Cisco Mobile Expert Remote Notes

Information circa Cisco Moible Expert Remote version 11.6 / May 2018

URLs:

Use a sample web app to accept calls and eliminate other variables.  Authenticate to REAS locally (default local user / password is agent1 / agent1) to keep it simple.  The cluster name should be your REAS server(s):
https://Cluster IP or FQDN:8443/expertassist/agent

Use a sample web app to generate calls and eliminate other variables. The cluster name should be your REAS server(s):
https://Cluster IP or FQDN:8443/assistsample

If tests using the local user are good, you can extend the test calls to your CUBE or CUCM using the same test web interface:
https://Cluster IP or FQDN:8443/assistsample?agent=sip:1234@10.10.10.10

The general administration page is here (the cluster name should be your REAS server):
https://Cluster IP or FQDN:8443/web_plugin_framework/webcontroller

The REAS Management Console is here:
https://Cluster IP or FQDN:9990

Videos from 10.6 versions showing basic configuration techniques.  These appear they may have come from Cafex and the OVA deployment and WebRTC examples are no longer valid:
https://communities.cisco.com/docs/DOC-59078

The Cisco REM troubleshooting doc wiki is incomplete.  More complete instructions including updated / accurate CLI can be found here:
https://support.cafex.com/hc/en-us/articles/208247075-Collecting-logs-for-Cisco-REM


Notes:

SSH to REAS(s) with rem-ssh user and run service reas status to verify reas is running.
SSH to REMB(s) with rem-ssh user and run service media_broker status to verify remb is running.

Install latest ES releases before troubleshooting regardless of release notes.

Logs are at ./opt/cisco/11.6.1.10000-7/REAS/domain/servers/appserver-YOUR_REAS_HOSTNAME/log/

The log capture script can now be run like so: ./opt/cisco/11.6.1.10000-7/REAS/bin/logcapture.sh -c -f YOUR_FILE_NAME.tar

Blocking Calls Based on Calling Party ID

There are several good write ups on how to block incoming calls on CUCM according to the CLID of the caller.  The feature basically revolves around the ability to "Route next hop by CNGID".  To save reading another version, here's a link to one of the oldest and my favorite:

https://supportforums.cisco.com/t5/collaboration-voice-and-video/blocking-calls-based-on-calling-party-id/ta-p/3113978

Here's an image that summarizes it all:

A big caveat though that I recently ran into is how calls presented to CUCM over a SIP trunk  are presented.  In my case, if a caller was hiding their caller ID the From: field in the SIP header contained the word "anonymous" rather than being blank or including zeros or the like.  The issue here is once you ask CUCM to route via the calling ID and if your calling ID is a word rather than some digits, you will find CUCM can't natively handle a request to route the call to a word.  The call is rejected with a 404 error.

The link above includes references to a LUA script that might be applied to the SIP trunk in question.  It also later references a change to the same LUA script.

I'm frankly not terribly comfortable depending on these scripts since I never craft them myself so I am effectively either relearning what they do on the fly or just blindly putting my faith into them.

The alternative I just used was this config on the CUBE routers in question:

voice class sip-profiles 10
request ANY sip-header From modify "<sip:anonymous@" "<sip:0000000000@"

voice service voip
sip
sip-profiles inbound
sip-profiles 10 inbound

It's a more aggressive version of a SIP profile modifying only INVITES suggestion found here:
http://technologyordie.com/calling-party-routing-of-anonymous-calls-sip-header-fix-up

The idea is the same regardless.  Replace the useless caller id (ie: the word "anonymous") with something else that CUCM understands (ie: 0000000000).

If you have been blocking calls like this and finding you and yours moving to SIP trunks, be forewarned and address it now.

UiPath Close Application Activity Value does not fall within the expected range.

While working in UiPath on a UCCX related RPA robot I found the Close Application activity was raising an exception

Main has thrown an exception

Source: Close application

Message: Value does not fall within the expected range.

I couldn't find a solid example of how to implement it correctly in the UiPath documentation but did find the UiPath Academy does provide a sample with the answer.  Ultimately you need to populate the Close Application Target.Selector property correctly.  It does not automatically inherit it from a Open Application activity.

Selector not populated

Selector populated (notepad.exe example)

You can find the appropriate value by one of two ways.  Simply using the Indicate on Screen feature of the Close Application activity to point to a running instance of your application will automatically populate the Target.Selector property.

No Screenshot Selected

Notepad selected (with error message)

Alternatively, you can use the UiExplorer on the Studio menu to find your application XML snippet and populate it manually.

I, for one, welcome our new RPA overloards.

End to end authentication and encryption in Cisco Collaboration and through MRA

It's 2017.  You want end to end authentication and encryption. outside and in. You should see padlocks everywhere.

Here's how to get yours.
 

Ten easy steps (super abridged version):

Look for your padlocks!

1. Sign your CUCM tomcat and CallManager certificates, IM&P tomcat, cup-xmpp and cup-xmpp-s2s certificates and UCXN tomcat certificate.
2. Activate and start CAPF on CUCM and restart TFTP.
3. Install LSCs on devices via CAPF enrollment.
4. Change CUCM to Mixed Mode and retart TFTP and CallManager.
5. Create a secure Phone Security Profile and apply to on-premise endpoints.
6. Sign Expressway C server certificate and include an alternate name to use as a CUCM device security profile name.
7. Sign Expressway E server certificate and include an alternate name of just domain.
8. Configure Expressway C and E for MRA.
9. Configure a secure Device Security Profile called your C alternative name and apply to outside CUCM devices.
10. Make calls and enjoy the padlocks.

So you want secure audio to Unity Connection too?

1. Apply a secure profile to the CUCM SIP trunk where the Subject Name is CUC FQDN and transports use TLS and port 5061.
2. Change your CUC port group to use 5061/TLS, Next Generation Encryption and sRTP.

Extra credit fun notes:

• If using TLS to secure communication between CUCM and your LDAP server, change the port from the default 389 to 636.

Unity Connection Cobras Export Import Schedule Detail Missing

I recently used the Cobras Export and Import tools found at http://ciscounitytools.com to perform a physical to virtual migration and upgrade from Unity Connection 8.6 to 11.5.

One issue I found was that schedules with multiple details weren't imported completely.  I don't know if this is an issue with the export or the import process or possibly with the Connection versions but after checking the target 11.5 cluster I found only the first detail in the schedules with multiple details was restored.

It may also be worth noting that all the detail in each of the affected schedules were named the same, for example "Detail for All Hours - All Days" used multiple times to describe individual detail for each day.  I don't remember seeing anyone use this technique elsewhere so it may also have been a contributing factor.

Lesson learned: check your schedules after your import is complete.

The Cobras Export for Connection version was 8.0.76 and Import for Connection was 8.0.92.