Configuring User Policy Manager, Username | TANDBERG D14049.01

UserText goesPolicyhere

TANDBERG VIDEO COMMUNICATION SERVER ADMINISTRATOR GUIDE

Configuring User Policy Manager

To configure the User Policy Manager:

•VCS Configuration > Policy > User.

You will be taken to the User Policy page.

•xConfiguration Policy UserPolicy

Administrator Policy will always be applied regardless of the User Policy mode.

Getting System

Introduction Started Overview

D 14049.01

07.2007

Enabling User Policy on the VCS

System	H.323 &	SIP	Registration	Zones and	Call Call	Firewall
Configuration	Configuration		Control	Neighbors	Processing	Traversal

68

Mode

Determines whether or not User Policy will be enabled, and if so, the location of the User Policy Manager.

Off: User Policy is not enabled.

Local: User Policy is enabled and the VCS’s own User Policy Manager is used.

Remote: User Policy is enabled and a User Policy Manager located on another system is used. If you select this option, further configuration options will appear (see below).

Protocol

The protocol used to connect to the remote User Policy Manager.

Address

The IP address or domain name of the remote User Policy Manager.

Path

The URL of the remote User Policy Manager.

Username

The username used by the VCS to log in and query the remote User Policy Manager.

Password

The password used by the VCS to log in and query the remote User Policy Manager.

Save

Click here to save your changes.

Bandwidth

Control Maintenance Appendices

Image 68

TANDBERG D14049.01 Configuring User Policy Manager, Enabling User Policy on the VCS, XConfiguration Policy UserPolicy

Contents

Video Communication Server Administrator Guide System Configuration Getting Started Table of Contents Administrator Policy Using TANDBERG’s FindMeCall Processing User Policy Enum Dialing Disconnecting calls Calls to and from Unregistered EndpointsFallback Alias Firewall Traversal Maintenance DNS Configuration 79Ldap Configuration 80 Regular Expression Reference 78 Trademarks and Copyright Copyright 2007, Tandberg Patent Information Disclaimer, Copyrights and License AgreementsDisclaimer Approvals Safety Instructions and ApprovalsSafety Instructions Environmental Issues Environmental Issues Main Product Features Standard FeaturesOptional Features Introduction Tandberg VCS Connecting the CablesGetting Started Powering on the VCS Initial Configuration via Serial Cable System Administrator Access Using the Web Interface Supported Browsers Using the Command Line Interface CLI Understanding the Overview ViewingText goesSystemhere OverviewViewing the Overview Systemtext Configuration Configuring System SettingsAbout Admin Access settings System Administration Configuration Configuring Ethernet Settings Ethernet ConfigurationXConfiguration Ethernet About Ethernet Speed Configuring IP Settings IP ConfigurationXConfiguration IP XConfiguration IPProtocol About IPv4 to IPv6 Gatewaying DNS Configuration Configuring DNS SettingsXConfiguration IP DNS About DNS Servers Configuring NTP Settings Setting the Time ZoneNTP Configuration XConfiguration NTP Address XConfiguration TimeZone Name Configuring Snmp Settings About Snmp SettingsSnmp Configuration XConfiguration Snmp Configuring External Manager Settings External Manager ConfigurationXConfiguration ExternalManager About the External Manager Backing up Configuration Settings Logging Logging Overview Viewing the Event Log Event LogEvent Log Format Message Details Field Events Logged at Level DNS Events Logged at Level 1 Event Data Fields TCP UDP TLSSIP 225 245 For Register requests the AOR for the Register request Number of bytes sent/received in the messageRequest/granted registration expiry duration Limitations of standard syslog timestamps WorkingText goeswithhereH.323 Overview Endpoint Registration Configuring H.323 XConfiguration H323 WorkingText goeswithhereSIP SIP Overview Configuring SIP Registrations, Protocols and Ports XConfiguration SIP Configuring SIP Domains XCommand DomainAdd XConfiguration SIP Domains Configuring Interworking XConfiguration Interworking ModeInterworkingesText here Overview MCU, Gateway and Content Server Registration RegistrationText goes hereControlEndpoint Registration Registration Overview Finding a VCS with which to Register 323Preventing automatic registrations H323 Gatekeeper AutoDiscovery About Authentication AuthenticationConfiguring Authentication XConfiguration Authentication Authentication using an Ldap Server Alias Origin SettingConfiguring the Ldap Server Directory Securing the Ldap Connection with TLS Configuring Ldap Server settings XConfiguration Ldap XConfiguration Authentication Authentication using a Local Database Configuring the Local DatabaseNew Create Credential Attempts to Register using an Existing Alias About Alias RegistrationRegistering Aliases Alias Registration XConfiguration Registration RestrictionPolicy About Allow and Deny ListsPatterns and Pattern Types Allow and Deny Lists XCommand AllowListAdd XConfiguration Registration AllowList Managing Entries in the Allow List XCommand DenyListAdd XConfiguration Registration DenyList Managing Entries in the Deny ListAdd Deny List Pattern Registration Deny List Example Managing Zones, Neighbors and AlternatesAbout your Video Communications Network About the Local Zone and its Subzones Configuring the Local Zone and its SubzonesLocal Zone and Subzones Zones Adding Zones Configuring Zones XCommand ZoneAddXConfiguration Zones Zone Create Zone Match1 Match5 Configuring Zones All TypesHop count Configuring Neighbor Zones SIP port Configuring Traversal Client Zones Retry intervalProtocol SIP transport Configuring Traversal Server Zones Configuring Enum Zones Configuring DNS ZonesDNS suffix Determines whether H.323 calls will be allowed to this zone Alternate 1 to Alternate 5 IP address About Alternates Configuring AlternatesXConfiguration Alternates Setting up a Dial Plan About Dial PlansFlat Dial Plan Structured Dial Plan Process CallText ProcessinggoeshereLocating a Destination Endpoint Dialing by Address Types Configuring Hop Counts XConfiguration Zones Zone 1..200 HopCountAbout Hop Counts Hop Counts Administrator Policy About Administrator PolicyAdministrator Policy and Authentication Authentication Mode On Enabling the use of Administrator Policy To enable Administrator PolicyAdministrator Policy Mode Administrator Policy Mode to take effect Configuring Administrator Policy via the Web Interface Configuring Administrator Policy via a CPL script Uploading a CPL ScriptAbout CPL XSD files Downloading policy files UserText goesPolicyhere About User Policy Configuring User Policy Manager XConfiguration Policy UserPolicyEnabling User Policy on the VCS Username Creating a New User Account About User AccountsManaging FindMe User Accounts Changing a User Password Viewing Existing User Account Settings Deleting a User Account To change delete a FindMe user accountTick the box next to the account you wish to delete Click here to delete the selected accounts Using TANDBERG’s FindMe FindMe User Accounts Accessing the FindMe ConfigurationAbout your FindMe User Account About FindMe Configuring your FindMe User Account AliasText goSearchingshere and Transforming Configuring Local Alias Transforms XConfiguration Transform Zone Searching and Transforming Zone searching and alias transforming configuration Configuring Zone Searches and TransformsDefault Settings Combining Match Types and Priorities ExamplesNever Query a Zone Always Query a Zone, Never Apply Transforms User@example.com User@exampleusa.com Filter Queries to a Zone Without TransformingChanging the Prefix or Suffix Before Querying Query a Zone for Both Original and Transformed Alias Query a Zone for Two or More Transformed Aliases URITextDialinggoeshere URI Dialing Overview An AlwaysMatch, or Configuring Matches for DNS ZonesURI Dialing for Outgoing Calls Adding and Configuring DNS Zones XCommand ZoneAdd XConfiguration Zones ZoneClick Create Zone Assigns a name to this zone Configuring DNS Servers XConfiguration IP DNS Server URI Dialing for Incoming Calls URI Dialing and Firewall Traversal Example DNS Record ConfigurationRecommended Configuration ENUMText goesDialinghere About Enum DialingEnum Dialing Overview Enum Process Prerequisites Enum Dialing for Outgoing Calls Mode of PatternMatch Pattern string Pattern type of Prefix Configuring Matches for Enum ZonesConfiguring Transforms for Enum Zones Configuring Enum Zones For Enum zones, this will be Enum Configuring DNS Servers Enum Dialing for Incoming Calls Configuring DNS Naptr RecordsAbout DNS Domains for Enum Configuration Recommended Configuration for Firewall TraversalCallsText gtoesandherefrom Unregistered Endpoints Calls to an Unregistered Endpoint XConfiguration Call Services Fallback Alias FallbackText goesAliashereFallback Alias Example Use of a Fallback Alias DisconnectingText goes herecalls Identifying a Particular Call Disconnecting a Call via the Web Interface Disconnecting a Call via the CLIIssues when Disconnecting SIP Calls Disconnect Firewall Traversal Firewall Traversal OverviewAbout Firewall Traversal VCS as a Firewall Traversal Client VCS as a Firewall Traversal Server Firewall Traversal Protocols and Ports 323 Ports for Connections out to the Public InternetStun Ports Firewall Traversal and Authentication VCS Configuring the VCS as a Traversal Client Adding a New Traversal Client ZoneFrom the Type drop-down menu, select TraversalClient Create Zone Configuring a Traversal Client Zone Alternate 1 Alternate 5 Address TraversalServer Create Zone Configuring the VCS as a Traversal ServerAdding a New Traversal Server Zone TCP retry count Interval Configuring a Traversal Server ZoneDemux mode Configuring Traversal for Endpoints XConfiguration Zones LocalZone Traversal H323 Configuring Traversal Server Ports Assent call signaling port323 H.460.18 call signaling port Media demultiplexing RTP port Stun Services About StunStun Binding Discovery Stun Relay Configuring Stun Services XConfiguration Traversal Server Example Network Deployment Bandwidthth ControllAbout Bandwidth Control Subzones Creating a Subzone XCommand SubZoneAddBandwidthControl Configuring a Subzone To configure a subzoneXConfiguration Zones LocalZone SubZone Subnet 2 Applying Bandwidth Limitations to Subzones Types of LimitationsHow Different Bandwidth Limitations are Managed Per call inter Limits the bandwidth of any individual call XCommand PipeAdd About PipesCreating a new pipe Creating Pipes Editing Pipes XConfiguration Bandwidth PipeEditing an Existing Pipe Default Links XCommand LinkAddAbout Links Creating Links Creating a New Link Editing Links XConfiguration Bandwidth LinkEditing Links Applying Pipes to Links Default LinksBandwidth Control About Downspeeding About the Default Call BandwidthConfiguring the Default Call Bandwidth and Downspeeding Bandwidth Control Examples Example Without a Firewall Example With a Firewall VCS Border Controller Subzone ConfigurationEnterprise VCS Subzone Configuration MaintenanceText goes here Backing up the Existing Configuration Before UpgradingUpgrading Using SCP/PSCP Upgrading Software Upgrading via the Web Interface Upgrading XConfiguration Option 1..64 Key S 0 Option KeysAbout Adding Extra Options Adding Options via the CLI Add Option Click Add Option Adding Options via the Web InterfaceAdd option key Security About SecurityEnabling Security Passwords System SnapshotAbout the System Snapshot Creating a System Snapshot XCommand Boot RestartingAbout Restarting About Shutting Down CommandText goes hereReference xConfiguration HttpHttps SSH Total Mode On/Off AliasOrigin LDAP/Endpoint/CombinedRequest Off the call will be rejected One call Far end were registered directly to the local system Fallback Alias S 0 Port H323 Gatekeeper CallSignalingTCP NTP Option Key S 0 Off the VCS will not act as a SIP registrar Tration will not be permittedOn the VCS will act as a DIP registrar 137 Snmp CommunityName S 0 Stun RtcpRTP For any one call to or from an endpoint in the Default Between two endpoints within the Default SubzoneTraversal Server For any one call between two endpoints within Intra Mode None/Limited/Unlimited To or from an endpoint in this subzone Name S 1 Assigns a name to this subzone Subnet Address S 0 LimitSets the total bandwidth limit in kbps of this subzone Zones LocalZone Traversal H323 Cont Order to keep the firewall’s NAT bindings openRetryCount VCS will attempt to send a TCP probe to the VCS Enum 145 TLS TLS will be used Transport TCP/TLSTCP TCP will be used Off Each call will use a separate pair of ports for Plexing mode for calls from the traversal clientZones TraversalClient Zones TraversalServer TCPProbe KeepAliveInterval Cont CommandText goes hereReference xCommand XCommand Description ParametersList, the registration will be permitted PatternType Exact/Prefix/Suffix/Regex List, the registration will not be permitted XCommandDescription Parameters Event/AuthenticationFailure Status/EthernetStatus/NTP Status/LDAP Pipe2 S 1 LinkAdd LinkDelete Locate OptionKeyAdd OptionKeyDeletePipe1 S 1 153 SubZoneAdd SubZoneDelete PerCallInterMode None/Limited/UnlimitedPerCallInter To Limited TransformAdd TransformDelete ZoneAdd ZoneDelete Each transform ZoneList CommandText goes hereReference xStatus Option Key S 1 Description S 1 Server Address IPv4Addr/IPv6Addr Domain S 0 NTP External Manager Status On/Off URL S 1,255 Expression S 1,127 0..15 entries 160 161 Contact S 1,255 Path URI 1..10 S 1,255 Zones 163 164 165 166 167 IPv4 Status Active/Inactive/Failed Address IPv4AddrStatus Active/Inactive/Failed Address IPv4Addr IPv6 Status Active/Inactive/Failed Address IPv6Addr 169 Address-switch node CPLText ReferencgoeshereAddress Otherwise node Field Authentication Mode OnSetup Url-ID 323 ID H323-ID Dialled Digits DialedDigits SubfieldURI Rule-switch CPL Script Actions LocationUnsupported CPL Elements Proxy Call Screening of Authenticated Users CPL ExamplesCall Screening Based on Alias Vpengineering Call Screening Based on Domain Change of Domain Name Block Calls from Default Zone and Default Subzone Allow Calls from Locally Registered Endpoints Only Restricting Access to a Local Gateway RegularText goesExpressionhere Reference About Regular ExpressionsWill match against any sequence of characters For a detailed description of regular expression syntax see DNSText goesConfiguhereation Overview Microsoft DNS ServerVerifying the SRV Record Bind 8 LDAPText goesConfigurationhere About the Ldap Databases Downloading the H.350 schemas Installing the H.350 Schemas Microsoft Active DirectoryAdding H.350 Objects Securing with TLS . Copy the OpenLDAP files to the OpenLDAP schema directory . Add the ldif file to the server using the commandOpenLDAP Add the H.350 Objects Bibliography Reference Title Link Glossary Term Definition IRQ LANLRQ NAT Session Initiation Protocol Protocol used to monitor network devicesFirewall NAT traversal for SIP. Defined by RFC 3489 Reliable communication protocol defined by RFC 791 187