.2

3214 Ensure customers can't use the %RND% generator in LDAP fields Fixed in3.2

383 Update Kubertnetes to 1.15.2 for vulnerabilities CVE-2019-11247 and CVE-2019-11249 Fixed in3.2

365 Upgrade to k8s 1.15 (bug fixes and HA readiness - beta) Fixed in3.2

358 Nginx Proxy logging; content traced as single object rather than set of objects Fixed in3.2

354 Backup tool updated to support incremental backup Fixed in3.2

345 VQCM-Admin; add last Pod restart time to CM-Admin & CLI. This change makes it moreobvious if a Pod has restarted and when

Fixed in3.2

281 Add support for multiple FQDNs. This is useful, for example, if customers require differentFQDNs for different geographic areas (e.g., US, Europe). Initially at 3.2, this functionalityis enabled by running a command line script; a user interface will follow. Please [email protected] for details on how to do this. A maximum of 2 additional FQDNscan be added

Fixed in3.2

272 VQCM-Admin; add improved validation to prevent FQDNs being added with upper casecharacters

Fixed in3.2

http://[email protected]/

23 Fixed issues


IssueNumber

Description Summary

266 VQCM-Admin->Database Settings tile typo Fixed in3.2

256 VQCM Admin - External Auth - Ask for domain to generate Outlook Add-in whitelist forexternal SAML2 Identity Providers

Fixed in3.2

254 Wrap the outlook.xml manifest download page in a more user friendly manner

253 VQCM-Admin; improve Certificates page to handle chained certificate creation/handling Fixed in3.2

252 Automate process of clicking "apply certificates" Fixed in3.2

251 VQCM-Admin main page shows URIs for nodes when it doesn't know the data Fixed in3.2

249 VQCM-Admin. CN and SANs not being displayed in the UI Fixed in3.2

240 VQCM-Admin; Automatically restart all Pods after updating database settings Fixed in3.2

220 VQCM-Admin; Enable upload of password protected keys for certificates Fixed in3.2

129 Kibana Default Dashboard not defaulting to VQCM’s default Fixed in3.2

18 Remove legacy text (“MCU” in guidance text) from call-bridge URI clash event log mes-sage

Fixed in3.2

16 iOS App; logging out does not clear the OIDC cookie on the iOS app Fixed in3.2

Fixed in3.2


IssueNumber

Description Summary

3840 Add configuration option that enables TLS to be disabled when connecting toSMTP servers

Fixed in3.1.3

3834 Do not overwrite URI/Call id values on Space Settings page if the Space Templateis changed

Fixed in3.1.3

23 Fixed issues


IssueNumber

Description Summary

3833 SSO ‘user not found’ logging improved to help isolated SSO authentication issues Fixed in3.1.3

3829 SAML2 login failed because of case Sensitivity Fixed in3.1.3

3790 Object Not Found exception running import after upgrading to 3.1 Fixed in3.1.3

3677 Logged in as an Operator (or Admin), Tenant>Spaces.

Call coApp, Scheduled Call, Settings coApp incorrectly displaying below the green+

Fixed in3.1.3


Issue Number

Description Summary

3769 CM crashes if rebooted with running calls Fixed in 3.1.2

3767 Legacy Analytics download has broken Fixed in 3.1.2

3750 Ldap authentication does not work in secure mode Fixed in 3.1.2

3746 Call coApp not starting a call when trying to dial any URI

or User on an inactive Space

Fixed in 3.1.2

3673 Users can get a "request rejected" error when updating or deleting a space. Fixed in 3.1.2

23 Fixed issues


23.7 VQ Conference Manager 3.1

IssueNumber

Description Summary

3692 During testing of the Outlook Add-in, we found an interestingMicrosoft “feature”. If Outlook’s extension library detects ajavascript error/exception, it posts the exception data (but nodata identifying the user or machine) back to a Telemetry datacapture server at Microsoft

The issue is tracked on Github(https://github.com/OfficeDev/office-js/issues/61) and Microsofthave responded stating that the problem is being worked onand does not violate GDPR

Closed

3691 The Outlook Plug-in does not support network proxies Closed

3404 Clicking on Passcode on a Space of type "Default Template"results in a very long password being displayed

Fixed in 3.1

3403 Change "Alert" to "Notification" in message subject to make itless alarming

Fixed in 3.1

3394 Elasticsearch is configured to generate too many shards andeventually runs out of memory

Fixed in 3.1

3202 Add MediaType (Video or AudioOnly) to Participant Call DataRecords written to Elastic

Fixed in 3.1

3201 Add Participant and Owner Cost Codes to Participant Call DataRecords written to Elastic

Fixed in 3.1

3144 Secondary Call Ids, Call Id auto-setting and Random Gen-erators

New in 3.1

3040 Search doesn't scan against multi-role URIs Fixed in 3.1

3030 Search doesn't search against Space URIs (Only searchedagainst name)

Fixed in 3.1

3011 Do not overwrite customer dashboards when updating KibanaDashboards, Visualizations and Searches on software updates

Fixed in 3.1

The upgrade process now onlyupdates VQ provided objects.

Please see section "DashboardVisualization and Searchmaintenance and update Policy"

2913 Enable VQCM branding from VQCM-Admin New in 3.1

Further refinements will beavailable in later releases toprovide control of text font and color

2814 404 error when adding an ACL Tag without a Customer Id Fixed in 3.1

https://github.com/OfficeDev/office-js/issues/61

23 Fixed issues


IssueNumber

Description Summary

2574 Add Peak Participant Concurrency to Call data written to theCall Index in Elastic

Fixed in 3.1

2480 Kibana Visualizations required manually updating to replacehard coded CMS node names with the node names used by theCustomer

The extensive reorking of the datawritten to Elastic (and newVisualizations) has fixed this issuein 3.1

Please note that further refinements(and therefore change) to the datastored in Elastic are being made forVQCM 3.2

2416 Audio only participants being incorrectly reported as video par-ticipants

Fixed in 3.1

2404 Correct confusing Importer logging to change Acano to CMS Fixed in 3.1

2302 Analytics Call table not present in Elastic data Fixed in 3.1

1408 Enable control of participant levels for join/leave tones Fixed in 3.1

Please note if you have existingSpaces based on the SpaceTemplate, either manually save theSpace to apply the new settings orrun TemplateManager

560 Extend Role based properties to allow import of PIN/Passcodefrom AD/LDAP

Fixed in 3.1

210 Kibana access is not authentication protected Fixed in 3.1

22 iOS App will sometimes unexpectedly crash during the loginprocess

Fixed in 3.1

20 It should be possible to re-run the web-installer (VQCM-Admin)process to change certificates

Fixed in 3.1

23.8 VQ Conference Manager 3.1 Beta

IssueNumber

Description Summary

Search no longer returns a long list of identical calls (expired). It only returnsactive calls

Fixed in 3.1Beta

Kibana can only be accessed as an authenicated user (admin Fixed in 3.1Beta

23 Fixed issues


IssueNumber

Description Summary

Kibana is now accessed via HTTPS Fixed in 3.1Beta

Kibana access is controlled (enabled/disabled) via the Admin UX Profile Fixed in 3.1Beta

The + green bar can be disabled Fixed in 3.1Beta

User creation of Spaces can be disabled Fixed in 3.1Beta

Cost codes can be set on users at AD/LDAP import time Fixed in 3.1Beta

Minute and Hour durations have been added to Participant/Call Analyticsrecords

Fixed in 3.1Beta

Cost codes have been added to Call/Participant Analytics records Fixed in 3.1Beta

MCU names are automatically picked up in Kibana; no need to manually editdahsboards

Fixed in 3.1Beta

Certificate support extended Fixed in 3.1Beta

Certificate key upload Fixed in 3.1beta

Branding (VQCM) Fixed in 3.1Beta

Elasticsearch index managment, 3.1 contains the long-term fix for Hot Fix3 (Janu-ary 2019)

Fixed in 3.1Beta

24 Fixed in Outlook Plug-in 3.1.16


24 Fixed in Outlook Plug-in 3.1.16Reference Issue

50974 When trying to open a saved email (*.msg), it will open the first time, but not openagain after that. The following error message is displayed:

25 Known limitations for the Outlook Add-in


25 Known limitations for the Outlook Add-inReference Issue Summary

26 Known limitations for the Outlook Plug-in


26 Known limitations for the Outlook Plug-inReference Issue Summary

27 More information on the new Generator functionality


27 More information on the new GeneratorfunctionalityFor more information on how to use the new URI and Call Id functionality available fromVQCM3.1,please download the “VQCM Generator Keywords” document from vqcomms.com.

https://www.vqcomms.com/login

28 Appendix A


28 Appendix A

28.1 Outlook Add-in installationTheDownload URI for the Outlook Add-in can be found in the URI list on the VQCM-AdminWelcome page:

Download theOutlookmanifest file from your VQCMsystem:

https://yourVQCM/outlook.xml

NOTE: if you are using an untrusted, temporary certificate, you will have to accept the non-trustedcertificate.

Select “File>Save As” from the browser menu and save the outlook.xml file.

FromOutlook 2016/Office365,Menu>File>Manage Add-ins

Authenticate with your Exchange Account.

Manage Add-ins:

https://yourvqcm/outlook.xml

28 Appendix A


Click + and select “Add from File”:

Select the file:

Click “Next”Read the caution and if OK, click "Install":

28 Appendix A


You're done:

ClickOK. Exit and re-loadOutlook.You should then see the VQCM logon in Outlook’smenu:

NOTE: The Add-in icon only appears if you are looking at mails in your inbox (and themail contentcan be read – see the note provided byMicrosoft at the final stage of installing the Add-in). If, forexample, you don’t have your inbox selected, you will see a greyed-out icon:

28 Appendix A


28.2 Getting startedOnce theOutlook Add-in has been installed, you will see theConference Manager button appearin Outlook’smenu:

Note that you need to have selected the inbox otherwise you’ll see no button or it will appearedgreyed out. This example shows it greyed because the inbox has not been opened:

Clicking on theConference Manager button results in:

Sign in:

28 Appendix A


For normal Users, the Add-in panel shows all Spaces that the user owns or is amember of.Operator users will see all Spaces as defined by their AccessControl Level. The functionalityavailable to Users andOperators is the same; the Add-in is designed to provide simple, end-userfriendly, functionality. Operatorsmight find using it useful but they are not the intended user group forit.

The default view for the Add-in is the Activity page; this showsActive Spaces (white background)and non-Active Spaces (grey background).

Active Spaces show the Space name, the count of how many participants are currently in the calland how long the call has been active:

28 Appendix A


Drilling down into an active Space shows the Participants:

28 Appendix A


Hover over the Participants to perform an active –mutes, layout changes or disconnecting theParticipant.

Select “People in call” if you want to perform the action onmultiple Participants.

Click on theSettings icon to change the Space settings.

28 Appendix A


ClickDone to save any changes.

28.3 Adding “How to join my Space” details to emails or calendarAppointmentsThe Add-In allows details about Spaces to be “injected” into emails or appointments. The content ofthe injected HTML is defined on the VQ ConferenceManager (VQCM) Server and can becustomized tomeet the specific needs of each customer.

28 Appendix A


The recipients of the email or meeting invite are therefore provided all the details to join the call; thismakes it easier for them and helps drive adoption.

Please note that the Add-In user interface only allows Space Details to be injected when an email ormeeting invite is open.

28.4 Adding Space Details to an EmailOpen an existing email or create a new one. Click on theConference Manager icon if required tomake the Add-In panel visible. Note how green arrows are now visible in the Add-In panel; click onthe green arrow corresponding to the Space you want to use.

Clicking on the green arrow next to 42 results in:

28 Appendix A


28.5 Adding Space Details to an AppointmentThe process is the same aswith an Email; open an Appointment (new or existing) and click on thegreen arrow for the Space you want to use:

28 Appendix A


28.6 Space passcodesPlease be aware that when you inject Space details into ameeting or email, you are accessing theSpace details at the point in time when you click the green inject arrow.If the passcode on the Space is changed sometime later, the passcode will then differ from thedetails originally sent to the Participants and their attempts to join themeeting will fail.

So, if you need to generate ameeting specific passcode, remember to note the existing passcode,generate a new one, inject the new one and then restore the Space passcode to the original. As thetime approaches for themeeting with themeeting specific passcode, remember to reverse theprocess and set the Space Passcode to the new ‘meeting specific passcode’ and, after themeeting, restore it to its original value.

Automating ‘one time’ or ‘meeting specific’ passcodes is a roadmap itemwe plan addressing in afuture release.

28.7 Changing the text injected into Emails and AppointmentsThe text injected is defined by the script associated with the User Experience (“UX”) Profileassociated with the User. As an Administrator, under System->UX Profiles, find the Profile of theUser and from that, drill down into Alerts and find the Email Alert template associated withURIReservation Details.

28 Appendix A


28.8 Controlling whether Add-in users can create new SpacesAs an Administrator, select the "UX Profile" for the Outlook Add-in users and use the "Settings"coApp to control whether users of this type can create, edit or delete Spaces.

28.9 Outlook Add-in and Internet Explorer 11 Compatibility modeTheOutlook Add-in requires IE 11 Compatibilitymode to be off; trying to use the Add-in withCompatibilitymode turned on results in a blank page being displayed. The page will look like this:

First check the version of Internet Explorer is 11. If not, upgrade to 11, otherwise continue.

Open a new browser (IE 11) session and navigate to https://yourVQCM/outlook.xml and check theconsole (press F12).

Depending on the your domain setup it’s possible it won’t show the compatibilitymode warning, buterrors will be visible:

https://yourvqcmserveraddress/outlook

28 Appendix A


A correct load looks something like this:

Check theCompatibility View settings from IE’s settingsmenu (see below):

Check for the domain in the list. YouDO NOTwant to see VQCM’swebsite listed below. In thefollowing example, we’d added VQCM to test the Compatibility problem:

28 Appendix A


If “Display Intranet sites in Compatibility View” is checked, make sure that the site is not in theIntranet Zone by right clicking on the background of the page and selectingProperties. Under“Zone”, it should show “Internet”:

28.10 Outlook Add-in and External Identity ProvidersIf an external Identity Provider is being used (for example, Okta, OneLogin, Duo or the VQCMWindows Identity Server), the Outlook Add-in manifest must bemanually edited to include a white-list entry for the Identity Provider.

This process has be automated in VQCM3.2

Process:

Beforemaking changes the AppDomains section should look like this, with the URIs forVQCMand VQCM login servers:

28 Appendix A


l <AppDomains>

l <AppDomain>https://james2.vq.k8s/</AppDomain>

l <AppDomain>https://login.james2.vq.k8s/</AppDomain>

l </AppDomains>

Add a third <AppDomain> element containing the URI for the external Identity Provider:

l <AppDomains>

l <AppDomain>https://vqcm.yourDomain.com/</AppDomain>

l <AppDomain>https://login. vqcm.yourDomain.com/</AppDomain>

l <AppDoman>https://yourDomain.okta.com/</AppDomain>

l </AppDomains>

29 Appendix B


29 Appendix B

29.1 Preparing the Outlook Plug-in to work with your VQCM systemTheOutlook Plug-in authenticates against VQCMusing the sameOIDC Authentication process asall the other components.

You will therefore need to update the Outlook Plug-in installer to specify the FQDN URIs to use forthe login and VQCMURIs.

Please download the “Configuring VQCM Outlook Plug-in Installer” document; it explains howto do this and provides a link (also from vqcomms.com) for the Orca tool to make the changes.

TheOrca tool allows other settings on the plug-in to be changed such as service name.

Please also note that before the Outlook plug-in can be used, it needs to be “enabled’ via theVQCM-Admin “Clients” page.

29.2 Installing the Outlook Plug-inTo install the Outlook Plug-in:

1. CloseOutlook.

2. Double-click on theOutlook Plug-in installer.

3. Follow theVideo Conference Plug-in Setup Wizard.4. OpenOutlook.

You will see a new Configuration button in the upper right corner.

5. Click theConfiguration button.6. Enter your VQ ConferenceManager user name and password.

7. If you are using a proxy server, clickConnection Setting to configure proxy settings.8. ClickLogin.

http://vqcomms.com/

29 Appendix B


29.3 New buttons in Outlook Plug-inAfter you have installed the Outlook Plug-in, please note that there is an additional button in themenu. The default name for the button isVQ Scheduler Configuration, but your systemadministrator may have renamed it. However, the button will be in the same position on theOutlookclient user interface, as shown in the figure below.

Figure 1: VQ Scheduler Configuration button

If you now click onHome>New Items>Meeting you will see another new button in theMeetingmenu. Again, this buttonmay have been relabeled by your system administrator, but it’s location onthe user interface will remain the same.

Figure 2: Add/Update Call Details

29.4 Scheduling a call using the Outlook Plug-inTo schedule a video call, navigate toMeeting fromHome>New Item>Meeting.1. Enter the email addresses of the participants that you would like to invite (e.g., Fred

@xyz.com)

2. Enter a themeetingSubject (e.g., Monday's TeamBriefing).

3. Add a Location (e.g., Willow Meeting Room).

29 Appendix B


4. If you need to check scheduling clashes, you can useOutlook'sScheduling function.

5. When you have filled in themeeting details, click onAdd/Update Call Details. This adds yourSpace details for video calls.

TheOutlook Plug-in then connects to VQ ConferenceManager. VQ ConferenceManagerinjects the details of the Space of the person scheduling themeeting using Outlook into theOutlook calendar body. These include the URI Reservation details, how to join the call usingtheMicrosoft Lync client and telephone dial-in details.

29 Appendix B


6. To complete the process, clickSend.Outlook sends theMeeting Invitation to Exchange which forwards the call invite to everyparticipant, endpoint andmeeting room entered in the To field. TheMeeting Invitation willappear in the calendar of all participants.

29.5 Updating meetingsMeetings can be updated fromOutlook bymaking the amendments to the call time and date,then clicking on theSend Update button.If you know that the Space details have changed click theAdd/Update Call Details button touse the new Space details.

29 Appendix B


The updated call detail information will display in the Outlook calendar.

Note: VQ ConferenceManager has not scheduled a call on the Space. It has simply provideddetails for the user's Space. For this reason , no record of the call appears in VQ ConferenceManager. VQ ConferenceManager dynamically creates the call when the first participant joins theSpace.

29.6 Cancelling meetings from Outlook1. In the OutlookCalendar, click on the call and then clickCancel Meeting.

29 Appendix B


Note: You can only cancel themeeting if you originally set it up.

2. ClickSend Cancellation

The call is removed from the calendar of all call invitees.

29.7 Outlook Plug-in Email Scripting

Note: This section is intended for SystemAdministrators. For additional information regarding EmailTemplate Scripting, please refer to the Email Templates chapter

The text injected is defined by the script associated with the User Experience (“UX”) Profileassociated with the User. As an Administrator, under System>UX Profiles, find the Profile of the

29 Appendix B


User and from that, drill down intoAlerts and find theEmail Alert template associated with “URIReservation Details”.Two predefined scripts are available:UriReservationDetailsIcons.html andUriReservationDetailsWithoutIcons.html. As the names suggest, one contains icons and theother is text only.

The “UriReservationDetailsIcons.html” script will generate a result that looks like this:

If the results you see include the Passcode for each Role, please contact our support [email protected] guide you thru the process of updating the script to only sendPasscodes to Invitees. New installs will install with a script that is able to differentiate between theHost and Invitee Roles. Customerswho installed VQCM3.0 or 3.0.1 will not have the latest, updatedscript. FromVQCM3.0.2, the script (lines 11-18) looked like this:

Whereas earlier (VQCM3.0 and 3.0.1) versions looked like this:


29 Appendix B


Note how the earlier version does not contain the “#if IsInviteRole” check.The script language (“Handlebars”) is documented in theHandlebars Expression section in theEmail Templates chapter of this document. A quick summary:

Commands such as “foreach” or “if” or “is” are terminated by a closing {{/each}}, {{/if}} or {{/is}}.

“Is” commands evaluate to true if the propertymatches the '' value specified. In this example, ''is an empty string (no Pin value). The “is” command supports an “else” condition.

The example above shows an “is else” conditional checkwithin an “if” condition that is, in turn,within a “foreach” loop.

The “WithoutIcons” versions does not contain the icons for Cisco CMA, Chrome, Skype forBusiness etc.

Both the domain name for registered SIP/Lync devices and also the dial-in numbers for yournetwork can be changed fromUriReservationDetails.html

29 Appendix B


3. Click Done.

30 Appendix C


30 Appendix C

30.1 Jabber Add-in Pre-requisitesJabber 12.7

VQConferenceManager 3.3.0

30.2 VQ Conference Manager Admin Settings1. Log in to your VQ ConferenceManager Admin

2. Browse toManage > Authentication Clients

3. Click “Jabber Add-in”. You should see aSuccess notification saying that the client wasenabled successfully

30.3 VQ Conference Manager Settings1. To enable “Call Space” functionality, youmust provide a SIP domain to call

30.4 Log in to your VQ Conference Manager.1. Navigate to your Tenant, whether throughSystem > Default Tenant or Tenants > Your

tenant name

30 Appendix C


2. Enter your SIP server domain in the SIP Domain field and click “Done”

30.5 VQ CM Jabber URITheURI for your Jabber Add-in in is

https://[conferencemanager FQDN]/jabber?readonly=true

30.6 Configuring with Cisco Unified CM (CUCM) Administration1. Sign into your CUCMAdministration site

2. SelectUser Management > User Settings > UC Service

3. Click “Add New” and follow the instructions below, or click “Find” and then select your existing“Jabber Client Configuration” and skip to Browser Plugin Configuration below.

30 Appendix C


4. Select “Jabber Client Configuration” as the UC Service Type

30.7 Browser Plugin Configuration

1. In the bottom section, select “Client”2. Select “jabber-plugin-config” “browser-plugin-v2” “page” under multipart parameter3. Enter your VQCMJabber URI

4. Enter the text you could like on the button in “Tooltip”, i.e. “VQCM”

5. Click “Save”

30.8 Assign Service Profile1. SelectUser Management > User Settings > Service Profile from the topmenu

2. Select the Service Profile you would like to have access to the VQCMJabber Add-in

30 Appendix C


3. In the “Jabber Client Configuration (jabber-config.xml) Profile” section, for “Desktop”,select the service we created or edited in the previous section

4. Click “Save”

Note: It can take some time after saving for the configuration to be propagated to clients.

31 Appendix D


31 Appendix D

31.1 Additional documentationThe following is list of the additional documentation we have produced to assist you with configuringandmanaging VQ ConferenceManager.

31.1.1 User Guide250+ page general VQCM referencemanual. Now also available in HTML form and searchablefrom vqcomms.com

31.1.2 Commissioning and Test PlanGuide on what to consider and checkwhen provisioning a new system.

31.1.3 Configuration OptionsA list of the available configurable options for VQCMand how to change them.

31.1.4 Generator KeywordsURI/Call ID Generator keywords.

31.1.5 Outlook Plug-in Installer ConfigurationHow to configure the Outlook plug-in to work with your VQCM's FQDN values. Other settings canalso be customized such as the service name displayed in Outlook'smenu.

31.1.6 Import EmailerAutomatically send "welcome" provisioning emails to new users created by the LDAP importprocess.

31.1.7 Bulk Emailer UtilityA tool for sending emails to groups of users on the system.

31.1.8 Template ManagerA tool for pushing Space Template changes to all existing Spaces based on the Template.

31.1.9 Pin ManagerA tool for checking Pins.


31 Appendix D


31.1.10 Endpoint ImporterA tool for bulk importing Endpoints via a csv. file.

31.1.11 Blast Dial/Reactive Calls ConfigurationConfigure Spaces to automatically call out to a list of deviceswhen the first person joins a Space.

31.1.12 Automated LDAP ImportA guide for the automated LDAP Import which is now done via a command either via SSH or via theEmergency Shell.

31.1.13 Space ListA tool which produces lists of Spaces and optionally, allows Spaces on CMS to be deleted.

31.1.14 Outbound Call RoutingA guide for how to create location-specific dial rules on a CMS cluster for outbound calls.

31.1.15 Watcher Setup in KibanaA guide to configure and create a simple watcher that detects a condition and then generates amail/message with links to dashboards.

31.1.16 Automatically Renaming LogfilesA guide to organise a scheduled task (cron) to run the ImportEmailer tool to generate a LogFile.txtlog and then run a simple script that renames the file to add date/time.

32 Open Source Software


32 Open Source SoftwareThe VQ ConferenceManager software product and the copyright in it is owned by VQCommunications Ltd. Some elements of the software product are used under license from thirdparties or are open source and used under appropriate open source licenses.

The open source software incorporated within the VQ ConferenceManager software product canbe viewed by navigating toAbout on the VQ ConferenceManager Navigation panel.


© 2020 VQ CommunicationsLtd. All rights reserved.This document is provided for information purposesonly and its contents are subject to change without notice. This document maynotbe reproduced or transmitted in any form or byanymeans, for anypurpose other than the recipient’s personal use, without our priorwritten permission.

Acano is now part of Cisco, and Acano is a trademarkof Cisco. Other namesmaybe trademarksof their respective owners.

VQ is a trademarkof VQ CommunicationsLtd.VQ ConferenceManager® is a registered trademarkof VQ CommunicationsLtd in the European Union.

coSpacesare now called Spaces throughout the Cisco solution. This change hasbeenmade from VQ ConferenceManager (3.0) andtheOutlookAdd-in.

VQConferenceManager€¦ · VQConferenceManager:ReleaseNotes20-1064-H Page1 Contents 1 Introduction 6 1.1 NetworkPortUsage 6 1.2 ChangesinVQ ConferenceManager3.3 7 1.3 ChangesinVQ

Documents