[{"content":"I am fortunate to have the opportunity to continue working from home during the pandemic. As myself and my family adapt to a new normal in a new working space at home, a way of notifying them when I\u0026rsquo;m on a call would prove useful.\nSo if you own a Plantronics (now Poly) headset, and have a Philips Hue Bridge with a light, I\u0026rsquo;ll explain how to build a little one-line script and have it light up when on a call. I love Plantronics (umm\u0026hellip; Poly) stuff!!!\nThis works pretty much independent of the software you use to make calls or join meetings, because we\u0026rsquo;re pulling call state from the headset, not the apps. Teams, Zoom, WebEx, Jabber, Skype for Business, the script does not care. If the Hub Desktop supports it as communications platform (and they support quite a few) then it\u0026rsquo;ll work.\nHere\u0026rsquo;s the summary of steps:\nInstall the Hub Desktop software. This exposes a local API endpoint that you can query for when your headset is active. Create an authorized user on your Hue Bridge so you can send it commands via REST API. Find the Light ID of the bulb you\u0026rsquo;re trying to change state Set up a Scheduled Task to run PowerShell, query the Hub Desktop API and send commands to the Hue Bridge when call state changes. Step 1: Pretty straightforward: go here and run the software. This will expose an API endpoint locally on port 32017 meant for third party app integrations. You can only access this via localhost/127.0.0.1, it does not listen on other interfaces. The endpoint we are interested in is http://localhost:32017/Spokes/CallServices/CallManagerState\nStep 2: Navigate to https://IPOFYOURHUB/debug/clip.html then use URL of /api, Body of {\u0026ldquo;devicetype\u0026rdquo;:\u0026ldquo;PolyHue#LAPTOP\u0026rdquo;} (change the json value to whatever you want, but the example will work), then go to your Hue Bridge, press the big button and press POST. You\u0026rsquo;ll get a username value back in the json response. COPY IT somewhere, as this is your key to sending authenticated API commands to the Hue Bridge.\nStep 3: Before you close the API Debug tool from your Hue Bridge, change the URL to /api/USERNAME/lights, using your new API username from Step 2, then press GET. Look at the json response and find the root number that matches the name of the light you\u0026rsquo;re using. They will be simple numbers, and in my case it\u0026rsquo;s \u0026ldquo;23\u0026rdquo;\nStep 4: Set up a Scheduled Task to run At log on, and also set it to restart every 5 minutes for 999 times in case it quits because of a network disruption. Then have it run \u0026ldquo;powershell\u0026rdquo; with the following arguments pasted in and edited for your settings. Replace BRIDGEID, USERNAME and LIGHTID with your values.\n-WindowStyle Hidden -Command \u0026amp;{$callStatePoll=Invoke-RestMethod -Method GET -Uri http://localhost:32017/Spokes/CallServices/CallManagerState;while($true){$oldCallState = $callStatePoll.Result.HasActiveCall;$callStatePoll = Invoke-RestMethod -Method GET -Uri http://localhost:32017/Spokes/CallServices/CallManagerState;$newCallState = $callStatePoll.Result.HasActiveCall;If ($oldCallState -ne $newCallState){Switch ($newCallState){$false {$body = @{\u0026#34;on\u0026#34;=$false} | ConvertTo-Json;Invoke-RestMethod -Method PUT -Uri http://BRIDGEIP/api/USERNAME/lights/LIGHTID/state -Body $body};$true {$body = @{\u0026#34;on\u0026#34;=$true} | ConvertTo-Json;Invoke-RestMethod -Method PUT -Uri http://BRIDGEIP/api/USERNAME/lights/LIGHTID/state -Body $body}}};Start-Sleep -Seconds 5}} Now to test it, turn on the light, set it to the desired brightness and color, then turn it off. The script will check every 5 seconds your call state, and if it changes, it will flip the light on if you have an active call, and off if you don\u0026rsquo;t.\nThe main gotcha: This will only work when using a Plantronics/Poly headset, as we rely on the API from Hub Desktop to give us call state. Jabra Direct software may work but couldn\u0026rsquo;t get the right API endpoints to query call state.\nHope it helps someone out there, and stay safe!\n","permalink":"https://blog.escarra.org/posts/on-a-call-light-notification-for-the-new-covid-world/","summary":"\u003cp\u003eI am fortunate to have the opportunity to continue working from home during the pandemic. As myself and my family adapt to a new normal in a new working space at home, a way of notifying them when I\u0026rsquo;m on a call would prove useful.\u003c/p\u003e\n\u003cp\u003eSo if you own a Plantronics (now Poly) headset, and have a Philips Hue Bridge with a light, I\u0026rsquo;ll explain how to build a little one-line script and have it light up when on a call. I love Plantronics (umm\u0026hellip; Poly) stuff!!!\u003c/p\u003e","title":"\"On a Call\" light notification for the new COVID-19 world"},{"content":"A couple of months ago I took delivery on my Tesla Model 3 \u0026ldquo;Speedy\u0026rdquo;. In the time between placing the order and actually getting the car, aside from being beyond excited, I took a bit of time to learn about the car\u0026rsquo;s always-connected API and how to use it, and also signed up for off-peak billing from my local utility ComEd.\nThen I decided to take things to a new level by combining two API\u0026rsquo;s and making some triggers for charging, so this is the whole point of my post.\nEarly TL;DR: Using ComEd\u0026rsquo;s Hourly Pricing\u0026rsquo;s API, Tesla\u0026rsquo;s API, HomeSeer\u0026rsquo;s software and a couple of plugins, I am now triggering charges when electricity prices are super low, so I can charge the car for a couple pennies per kWh or even for free or get money back.\nInitially I wanted to see if there was a way to tie the car to my home automation software, HomeSeer, and turns out there\u0026rsquo;s an awesome plugin called teslaSeer. It uses Tesla\u0026rsquo;s API to create objects within HomeSeer\u0026rsquo;s interface, so now you can schedule actions or create triggers, like have the car to heat up based on a time or what\u0026rsquo;s on my calendar for the day. One of the options is to start or stop charging.\nRight after putting in the order for the Model 3, I signed up for ComEd\u0026rsquo;s Hourly Pricing program which takes about a month to really kick in. My thought was just to use the off-peak pricing and schedule my charges from the Tesla directly, say at 2am every night. But\u0026hellip; turns out ComEd\u0026rsquo;s Hourly Pricing program ALSO has an API, just like the car, which is AWESOME and far better than just simple off-peak. The API gives you an output of either JSON or XML with 5-minute average or hourly average.\nWhat\u0026rsquo;s even more interesting is that anyone can see the \u0026ldquo;Dashboard\u0026rdquo; off ComEd\u0026rsquo;s program, and sometimes it dips BELOW 0c, meaning you\u0026rsquo;re getting credited for consuming electricity as an hourly customer.\nSo I thought\u0026hellip; if there\u0026rsquo;s a chance that price could dip below say\u0026hellip; a penny per kWh\u0026hellip; could I automate a charge then? And stop it if the price is too high?\nOF COURSE, it just took some sweat and hacks. My way of doing this isn\u0026rsquo;t particularly elegant or friendly, but it works for me. Think of IFTTT but with a lot more duct-tape to make it all work. (sidenote, ComEd Hourly Pricing has an IFTTT trigger or whatever it\u0026rsquo;s called, but it\u0026rsquo;s not quick enough for what I need\u0026quot;\nHere\u0026rsquo;s what I ended up doing\u0026hellip;\nUsing Jon00\u0026rsquo;s DataScraper script, created a trigger on price dips and jumps from ComEd every minute. Basically \u0026ldquo;If price is below 1\u0026rdquo; With teslaSeer, wake then update the car to get it ready to take in the next couple of commands. The event won\u0026rsquo;t continue until the car is awake which takes anywhere between 30 seconds and 2 minutes Once the Tesla is awake, set SoC to 90% (I usually leave this set to 70%) and then trigger a charge. That gives me at least 16kWh of juice I can consume, more if the car has been discharged If the event gets triggered, send me a notification My electric bill was actually lower in price by about 15% with this going, but was about 30% higher in kWh consumed. Go figure :). My Tesla seems to be running on free electricity.\nThat\u0026rsquo;s about it. There\u0026rsquo;s another event that stops the charge if the price goes above a certain value and also the battery is over 70% SoC. That way I don\u0026rsquo;t wake up to a car that didn\u0026rsquo;t charge because it was stopped because of some price fluctuation. Below is what the whole thing looks like right now. Again, not pretty, but completely functional and reliable.\nTo the smart folks out there I\u0026rsquo;m sure there\u0026rsquo;s a better way to trigger these things to happen, maybe using AWS Lambda or Azure Functions instead of HomeSeer, after all it\u0026rsquo;s just HTTP calls that we\u0026rsquo;re making and some basic parameters passed. If you have something similar working, I would absolutely love to hear it.\nAlso, If what I just wrote pushed you over the edge to get a Tesla and want to get 6 months of free Supercharging with it, here\u0026rsquo;s my referral code: https://ts.la/gonzalo13311\n","permalink":"https://blog.escarra.org/posts/tesla-smart-meters-and-automation-via-apis/","summary":"\u003cp\u003eA couple of months ago I took delivery on my Tesla Model 3 \u0026ldquo;Speedy\u0026rdquo;. In the time between placing the order and actually getting the car, aside from being beyond excited, I took a bit of time to learn about the car\u0026rsquo;s always-connected API and how to use it, and also signed up for off-peak billing from my local utility ComEd.\u003c/p\u003e\n\u003cp\u003eThen I decided to take things to a new level by combining two API\u0026rsquo;s and making some triggers for charging, so this is the whole point of my post.\u003c/p\u003e","title":"Tesla, Smart Meters and Automation via APIs"},{"content":"If you\u0026rsquo;ve never heard of Twilio before, you\u0026rsquo;d be surprised to learn that they are the largest backend for services around automated calling services, text messaging (and verification), and are pioneering Software Defined Telephony by use of APIs to route and handle texts/calls/faxes. Is your Uber driver calling you now? That\u0026rsquo;s Twilio\u0026hellip; Got a text from Netflix for a password reset? Yup, that\u0026rsquo;s Twilio\u0026hellip; PagerDuty sending you a SMS alert? You guessed it!\nThere are MANY things you can build with Twilio, but you can also use its simple services to set up PSTN origination/termination with your Skype for Business infrastructure. Why?\nFast and easy provisioning of trunks and numbers. No contracts, and you pay for what you use. Buy a number and it\u0026rsquo;s ready to use in less than a minute! Crazy scalable. If large companies rely on Twilio for their backend integrations, why wouldn\u0026rsquo;t you? Support for SIPS and SRTP, which means encrypted, secure calls over that internet trunk Record calls and pull them from the Twilio portal or over API. Need recording for certain Response Groups? Done. Failover mechanisms that can use preference/weight to balance call targets, or set up a script that can at least give callers a notice that your phones are down, or route them somewhere else, automatically Use add-ons to do fancy things like transcribe calls with speaker recognition, translate calls then play them using text-to-speech, or even cleanse call recordings of sensitive PCI data. Yes. I know. It\u0026rsquo;s crazy. Entire platform is built on top of AWS and globally scaled, so you know it\u0026rsquo;s good\u0026hellip; In this post I\u0026rsquo;ll guide you on setting up a trunk over the internet between a SfB infrastructure and Twilio\u0026rsquo;s Elastic SIP Trunking service, and you can start using it as a failover, aggregate, or maybe a conferencing bridge number so you\u0026rsquo;re not limited by your PRIs.\nFirst, Sign up for Twilio Obvious step here, you have to go here and sign up for an account.\nLoad it with some of your cash, which you can source from a Credit Card or over PayPal. You could use Twilio\u0026rsquo;s free test features, but if you want to call real numbers you need to have some money loaded there.\nCreate and configure a Twilio Elastic SIP Trunk Now that you have an account with some moolah, it\u0026rsquo;s time to make that SIP trunk. Go on Elastic SIP Trunking (if you don\u0026rsquo;t see it, hit the \u0026ldquo;\u0026hellip;\u0026rdquo; button) then Create new SIP Trunk\nGive it a friendly name.\nThen go on Termination and enter a Termination SIP URI. You\u0026rsquo;ll use this when creating the PSTN Gateway in Skype or Lync (or your favorite SBC). Don\u0026rsquo;t worry about call recording or encryption yet, you can play with that stuff later.\nThen under Authentication, create an ACL and add the IP addresses of your mediation boxes. If you\u0026rsquo;re NATted outbound then use that, but in order to receive calls you\u0026rsquo;ll need to have inbound NAT or a public IP assigned.\nNow save your Trunk by hitting Save at the bottom.\nNext we will configure origination, so we can receive PSTN calls over the SIP trunk.\nConfigure an Origination URI, and set it in the format shown. ;transport=tcp will force Twilio\u0026rsquo;s edge to use TCP instead of the default UDP transport, still over 5060. If you want a different port, just use sip:IPADDR:PORT;transport=tcp. This is very similar if not exactly to how Flowroute\u0026rsquo;s inbound routes work. If you\u0026rsquo;ve got multiple servers, you can play with priorities and weights\u0026hellip; but that\u0026rsquo;s out-of-scope for now.\nNext, you can assign numbers for your DID\u0026rsquo;s. If you don\u0026rsquo;t, you can still make outbound calls and mask caller ID as anything you want, but for receiving calls you need a PSTN number\u0026hellip;\nYou can probably figure out the rest, but the basics are done. Let\u0026rsquo;s move to SfB now.\nConfigure Lync / Skype for Business Trunk Remember that Termination SIP URI? We need it now. So we start by creating a new PSTN Gateway in the topology and using it as the FQDN.\nThen we use 5060 as ports and TCP as the protocol. If we were using TLS, we can change that to 5061.\nPublish the topology and then start using your new root trunk in your voice routes for outbound calls. That\u0026rsquo;s pretty much it! (assuming you\u0026rsquo;ve got the networking done right, either NAT or Public with dual-home).\nTo secure your edge you can use Twilio\u0026rsquo;s public IP list to make sure you\u0026rsquo;re not getting unauthorized SIP requests. You can get that here: https://www.twilio.com/console/sip-trunking/your-network\nTest and smile Since we\u0026rsquo;re not encrypting SIP traffic, and it\u0026rsquo;s flowing over 5060, we can fire up Wireshark and start looking at dialogs. Even with no calls flowing, we should be seeing OPTIONS requests roughly every 60 seconds sourcing from the Skype servers that have the trunk attached.\nMaking an inbound call we see the INVITE sourcing from Twilio.\nAnd making an outbound call we see the call outgoing:\nAlso, Twilio has built-in pcaps that you can use to troubleshoot the remote-end of the trunk. Think of this as having Wireshark running on Twilio\u0026rsquo;s edge. VERY COOL!\nImportant note for NAT and non-SIP-aware edge If you\u0026rsquo;re using a Mediation server, either dedicated or collocated, and use RFC1918 private IPs on your inside network, you have to do NAT to translate a public address to the inside IP and get calls flowing.\nThe issue this introduces is it\u0026rsquo;s not a supported configuration with Skype because the Contact header (and many others) will have the server\u0026rsquo;s internal IP, when it really should have the external, public IP. That\u0026rsquo;s why when doing Direct SIP with certified providers, you need to use the Edge server with a Public IP.\nSome providers like IntelePeer will happily mangle SIP headers to make sure they have your external IP in there, and everything is well. In my case, using a NAT address kills some functionality, specifically:\nSome calls tend to hang up after 30 seconds Calls can\u0026rsquo;t be put on hold for longer than 30 seconds When hanging up the call on the far end, the out-of-dialog BYE message coming from Twilio goes to the contact IP, so you never get it\u0026hellip; and the call hangs up after 30 seconds anyway Using a Session Border Controller to trunk to Twilio is one answer. Using a SIP-aware firewall or edge device is another, but most can\u0026rsquo;t do SIP over TCP, and definitely not SIP over TLS\u0026hellip; so what then?\nThere\u0026rsquo;s a bit of a hack, and it involves setting the EnableSessionTimer to $True, RTCPActiveCalls to $False and RTCPCallsOnHold to $False, like so:\nNot ideal, but gets the job done. The SessionTimer will check every 30 seconds for an active RTP session, regardless of whether RTCP \u0026ldquo;control\u0026rdquo; packets were received or not. This is why calls hang up after 30 seconds, because of no RTCP from Twilio since it goes to the Contact IP.\nThis hack is probably best if done as a MUST, and no other solutions are viable. My recommendation would be to use use Public IP with proper edge security (limiting to Twilio\u0026rsquo;s service addresses) or using an SBC or B2BUA.\nHope you enjoyed this post!!! Please leave a comment!!!\n","permalink":"https://blog.escarra.org/posts/hooking-up-twilio-sip-to-skype-for-business/","summary":"\u003cp\u003eIf you\u0026rsquo;ve never heard of \u003ca href=\"https://www.twilio.com/\"\u003eTwilio\u003c/a\u003e before, you\u0026rsquo;d be surprised to learn that they are the largest backend for services around automated calling services, text messaging (and verification), and are pioneering Software Defined Telephony by use of APIs to route and handle texts/calls/faxes. Is your Uber driver calling you now? That\u0026rsquo;s Twilio\u0026hellip; Got a text from Netflix for a password reset? Yup, that\u0026rsquo;s Twilio\u0026hellip; PagerDuty sending you a SMS alert? You guessed it!\u003c/p\u003e","title":"Hooking up Twilio SIP to Skype for Business"},{"content":"If running Lync Server 2010, Lync Server 2013 or Skype for Business Server 2015, and started noticing these in your Lync Server event log sometime between May and June of 2017, while at the same time people can\u0026rsquo;t share PowerPoints or do Whiteboards / Q\u0026amp;A\u0026hellip;\nThen you\u0026rsquo;ve fallen victim of a known issue with the May 2017 .NET Framework Security and Quality Rollup affecting the Web Conferencing Service.\nLuckily, Microsoft detailed two workarounds, one involves getting a new Edge Internal cert, and another involved a registry change. Here\u0026rsquo;s the details:\nhttps://support.microsoft.com/en-us/help/4023993/ls-data-mcu-events-41025-and-41026-are-constantly-generated-after-you-\n","permalink":"https://blog.escarra.org/posts/ls-data-mcu-events-and-starting-in-may-june/","summary":"\u003cp\u003eIf running Lync Server 2010, Lync Server 2013 or Skype for Business Server 2015, and started noticing these in your Lync Server event log sometime between May and June of 2017, while at the same time people can\u0026rsquo;t share PowerPoints or do Whiteboards / Q\u0026amp;A\u0026hellip;\u003c/p\u003e\n\u003cp\u003e\u003cimg loading=\"lazy\" src=\"/wp-content/uploads/2017/06/2017-06-13-21_04_07-Clipboard.png\"\u003e\u003c/p\u003e\n\u003cp\u003eThen you\u0026rsquo;ve fallen victim of a known issue with the May 2017 .NET Framework Security and Quality Rollup affecting the Web Conferencing Service.\u003c/p\u003e\n\u003cp\u003eLuckily, Microsoft detailed two workarounds, one involves getting a new Edge Internal cert, and another involved a registry change. Here\u0026rsquo;s the details:\u003c/p\u003e","title":"LS Data MCU events 41025 and 41026 starting in May-June?"},{"content":"TL;DR: When dual-homing, make sure both your NICs have the same link speed (1Gb, 10Gb). VMware\u0026rsquo;s E1000E is 1Gb, and VMXNET3 is 10Gb. Automatic metrics will prefer the 10Gb and that may cause the issue below\u0026hellip;.\nAfter a power loss over the weekend, two Skype for Business Front-Ends were restarted and the RTCSRV service failed to start. A bit about these machines that\u0026rsquo;s relevant to the issue:\nRunning Widnows Server 2012 R2 as VMware ESXi 5.5 guests. Collocated Mediation service. Dual-homed, with Data network as default gateway, and Voice network to talk to a Sonus SBC, with service usage limited to the specified addresses for Primary and PSTN in the topology. Certificate stores were in good order, so KB2795828 did not apply.\nEvent ID\u0026rsquo;s seen in the log were LS User Services 32178:\nFailed to sync data for Routing group {0FCDD1FD-39AF-502A-AECA-E702A5E8FC55} from backup store. Cause: This may indicate a problem with connectivity to backup database or some unknown product issue. Resolution: Ensure that connectivity to backup database is proper. If the error persists, please contact product support with server traces.\nLS User Services 30988:\nSending HTTP request failed. Server functionality will be affected if messages are failing consistently.\nSending the message to https://FE1.domain.org:444/LiveServer/Replication failed. IP Address is IPOFVOICENIC. Error code is 0x2EFD. Content-Type is application/replication+xml. Http Error Code is 0x0. Cause: Network connectivity issues or an incorrectly configured certificate on the destination server. Check the eventlog description for more information. Resolution: Check the destination server to see that it is listening on the same URI and it has certificate configured for MTLS. Other reasons might be network connectivity issues between the two servers.\nand User Services 32174:\nServer startup is being delayed because fabric pool manager has not finished initial placement of users.\nCurrently waiting for routing group: {EF5151C7-B5E1-53B8-9F61-0CC90C82B9F6}. Number of groups potentially not yet placed: 9. Total number of groups: 9.\n[\u0026hellip;]\nThe issue ended up being different Adapter Type in VMware for both NICs. The primary NIC was set to E1000E, so 1Gb/s Max, and the Voice NIC, which was added after the server was deployed, was set to VMXNET 3, which runs at 10Gb/s regardless of uplink bandwidth from the host.\nTurns out the Windows Automatic Metric was messing up interface preference here because it was setting the 10Gb/s NIC with an automatic lower metric.\nManually setting a lower metric for the Primary NIC and rebooting the server resolved the issue.\n","permalink":"https://blog.escarra.org/posts/skype-front-end-not-starting-on-dual-homed-vm/","summary":"\u003cp\u003e\u003cstrong\u003eTL;DR: When dual-homing, make sure both your NICs have the same link speed (1Gb, 10Gb). VMware\u0026rsquo;s E1000E is 1Gb, and VMXNET3 is 10Gb. Automatic metrics will prefer the 10Gb and that may cause the issue below\u0026hellip;.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eAfter a power loss over the weekend, two Skype for Business Front-Ends were restarted and the RTCSRV service failed to start. A bit about these machines that\u0026rsquo;s relevant to the issue:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRunning Widnows Server 2012 R2 as VMware ESXi 5.5 guests.\u003c/li\u003e\n\u003cli\u003eCollocated Mediation service.\u003c/li\u003e\n\u003cli\u003eDual-homed, with Data network as default gateway, and Voice network to talk to a Sonus SBC, with service usage limited to the specified addresses for Primary and PSTN in the topology.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eCertificate stores were in good order, so \u003ca href=\"https://support.microsoft.com/en-us/kb/2795828\"\u003eKB2795828\u003c/a\u003e did not apply.\u003c/p\u003e","title":"Skype Front End not starting on dual-homed VM"},{"content":"Let\u0026rsquo;s say it was totally underprovisioned at some point. Just bumping up the RAM won\u0026rsquo;t give you the performance you expect. Here\u0026rsquo;s why:\nYou deploy a Server 2012 R2 template with 2GB RAM using your favorite hypervisor and just roll with the Skype for Business or Lync deployment without even thinking about it. Or\u0026hellip; let\u0026rsquo;s say you ask for a VM to be provisioned so you can roll out SfB, and it\u0026rsquo;s underprovisioned from the start, but changing the resources would take too long so you go ahead with the deployment anyway and just wait for resources to be added later on. No time wasted. How many times has that happened? Plenty to me\u0026hellip;\nDown the road, whether it\u0026rsquo;s a reactive need for more memory, or you just realized the VM\u0026rsquo;s were completely underprovisioned and not up to those 32GB RAM Microsoft really asks for\u0026hellip; What then? Just bump up the RAM, right?\nNot quite\u0026hellip;\nDo that, and your SQL instances RTCLOCAL and LYNCLOCAL will just daydream about those sweet 32GB you allocated\u0026hellip; Let\u0026rsquo;s take a look at a VM with only 4GB on it:\nPretty sad, right? at no point in time can both SQL instances consume more than 941MB. What if you add RAM you say? The Minimum and Maximum Server Memory stay the exact same!!!\nIf you want to go ahead and change these values, you\u0026rsquo;re open to do so, but it\u0026rsquo;s not technically supported. Don\u0026rsquo;t care? then pick values for 6%-8% of your total RAM for LYNCLOCAL, and 12%-15% for RTCLOCAL. Care? Then:\nOpen the Deployment Wizard, Install or Update, and run Step 1 again . Go grab a coffee while RTCLOCAL gets pimped out with more RAM. Then run Step 2 again. If done with coffee, get a new one while LYNCLOCAL gets a memory makeover. You can verify the added memory now. Big difference. But, because these instances actually run on SQL Express, they won\u0026rsquo;t be able to address more than 1GB each (or 1400MB depending on who you ask). The difference between a max 327MB and 1GB is quite substantial, so this change will still make a difference.\n7/28/2016 Edit: Looks like Tom Pacyk wrote a better post over two years ago, and also points out the SQL Express limit of 1GB per instance. http://www.confusedamused.com/notebook/lync-2013-sql-express-instance-memory\n","permalink":"https://blog.escarra.org/posts/is-your-lync-sfb-starved-for-memory/","summary":"\u003cp\u003eLet\u0026rsquo;s say it was totally underprovisioned at some point. Just bumping up the RAM won\u0026rsquo;t give you the performance you expect. Here\u0026rsquo;s why:\u003c/p\u003e\n\u003cp\u003eYou deploy a Server 2012 R2 template with 2GB RAM using your favorite hypervisor and just roll with the Skype for Business or Lync deployment without even thinking about it. Or\u0026hellip; let\u0026rsquo;s say you ask for a VM to be provisioned so you can roll out SfB, and it\u0026rsquo;s underprovisioned from the start, but changing the resources would take too long so you go ahead with the deployment anyway and just wait for resources to be added later on. No time wasted. How many times has that happened? Plenty to me\u0026hellip;\u003c/p\u003e","title":"Is your Lync/SfB starved for memory?"},{"content":"New features!\nVideo Based Screen Sharing (VBSS) in meetings, enables much more efficient screen sharing with fluid motion (not the 2fps we’re used to in meetings. Multiple Emergency Numbers in a location policy, useful for universities that may have their own local emergency number in addition to 911 Busy Options like Busy on Busy and Voicemail on Busy. Get it here:\nhttps://support.microsoft.com/en-us/kb/3061064\n","permalink":"https://blog.escarra.org/posts/skype-for-business-server-june-cu/","summary":"\u003cp\u003eNew features!\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://support.microsoft.com/en-us/kb/3170163\"\u003eVideo Based Screen Sharing\u003c/a\u003e (VBSS) in meetings, enables much more efficient screen sharing with fluid motion (not the 2fps we’re used to in meetings.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.microsoft.com/en-us/kb/3170171\"\u003eMultiple Emergency Numbers\u003c/a\u003e in a location policy, useful for universities that may have their own local emergency number in addition to 911\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.microsoft.com/en-us/kb/3137160\"\u003eBusy Options\u003c/a\u003e like Busy on Busy and Voicemail on Busy.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eGet it here:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://support.microsoft.com/en-us/kb/3061064\"\u003ehttps://support.microsoft.com/en-us/kb/3061064\u003c/a\u003e\u003c/p\u003e","title":"Skype for Business Server June 2016 CU"},{"content":"Ever wondered what a proper T.38 Fax over IP (FoIP) transmission looks like running through Wireshark? Maybe you\u0026rsquo;re troubleshooting a call flow, or never seen a T.38 capture. Below I\u0026rsquo;ll try to explain the call flow and steps to look out for when troubleshooting T.38 calls. Here\u0026rsquo;s an Outbound FAX call originating from a FXS port in a Cisco CUBE, and going towards Flowroute.\nInitial SIP INVITE and early media receipt (ringback). Note this is all RTP. SDP from the INVITE shows media offered is all voice (RTP) 183 Session in Progress, and we start sending media too (again, RTP). Later on comes the 200 OK, meaning the call was answered on the remote end. Things changing now\u0026hellip; in-dialog (RE)INVITE from Cisco CUBE to SIP trunk\u0026hellip; RTP and T.38 packets mixed because the remote end has not accepted our INVITE yet, but we start sending media either way. And the SDP of the new INVITE now shows all T.38 media now. Once we get the 200 OK from Flowroute, it\u0026rsquo;s all T.38 media both ways. Now the flow gets interesting, more Fax-ey. Wireshark will decode the HDLC data and show interesting bits here TSI, is our Fax station number programmed in the machine. DCS, our Fax machine communicates the capabilities, and starts training. If we look inside the packet\u0026rsquo;s data, our DCS has a lot more information about our Fax machine\u0026rsquo;s settings and resolution Then we get an FTT, means the remote end \u0026ldquo;Failed to Train\u0026rdquo;. Not usually a sign something is wrong, but more a capability mismatch. The remote fax may accept only lower baud rates, and will fail to train any higher. This is normal unless it\u0026rsquo;s the only response we get back from the remote end. We see the same process of TSI, DCS and FTT until we hit the right baud rate\u0026hellip; in our case it\u0026rsquo;s 9600\u0026hellip; Once we get that, we receive a CFR. Followed by a short training to sync-up and data (because we did long training before the CFR) And our actual FAX data which will vary At the end of the data, Wireshark reassembles the packets and tells us whether there was a loss or not. In our case, we\u0026rsquo;re good! We send an EOP to signal the end of the transmission The remote end does an MCF to acknowledge receipt (this is how your Fax machine knows the fax is \u0026ldquo;good\u0026rdquo; on the other end) And then we send a DCN to logically hang up the HDLC stream, but we wait for the remote end\u0026hellip; Remote end hangs up the call\u0026hellip; and we\u0026rsquo;re done\u0026hellip; And that was it. Many exchanges and training but in the end our page was sent over a SIP trunk, negotiating T.38, training with the remote fax machine at 9600 baud, and transmitting one page in about a minute.\n","permalink":"https://blog.escarra.org/posts/t-fax-over-ip-call-on-wireshark/","summary":"\u003cp\u003eEver wondered what a proper T.38 Fax over IP (FoIP) transmission looks like running through Wireshark? Maybe you\u0026rsquo;re troubleshooting a call flow, or never seen a T.38 capture. Below I\u0026rsquo;ll try to explain the call flow and steps to look out for when troubleshooting T.38 calls. Here\u0026rsquo;s an Outbound FAX call originating from a FXS port in a Cisco CUBE, and going towards Flowroute.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eInitial SIP INVITE and early media receipt (ringback). Note this is all RTP.\n\u003cimg alt=\"2016-03-22 16_08_08\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_08_08.png\"\u003e\u003c/li\u003e\n\u003cli\u003eSDP from the INVITE shows media offered is all voice (RTP)\n\u003cimg alt=\"2016-03-22 16_10_50\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_10_50.png\"\u003e\u003c/li\u003e\n\u003cli\u003e183 Session in Progress, and we start sending media too (again, RTP). Later on comes the 200 OK, meaning the call was answered on the remote end.\n\u003cimg alt=\"2016-03-22 16_09_50\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_09_50.png\"\u003e\u003c/li\u003e\n\u003cli\u003eThings changing now\u0026hellip; in-dialog (RE)INVITE from Cisco CUBE to SIP trunk\u0026hellip; RTP and T.38 packets mixed because the remote end has not accepted our INVITE yet, but we start sending media either way.\n\u003cimg alt=\"2016-03-22 16_14_17\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_14_17.png\"\u003e\u003c/li\u003e\n\u003cli\u003eAnd the SDP of the new INVITE now shows all T.38 media now.\n\u003cimg alt=\"2016-03-22 16_14_59\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_14_59.png\"\u003e\u003c/li\u003e\n\u003cli\u003eOnce we get the 200 OK from Flowroute, it\u0026rsquo;s all T.38 media both ways.\n\u003cimg alt=\"2016-03-22 16_15_44\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_15_44.png\"\u003e\u003c/li\u003e\n\u003cli\u003eNow the flow gets interesting, more Fax-ey. Wireshark will decode the HDLC data and show interesting bits here\n\u003cul\u003e\n\u003cli\u003eTSI, is our Fax station number programmed in the machine.\n\u003cimg alt=\"2016-03-22 16_17_35\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_17_35.png\"\u003e\u003c/li\u003e\n\u003cli\u003eDCS, our Fax machine communicates the capabilities, and starts training.\n\u003cimg alt=\"2016-03-22 16_18_34\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_18_34.png\"\u003e\u003c/li\u003e\n\u003cli\u003eIf we look inside the packet\u0026rsquo;s data, our DCS has a lot more information about our Fax machine\u0026rsquo;s settings and resolution\n\u003cimg alt=\"2016-03-22 16_44_22\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_44_22.png\"\u003e\u003c/li\u003e\n\u003cli\u003eThen we get an FTT, means the remote end \u0026ldquo;Failed to Train\u0026rdquo;. Not usually a sign something is wrong, but more a capability mismatch. The remote fax may accept only lower baud rates, and will fail to train any higher. This is normal unless it\u0026rsquo;s the only response we get back from the remote end.\n\u003cimg alt=\"2016-03-22 16_18_49\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_18_49.png\"\u003e\u003c/li\u003e\n\u003cli\u003eWe see the same process of TSI, DCS and FTT until we hit the right baud rate\u0026hellip; in our case it\u0026rsquo;s 9600\u0026hellip; Once we get that, we receive a CFR.\n\u003cimg alt=\"2016-03-22 16_20_19\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_20_19.png\"\u003e\u003c/li\u003e\n\u003cli\u003eFollowed by a short training to sync-up and data (because we did long training before the CFR)\n\u003cimg alt=\"2016-03-22 16_20_35\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_20_35.png\"\u003e\u003c/li\u003e\n\u003cli\u003eAnd our actual FAX data which will vary\n\u003cimg alt=\"2016-03-22 16_21_21\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_21_21.png\"\u003e\u003c/li\u003e\n\u003cli\u003eAt the end of the data, Wireshark reassembles the packets and tells us whether there was a loss or not. In our case, we\u0026rsquo;re good!\n\u003cimg alt=\"2016-03-22 16_21_50\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_21_50.png\"\u003e\u003c/li\u003e\n\u003cli\u003eWe send an EOP to signal the end of the transmission\n\u003cimg alt=\"2016-03-22 16_22_21\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_22_21.png\"\u003e\u003c/li\u003e\n\u003cli\u003eThe remote end does an MCF to acknowledge receipt (this is how your Fax machine knows the fax is \u0026ldquo;good\u0026rdquo; on the other end)\n\u003cimg alt=\"2016-03-22 16_22_40\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_22_40.png\"\u003e\u003c/li\u003e\n\u003cli\u003eAnd then we send a DCN to logically hang up the HDLC stream, but we wait for the remote end\u0026hellip;\n\u003cimg alt=\"2016-03-22 16_24_42\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_24_42.png\"\u003e\u003c/li\u003e\n\u003cli\u003eRemote end hangs up the call\u0026hellip; and we\u0026rsquo;re done\u0026hellip;\n\u003cimg alt=\"2016-03-22 16_25_02\" loading=\"lazy\" src=\"/wp-content/uploads/2016/03/2016-03-22-16_25_02.png\"\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAnd that was it. Many exchanges and training but in the end our page was sent over a SIP trunk, negotiating T.38, training with the remote fax machine at 9600 baud, and transmitting one page in about a minute.\u003c/p\u003e","title":"T.38 Fax over IP call on Wireshark"},{"content":"Sophos UTM v9 comes with the tcpdump utility, which lets you run packet captures from the shell. This is great and all, but in order to look at those pcaps with Wireshark, you need to pipe to a file, copy the file, then run Wireshark against it. Annoying. All of it.\nWhat if we could remotely capture packets over an SSH tunnel? YES\u0026hellip; turns out it\u0026rsquo;s a bit tricky if you\u0026rsquo;re on Windows, and the authentication piece to get root access without having to do the loginuser first. How? Keep reading\u0026hellip;\nFirst, the necessary ingredients:\nSophos UTM Wireshark (or your favorite pcap application) Putty suite (specifically Plink and PuttyGen) To start, we\u0026rsquo;ll need to enable Shell Access, with public key authentication, and with Root access but only with SSH key.\nWe need to use PuttyGen to generate the key pair we\u0026rsquo;ll use for root authentication, so open it, Generate the key, then copy the Public Key into the Authorized Keys for root in the UTM, apply and save\u0026hellip; and also Save private key to somewhere you\u0026rsquo;ll remember. We\u0026rsquo;ll need this for Plink.\nThere\u0026rsquo;s our new key\u0026hellip;\nThen run the actual magic using Plink. Take the following command as an example:\nplink -ssh root@firewall.domain.com -i C:\\ssh-priv.ppk \u0026ldquo;tcpdump -s 0 -U -n -w - not port 22 and not host 192.168.0.1\u0026rdquo; | \u0026ldquo;C:\\Program Files\\Wireshark\\Wireshark.exe\u0026rdquo; -k -i -\nReplace the SSH connection string for your actual firewall FQDN, the filename of ssh-priv.ppk for the location of your saved Private Key generated with PuttyGen, and the not host 192.168.0.1 with the IP address of the firewall from the interface you\u0026rsquo;re reaching it.\nWireshark will open and start showing packets. You can smile and jump now.\nYou can modify the tcpdump parameters to better match the capture, for example, using -i eth1 to capture a specific interface, or filter specific traffic\u0026hellip; once you\u0026rsquo;re done, just close Wireshark and CTRL+C the command.\nNote, if you\u0026rsquo;re doing this capture remotely over WAN or Internet, it will tunnel ALL packets over SSH, so it will take up a lot of bandwidth\u0026hellip;\nHave fun!!!\n","permalink":"https://blog.escarra.org/posts/remote-wireshark-capture-for-sophos-utm-over-ssh/","summary":"\u003cp\u003eSophos UTM v9 comes with the tcpdump utility, which lets you run packet captures from the shell. This is great and all, but in order to look at those pcaps with Wireshark, you need to pipe to a file, copy the file, then run Wireshark against it. Annoying. All of it.\u003c/p\u003e\n\u003cp\u003eWhat if we could remotely capture packets over an SSH tunnel? YES\u0026hellip; turns out it\u0026rsquo;s a bit tricky if you\u0026rsquo;re on Windows, and the authentication piece to get root access without having to do the loginuser first. How? Keep reading\u0026hellip;\u003c/p\u003e","title":"Remote Wireshark capture for Sophos UTM over SSH"},{"content":"VMware\u0026rsquo;s Performance Best Practices mentions you should set power management in the BIOS to “OS Controlled Mode” or equivalent. This is so you can control power saving from the hypervisor itself. It\u0026rsquo;s very useful when you want to change these settings on the fly without having to reboot into the BIOS, similar to how Windows power profiles work.\nBut the \u0026ldquo;gotcha\u0026rdquo; here, which is also mentioned in the best practices documentation, is that the default Power Policy setting is set to Balanced, when you most likely want to set this to High Performance, as you\u0026rsquo;ll see later\u0026hellip;\nThis makes it pretty awful for latency-sensitive workloads. In Balanced, your CPU sometimes has to scale up or down in the power states before it can process an instruction, and this adds latency. The difference can be clearly seen by looking at the CPU Ready (RDY%) metric. Here\u0026rsquo;s the difference changing to High Performance made in a single vCPU VM:\nAnd here is a 4 vCPU VM running Exchange 2013\nMy VM\u0026rsquo;s felt \u0026ldquo;snappier\u0026rdquo; after the change. It\u0026rsquo;s hard to avoid speaking subjectively here, but click-to-action felt quicker. Maybe it\u0026rsquo;s in my head, but I feel those charts tell a different story.\nThe effect the \u0026ldquo;Balanced\u0026rdquo; power savings has on CPU Ready times is clear as day, though it\u0026rsquo;s mentioned that Balanced has minimal to no impact on performance. I have yet to do benchmarks to show how CPU Ready% affects real workloads, but at the very least, CPU instruction latency from a guest VM is dramatically decreased, which benefits those real-time workloads like Lync, Skype for Business or VoIP.\n","permalink":"https://blog.escarra.org/posts/vmware-power-policy-and-cpu-ready-latency/","summary":"\u003cp\u003eVMware\u0026rsquo;s \u003ca href=\"https://www.vmware.com/files/pdf/techpaper/VMware-PerfBest-Practices-vSphere6-0.pdf\"\u003ePerformance Best Practices\u003c/a\u003e mentions you should \u003cstrong\u003eset power management in the BIOS to “OS Controlled Mode” or equivalent\u003c/strong\u003e. This is so you can control power saving from the hypervisor itself. It\u0026rsquo;s very useful when you want to change these settings on the fly without having to reboot into the BIOS, similar to how Windows power profiles work.\u003c/p\u003e\n\u003cp\u003eBut the \u0026ldquo;gotcha\u0026rdquo; here, which is also mentioned in the best practices documentation, is that the default Power Policy setting is set to Balanced, when you most likely want to set this to \u003cstrong\u003eHigh Performance\u003c/strong\u003e, as you\u0026rsquo;ll see later\u0026hellip;\u003c/p\u003e","title":"VMware Power Policy and CPU Ready latency"},{"content":"So\u0026hellip; VMware\u0026rsquo;s NSX is super awesome! I\u0026rsquo;m one of those weird guys that find playing with networking and virtualization on a Monday night more fun and exciting than a weekend in Vegas. Ok, maybe not so much, but still somehow I managed to stay up past midnight deploying an NSX \u0026ldquo;Lab\u0026rdquo; just by messing with it. I say screw the guide, I learn better by just pressing buttons and breaking things\u0026hellip; I\u0026rsquo;m not doing this for a client so what gives? Let\u0026rsquo;s poke\u0026hellip;\nAfter some fun I\u0026rsquo;ve gone from just knowing concepts of SDN to a fully usable network running on top of VMware NSX. It\u0026rsquo;s complete with:\nSingle 6.2 controller VXLAN transport on a Force10 S60 with PIM and IGMP snooping enabled Since I already had Distributed vSwitches, it was very easy to provision the transport Multicast Transport Zone and segment ID Single NSX Edge running OSPF connecting to the S60 core and redistributing connected networks Single logical switch (for now) Two VM\u0026rsquo;s on two different hosts to test connectivity Smiles Captured live flows while downloading a CentOS ISO from a mirror site just to test speeds.\nSo far i\u0026rsquo;m very impressed with what NSX can do, and i\u0026rsquo;ve only scratched the surface. Think stretched networks over L3, per-VM firewall policies both at Layer 3 and Layer 2 levels, Logical routers between virtual switches, each with its own ACLs, HA edges, so many cool things!. Only 59 days left\u0026hellip;\nIt\u0026rsquo;s almost 1am and I should really go to sleep now. Good night.\n","permalink":"https://blog.escarra.org/posts/vmware-nsx-lab-in-a-night-awesome/","summary":"\u003cp\u003eSo\u0026hellip; VMware\u0026rsquo;s NSX is super awesome! I\u0026rsquo;m one of those weird guys that find playing with networking and virtualization on a Monday night more fun and exciting than a weekend in Vegas. Ok, maybe not so much, but still somehow I managed to stay up past midnight deploying an NSX \u0026ldquo;Lab\u0026rdquo; just by messing with it. I say screw the guide, I learn better by just pressing buttons and breaking things\u0026hellip; I\u0026rsquo;m not doing this for a client so what gives? Let\u0026rsquo;s poke\u0026hellip;\u003c/p\u003e","title":"VMware NSX Lab in a night = awesome"},{"content":"Released last week, new technical diagrams in Visio and PDF for Skype for Business workloads, Call Quality Methodology (CQM) and different hybrid scenarios.\nhttps://technet.microsoft.com/en-us/library/dn594589.aspx ","permalink":"https://blog.escarra.org/posts/new-technical-diagrams-for-skype-for-business-server/","summary":"\u003cp\u003eReleased last week, new technical diagrams in Visio and PDF for Skype for Business workloads, Call Quality Methodology (CQM) and different hybrid scenarios.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://technet.microsoft.com/en-us/library/dn594589.aspx\"\u003ehttps://technet.microsoft.com/en-us/library/dn594589.aspx\u003c/a\u003e \u003ca href=\"http://go.microsoft.com/fwlink/?LinkId=550989\"\u003e\u003cimg alt=\"SfB Protocol Workloads poster\" loading=\"lazy\" src=\"/wp-content/uploads/2016/02/IC793264.png\"\u003e\u003c/a\u003e \u003ca href=\"http://go.microsoft.com/fwlink/?LinkId=617899\"\u003e\u003cimg alt=\"Thumbnail for the CQM poster\" loading=\"lazy\" src=\"/wp-content/uploads/2016/02/IC815848.png\"\u003e\u003c/a\u003e \u003ca href=\"http://download.microsoft.com/download/2/E/E/2EE5C4DE-7F12-475C-A507-37870020F0D3/Plan%20Voice%20Solution%20poster%20-%20Final.pdf\"\u003e\u003cimg alt=\"Plan Voice Solution poster Thumbnail\" loading=\"lazy\" src=\"/wp-content/uploads/2016/02/IC846449.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"New Technical Diagrams for Skype for Business Server 2015"},{"content":"My first attempt at a semi-useful PowerShell script. This script will export all UM prompts from all dial plans and auto attendants for Exchange 2010 and 2013. The output of the script is a collection of files with WAV extension on the running directory, matching the names of the custom prompts.\nFuture changes: Set a working folder, and organize the prompts into folders based on AA and DP name.\nThe output files are in WAV extension, but are actually MP3 files (Insert blame for Export-UMPrompt). There is another script coming that will convert these files from MP3 to 8Khz Mono PCM WAV files so they can be reused for other UM attendants.\nDisclaimer: This is one of my first attempts at scripting, so the code may be completely unoptimized, slow, confusing or just plain ugly.\nHope this is useful!\nhttps://gallery.technet.microsoft.com/Export-UM-Custom-Prompts-048ac1d4\n","permalink":"https://blog.escarra.org/posts/export-um-custom-prompts/","summary":"\u003cp\u003eMy first attempt at a semi-useful PowerShell script. This script will export all UM prompts from all dial plans and auto attendants for Exchange 2010 and 2013. The output of the script is a collection of files with WAV extension on the running directory, matching the names of the custom prompts.\u003c/p\u003e\n\u003cp\u003eFuture changes: Set a working folder, and organize the prompts into folders based on AA and DP name.\u003c/p\u003e\n\u003cp\u003eThe output files are in WAV extension, but are actually MP3 files (Insert blame for Export-UMPrompt). There is another script coming that will convert these files from MP3 to 8Khz Mono PCM WAV files so they can be reused for other UM attendants.\u003c/p\u003e","title":"Export UM Custom Prompts"},{"content":"Skype for Business for Android is out of preview and finally released. Time to try it with the Grandstream GXV3275\u0026hellip;\nhttps://blogs.office.com/2015/12/16/skype-for-business-for-android-now-available/?wt.mc_id=soc_li_Office-365_Skype-for-Business_null\u0026amp;ls=soc\u0026amp;ca=Office-365\u0026amp;lsd=li\u0026amp;Ocid=1%20-%20Fans_Social_LINKEDIN_COMPANY_Skype%20for%20Business_20151216_305715181\n","permalink":"https://blog.escarra.org/posts/skype-for-business-for-android-is-now-released/","summary":"\u003cp\u003eSkype for Business for Android is out of preview and finally released. Time to try it with the Grandstream GXV3275\u0026hellip;\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://blogs.office.com/2015/12/16/skype-for-business-for-android-now-available/?wt.mc_id=soc_li_Office-365_Skype-for-Business_null\u0026amp;ls=soc\u0026amp;ca=Office-365\u0026amp;lsd=li\u0026amp;Ocid=1%20-%20Fans_Social_LINKEDIN_COMPANY_Skype%20for%20Business_20151216_305715181\"\u003ehttps://blogs.office.com/2015/12/16/skype-for-business-for-android-now-available/?wt.mc_id=soc_li_Office-365_Skype-for-Business_null\u0026amp;ls=soc\u0026amp;ca=Office-365\u0026amp;lsd=li\u0026amp;Ocid=1%20-%20Fans_Social_LINKEDIN_COMPANY_Skype%20for%20Business_20151216_305715181\u003c/a\u003e\u003c/p\u003e","title":"Skype for Business for Android is now released"},{"content":"Released 11/17 and fixes an issue with Windows 10 users over Edge not able to join meetings using the Skype Web App.\nIt also adds a new Shared Line Appearance (SLA). More details on that here: https://support.microsoft.com/en-us/kb/3092727\nGet the CU here: https://www.microsoft.com/en-us/download/details.aspx?id=47690\n","permalink":"https://blog.escarra.org/posts/skype-for-business-november-cumulative-update/","summary":"\u003cp\u003eReleased 11/17 and fixes an issue with Windows 10 users over Edge not able to join meetings using the Skype Web App.\u003c/p\u003e\n\u003cp\u003eIt also adds a new Shared Line Appearance (SLA). More details on that here: \u003ca href=\"https://support.microsoft.com/en-us/kb/3092727\"\u003ehttps://support.microsoft.com/en-us/kb/3092727\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eGet the CU here: \u003ca href=\"https://www.microsoft.com/en-us/download/details.aspx?id=47690\"\u003ehttps://www.microsoft.com/en-us/download/details.aspx?id=47690\u003c/a\u003e\u003c/p\u003e","title":"Skype for Business November Cumulative Update"},{"content":"Paul Bloem\u0026rsquo;s stencils blow anything else out of the water. Zeacom servers, AudioCodes SBC\u0026rsquo;s, and better looking Skype for Business roles, even the CQD! What else could I want?\nExcellent job Paul. I\u0026rsquo;ve shared this with my colleagues so they better vote 5 stars!\nhttps://gallery.technet.microsoft.com/office/Skype-for-Business-2015-4a8f03dc ","permalink":"https://blog.escarra.org/posts/awesome-skype-for-business-visio-stencils/","summary":"\u003cp\u003ePaul Bloem\u0026rsquo;s stencils blow anything else out of the water. Zeacom servers, AudioCodes SBC\u0026rsquo;s, and better looking Skype for Business roles, even the CQD! What else could I want?\u003c/p\u003e\n\u003cp\u003eExcellent job Paul. I\u0026rsquo;ve shared this with my colleagues so they better vote 5 stars!\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://gallery.technet.microsoft.com/office/Skype-for-Business-2015-4a8f03dc\"\u003ehttps://gallery.technet.microsoft.com/office/Skype-for-Business-2015-4a8f03dc\u003c/a\u003e \u003ca href=\"/wp-content/uploads/2015/10/paulbloems4bstencil.png\"\u003e\u003cimg alt=\"paulbloems4bstencil\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/paulbloems4bstencil.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Awesome Skype for Business Visio Stencils"},{"content":"After a year or more of constant changes to the home rack, the wiring started to look ugly and not presentable. If my lab is something I take pride on, then something had to change. Current wiring looked a bit like this:\nThe idea was not only to rework the cables so they\u0026rsquo;re a bit more presentable, but also to start a color standard for patch cables within the rack itself:\nBlue: VLAN Trunks (Data + iSCSI) Black: Native Data/Voice Red: iSCSI / NFS Orange: Internet Uplinks Yellow: Management (iLO/IPMI) Also, the cables that are going up to the office and to the TV\u0026rsquo;s and media rack were all loose and just crimped at the end. Time to get serious, take advantage of this rewiring and put a patch panel so it all looks cleaner.\nI started by removing all cables and leaving only those that will go in the panel, then toning them down and use some labels.\nPunched the pairs into the panel, and racked it in between the core and access switches (so i could patch into core or access with a short patch and no \u0026ldquo;skipping over\u0026rdquo;).\nCLEAN!\nMoved some things around so the Comcast/AT\u0026amp;T modems go in between instead of the side, and also fitted the Sophos UTM.\nMeanwhile, the whole rest of the room looked like a total mess.\nNew cables start to go in\u0026hellip;\nNot too happy with the C-shape of those Orange cables, and wish I had gotten a couple 1ft instead. For now, meh\u0026hellip;\nAnd by Sunday morning, this is what is all looked like.\n","permalink":"https://blog.escarra.org/pages/rack-rewiring-october/","summary":"\u003cp\u003eAfter a year or more of constant changes to the home rack, the wiring started to look ugly and not presentable. If my lab is something I take pride on, then something had to change. Current wiring looked a bit like this:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2015/10/20151010_113126.jpg\"\u003e\u003cimg alt=\"20151010_113126\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/20151010_113126.jpg\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2015/10/20151010_120425.jpg\"\u003e\u003cimg alt=\"20151010_120425\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/20151010_120425.jpg\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThe idea was not only to rework the cables so they\u0026rsquo;re a bit more presentable, but also to start a color standard for patch cables within the rack itself:\u003c/p\u003e","title":"Rack Rewiring - October 2015"},{"content":"A few hours ago I received an e-mail from Microsoft inviting me and some of my coworkers to the Skype for Business Mobile Preview program, with instructions on how to get the Android app installed.\nSo far the app is very well made, with a less \u0026ldquo;beta\u0026rdquo; sense than many other products. I dare to say this preview app feels more reliable than the Lync 2013 app. Some screenshots that give you an idea of what it\u0026rsquo;s like:\nSome nice changes/additions:\nAbility to manage your contact list from the app. Add, remove and move contacts within groups Shake your phone for feedback to the developers (can see this getting removed in GA, but it\u0026rsquo;s pretty nice) Improved integration into the Android OS (missed calls, missed IM\u0026rsquo;s and active calls, but Lync 2013 had similar integration) Call Forwarding settings now let you apply settings outside business hours (like the Desktop client) Tomorrow when the greater part of my colleagues are actually awake, it will be time to run conferences and view content. So far so good. Great job Microsoft!\n","permalink":"https://blog.escarra.org/posts/skype-for-business-preview-for-android/","summary":"\u003cp\u003eA few hours ago I received an e-mail from Microsoft inviting me and some of my coworkers to the Skype for Business Mobile Preview program, with instructions on how to get the Android app installed.\u003c/p\u003e\n\u003cp\u003eSo far the app is very well made, with a less \u0026ldquo;beta\u0026rdquo; sense than many other products. I dare to say this preview app feels more reliable than the Lync 2013 app. Some screenshots that give you an idea of what it\u0026rsquo;s like:\u003c/p\u003e","title":"Skype for Business preview for Android"},{"content":"Technet has a PowerShell one-liner but it\u0026rsquo;s missing .NET 3.5 and the Windows Identity Foundation, which you need anyway. Here\u0026rsquo;s the one-liner that includes them (and assumes your media is on D:)\nInstall-WindowsFeature RSAT-ADDS, Web-Server, Web-Static-Content, Web-Default-Doc, Web-Http-Errors, Web-Asp-Net, Web-Net-Ext, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Logging, Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, Web-Basic-Auth, Web-Windows-Auth, Web-Client-Auth, Web-Filtering, Web-Stat-Compression, Web-Dyn-Compression, NET-WCF-HTTP-Activation45, Web-Asp-Net45, Web-Mgmt-Tools, Web-Scripting-Tools, Web-Mgmt-Compat, Desktop-Experience, Telnet-Client, Net-Framework-Core, Net-HTTP-Activation, Windows-Identity-Foundation -Source D:\\Sources\\SxS ","permalink":"https://blog.escarra.org/posts/skype-for-business-prerequisites-one-liner/","summary":"\u003cp\u003eTechnet has a PowerShell one-liner but it\u0026rsquo;s missing .NET 3.5 and the Windows Identity Foundation, which you need anyway. Here\u0026rsquo;s the one-liner that includes them (and assumes your media is on D:)\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;\"\u003e\u003ccode class=\"language-fallback\" data-lang=\"fallback\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eInstall-WindowsFeature RSAT-ADDS, Web-Server, Web-Static-Content, Web-Default-Doc, Web-Http-Errors, Web-Asp-Net, Web-Net-Ext, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Logging, Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, Web-Basic-Auth, Web-Windows-Auth, Web-Client-Auth, Web-Filtering, Web-Stat-Compression, Web-Dyn-Compression, NET-WCF-HTTP-Activation45, Web-Asp-Net45, Web-Mgmt-Tools, Web-Scripting-Tools, Web-Mgmt-Compat, Desktop-Experience, Telnet-Client, Net-Framework-Core, Net-HTTP-Activation, Windows-Identity-Foundation -Source D:\\Sources\\SxS\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003c/blockquote\u003e","title":"Skype for Business Prerequisites one-liner"},{"content":"No time to install Management Tools? Or just want to test your scripts locally without having to copy/paste on the Front Ends or management nodes? This is what i do:\nparam( [string]$pool = $(Read-Host \u0026#34;Lync/SfB Pool\u0026#34;) ) $Credential = Get-Credential $PSSessionOption = New-PSSessionOption -SkipCACheck:$true -SkipCNCheck:$true -SkipRevocationCheck:$true $PSSession = New-PSSession -ConnectionUri https://$pool/ocspowershell -Credential $Credential -SessionOption $PSSessionOption Import-PSSession $PSSession ","permalink":"https://blog.escarra.org/posts/remote-sfb-powershell-administration/","summary":"\u003cp\u003eNo time to install Management Tools? Or just want to test your scripts locally without having to copy/paste on the Front Ends or management nodes? This is what i do:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;\"\u003e\u003ccode class=\"language-fallback\" data-lang=\"fallback\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eparam(\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e [string]$pool = $(Read-Host \u0026#34;Lync/SfB Pool\u0026#34;)\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e )\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e$Credential = Get-Credential\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e $PSSessionOption = New-PSSessionOption -SkipCACheck:$true -SkipCNCheck:$true -SkipRevocationCheck:$true\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e $PSSession = New-PSSession -ConnectionUri https://$pool/ocspowershell -Credential $Credential -SessionOption $PSSessionOption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e Import-PSSession $PSSession\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e","title":"Remote SfB PowerShell Administration"},{"content":"Skype for Business 2015 was released today, and I get to try an upgrade in my lab before trying a greenfield rollout on a fresh domain. Here is what I have running right now:\nLync 2013 Enterprise Pool with 3 Front-End servers (DNS load balanced) Lync 2013 Enterprise Edge server in a single pool with two perimeter networks Mediation Server dual-homed in Server and Voice VLANs Sophos UTM for networking and Reverse Proxy First run of the setup.exe, we are asked to install a hotfix:\nTried installing the December 2014 Rollup referenced by the hotfix and running setup again, but would not go, I had to actually request and install the hotfix.\nAfter installing, it still failed, saying the following:\nYou cannot perform this upgrade until you have used Skype for Business Server 2015, Topology Builder to upgrade the Lync Server 2013 Pools and then publish the upgraded topology. If you have already published an updated topology those changes might not have replicated to this computer. You can force an immediate replication by running the Invoke-CsManagementStoreReplication cmdlet. You can also use the Export-CsConfiguration and Import-CsConfiguration -LocalStore cmdlets to copy the updated topology to this computer. For more information, see the appropriate cmdlet help topic.\nGuh\u0026hellip; but this makes more sense and right along the guidelines from Microsoft. However, at no point did Setup install any core components or give me the option to install the Administrative Tools.\nWhat\u0026rsquo;s worse, I tried doing this myself by running admintools.msi and got denied since Lync 2013 components were already installed on the server.\nSo I installed the Core Components ( ocscore.msi), SQL 2014 Shared Management Objects ( SharedManagementObjects.msi) and Administrative Tools ( admintools.msi) manually on a VM dedicated for admin purposes, and then I was able to go about the topology modifications. PROGRESS!\nAfter downloading the existing topology, we get our topology much like 2010/2013 was, separated in a tree format:\nAnd we see the new VIS-related nodes in Skype for Business 2015 topology and shared components:\nAs part of the upgrade, we right click on the pool, and select Upgrade to Skype for Business Server 2015.\nWe get a prompt and click Yes.\nAnd now our pool has been moved to the Skype for Business 2015 node.\nWe then publish the topology like we normally would, and get a Select Databases prompt. This will in essence upgrade our back-end databases. Since this is an Enterprise Edition pool, we can upgrade the database without installing the Skype for Business 2015 components on the SQL server. If it were Standard Edition, the upgrade would take a different path.\nThe topology is now published and database installed. The warnings are related to File Store permissions because it\u0026rsquo;s DFS-backed and thus this is expected.\nOn the to-do list, we can see the following instructions:\nTo perform an in-place upgrade of your Skype for Business Server, you\u0026rsquo;ll need to do the following, in order: (1) Stop the Skype for Business services on all of the servers that you are upgrading; (2) Run Skype for Business Server setup (Setup.exe) on all of the servers you are upgrading; (3) Start the Skype for Business services on all of the servers you upgraded. To start the services in a Front End pool, connect to one of the servers in the pool and run the Start-CsPool cmdlet. All the servers in the pool should be running Skype for Business Server before you use the Start-CsPool cmdlet. To start the services in all other pools (e.g. Edge pool, Mediation pool), run the Start-CsWindowsService cmdlet on every server in the pool;\nAnd so the actual process begins. I will start by issuing Stop-CsWindowsService on all Front-Ends, then running setup. Note: If you don\u0026rsquo;t stop all services, Setup will check and won\u0026rsquo;t continue.\nOnce all services are stopped in the pool, the upgrade can move forward.\nOnce the Front-End is all done I get an Upgrade Completed with Warnings\nTurns out the warning is simply that the installer can\u0026rsquo;t access the other Front-Ends, and can\u0026rsquo;t fully match the version. It should be safe to ignore. After clicking OK I get a final list of steps to be followed once all Front-Ends in the pool are updated:\nNew Skype for Business Server icons! Fancy\u0026hellip;\nAfter upgrading the other two Front-Ends we can issue Start-CsPool. Progress:\nAnd after about 3 minutes all services started and\u0026hellip; POOF!\nWe have liftoff! Client signs in quicker than Lync 2013 ever did\u0026hellip; Maybe it\u0026rsquo;s all in my head\u0026hellip;\nWe can see the Control Panel GUI has changed quite a bit\u0026hellip;\nLast to update are the Mediation and Edge, which should just be a matter of upgrading the pool from Topology Builder and then running Setup and letting the update wizard take care of everything\u0026hellip;\nDone for today\u0026hellip;\n","permalink":"https://blog.escarra.org/posts/lync-server-to-skype-for-business-server-in-place-upgrade/","summary":"\u003cp\u003eSkype for Business 2015 was released today, and I get to try an upgrade in my lab before trying a greenfield rollout on a fresh domain. Here is what I have running right now:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eLync 2013 Enterprise Pool with 3 Front-End servers (DNS load balanced)\u003c/li\u003e\n\u003cli\u003eLync 2013 Enterprise Edge server in a single pool with two perimeter networks\u003c/li\u003e\n\u003cli\u003eMediation Server dual-homed in Server and Voice VLANs\u003c/li\u003e\n\u003cli\u003eSophos UTM for networking and Reverse Proxy\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFirst run of the setup.exe, we are asked to install a hotfix:\u003c/p\u003e","title":"Lync Server 2013 to Skype for Business Server 2015 In-Place Upgrade"},{"content":"Today Microsoft released the next version of Lync Server 2013, called Skype for Business Server 2015.\nOver the next few days i will be going through the process of performing an in-place upgrade from Lync 2013, and a greenfield installation on a new domain with no Lync infrastructure.\nHere\u0026rsquo;s a sneak peek:\n","permalink":"https://blog.escarra.org/posts/skype-for-business-server-is-out/","summary":"\u003cp\u003eToday Microsoft released the next version of Lync Server 2013, called Skype for Business Server 2015.\u003c/p\u003e\n\u003cp\u003eOver the next few days i will be going through the process of performing an in-place upgrade from Lync 2013, and a greenfield installation on a new domain with no Lync infrastructure.\u003c/p\u003e\n\u003cp\u003eHere\u0026rsquo;s a sneak peek:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2015/05/2015-05-01-12_28_30.png\"\u003e\u003cimg alt=\"2015-05-01 12_28_30\" loading=\"lazy\" src=\"/wp-content/uploads/2015/05/2015-05-01-12_28_30.png\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2015/05/2015-05-01-12_29_47.png\"\u003e\u003cimg alt=\"2015-05-01 12_29_47\" loading=\"lazy\" src=\"/wp-content/uploads/2015/05/2015-05-01-12_29_47.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Skype for Business Server 2015 is OUT!"},{"content":"The Microsoft Ignite conference for 2015 is kicking off next week starting May 4th, and that can\u0026rsquo;t come soon enough. I\u0026rsquo;ll attend mostly Skype for Business and Exchange vNext sessions. If you\u0026rsquo;re going to the conference, see you there!\n","permalink":"https://blog.escarra.org/posts/see-you-at-microsoft-ignite/","summary":"\u003cp\u003eThe Microsoft Ignite conference for 2015 is kicking off next week starting May 4th, and that can\u0026rsquo;t come soon enough. I\u0026rsquo;ll attend mostly Skype for Business and Exchange vNext sessions. If you\u0026rsquo;re going to the conference, see you there!\u003c/p\u003e","title":"See you at Microsoft Ignite!"},{"content":"The million dollar question (at least in my team). When will Skype for Business be released? Well\u0026hellip; Microsoft announced today that the bits for Skype for Business client, server and online services will be released in April. That\u0026rsquo;s next month!\nAlso, the technical preview of the Skype for Business client is starting today.\nMore: http://blogs.office.com/2015/03/16/get-ready-for-skype-for-business/ ","permalink":"https://blog.escarra.org/posts/skype-for-business-release-announcement/","summary":"\u003cp\u003eThe million dollar question (at least in my team). When will Skype for Business be released? Well\u0026hellip; Microsoft announced today that the bits for Skype for Business client, server and online services will be released in April. That\u0026rsquo;s next month!\u003c/p\u003e\n\u003cp\u003eAlso, the technical preview of the Skype for Business client is starting today.\u003c/p\u003e\n\u003cp\u003eMore: \u003ca href=\"http://blogs.office.com/2015/03/16/get-ready-for-skype-for-business/\"\u003ehttp://blogs.office.com/2015/03/16/get-ready-for-skype-for-business/\u003c/a\u003e \u003ca href=\"/wp-content/uploads/2015/03/2015-03-16-09_56_47.png\"\u003e\u003cimg alt=\"2015-03-16 09_56_47\" loading=\"lazy\" src=\"/wp-content/uploads/2015/03/2015-03-16-09_56_47.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Skype for Business Release Announcement"},{"content":"My switch kept complaining about the links to my FreeNAS SAN not supporting Flow Control. To enable it, edit the interface options in FreeNAS and ass mediaopt flowcontrol then save. Flow Control (and Jumbo Frames) is pretty important for iSCSI workloads to avoid dropped frames and uneven traffic.\n","permalink":"https://blog.escarra.org/posts/enabling-flow-control-on-freenas/","summary":"\u003cp\u003eMy switch kept complaining about the links to my FreeNAS SAN not supporting Flow Control. To enable it, edit the interface options in FreeNAS and ass \u003cstrong\u003emediaopt flowcontrol\u003c/strong\u003e then save. Flow Control (and Jumbo Frames) is pretty important for iSCSI workloads to avoid dropped frames and uneven traffic.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2015/02/2015-02-26-15_23_31.png\"\u003e\u003cimg alt=\"2015-02-26 15_23_31\" loading=\"lazy\" src=\"/wp-content/uploads/2015/02/2015-02-26-15_23_31.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Enabling Flow Control on FreeNAS"},{"content":"After a few hours of headscratching and a support ticket with AudioCodes I\u0026rsquo;ve resolved an issue that VVX phones have with Music on Hold through an AudioCodes gateway. All VVX phones are running UC firmware 5.2.0.8330, and someone else out there is having the exact same issue, but turns out the suggested fix of using voIpProt.SIP.useSendonlyHold=\u0026ldquo;0\u0026rdquo; does not actually work in the 5.2 firmware.\nFor a bit of background, what\u0026rsquo;s happening is the VVX sends a=sendonly in the SDP when a call gets put on hold, but Lync clients send a=inactive. The AudioCodes will play MOH when a=inactive is in the SDP, but not with sendonly, and there is only one behavior that can be configured.\nSetting the SendonlyHold flag in the config files did not make a difference, and the VVX\u0026rsquo;s were still sending the undesired SDP parameter, so the fix was to use a message manipulation rule on the AudioCodes to change it.\nGoing to VoIP \u0026gt; SIP Definitions \u0026gt; Msg Policy \u0026amp; Manipulation \u0026gt; Message Manipulations then creating the following is the first step:\nManipulation Name: VVX Hold Manipulation Set ID: 1 Message Type: reinvite.request Condition: param.message.sdp.rtpmode==\u0026lsquo;sendonly\u0026rsquo; Action Subject: param.message.sdp.rtpmode Action Type: Modify Action Value: \u0026lsquo;inactive\u0026rsquo; Then if you\u0026rsquo;re using SBC, you\u0026rsquo;ll need to apply the Manipulation Rule to the IP Group and call it a day\u0026hellip; But in my case I\u0026rsquo;m using GW as the setup is from Lync to a PRI, and I could not associate the rule to the IP group for Lync. This was the difficult part because nothing I did applied that manipulation rule to Lync\u0026hellip; then Janiel from AudioCodes came to the rescue with instructions:\nOpen the INI parameters from the Admin Page ( http://x.x.x.x/AdminPage), then enter GWINBOUNDMANIPULATIONSET with a value of 1 (or whichever Set ID you used for your Manipulation rule)\nOnce this was done, all reinvites back from Mediation with a=sendonly (call on hold)get translated to a=inactive and the gateway queues Kenny G or AC/DC. We can confirm the rule is applied and the RTP mode gets changed.\nBOOM!!!\n","permalink":"https://blog.escarra.org/posts/music-on-hold-issue-with-audiocodes-and-vvx/","summary":"\u003cp\u003eAfter a few hours of headscratching and a support ticket with AudioCodes I\u0026rsquo;ve resolved an issue that VVX phones have with Music on Hold through an AudioCodes gateway. All VVX phones are running UC firmware 5.2.0.8330, and someone else out there is having the \u003ca href=\"http://community.polycom.com/t5/VoIP/LYNC-Music-on-hold-VVX500/td-p/33082\"\u003eexact same issue\u003c/a\u003e, but turns out the suggested fix of using \u003cstrong\u003evoIpProt.SIP.useSendonlyHold=\u0026ldquo;0\u0026rdquo;\u003c/strong\u003e does not actually work in the 5.2 firmware.\u003c/p\u003e\n\u003cp\u003eFor a bit of background, what\u0026rsquo;s happening is the VVX sends \u003cstrong\u003ea=sendonly\u003c/strong\u003e in the SDP when a call gets put on hold, but Lync clients send \u003cstrong\u003ea=inactive\u003c/strong\u003e. The AudioCodes will play MOH when a=inactive is in the SDP, but not with sendonly, and there is only one behavior that can be configured.\u003c/p\u003e","title":"Music on Hold issue with AudioCodes and VVX"},{"content":"Grab it here: http://www.microsoft.com/en-us/download/details.aspx?id=36517\nBiggest changes are Call/Conversation History, Media Resiliency (automatic reconnection) and OS X Yosemite support.\nUpdate enables users to view call history in Lync for Mac 2011 Update for Lync for Mac 2011 enables users to store conversation history on an Exchange server Location is not displayed in Lync for Mac 2011 when users join a wireless network Error \u0026ldquo;One or more selected contacts cannot receive your calls\u0026rdquo; when you forward calls in Lync for Mac 2011 Delegation relationship is broken after a delegate signs in to Lync for Mac 2011 Computer shutdown is not processed when Lync for Mac 2011 is running Update implements media resiliency mode in Lync for Mac 2011 Dial pad disappears when a user who is not enabled for EV joins a video conference or a video call in Lync for Mac 2011 Update enables users to interact with a contact from the call history in Lync for Mac 2011 ","permalink":"https://blog.escarra.org/posts/october-update-for-lync-for-mac/","summary":"\u003cp\u003eGrab it here: \u003ca href=\"http://www.microsoft.com/en-us/download/details.aspx?id=36517\"\u003ehttp://www.microsoft.com/en-us/download/details.aspx?id=36517\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eBiggest changes are Call/Conversation History, Media Resiliency (automatic reconnection) and OS X Yosemite support.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate enables users to view call history in Lync for Mac 2011\u003c/li\u003e\n\u003cli\u003eUpdate for Lync for Mac 2011 enables users to store conversation history on an Exchange server\u003c/li\u003e\n\u003cli\u003eLocation is not displayed in Lync for Mac 2011 when users join a wireless network\u003c/li\u003e\n\u003cli\u003eError \u0026ldquo;One or more selected contacts cannot receive your calls\u0026rdquo; when you forward calls in Lync for Mac 2011\u003c/li\u003e\n\u003cli\u003eDelegation relationship is broken after a delegate signs in to Lync for Mac 2011\u003c/li\u003e\n\u003cli\u003eComputer shutdown is not processed when Lync for Mac 2011 is running\u003c/li\u003e\n\u003cli\u003eUpdate implements media resiliency mode in Lync for Mac 2011\u003c/li\u003e\n\u003cli\u003eDial pad disappears when a user who is not enabled for EV joins a video conference or a video call in Lync for Mac 2011\u003c/li\u003e\n\u003cli\u003eUpdate enables users to interact with a contact from the call history in Lync for Mac 2011\u003c/li\u003e\n\u003c/ul\u003e","title":"October 2014 update for Lync for Mac 2011 14.0.10"},{"content":"Since version 8.2, when Sophos UTM was called Astaro Security Gateway, the firewall distribution has the ability to filter by application instead of just ports, making it what marketing loves to call a \u0026ldquo;next-generation firewall\u0026rdquo;. Sophos calls this Application Control, Palo Alto Networks calls this App-ID, and other vendors have different names for it, but the underlying technology is similar to how an IDS would detect attacks by using signatures. In simple terms, the firewall identifies traffic based on application signatures and takes actions based on that.\nThe neat thing with Sophos UTM is that you can leverage this Application Control to select traffic and give it priority or throttle down the speed. When using Lync, it\u0026rsquo;s important to prioritize your media traffic at the edge so calls and sharing for external users or federated users gets the bandwidth it needs. Or perhaps you use Sophos UTM at home (because why not? it\u0026rsquo;s free), and want to make sure your calls get the right amount of bandwidth. Here\u0026rsquo;s how to do it:\nSet your interface bandwidths properly and turn on QoS on each. You can leave Automatic QoS checked (it\u0026rsquo;ll use WRED to balance your traffic nicely). Create a Traffic Selector by going to Interfaces \u0026amp; Routing \u0026gt; Quality of Service (QoS) \u0026gt; Traffic Selectors \u0026gt; New Traffic Selector. Pick the selector type as Application Selector, with source Any, destination Any, and browse for the Lync application objects. Note there are many, and we\u0026rsquo;re interested in the real time audio/video ones. Pick them, then hit Apply, then save the Traffic Selector. Next move to Bandwidth Pools, pick your external interface, and then New Bandwidth Pool. Pick a name for it, a \u0026ldquo;reserve\u0026rdquo; bandwidth, and then select your Traffic Selector created earlier. The bandwidth setting should be the maximum Lync will get if your upload is completely saturated. For example, if you\u0026rsquo;ve got a 10 megabit line, and reserve 2048 kilobits, then Lync will be guaranteed 2 megabits even when the connection is being used 100%. Save the rule and then turn it on. You can also create the same rule on the inside interfaces to make sure your traffic gets priority on the way back as well. Note that you can really only control how you send packets, not how you receive them.\nHope this is helpful! Feel free to drop a comment!\n","permalink":"https://blog.escarra.org/posts/lync-quality-of-service-qos-with-sophos-utm/","summary":"\u003cp\u003eSince version 8.2, when Sophos UTM was called Astaro Security Gateway, the firewall distribution has the ability to filter by application instead of just ports, making it what marketing loves to call a \u0026ldquo;next-generation firewall\u0026rdquo;. Sophos calls this Application Control, Palo Alto Networks calls this App-ID, and other vendors have different names for it, but the underlying technology is similar to how an IDS would detect attacks by using signatures. In simple terms, the firewall identifies traffic based on application signatures and takes actions based on that.\u003c/p\u003e","title":"Lync Quality of Service (QoS) with Sophos UTM"},{"content":"When integrating an AudioCodes gateway with Microsoft Exchange Unified Messaging, you may see an issue where the call is terminated while someone is leaving a voicemail longer than 30 seconds. This is because the gateway assumes the connection is broken the moment you start speaking, since UM is no longer sending RTP packets or silence suppression codes.\nThe solution is to turn of the Disconnect on Broken Connection on the IP profile used for your UM server within the AudioCodes gateway.\n","permalink":"https://blog.escarra.org/posts/audiocodes-hanging-up-um-call-mid-voicemail/","summary":"\u003cp\u003eWhen integrating an AudioCodes gateway with Microsoft Exchange Unified Messaging, you may see an issue where the call is terminated while someone is leaving a voicemail longer than 30 seconds. This is because the gateway assumes the connection is broken the moment you start speaking, since UM is no longer sending RTP packets or silence suppression codes.\u003c/p\u003e\n\u003cp\u003eThe solution is to turn of the \u003cstrong\u003eDisconnect on Broken Connection\u003c/strong\u003e on the IP profile used for your UM server within the AudioCodes gateway.\u003c/p\u003e","title":"AudioCodes hanging up UM call mid-voicemail"},{"content":"Microsoft released updates to Lync Phone Edition devices yesterday, including updates for devices like the popular Polycom CX600 and CX3000 that we use around the office.\nAn item worth mentioning is an update that enables non-EV or non-UC users to sign-in to Lync Phone Edition devices, and still use them for PC-to-PC calls, detailed here.\nHere\u0026rsquo;s the download (for CX series devices): http://support.microsoft.com/kb/2988181. If you have other devices like Aastra or HP, there are other downloads out there.\n","permalink":"https://blog.escarra.org/posts/august-lync-phone-edition-updates/","summary":"\u003cp\u003eMicrosoft released updates to Lync Phone Edition devices yesterday, including updates for devices like the popular Polycom CX600 and CX3000 that we use around the office.\u003c/p\u003e\n\u003cp\u003eAn item worth mentioning is an update that enables non-EV or non-UC users to sign-in to Lync Phone Edition devices, and still use them for PC-to-PC calls, detailed \u003ca href=\"http://support.microsoft.com/kb/2988193\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eHere\u0026rsquo;s the download (for CX series devices): \u003ca href=\"http://support.microsoft.com/kb/2988181\"\u003ehttp://support.microsoft.com/kb/2988181\u003c/a\u003e. If you have other devices like Aastra or HP, there are other downloads out there.\u003c/p\u003e","title":"August 2014 Lync Phone Edition Updates"},{"content":"Useful little utility if you\u0026rsquo;re probing network ports to find out where you\u0026rsquo;re plugged in. This reads Link Layer Discovery Protocol (LLDP) or Cisco Discovery Protocol (CDP) packets coming in the interface you pick, and displays it all. Sure beats filtering Wireshark packets!\nhttp://chall32.blogspot.com/2013/03/ldwin-link-discovery-for-windows.html ","permalink":"https://blog.escarra.org/posts/ldwin-lldp-reader-for-windows/","summary":"\u003cp\u003eUseful little utility if you\u0026rsquo;re probing network ports to find out where you\u0026rsquo;re plugged in. This reads Link Layer Discovery Protocol (LLDP) or Cisco Discovery Protocol (CDP) packets coming in the interface you pick, and displays it all. Sure beats filtering Wireshark packets!\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"http://chall32.blogspot.com/2013/03/ldwin-link-discovery-for-windows.html\"\u003ehttp://chall32.blogspot.com/2013/03/ldwin-link-discovery-for-windows.html\u003c/a\u003e \u003ca href=\"/wp-content/uploads/2014/08/LDWin.png\"\u003e\u003cimg alt=\"LDWin\" loading=\"lazy\" src=\"/wp-content/uploads/2014/08/LDWin.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"LDWin: LLDP \"Reader\" for Windows"},{"content":"LyncFix: This Just In: Lync 2013 CU5 Has Been Released!.\n","permalink":"https://blog.escarra.org/posts/this-just-in-lync-cu-has-been-released/","summary":"\u003cp\u003eLyncFix: \u003ca href=\"http://www.lyncfix.com/2014/08/06/this-just-in-lync-2013-cu5-has-been-released/\"\u003eThis Just In: Lync 2013 CU5 Has Been Released!\u003c/a\u003e.\u003c/p\u003e","title":"This Just In: Lync 2013 CU5 Has Been Released!"},{"content":"If the default Zeacom System Administrator (or System Admin) credentials for your deployment have not been changed, they should be:\nLogin Name: System Admin Password: 2222 ","permalink":"https://blog.escarra.org/posts/default-zeacom-administrator-credentials/","summary":"\u003cp\u003eIf the default Zeacom System Administrator (or System Admin) credentials for your deployment have not been changed, they should be:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eLogin Name: \u003cstrong\u003eSystem Admin\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003ePassword: \u003cstrong\u003e2222\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/07/2014-07-23-09_37_22.png\"\u003e\u003cimg alt=\"2014-07-23 09_37_22\" loading=\"lazy\" src=\"/wp-content/uploads/2014/07/2014-07-23-09_37_22.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Default Zeacom Administrator credentials"},{"content":"New July 2014 Lync Phone Edition updates: http://support.microsoft.com/kb/2973941\nThis cumulative update resolves the following issue: 2973943 Update for Lync Phone Edition to accommodate daylight saving time (DST) in Egypt and Morocco\n","permalink":"https://blog.escarra.org/posts/new-lync-phone-edition-july-update/","summary":"\u003cp\u003eNew July 2014 Lync Phone Edition updates: \u003ca href=\"http://support.microsoft.com/kb/2973941\"\u003ehttp://support.microsoft.com/kb/2973941\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis cumulative update resolves the following issue:\n\u003cstrong\u003e2973943\u003c/strong\u003e Update for Lync Phone Edition to accommodate daylight saving time (DST) in Egypt and Morocco\u003c/p\u003e","title":"New Lync Phone Edition July 2014 update"},{"content":"My good colleague Anthony Caragol wrote a nice Lync tool to backup and restore contacts in Lync 2013. Check it out!\nLync 2013 Contact Backup and Restore Tool (GUI).\n","permalink":"https://blog.escarra.org/posts/lync-contact-backup-and-restore-tool-gui/","summary":"\u003cp\u003eMy good colleague Anthony Caragol wrote a nice Lync tool to backup and restore contacts in Lync 2013. Check it out!\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"http://www.lyncfix.com/2014/07/14/new-tool-lync-2013-backup-and-restore-tool-gui/\"\u003eLync 2013 Contact Backup and Restore Tool (GUI)\u003c/a\u003e.\u003c/p\u003e","title":"Lync 2013 Contact Backup and Restore Tool (GUI)"},{"content":"Update: Sophos released an official guide on how to get Lync Web Services to work over the UTM\u0026rsquo;s WAF. https://sophserv.sophos.com/repo_kb/120454/file/Configuring%20UTM%20firewall%20for%20Lync%20connectivity.pdf\nUsing a Sophos UTM or Astaro Security Gateway (ASG) appliance? You can use it to reverse proxy to your Lync front ends!\nv8 a feature called Web Application Firewall, which is a nicely wrapped version of Apache mod_proxy, and can be configured to reverse proxy your Lync Mobility and simple URLs, Office Web Apps and can also work with Exchange and pass Outlook Anywhere. The added benefit is that you can configure rules to block Cross-Site Scripting (XSS) and SQL Injection type attacks, among other things.\nIf you have the subscription, here\u0026rsquo;s how you set it up with Lync 2013:\nConfigure your Lync Front Ends as Real Webservers. You will need to configure two servers for each FE, one for 8080 and another for 4443. If you plan on using the proxy for internal loopback (to avoid cert conflicts), then you will need 4 real servers, one for each port (80, 443, 4443, 8080). If you only want SSL, then skip the 80 and 8080:\nThen configure your Virtual Web Server (I will assume you already uploaded a valid certificate to the Sophos appliance). Make sure to check Pass Host Header, and you can enable HTTP redirection so your end users are happy when they skip HTTPS prefixes.\nSave it, enable it, and DONE!\nNOTE: If you have issues with the Lync iOS client resetting the connection, you can increase the timeout on the Real Webservers to 960 or 1200, but you will need to be on firmware version 9.204-19 or greater, since the feature was introduced then.\n","permalink":"https://blog.escarra.org/posts/sophos-utm-as-reverse-proxy-for-lync/","summary":"\u003cp\u003eUpdate: Sophos released an official guide on how to get Lync Web Services to work over the UTM\u0026rsquo;s WAF. \u003ca href=\"https://sophserv.sophos.com/repo_kb/120454/file/Configuring%20UTM%20firewall%20for%20Lync%20connectivity.pdf\"\u003ehttps://sophserv.sophos.com/repo_kb/120454/file/Configuring%20UTM%20firewall%20for%20Lync%20connectivity.pdf\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eUsing a Sophos UTM or Astaro Security Gateway (ASG) appliance? You can use it to reverse proxy to your Lync front ends!\u003c/p\u003e\n\u003cp\u003ev8 a feature called Web Application Firewall, which is a nicely wrapped version of Apache mod_proxy, and can be configured to reverse proxy your Lync Mobility and simple URLs, Office Web Apps and can also work with Exchange and pass Outlook Anywhere. The added benefit is that you can configure rules to block Cross-Site Scripting (XSS) and SQL Injection type attacks, among other things.\u003c/p\u003e","title":"Sophos UTM as Reverse Proxy for Lync 2013"},{"content":"Both Lync and Exchange rely heavily on public-key encryption using X.509 certificates (commonly known as SSL Certificates), and so they are required in every implementation. Regardless of whether you are using a public certification authority like DigiCert, or host your own internal CA, generating, installing and managing certificates can get pretty complex, especially when you have to deal with Intermediate Certificates.\nCertificate Chains can be a confusing concept and hopefully I do a good job in trying to explain them with a real-world analogy. Here goes:\nLet\u0026rsquo;s say you are John Doe, a fellow citizen that obeys the laws and respects the rules and guidelines put forth by society, and you\u0026rsquo;ve been asked to make a State of the Union speech on national television. Sounds crazy, I know, but I had a hard time coming up with a better situation\u0026hellip; (comments?)\nHere\u0026rsquo;s one issue to tackle as soon as you show up on that big screen: \u0026ldquo;Who\u0026rsquo;s THIS guy?\u0026rdquo;. You begin your speech, and in the first few statements you say that you\u0026rsquo;ve been granted authority to speak by Senator Joe Smith, and that any questions of authority should be directed to him. Officially, t he Senator endorsed (or signed for) you, John Doe the citizen.\nNow, most people may not know Senator Joe Smith, but they do know the President of the United States. If you were to call the Senator and ask him for his authority or credentials, he will say he has been granted permission to act on the President\u0026rsquo;s behalf for the purpose of assigning someone to speak at the State of the Union speech. In other words, the President endorsed (or signed for) the Senator, who in turn signed for you.\nIf we were to break this down, John Doe citizen is the holder of the end LEAF certificate, the Senator is the INTERMEDIATE authority, and the President is the ROOT Certification Authority\u0026hellip; Makes sense so far?\nYou were never technically granted authority to speak directly by the President. In fact, you were never in contact with him, and were only granted authority by an intermediary that has been endorsed by him. In this case, the CHAIN is:\nRoot(President) \u0026gt;Intermediary(Senator) \u0026gt; You(Citizen) .\nIf during the initial stages of your speech you were to have said the President gave you authority, and everyone went to check with him, they would find that statement to be false. The President never directly endorsed YOU, therefore the chain is broken and cannot be validated. There\u0026rsquo;s something missing, and that\u0026rsquo;s the information about the intermediary. If you never send that chain information, some (or most) will not trust you, even if you claim to be authentic.\nWhat does that mean in IT terms? Make sure your certificate chain is followed, and organize your certificates properly in your Certificates MMC on each system that presents them. Follow these rules:\nRoot CA certificates will always be self-signed and must be placed on the Trusted Root Certification Authorities store. Intermediate CA certificates will be signed by a Root CA or another Intermediate CA, and must be placed on the Intermediate Certification Authorities store. Your own certificates will be signed by either a Root CA (less likely) or an Intermediate CA (more likely), and should be stored in the Personal store. Here are samples screenshots of the public certs I am using for my Lync lab:\nRoot CA (notice how it\u0026rsquo;s self-signed):\nIntermediate CA (signed by the above Root CA):\nChain:\nHope this article didn\u0026rsquo;t get too messy or confusing. If you have any questions, please drop me a comment!\n","permalink":"https://blog.escarra.org/posts/certificates-unchained/","summary":"\u003cp\u003eBoth Lync and Exchange rely heavily on public-key encryption using X.509 certificates (commonly known as SSL Certificates), and so they are required in every implementation. Regardless of whether you are using a public certification authority like DigiCert, or host your own internal CA, generating, installing and managing certificates can get pretty complex, especially when you have to deal with Intermediate Certificates.\u003c/p\u003e\n\u003cp\u003eCertificate Chains can be a confusing concept and hopefully I do a good job in trying to explain them with a real-world analogy. Here goes:\u003c/p\u003e","title":"Certificates Unchained"},{"content":"Going to Help \u0026gt; About in the AudioCodes Syslog tool ACSyslog gives you a nice little show at first\u0026hellip;\nThe little animation blew my mind, so I subconsciously clicked on it, and was blown away even more. BOOM!\nHave fun using Keys 1, 5, Left, Right and Ctrl while debugging SIP messages!\n","permalink":"https://blog.escarra.org/posts/space-invaders-hidden-on-acsyslog/","summary":"\u003cp\u003eGoing to \u003cstrong\u003eHelp \u0026gt; About\u003c/strong\u003e in the AudioCodes Syslog tool ACSyslog gives you a nice little show at first\u0026hellip;\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/07/2014-07-15-19_32_50-About-ACSyslog-.png\"\u003e\u003cimg alt=\"2014-07-15 19_32_50-About ACSyslog ;-)\" loading=\"lazy\" src=\"/wp-content/uploads/2014/07/2014-07-15-19_32_50-About-ACSyslog-.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThe little animation blew my mind, so I subconsciously clicked on it, and was blown away even more. BOOM!\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/07/2014-07-15-19_33_17-About-ACSyslog-.png\"\u003e\u003cimg alt=\"2014-07-15 19_33_17-About ACSyslog ;-)\" loading=\"lazy\" src=\"/wp-content/uploads/2014/07/2014-07-15-19_33_17-About-ACSyslog-.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eHave fun using Keys 1, 5, Left, Right and Ctrl while debugging SIP messages!\u003c/p\u003e","title":"Space Invaders hidden on ACSyslog!"},{"content":"X.509 certs are annoying. You need to get them issued with the right names, or reissued if you make a mistake or forget a SAN, and they need to be cared for from time to time otherwise they expire and make your world hell.\nWouldn\u0026rsquo;t it be great if you could make them last longer than the default of 2 years? Especially if you\u0026rsquo;ve installed them all over your Lync infrastructure, like:\nFront End servers Mediation servers Edge server\u0026rsquo;s Inside NIC Office Web App Server Reverse Proxy or HLB Voice Gateways Exchange UM Having to track and schedule downtime for cert renewal of all of the above components is quite the chore. So let\u0026rsquo;s extend it to 5 years using Microsoft Windows AD Certificate Services (AD CS)\nTo start, we\u0026rsquo;ll duplicate the Web Server template. Open your Certification Authority MMC, go on your CA, and right click on Certificate Templates, then click Manage. Right click on Web Server, then go on Duplicate Template.\nUnder General, we will need to give it a name and Validity Period. I\u0026rsquo;ve chosen LyncServer but it can be anything. You will need the Template Name when getting certificates issued without auto-enrollment, like from an edge server, or from your voice gateway using a CSR.\nUnder Request Handling, make sure to check Allow private key to be exported, review the other tabs and options to satisfy your curiosity, then click OK. You can close the Certificate Templates Console and wait a bit for AD to replicate, or force it.\nWe will now enable the certificate so it can be issued. Right click on Certificate Templates again, then go on New, and Certificate Template to Issue. Look for your new LyncServer template, then click OK.\nONE LAST STEP!\nOn the CA server, you will need to extend the limit on the validity period, otherwise it will remain at 2 years regardless of what our template says. To do this, run:\ncertutil -setreg ca\\ValidityPeriodUnits 5\ncertutil -setreg ca\\ValidityPeriod years\nThe restart the Active Directory Certificate Services service, and the CA is now ready to start issuing longer certs!\nWhen requesting certificates from Lync (or others), make sure to specify the template name when prompted. And if using a CSR for your gateway or edge servers, you can force the template attribute which is not included in the CSR, and is required by Windows to issue you a cert. To do that run:\ncertreq -attrib \u0026ldquo;CertificateTemplate:LyncServer\u0026rdquo;\nThen pick the CSR, and then save the resulting signed certificate. BOOM!\n","permalink":"https://blog.escarra.org/posts/extending-lync-server-certificate-validity-periods/","summary":"\u003cp\u003eX.509 certs are annoying. You need to get them issued with the right names, or reissued if you make a mistake or forget a SAN, and they need to be cared for from time to time otherwise they expire and make your world hell.\u003c/p\u003e\n\u003cp\u003eWouldn\u0026rsquo;t it be great if you could make them last longer than the default of 2 years? Especially if you\u0026rsquo;ve installed them all over your Lync infrastructure, like:\u003c/p\u003e","title":"Extending Lync Server certificate validity periods"},{"content":"The Lync 2013 Management Shell has a tendency of getting stuck or hung when running on Windows Server 2012 R2. Upon opening it, all you see is a black window, no prompt.\nTo fix the problem, just install the latest Cumulative Update package (CU from January 2014 fixes the problem).\nhttp://support.microsoft.com/kb/2809243\n","permalink":"https://blog.escarra.org/posts/lync-shell-stuck-on-server-r/","summary":"\u003cp\u003eThe Lync 2013 Management Shell has a tendency of getting stuck or hung when running on Windows Server 2012 R2. Upon opening it, all you see is a black window, no prompt.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/06/PS-Stuck.png\"\u003e\u003cimg alt=\"PS Stuck\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/PS-Stuck.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo fix the problem, just install the latest Cumulative Update package (CU from January 2014 fixes the problem).\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003ca href=\"http://support.microsoft.com/kb/2809243\"\u003e\u003cstrong\u003ehttp://support.microsoft.com/kb/2809243\u003c/strong\u003e\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e","title":"Lync 2013 Shell \"Stuck\" on Server 2012 R2"},{"content":"During configuration of an AudioCodes gateway, a required config for successful TLS negotiation is the use of an NTP server. If you\u0026rsquo;re running Active Directory domain in your network, your primary time source is the Domain Controller hosting the PDC Operations Master role.\nTo test NTP is working correctly before hardcoding it into your appliances, you can run the following command:\nw32tm /stripchart /computer:\nThe Stripchart modifier will show a strip chart of the offset between your computer and the NTP source you specified.\nAlso, for future-proof NTP configuration and to avoid having broken services in case you move PDC role and demote your time source, you can create CNAME records such as ntp.yourdomain.com, or use SRV records like the standard _ntp._udp.yourdomain.com (and point them to _ldap._tcp.pdc._msdcs.yourdomain.com for no manual intervention!).\n","permalink":"https://blog.escarra.org/posts/testing-ntp-from-windows/","summary":"\u003cp\u003eDuring configuration of an AudioCodes gateway, a required config for successful TLS negotiation is the use of an NTP server. If you\u0026rsquo;re running Active Directory domain in your network, your primary time source is the Domain Controller hosting the PDC Operations Master role.\u003c/p\u003e\n\u003cp\u003eTo test NTP is working correctly before hardcoding it into your appliances, you can run the following command:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003ew32tm /stripchart /computer:\u003cyourNTPsource\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThe Stripchart modifier will show a strip chart of the offset between your computer and the NTP source you specified.\u003c/p\u003e","title":"Testing NTP from Windows"},{"content":"Right-clicking on the Task Manager\u0026rsquo;s network throughput graph can give you some nice details on your traffic. This will work on Windows 8, 8.1 and the equivalent Server editions 2012 and 2012 R2. Note that the statistics are only gathered while the Task Manager process is running and are not cumulative. For cumulative results, you can use the Get-NetAdapterStatistics | fl cmdlet.\n","permalink":"https://blog.escarra.org/posts/network-details-from-windows-task-manager/","summary":"\u003cp\u003eRight-clicking on the Task Manager\u0026rsquo;s network throughput graph can give you some nice details on your traffic. This will work on Windows 8, 8.1 and the equivalent Server editions 2012 and 2012 R2. Note that the statistics are only gathered while the Task Manager process is running and are not cumulative. For cumulative results, you can use the \u003cstrong\u003eGet-NetAdapterStatistics\u003c/strong\u003e \u003cstrong\u003e| fl\u003c/strong\u003e cmdlet.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/06/2014-06-10-15_16_12-astaro.escarra.org-Remote-Desktop-Connection.png\"\u003e\u003cimg alt=\"2014-06-10 15_16_12-astaro.escarra.org - Remote Desktop Connection\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/2014-06-10-15_16_12-astaro.escarra.org-Remote-Desktop-Connection.png\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2014/06/2014-06-10-15_16_28-astaro.escarra.org-Remote-Desktop-Connection.png\"\u003e\u003cimg alt=\"2014-06-10 15_16_28-astaro.escarra.org - Remote Desktop Connection\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/2014-06-10-15_16_28-astaro.escarra.org-Remote-Desktop-Connection.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Network details from Windows 8/8.1 Task Manager"},{"content":"Say you\u0026rsquo;re trying to speed up your VM deployments and create a template with Windows Server 2012 or 2012 R2, and in the process to clean up some valuable HD space you run something like the following:\nGet-WindowsFeature | Where-Object -FilterScript { $_.Installed -Eq $FALSE } | Uninstall-WindowsFeature –Remove\nWhat that\u0026rsquo;ll do is remove the binaries off any uninstalled feature and save you a few gigs\u0026hellip; BUT you will need the media, or the sources in a share, any time you want to install a feature, which is fine\u0026hellip; as long as your template does not get updated. The moment you run Windows Update and go through the motions, your media will no longer work if you want to add features, and installations will fail with something like this:\nError: 0x800f081fThe source files could not be found. Use the \u0026ldquo;Source\u0026rdquo; option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.\nTo update your sources so that you can use them when installing features, you can use the install.wim file on your media and grab the latest patches using WSUS Offline Updater (http://www.wsusoffline.net/), then merge the updates with the sources. Here\u0026rsquo;s how:\nCopy the Sources\\install.wim file from your Windows Server 2012 or 2012 R2 DVD media to somewhere in your hard drive. Create a temporary folder, let\u0026rsquo;s call it C:\\Win2012R2 Remove the read-only attributes of your local install.wim file because we will be modifying it Run dism.exe /get-wiminfo /wimfile:C:\\install.wim and take note of the Index for the edition you\u0026rsquo;re using Run dism.exe /mount-wim /WimFile:C:\\install.wim /index:4 /mountDir:C:\\Win2012R2. Note i\u0026rsquo;m using Index 4, which is for Datacenter (non-core) Run WSUS Offline and download all patches for the edition you\u0026rsquo;re using, and create an ISO from them Mount the ISO with the updates, then run dism.exe /image:C:\\Win2012R2 /Add-Package /PackagePath:F:\\w63-x64\\glb. In my case, the ISO was mounted on drive F: Run the previous command at least twice. There are times where updates won\u0026rsquo;t slipstream into the sources unless they are at the right version. This is the case with Update 1 for Server 2012 R2. Once all updates are injected, run dism.exe /Unmount-Wim /MountDir:C:\\Win2012R2 /commit which will write the install.wim file back with changes and is ready for use. When it comes time to install features, just use Add-WindowsFeature with -source:wim:\\\\server\\share\\install.wim :4 (note the Index number at the end).\nFor more detail, you can check out this TechNet article in combination with WSUS Offline to help you with the patch downloads.\nThanks for reading!\n","permalink":"https://blog.escarra.org/posts/out-of-date-sources-for-an-up-to-date-template/","summary":"\u003cp\u003eSay you\u0026rsquo;re trying to speed up your VM deployments and create a template with Windows Server 2012 or 2012 R2, and in the process to clean up some valuable HD space you run something like the following:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eGet-WindowsFeature | Where-Object -FilterScript { $_.Installed -Eq $FALSE } | Uninstall-WindowsFeature –Remove\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eWhat that\u0026rsquo;ll do is remove the binaries off any uninstalled feature and save you a few gigs\u0026hellip; BUT you will need the media, or the sources in a share, any time you want to install a feature, which is fine\u0026hellip; as long as your template does not get updated. The moment you run Windows Update and go through the motions, your media will no longer work if you want to add features, and installations will fail with something like this:\u003c/p\u003e","title":"Out of date sources for an up-to-date template?"},{"content":"After applying Cumulative Update packages to Lync 2010 or 2013 topologies, there is a required step to update the back-end databases and the Central Management Store (CMS). If you forget because you\u0026rsquo;re either lazy or rushed, you\u0026rsquo;ll start noticing some things don\u0026rsquo;t work as expected, like the Call Park Service and the Response Group Service. Here\u0026rsquo;s an indication that your DB needs to be upgraded:\nEvent ID 31059 by the LS Call Park Service clearly tells us to Upgrade the databse to CU1. See below for the cmdlets to run, but please refer to Microsoft\u0026rsquo;s official upgrade documentation for some important considerations:\nLync 2013 Standard Edition:\nInstall-CsDatabase -ConfiguredDatabases -SqlServerFqdn SE.FQDN -Verbose Install-CsDatabase -CentralManagementDatabase -SqlServerFqdn CMS.FQDN -SqlInstanceName DBInstanceName -Verbose Enable-CsTopology %ProgramFiles%\\Microsoft Lync Server 2013\\Deployment\\Bootstrapper.exe Lync 2013 Enterprise Edition:\nInstall-CsDatabase -ConfiguredDatabases -SqlServerFqdn FEBE.FQDN -Verbose Install-CsDatabase -DatabaseType PersistentChat -SqlServerFqdn PChatBE.fqdn -SqlInstanceName DBInstance -Verbose Install-CsDatabase -ConfiguredDatabases -SqlServerFqdn SQLServer.FQDN -Verbose Enable-CsTopology %ProgramFiles%\\Microsoft Lync Server 2013\\Deployment\\Bootstrapper.exe ","permalink":"https://blog.escarra.org/posts/oops-when-you-forget-to-update-lync-s-back-end-db/","summary":"\u003cp\u003eAfter applying Cumulative Update packages to Lync 2010 or 2013 topologies, there is a required step to update the back-end databases and the Central Management Store (CMS). If you forget because you\u0026rsquo;re either lazy or rushed, you\u0026rsquo;ll start noticing some things don\u0026rsquo;t work as expected, like the Call Park Service and the Response Group Service. Here\u0026rsquo;s an indication that your DB needs to be upgraded:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/06/2014-06-09-13_34_18-MobaXterm-Professional.png\"\u003e\u003cimg alt=\"2014-06-09 13_34_18-MobaXterm Professional\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/2014-06-09-13_34_18-MobaXterm-Professional.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eEvent ID 31059 by the LS Call Park Service clearly tells us to Upgrade the databse to CU1. See below for the cmdlets to run, but please refer to Microsoft\u0026rsquo;s official upgrade documentation for some important considerations:\u003c/p\u003e","title":"Oops! when you forget to update Lync's Back End DB"},{"content":" In the days of work anywhere, at any time, from any device, having a reliable bluetooth headset that will integrate with Microsoft Lync and pair with a multitude of devices is a must. The Plantronics Voyager Legend UC is now part of my mobile office and is always in my backpack. Here are the things I love about it:\nIt integrates beautifully into Lync. You can pick up and hang up calls with a single press of a button on the headset. Also, if you press the \u0026ldquo;mute\u0026rdquo; button on your headset, it mutes your Lync client so people are aware of your status when in conferences. This integration requires the use of the BT dongle (and of course it is included). Voice and build quality is outstanding for a bluetooth headset, and can play A2DP audio so you can listen to podcasts or music while in between calls. The noise cancelling is excellent and removes most background noise. Tested battery life is about 5 hours if you\u0026rsquo;re constantly talking (or listening over A2DP), and the headset can charge all the way to 100% in about 30 minutes. Zero effort in PC pairing. Plug in the dongle and you\u0026rsquo;re set. I have never had a problem with pairing to either cell phone or BT dongle. Can pair with a PC (dongle) and two other Bluetooth devices at the same time. You can pair your Lync client on your laptop and have your smartphone and tablet also paired, simultaneously, with the ability to seamlessly pick up and switch calls. Voice commands to \u0026ldquo;answer\u0026rdquo;, \u0026ldquo;ignore\u0026rdquo; or \u0026ldquo;call John Doe\u0026rdquo; built into the headset make it easy to handle calls without touching the headset, and sensors within enable you to automatically answer calls simply by putting the headset on your ear. The sensors are accurate enough to not trigger if you have the headset in your pocket. The UC edition of the headset comes with a few accessories that the regular non-UC edition lacks, like a nice little docking station for your desk, a portable charge cable which doubles as a micro-USB cable, and probably best of all, a case that holds the BT dongle and the headset with a built-in battery that can give you up to 14 hours of additional talk time!\nAlso, as part of a software value-add, the Plantronics Spokes software can be installed on your computer so the Lync client can change your presence to \u0026ldquo;In a Call\u0026rdquo; even if you\u0026rsquo;re on your cell phone. This unifies your presence between any voice devices using the common headset, and makes Lync aware of your status.\nMy only complaints about the headset is that there is no way to turn the \u0026ldquo;Mute On\u0026rdquo; and \u0026ldquo;Mute Off\u0026rdquo; prompts even after making changes through the Spokes software, or through the MyHeadset Updater settings. Also, while it offers excellent noise cancelling, the wind resistance is not that great. If you are using this headset outdoors, the voice quality might disappoint, but I feel it\u0026rsquo;s more designed for home/office and road warriors anyway, so this is not a big deal at all for me.\nAs part of my testing I\u0026rsquo;ve recorded a short clip with audio direct from the headset.\nYour browser does not support the audio element. In summary, the Plantronics Voyager Legend UC is probably the best bluetooth headset I have ever used, and is now part of those gadgets that I can\u0026rsquo;t live without. It retails for about $199 with all the accessories (headset, dongle, charging cable, battery case and desk cradle), or about $119 for the headset, dongle and charging cable. With it\u0026rsquo;s outstanding build and audio quality, a large number of accessories that can be included, and complete Lync integration, this headset will not disappoint those who are looking to break off the desk phone forever.\nDo you use the Legend UC? What do you think?\n","permalink":"https://blog.escarra.org/posts/review-plantronics-voyager-legend-uc/","summary":"\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/06/IMG_0378_resized.jpg\"\u003e\u003cimg alt=\"VoyagerLegendUC1\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/IMG_0378_resized.jpg\"\u003e\u003c/a\u003e In the days of work anywhere, at any time, from any device, having a reliable bluetooth headset that will integrate with Microsoft Lync and pair with a multitude of devices is a must. The \u003cstrong\u003ePlantronics Voyager Legend UC\u003c/strong\u003e is now part of my mobile office and is always in my backpack. Here are the things I love about it:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eIt integrates beautifully into Lync\u003c/strong\u003e. You can pick up and hang up calls with a single press of a button on the headset. Also, if you press the \u0026ldquo;mute\u0026rdquo; button on your headset, it mutes your Lync client so people are aware of your status when in conferences. This integration requires the use of the BT dongle (and of course it is included).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVoice and build quality is outstanding\u003c/strong\u003e for a bluetooth headset, and can play A2DP audio so you can listen to podcasts or music while in between calls. The noise cancelling is excellent and removes most background noise.\u003c/li\u003e\n\u003cli\u003eTested battery life is about \u003cstrong\u003e5 hours\u003c/strong\u003e if you\u0026rsquo;re constantly talking (or listening over A2DP), and the headset can charge all the way to \u003cstrong\u003e100% in about 30 minutes\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eZero effort in PC pairing\u003c/strong\u003e. Plug in the dongle and you\u0026rsquo;re set. I have never had a problem with pairing to either cell phone or BT dongle.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCan pair with a PC (dongle) and two other Bluetooth devices at the same time\u003c/strong\u003e. You can pair your Lync client on your laptop and have your smartphone and tablet also paired, simultaneously, with the ability to seamlessly pick up and switch calls.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVoice commands to \u0026ldquo;answer\u0026rdquo;, \u0026ldquo;ignore\u0026rdquo; or \u0026ldquo;call John Doe\u0026rdquo;\u003c/strong\u003e built into the headset make it easy to handle calls without touching the headset, and sensors within enable you to automatically answer calls simply by putting the headset on your ear. The sensors are accurate enough to not trigger if you have the headset in your pocket.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe UC edition of the headset comes with a few accessories that the regular non-UC edition lacks, like a nice little docking station for your desk, a portable charge cable which doubles as a micro-USB cable, and probably best of all, a case that holds the BT dongle and the headset with a built-in battery that can give you up to 14 hours of additional talk time!\u003c/p\u003e","title":"Review: Plantronics Voyager Legend UC"},{"content":"While doing an integration with a Cisco CallManager cluster that was on version 6.1, I realized why Microsoft only supports CUCM 7.0 and above. Earlier versions do not handle E.164 and so calls through the SIP trunk into the Lync mediation pool would not have the nice \u0026ldquo;+\u0026rdquo; on the SIP Invites. Fortunately, Lync 2013 lets you do inbound and outbound translations to overcome these situations, although you\u0026rsquo;d still be running on an unsupported Voice gateway.\nTo handle Inbound SIP without E.164 prefix, you can create a Pool Dial Plan for the SIP trunks (PstnGateway) you\u0026rsquo;ll need to handle, and then create normalization rules to prefix a + and remove any other numbers. You can also do it at a Global level, but I like to keep things separate, and in my case CUCM integration is only temporary until all sites are on Lync.\nInbound:\nTo handle Outbound SIP, you can use Calling and Called Number Rules under Trunk Configuration, and add/remove prefixes to be passed over to the voice gateway. In my case, I\u0026rsquo;m removing the + and prefixing a 7 to test outbound PSTN calling.\nOutbound:\n","permalink":"https://blog.escarra.org/posts/non-e-voice-gateway-trunk-into-lync/","summary":"\u003cp\u003eWhile doing an integration with a Cisco CallManager cluster that was on version 6.1, I realized why Microsoft only supports CUCM 7.0 and above. Earlier versions do not handle E.164 and so calls through the SIP trunk into the Lync mediation pool would not have the nice \u0026ldquo;+\u0026rdquo; on the SIP Invites. Fortunately, Lync 2013 lets you do inbound and outbound translations to overcome these situations, although you\u0026rsquo;d still be running on an unsupported Voice gateway.\u003c/p\u003e","title":"Non-E.164 voice gateway trunk into Lync 2013"},{"content":"Lync uses a feature called Comfort Noise that reduces network traffic in moments of silence, but still allows the voice gateways to generate some white noise to avoid the \u0026ldquo;hello? are you still there?\u0026rdquo; conversations. If your gateway is not configured to support Comfort Noise, then Lync will throw Event ID 25073 on your calls, saying The Mediation Server service has received a call that does not support comfort noise [\u0026hellip;] The Trunk does not support comfort noise. If you\u0026rsquo;re using a Cisco router as your voice gateway, you can enable Comfort Noise support by using the following command under your voip dial-peer connecting into Lync:\nrtp payload-type comfort-noise 13\nOr if you\u0026rsquo;re using an AudioCodes gateway, you can find the options under VoIP \u0026gt; Media \u0026gt; RTP/RTCP Settings, but make sure you\u0026rsquo;re using the Full menu set.\nAfter enabling Comfort Noise support, you can run a packet capture and notice the RTP packets showing support\n","permalink":"https://blog.escarra.org/posts/lync-comfort-noise-with-cisco-router-or-audiocodes/","summary":"\u003cp\u003eLync uses a feature called Comfort Noise that reduces network traffic in moments of silence, but still allows the voice gateways to generate some white noise to avoid the \u0026ldquo;hello? are you still there?\u0026rdquo; conversations. If your gateway is not configured to support Comfort Noise, then Lync will throw Event ID 25073 on your calls, saying \u003cstrong\u003eThe Mediation Server service has received a call that does not support comfort noise [\u0026hellip;] The Trunk does not support comfort noise.\u003c/strong\u003e \u003ca href=\"/wp-content/uploads/2014/06/Comfort-Noise.png\"\u003e\u003cimg alt=\"Comfort Noise\" loading=\"lazy\" src=\"/wp-content/uploads/2014/06/Comfort-Noise.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Lync Comfort Noise with Cisco router or AudioCodes"},{"content":"Recently I upgraded my single \u0026ldquo;LAMP\u0026rdquo; setup with two Apache front-ends, and two MySQL mirrored backends. When moving Wordpress to the new web servers I came across an issue with MySQL connections. The /var/log/audit/audit.log shows:\ntype= AVC msg=audit(1401916568.434:533): avc: denied { name_connect } for pid=31254 comm=\u0026ldquo;httpd\u0026rdquo; dest=3306 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r: mysqld_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1401916568.434:533): arch=c000003e syscall=42 success=no exit=-13 a0=10 a1=7fffdda48c20 a2=10 a3=10 items=0 ppid=1685 pid=31254 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=\u0026ldquo;httpd\u0026rdquo; exe=\u0026quot;/usr/sbin/httpd\u0026quot; subj=system_u:system_r:httpd_t:s0 key=(null)\nThe issue is related to SELinux blocking the MySQL connections from within Apache, and instead of taking the easy way out and disabling SELinux completely, the only command needed to get it to work was:\nsetsebool -P httpd_can_network_connect_db 1\n","permalink":"https://blog.escarra.org/posts/apache-and-mysql-on-different-hosts-with-selinux/","summary":"\u003cp\u003eRecently I upgraded my single \u0026ldquo;LAMP\u0026rdquo; setup with two Apache front-ends, and two MySQL mirrored backends. When moving Wordpress to the new web servers I came across an issue with MySQL connections. The /var/log/audit/audit.log shows:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003etype= \u003cstrong\u003eAVC\u003c/strong\u003e msg=audit(1401916568.434:533): \u003cstrong\u003eavc: denied\u003c/strong\u003e { name_connect } for pid=31254 \u003cstrong\u003ecomm=\u0026ldquo;httpd\u0026rdquo; dest=3306\u003c/strong\u003e scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r: \u003cstrong\u003emysqld_port_t\u003c/strong\u003e:s0 tclass=tcp_socket\ntype=SYSCALL msg=audit(1401916568.434:533): arch=c000003e syscall=42 success=no exit=-13 a0=10 a1=7fffdda48c20 a2=10 a3=10 items=0 ppid=1685 pid=31254 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 \u003cstrong\u003ecomm=\u0026ldquo;httpd\u0026rdquo; exe=\u0026quot;/usr/sbin/httpd\u0026quot;\u003c/strong\u003e subj=system_u:system_r:httpd_t:s0 key=(null)\u003c/p\u003e","title":"Apache and MySQL on different hosts with SELinux"},{"content":"If you\u0026rsquo;re missing the nice little graph and metrics that show in your Task Manager\u0026rsquo;s Performance tab on Windows 8 and 8.1, but not on 2012 and 2012 R2, all you have to do is run:\ndiskperf -Y\nBefore:\nAfter:\n","permalink":"https://blog.escarra.org/posts/missing-disk-performance-counter-from-task-manager-r/","summary":"\u003cp\u003eIf you\u0026rsquo;re missing the nice little graph and metrics that show in your Task Manager\u0026rsquo;s Performance tab on Windows 8 and 8.1, but not on 2012 and 2012 R2, all you have to do is run:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003ediskperf -Y\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eBefore:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/05/2014-05-19-13_08_21-makara.escarra.org-Remote-Desktop-Connection-escarra.org_.png\"\u003e\u003cimg alt=\"2014-05-19 13_08_21-makara.escarra.org - Remote Desktop Connection (escarra.org)\" loading=\"lazy\" src=\"/wp-content/uploads/2014/05/2014-05-19-13_08_21-makara.escarra.org-Remote-Desktop-Connection-escarra.org_.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eAfter:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2014/05/2014-05-19-13_09_31-makara.escarra.org-Remote-Desktop-Connection-escarra.org_.png\"\u003e\u003cimg alt=\"2014-05-19 13_09_31-makara.escarra.org - Remote Desktop Connection (escarra.org)\" loading=\"lazy\" src=\"/wp-content/uploads/2014/05/2014-05-19-13_09_31-makara.escarra.org-Remote-Desktop-Connection-escarra.org_.png\"\u003e\u003c/a\u003e\u003c/p\u003e","title":"Missing Disk performance counter from Task Manager 2012 R2"},{"content":" For a while now I\u0026rsquo;ve had a server rack hosting my lab environment, but it\u0026rsquo;s always been exposed to bad temperature conditions. Since moving to our own house the rack has been sitting in the attached garage, where it gets up to 90F in the summer and as low as 20F in the winter. So far all equipment in the rack survived the abuse, but it was difficult to work on stuff during extreme weather, it meant either freezing or sweating during seasons. And that\u0026rsquo;s not all, the only electrical circuit that went to the garage also ran the outside lights, kitchen and living room outlets, and would trip at least once a week.\nSo a couple of months ago I started a little project to build an insulated server room in the basement, with tempered dual-pane glass sliding doors, separate electrical circuits, and access to a window that could house an A/C unit during the summer, and just be open during the winter. You can see the end result in the picture, but for the whole process in building the room, you can visit THIS PAGE.\n","permalink":"https://blog.escarra.org/posts/home-server-room-finished/","summary":"\u003cp\u003e\u003ca href=\"/?page_id=163\"\u003e\u003cimg alt=\"20140303_020545778_iOS\" loading=\"lazy\" src=\"/wp-content/uploads/2014/03/20140303_020545778_iOS.jpg\"\u003e\u003c/a\u003e For a while now I\u0026rsquo;ve had a server rack hosting my lab environment, but it\u0026rsquo;s always been exposed to bad temperature conditions. Since moving to our own house the rack has been sitting in the attached garage, where it gets up to 90F in the summer and as low as 20F in the winter. So far all equipment in the rack survived the abuse, but it was difficult to work on stuff during extreme weather, it meant either freezing or sweating during seasons. And that\u0026rsquo;s not all, the only electrical circuit that went to the garage also ran the outside lights, kitchen and living room outlets, and would trip at least once a week.\u003c/p\u003e","title":"Home Server Room finished!"},{"content":"As of October 2015 the rack looked like below. But the current state is much different, in a different house, in a corner of the basement, barely picture-worthy\u0026hellip;\nHaving the server rack in the garage during winter didn\u0026rsquo;t let me work on it much, so I started building a room for it in the basement.\nBought a couple of dual-pane glass doors, 4ft x 9ft, and then trimmed them so they would fit downstairs and could put some wheels underneath. The idea is to use a rail on both top and bottom, with the doors sitting on the wheels.\nI then used 3 white square vinyl molding as spacers, and a couple oak pieces to build a set of rails for both doors from side to side.\nAnd with both doors in position (no top rail yet)\nTo build the top track, I used 4 long pieces of L-shaped molding and bolted them to the ceiling. The doors went into the top track first then into the rails along the floor, looking like this:\nTo cool the room, the window will hold an A/C unit for hot days, and would be left semi-open during the winter. I used some 3-inch foam for the sides and rubber strips on the bottom.\nTo shield from noise, I hung db-4 walls loaded vinyl on walls and ceiling. Since the process got messy with lots of cutting, glue and staples, I only had time for a couple of pictures. Also the foam had to be removed so I could get a better fit of the panels.\nOutlets were available on both side walls, and I took advantage of that to make new runs to the panel. Two independent 20A circuits should give me enough power for the the rack, cooling and some lights, and also give me redundancy if I need to cut power to one side.\nBoth circuits done with lighting!\nNext up was painting\nInstalled some ceiling trim to make it all come together.\nRoom is finished! Moving the rack into it is next.\nBecause the garage was mostly open and I ended up doing most of the wood panel cuts inside of it, dust settled everywhere including the rack itself. Disconnected it all, took the side panels and doors off it and started some serious cleaning.\nHere\u0026rsquo;s my C6100 chassis after cleaning it up\nWith help of a good friend, the rack was brought downstairs and put in the room. Now the work remains in racking everything back and hooking it all up.\n5 hours later, this is the side profile of what it looked like. You can see the A/C unit installed in the window too.\nAnd once it was all tested and in good working order, I cleaned up a side panel and installed it so it looks cleaner. The doors and the other side are still open (it\u0026rsquo;s too cold out to dust them)\nAnd that\u0026rsquo;s it! The whole project took me about 60-some hours, but extended over the course of 2 months. Now I have a sound and weather insulated room with two dedicated circuits to host all my stuff!!! Dream come true\u0026hellip;\n","permalink":"https://blog.escarra.org/pages/home-server-room-build/","summary":"\u003cp\u003eAs of October 2015 the rack looked like below. But the current state is much different, in a different house, in a corner of the basement, barely picture-worthy\u0026hellip;\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2015/10/20151011_212744.jpg\"\u003e\u003cimg alt=\"20151011_212744\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/20151011_212744.jpg\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2015/10/20151011_212754.jpg\"\u003e\u003cimg alt=\"20151011_212754\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/20151011_212754.jpg\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2014/03/20151011_212824.jpg\"\u003e\u003cimg alt=\"20151011_212824\" loading=\"lazy\" src=\"/wp-content/uploads/2014/03/20151011_212824.jpg\"\u003e\u003c/a\u003e\u003ca href=\"/wp-content/uploads/2015/10/20151011_212837.jpg\"\u003e\u003cimg alt=\"20151011_212837\" loading=\"lazy\" src=\"/wp-content/uploads/2015/10/20151011_212837.jpg\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eHaving the server rack in the garage during winter didn\u0026rsquo;t let me work on it much, so I started building a room for it in the basement.\u003c/p\u003e\n\u003cp\u003eBought a couple of dual-pane glass doors, 4ft x 9ft, and then trimmed them so they would fit downstairs and could put some wheels underneath. The idea is to use a rail on both top and bottom, with the doors sitting on the wheels.\u003c/p\u003e","title":"Home Server Room Build"},{"content":"If you are using Apache as the reverse proxy for Lync, you may experience some issues when signing in using the mobile app (I only tested iOS). Things to look for are:\n50/50 chance in sign-ins (first fails, second works, as shown below) Calls (audio or video) fail to establish Signing out of the application produces an error as shown below To resolve, look for the DefaultType directive in your httpd.conf. If it\u0026rsquo;s set to text/plain, change it to None and reload Apache config. The line should read:\nDefaultType None\n","permalink":"https://blog.escarra.org/posts/lync-apache-reverse-proxy-issues/","summary":"\u003cp\u003eIf you are using Apache as the reverse proxy for Lync, you may experience some issues when signing in using the mobile app (I only tested iOS). Things to look for are:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e50/50 chance in sign-ins (first fails, second works, as shown below)\u003c/li\u003e\n\u003cli\u003eCalls (audio or video) fail to establish\u003c/li\u003e\n\u003cli\u003eSigning out of the application produces an error as shown below\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"/?attachment_id=149\"\u003e\u003cimg alt=\"IMG_0877\" loading=\"lazy\" src=\"/wp-content/uploads/2013/06/IMG_0877.png\"\u003e\u003c/a\u003e\u003ca href=\"/?attachment_id=148\"\u003e\u003cimg alt=\"IMG_0876\" loading=\"lazy\" src=\"/wp-content/uploads/2013/06/IMG_0876.png\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo resolve, look for the \u003cstrong\u003eDefaultType\u003c/strong\u003e directive in your httpd.conf. If it\u0026rsquo;s set to \u003cstrong\u003etext/plain\u003c/strong\u003e, change it to \u003cstrong\u003eNone\u003c/strong\u003e and reload Apache config. The line should read:\u003c/p\u003e","title":"Lync 2013 Apache Reverse Proxy issues"},{"content":"Instead of hunting down Domain Controllers in ADSS and replicating each manually after some last-minute changes, you can run the following repadmin command to run a sync against all the connections:\nrepadmin /syncall /APed\nThe /APed stands for A ll-partitions, P ush, E nterprise-cross-sites and D istinguished names.\nThis will replicate all domain controllers simultaneously.\n","permalink":"https://blog.escarra.org/posts/replicating-all-domain-controllers/","summary":"\u003cp\u003eInstead of hunting down Domain Controllers in ADSS and replicating each manually after some last-minute changes, you can run the following repadmin command to run a sync against all the connections:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003erepadmin /syncall /APed\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThe \u003cstrong\u003e/APed\u003c/strong\u003e stands for \u003cstrong\u003eA\u003c/strong\u003e ll-partitions, \u003cstrong\u003eP\u003c/strong\u003e ush, \u003cstrong\u003eE\u003c/strong\u003e nterprise-cross-sites and \u003cstrong\u003eD\u003c/strong\u003e istinguished names.\u003c/p\u003e\n\u003cp\u003eThis will replicate all domain controllers simultaneously.\u003c/p\u003e","title":"Replicating all Domain Controllers"},{"content":"If you ever want to query AD for Certification Authorities, skip ADSI Edit\u0026hellip; there\u0026rsquo;s a quick way to do it using certutil. Here\u0026rsquo;s how:\ncertutil -config - -ping\nNote the extra empty dash between -config and -ping is needed to query the list of CAs.\nCredit for the useful command goes to colleague and UC ninja Jeff Carlson.\n","permalink":"https://blog.escarra.org/posts/discovering-internal-cas/","summary":"\u003cp\u003eIf you ever want to query AD for Certification Authorities, skip ADSI Edit\u0026hellip; there\u0026rsquo;s a quick way to do it using certutil. Here\u0026rsquo;s how:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003ecertutil -config - -ping\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eNote the extra empty dash between -config and -ping is needed to query the list of CAs.\u003c/p\u003e\n\u003cp\u003eCredit for the useful command goes to colleague and UC ninja Jeff Carlson.\u003c/p\u003e","title":"Discovering Internal CAs"},{"content":"Recently I came across an issue where the Edge server would not replicate the topology. After spending some time looking through firewall ACLs, NAT exemptions, packet captures and the rest of the usual networking stuff, it turns out the problem was WAY more obscure than simple connectivity\u0026hellip;\nIf your Edge server\u0026rsquo;s Trusted Root CA store contains over 100 entries, the SChannel security package will truncate this list internally and depending on where your internal Root CA sits in the alphabetical order, it could be truncated and affect the ability to replicate the Lync topology over HTTPS 4443.\nTo resolve this issue, there are two options:\n1. Delete unnecessary certificates from the Trusted Root CA store of the Edge server. This could potentially affect federated partners depending on which Root CAs you delete, but is a quick and easy way to fix the problem.\n2. Edit the registry on the Edge server to add a DWORD value, SendTrustedIssuerList, to the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL key and assign it a value of 0. This will prevent schannell.dll from truncating the Root CA list from the edge server, and allow validation tests to pass.\nThis was taken from the Technet\u0026rsquo;s Lync Forums here\n","permalink":"https://blog.escarra.org/posts/lync-edge-replication-broken/","summary":"\u003cp\u003eRecently I came across an issue where the Edge server would not replicate the topology. After spending some time looking through firewall ACLs, NAT exemptions, packet captures and the rest of the usual networking stuff, it turns out the problem was WAY more obscure than simple connectivity\u0026hellip;\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"/wp-content/uploads/2012/12/Shot11.jpg\"\u003e\u003cimg loading=\"lazy\" src=\"/wp-content/uploads/2012/12/Shot11.jpg\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eIf your Edge server\u0026rsquo;s Trusted Root CA store contains over 100 entries, the SChannel security package will truncate this list internally and depending on where your internal Root CA sits in the alphabetical order, it could be truncated and affect the ability to replicate the Lync topology over HTTPS 4443.\u003c/p\u003e","title":"Lync Edge Replication broken"},{"content":"Being on Windows 8\u0026rsquo;s lock screen will automatically turn your display off after 1 minute regardless of your power settings. Even if you have your screen set to never turn off, the lock screen will override that setting and turn off displays after the minute passes.\nTo enable the setting under Display for Advanced Power Options, do the following registry change under HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Power\\PowerSettings\\7516b95f-f776-4464-8c53-06167f40cc99\\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7\nChange Attributes from 1 to 2\nOpen the Advanced Power Options for your profile and you will now see the option. Enjoy!\n","permalink":"https://blog.escarra.org/posts/console-lock-display-off-timeout-for-windows/","summary":"\u003cp\u003eBeing on Windows 8\u0026rsquo;s lock screen will automatically turn your display off after 1 minute regardless of your power settings. Even if you have your screen set to never turn off, the lock screen will override that setting and turn off displays after the minute passes.\u003c/p\u003e\n\u003cp\u003eTo enable the setting under Display for Advanced Power Options, do the following registry change under \u003cem\u003eHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Power\\PowerSettings\\7516b95f-f776-4464-8c53-06167f40cc99\\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eChange \u003cstrong\u003eAttributes\u003c/strong\u003e from 1 to \u003cstrong\u003e2\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eOpen the Advanced Power Options for your profile and you will now see the option. Enjoy!\u003c/p\u003e","title":"Console Lock Display Off Timeout for Windows 8"},{"content":"Windows 8 now introduced taskbar options when using multiple displays! You can set it to show all programs, show only those which are active on the display, or just turn the feature off (but WHY would you do that?).\n","permalink":"https://blog.escarra.org/posts/windows-multi-display-taskbar/","summary":"\u003cp\u003eWindows 8 now introduced taskbar options when using multiple displays! You can set it to show all programs, show only those which are active on the display, or just turn the feature off (but WHY would you do that?).\u003c/p\u003e\n\u003cp\u003e\u003cimg loading=\"lazy\" src=\"/wp-content/uploads/2012/09/Taskbars.png\"\u003e\u003c/p\u003e","title":"Windows 8 multi-display taskbar"},{"content":"The Dell PERC H200 is a very basic RAID controller that does not have battery-backed cache, and therefore does not let you enable Write Caching within the OS. Writes using the H200 adapter can be very slow, so much that Windows Updates could take 2 to 3 hours on a RAID1!\nTo force enable write cache on an H200 adapter (at your own risk), do the following:\nGo to www.lsi.com and search for the latest MSM (or MegaRAID Storage Manager). At the time of this writing, it is 12.05.03.00. Install it, then run it. Log in to MSM using your local/domain admin credentials. Under the Logical tab, select the VD you want to enable write cache for, then right click and Set Virtual Drive Properties. Enable the write cache and accept all dialogs. Confirm write cache is enabled using Device Manager. Keep in mind that this setting could cause data corruption if you don\u0026rsquo;t gracefully shut down your server during a disk write operation. What\u0026rsquo;s why it\u0026rsquo;s disabled by default and difficult to enable. Don\u0026rsquo;t leave this enabled on a production server\u0026hellip;\n","permalink":"https://blog.escarra.org/posts/enabling-write-cache-on-perc-h/","summary":"\u003cp\u003eThe Dell PERC H200 is a very basic RAID controller that does not have battery-backed cache, and therefore does not let you enable Write Caching within the OS. Writes using the H200 adapter can be very slow, so much that Windows Updates could take 2 to 3 hours on a RAID1!\u003c/p\u003e\n\u003cp\u003eTo force enable write cache on an H200 adapter (at your own risk), do the following:\u003c/p\u003e\n","title":"Enabling Write Cache on PERC H200"},{"content":"Just found out that if you are running Windows 8 with the Hyper-V Platform installed, some important settings in your \u0026ldquo;Processor Power Management\u0026rdquo; section under Power Options go missing. This is because Hyper-V decides to keep your CPU clocked at 100%.\nThis is obviously bad if you\u0026rsquo;re on a laptop, since your CPU will no longer clock itself down when not in use, and your battery will drain considerably faster. Unfortunately, the only way to re-enable power management for your CPU is to uninstall the Hyper-V Platform from the OS. More of a reason for me to keep using VMware then\u0026hellip;\n","permalink":"https://blog.escarra.org/posts/missing-cpu-power-management-from-win/","summary":"\u003cp\u003eJust found out that if you are running Windows 8 with the Hyper-V Platform installed, some important settings in your \u0026ldquo;Processor Power Management\u0026rdquo; section under Power Options go missing. This is because Hyper-V decides to keep your CPU clocked at 100%.\u003c/p\u003e\n\u003cp\u003eThis is obviously bad if you\u0026rsquo;re on a laptop, since your CPU will no longer clock itself down when not in use, and your battery will drain considerably faster.\nUnfortunately, the only way to re-enable power management for your CPU is to uninstall the Hyper-V Platform from the OS. More of a reason for me to keep using VMware then\u0026hellip;\u003c/p\u003e","title":"Missing CPU Power Management from Win8"},{"content":"To set the timezone on a Server Core 2008 R2/2012, or any other version if you fancy CLI, use the following:\nTZUTIL /G to list the current timezone TZUTIL /L to list all available timezone settings TZUTIL /S \u0026ldquo;Central Standard Time\u0026rdquo; to set your timezone to CST as example\nAlso useful is the w32tm tool to change settings around the Windows Time Service, such as setting up a manual NTP peer or forcing a time resync.\n","permalink":"https://blog.escarra.org/posts/setting-timezone-on-server-core-r/","summary":"\u003cp\u003eTo set the timezone on a Server Core 2008 R2/2012, or any other version if you fancy CLI, use the following:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTZUTIL /G\u003c/strong\u003e to list the current timezone\n\u003cstrong\u003eTZUTIL /L\u003c/strong\u003e to list all available timezone settings\n\u003cstrong\u003eTZUTIL /S \u0026ldquo;Central Standard Time\u0026rdquo;\u003c/strong\u003e to set your timezone to CST as example\u003c/p\u003e\n\u003cp\u003eAlso useful is the \u003cstrong\u003e\u003ca href=\"http://technet.microsoft.com/en-us/library/bb491016.aspx\"\u003ew32tm\u003c/a\u003e\u003c/strong\u003e tool to change settings around the Windows Time Service, such as setting up a manual NTP peer or forcing a time resync.\u003c/p\u003e","title":"Setting timezone on Server Core 2008 R2/2012"},{"content":"If you\u0026rsquo;re reading this, chances are that you just installed Windows Server 2012 in the recommended instance of Server Core, and upon boot, you get the nice little cmd.exe window but nothing else. Here\u0026rsquo;s how you get started using PowerShell cmdlets to configure it:\nRename: Rename-Computer computername\nReboot: Restart-Computer\nConfigure an IP: New-NetIPAddress -IPAddress x.x.x.x -InterfaceAlias \u0026ldquo;Ethernet\u0026rdquo; -DefaultGateway x.x.x.x -AddressFamily IPv4 -PrefixLength 24 (or whatever your subnet mask is)\nConfigure a DNS server: Set-DnsClientServerAddress -InterfaceAlias \u0026ldquo;Ethernet\u0026rdquo; -ServerAddresses x.x.x.x\nJoin a domain: Add-Computer -DomainName domain.com\nYou can start using Server Manager after that to install roles and features, and configure them. If you can\u0026rsquo;t use Server Manager remotely, you might want to run Configure-SMRemoting.exe -enable and maybe disable/modify the Windows Firewall rules using MMC from another system\n","permalink":"https://blog.escarra.org/posts/getting-started-with-windows-server-core/","summary":"\u003cp\u003eIf you\u0026rsquo;re reading this, chances are that you just installed Windows Server 2012 in the recommended instance of Server Core, and upon boot, you get the nice little cmd.exe window but nothing else. Here\u0026rsquo;s how you get started using PowerShell cmdlets to configure it:\u003c/p\u003e\n\u003cp\u003eRename: \u003cstrong\u003eRename-Computer computername\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eReboot: \u003cstrong\u003eRestart-Computer\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eConfigure an IP: \u003cstrong\u003eNew-NetIPAddress -IPAddress x.x.x.x -InterfaceAlias \u0026ldquo;Ethernet\u0026rdquo; -DefaultGateway x.x.x.x -AddressFamily IPv4 -PrefixLength 24\u003c/strong\u003e (or whatever your subnet mask is)\u003c/p\u003e\n\u003cp\u003eConfigure a DNS server: \u003cstrong\u003eSet-DnsClientServerAddress -InterfaceAlias \u0026ldquo;Ethernet\u0026rdquo; -ServerAddresses x.x.x.x\u003c/strong\u003e\u003c/p\u003e","title":"Getting started with Windows Server 2012 Core"},{"content":"So it has been a little over three months since I last posted, and having left off before starting to explain a simple WPA Enterprise implementation, I will now continue.\nI\u0026rsquo;ll assume you already have a Domain Controller setup with a Certification Authority, and Internet Authentication Service, since that will be the key around authenticating our users and computers.\nSo, let\u0026rsquo;s start with setting up our AD. We\u0026rsquo;ll create two security groups, one for authenticating computers, and another for authenticating users against the wireless network. We can add our Computer objects and User objects from AD to the respective groups.\nNext, we\u0026rsquo;ll configure IAS Policies. Open the Internet Authentication Service console, then right click on Remote Access Policies and click on New Remote Policy.\nWe can use the Wizard, as it asks the right questions to get this working quick.\nName the policy as Wireless Users, and click Next. Click on Wireless and Next. Select Group and then click Add. Browse for the group we created for Wireless Users in AD, then click Next. Select the EAP type for the policy as Protected EAP (PEAP). Finish the wizard. Repeat the steps above, but this time, create a policy for authenticating the computers instead of users. After that is done, we\u0026rsquo;ve got the IAS policies in place that\u0026rsquo;ll allow domain users to use the wireless network.\nOn my next post, we\u0026rsquo;ll need to setup an association, then configure our AP, and then use Group Policy to our advantage: Automate the deployment of our root certificate and wireless access.\nBy the time we\u0026rsquo;re done with all the steps our users will have wireless access as soon as the computer joins the domain and you authorize them. No keys!!!!\n","permalink":"https://blog.escarra.org/posts/wpa-enterprise-server-setup/","summary":"\u003cp\u003eSo it has been a little over three months since I last posted, and having left off before starting to explain a simple WPA Enterprise implementation, I will now continue.\u003c/p\u003e\n\u003cp\u003eI\u0026rsquo;ll assume you already have a Domain Controller setup with a Certification Authority, and Internet Authentication Service, since that will be the key around authenticating our users and computers.\u003c/p\u003e\n","title":"WPA Enterprise - Server Setup"},{"content":"Given that I\u0026rsquo;ve posted about the weaknesses of WEP, and how it can be easily cracked in about 15 minutes, I wanted to write about how to secure your corporate wireless environment and keep script kiddies out of your network.\nMost companies and wireless AP manufacturers started moving towards WPA-PSK as a default setting for wireless networks. Just recently I\u0026rsquo;ve learned (and tested) using tools such as coWPAtty to crack WPA-PSK networks that use TKIP and do a brute-force attack on the key. While this does not present such a huge security risk as using WEP does, it still opens the door for sites that use weak WPA keys. Since WPA is stronger, but they key can be the weak point now, is there a way to generate \u0026ldquo;dynamic\u0026rdquo; keys? better yet, to generate new keys for every single client station, every time they log on?\nThe answer is YES! We use WPA/WPA2 Enterprise and RADIUS to create a practically impossible to hack wireless network that offers computer+user access granularity and management, and even easy deployment through Group Policy. Doesn\u0026rsquo;t that sound cool???\nTo prepare for the next posts, you\u0026rsquo;ll need the following:\nA WPA/WPA2 Compatible wireless Access Point. I\u0026rsquo;m using a Linksys WRT54GS with DD-WRT firmware on it and it works like a charm. A Windows Server 2003 with IAS + Certificate Services components installed, and a valid Active Directory domain (you can use FreeRADIUS+LDAP on Linux, but I\u0026rsquo;m not going to cover that). A test laptop or WPA-compatible client that\u0026rsquo;s a domain member. ","permalink":"https://blog.escarra.org/posts/implementing-wpa-enterprise-intro/","summary":"\u003cp\u003eGiven that I\u0026rsquo;ve posted about the weaknesses of WEP, and how it can be easily cracked in about 15 minutes, I wanted to write about how to secure your corporate wireless environment and keep script kiddies out of your network.\u003c/p\u003e\n\u003cp\u003eMost companies and wireless AP manufacturers started moving towards WPA-PSK as a default setting for wireless networks. Just recently I\u0026rsquo;ve learned (and tested) using tools such as coWPAtty to crack WPA-PSK networks that use TKIP and do a brute-force attack on the key. While this does not present such a huge security risk as using WEP does, it still opens the door for sites that use weak WPA keys. Since WPA is stronger, but they key can be the weak point now, is there a way to generate \u0026ldquo;dynamic\u0026rdquo; keys? better yet, to generate new keys for every single client station, every time they log on?\u003c/p\u003e","title":"Implementing WPA Enterprise - Intro"},{"content":"Just recently I\u0026rsquo;ve devoted my extra time to finding and implementing open-source alternatives for common proprietary business applications. So far I\u0026rsquo;ve had great success in getting the solutions up and running, and I\u0026rsquo;ve been nothing short of impressed on how much community support they receive.\nI will start writing comparisons on the Commercial VS. Open-Source solutions I\u0026rsquo;ve come across and tested, but for now i\u0026rsquo;ll simply list a few that i\u0026rsquo;ve been very happy with:\nCommercial / OSS Alternative\nMicrosoft Exchange or Lotus Notes / Zimbra Collaboration Suite\nMicrosoft Live Communications Server / Asterisk + Openfire\nMicrosoft SharePoint / Alfresco (Not yet implemented)\nMicrosoft CRM / SugarCRM Community\nMicrosoft Office / OpenOffice or IBM\u0026rsquo;s Symphony\nThere\u0026rsquo;s still a few things that I cannot go without, which is Active Directory. SAMBA 4 will come with DC emulation built-in, but it\u0026rsquo;s still not out. Until then i\u0026rsquo;ll keep working on other OSS alternatives to see if i can completely eliminate Microsoft or otherwise commercial software in a small environment.\n","permalink":"https://blog.escarra.org/posts/open-source-alternatives/","summary":"\u003cp\u003eJust recently I\u0026rsquo;ve devoted my extra time to finding and implementing open-source alternatives for common proprietary business applications. So far I\u0026rsquo;ve had great success in getting the solutions up and running, and I\u0026rsquo;ve been nothing short of impressed on how much community support they receive.\u003c/p\u003e\n\u003cp\u003eI will start writing comparisons on the Commercial VS. Open-Source solutions I\u0026rsquo;ve come across and tested, but for now i\u0026rsquo;ll simply list a few that i\u0026rsquo;ve been very happy with:\u003c/p\u003e","title":"Open-Source Alternatives"},{"content":"Pulling my hair out trying to figure out how to set the URI for Zenoss to work behind an Apache mod_proxy setup, I figured out the solution is to use a rewrite rule on the virtual host within Apache. Here\u0026rsquo;s the rule I\u0026rsquo;m using:\nRewriteEngine on RewriteRule ^/(.*) http://internalserver:8080/VirtualHostBase/http/externalserver:80/VirtualHostRoot/$1 [L,P]\nOf course, change \u0026ldquo;internalserver\u0026rdquo; and \u0026ldquo;externalserver\u0026rdquo; for your hosts, and \u0026ldquo;externalserver\u0026rdquo; should match your ServerName definition in the virtual host config.\n","permalink":"https://blog.escarra.org/posts/zenoss-behind-apache-proxy/","summary":"\u003cp\u003ePulling my hair out trying to figure out how to set the URI for Zenoss to work behind an Apache mod_proxy setup, I figured out the solution is to use a rewrite rule on the virtual host within Apache. Here\u0026rsquo;s the rule I\u0026rsquo;m using:\u003c/p\u003e\n\u003cp\u003eRewriteEngine on\nRewriteRule ^/(.*) \u003ca href=\"http://internalserver:8080/VirtualHostBase/http/externalserver:80/VirtualHostRoot/$1\"\u003ehttp://internalserver:8080/VirtualHostBase/http/externalserver:80/VirtualHostRoot/$1\u003c/a\u003e [L,P]\u003c/p\u003e\n\u003cp\u003eOf course, change \u0026ldquo;internalserver\u0026rdquo; and \u0026ldquo;externalserver\u0026rdquo; for your hosts, and \u0026ldquo;externalserver\u0026rdquo; should match your ServerName definition in the virtual host config.\u003c/p\u003e","title":"Zenoss behind Apache proxy"},{"content":"We left off at sniffing the packets, but unless you can spare a whole week if trying to get access to a mostly inactive network, we\u0026rsquo;re going to need to generate some sort of traffic to speed things up.\nTo do this, we are going to take advantage of packet injection, and only then we\u0026rsquo;ll see that Data counter jump up to a useable level. Let\u0026rsquo;s open another terminal, and run the command:\naireplay-ng -1 1 -a 00:12:17:05:92:5D wlan0\nWhat this will accomplish is start a \u0026ldquo;fake authentication\u0026rdquo; to the access point. Most access points will respond to the auth request, thus generating data.\nOnce we\u0026rsquo;re authenticated, even with a bogus request, we should be able to start replaying ARP requests. To do this, we\u0026rsquo;ll run:\naireplay-ng -3 -b 00:12:17:05:92:5D wlan0\nI suggest running it on another terminal window so we can see everything going at once. Up until now, we should have 3 terminal windows open, one with airodump-ng sniffing data, another with aireplay-ng doing fake auths and the last one replaying ARP requests.\nLastly, we\u0026rsquo;ll start our fourth last terminal window and run aircrack-ng, which will analyze the dump traffic, and hopefully get the key. Run:\naircrack-ng /root/*.ivs\nThis will read all files that contain IV captures, and start the cracking process. The program will retry the crack if unsuccessful over and over, so this can be left running in the background. Within a few minutes, we get our prize:\nNow we know that my public wireless has the key of 1234512345 as expected. Note that if I had a 128 bit WEP key, the process shouldn\u0026rsquo;t take much longer than 64 bit. NOTE: we got a LOT more than 3110 IVs. I\u0026rsquo;m not sure why only 3110 are counted, but be sure that you will likely not get far with anything under 20k IV\u0026rsquo;s.\nSo, what have we learned from this?? DO NOT USE WEP!!!. At the very least, use WPA PSK with a unique AP name, as WPA PSK can also be cracked using huge pre-computed Rainbow Tables (I won\u0026rsquo;t go into this yet\u0026hellip; plus you\u0026rsquo;d need my 64GB tables to do it). WPA Enterprise, or WPA2 Enterprise are the best way to go, but unfortunately many home environments don\u0026rsquo;t have a RADIUS server for authentication\u0026hellip; so stick with WPA PSK and you should be fine.\n","permalink":"https://blog.escarra.org/posts/messing-with-wep-part-iii/","summary":"\u003cp\u003eWe left off at sniffing the packets, but unless you can spare a whole week if trying to get access to a mostly inactive network, we\u0026rsquo;re going to need to generate some sort of traffic to speed things up.\u003c/p\u003e\n\u003cp\u003eTo do this, we are going to take advantage of packet injection, and only then we\u0026rsquo;ll see that Data counter jump up to a useable level.\nLet\u0026rsquo;s open another terminal, and run the command:\u003c/p\u003e","title":"Messing with WEP - Part III"},{"content":"This is where it gets fun. In this part, we\u0026rsquo;ll set our wireless interface to monitor mode, and we\u0026rsquo;ll start sniffing some packets and dumping the captures into a file for further analysis.\nTo start, we have to list the available wireless interfaces to the system. Hopefully your card is compatible and has a driver already loaded. Let\u0026rsquo;s fire up Konsole (a terminal application), which is the third icon from the bottom-left, and we\u0026rsquo;ll type:\niwconfig\nThis will throw us back the list of wireless interfaces. iwconfig is similar to ifconfig, and easy to remember because of the single letter change. Once we determined that our wireless card is there, and what it\u0026rsquo;s name is, we\u0026rsquo;ll set it into monitor mode by running:\nairmon-ng start wlan0\nObviously, replace wlan0 for whatever your interface name is. After we set the card in monitor mode, we\u0026rsquo;ll be given an alternate interface name usually in the form of mon[x]. We\u0026rsquo;ll be using that interface to sniff packets. Next, let\u0026rsquo;s do a short site survey to see what\u0026rsquo;s really around us. We\u0026rsquo;ll run airodump-ng to do this as follows:\nairodump-ng mon0\nThis will give us the list of AP\u0026rsquo;s and stations close to us, and if your card supports it, a signal strength and receive quality indicator. It\u0026rsquo;s best that your receive quality is close to 100, as this will help when injecting packets later on\u0026hellip; If you see, the Channel keeps varying, this is because we\u0026rsquo;re surveying the entire spectrum for available networks. Once we find the one we\u0026rsquo;d like to peek into, it\u0026rsquo;s very important to lock the card in that channel so we can listen to the maximum number of packets. Let\u0026rsquo;s lock the card into channel 1 so we can hear that AP better\u0026hellip; we do that by using iwconfig again:\niwconfig wlan0 channel 1\nAnd then let\u0026rsquo;s see the results:\nairodump-ng \u0026ndash;channel 1 mon0\nHopefully now there will be beacons more often (which are useless, but good indicator that we have signal, the faster they flow the better). We\u0026rsquo;ll set the proper airodump-ng parameters so we lock to a specific Channel, specific AP (or BSSID), and we write the captured IV\u0026rsquo;s into a file that we can use\u0026hellip;\nairodump-ng \u0026ndash;ivs \u0026ndash;write /root/capture \u0026ndash;bssid 00:12:17:05:92:5D \u0026ndash;channel 1 mon0\nBy doing this, we\u0026rsquo;ll start listening to ALL network traffic going and coming out of that specific AP. If the network is pretty active, we should see the \u0026ldquo;#Data\u0026rdquo; counter go up, which is exactly what we want. The more \u0026ldquo;Data\u0026rdquo; the faster we can get that WEP key. Just to give you an idea, it\u0026rsquo;s very unlikely you\u0026rsquo;ll get far with anything less than 50000 IV\u0026rsquo;s (\u0026ldquo;Data\u0026rdquo;). This is why on the next section I\u0026rsquo;ll go over how to inject packets to generate fake traffic and get that Data counter up to something usable in minutes.\n","permalink":"https://blog.escarra.org/posts/messing-with-wep-part-ii/","summary":"\u003cp\u003eThis is where it gets fun. In this part, we\u0026rsquo;ll set our wireless interface to monitor mode, and we\u0026rsquo;ll start sniffing some packets and dumping the captures into a file for further analysis.\u003c/p\u003e\n\u003cp\u003eTo start, we have to list the available wireless interfaces to the system. Hopefully your card is compatible and has a driver already loaded. Let\u0026rsquo;s fire up Konsole (a terminal application), which is the third icon from the bottom-left, and we\u0026rsquo;ll type:\u003c/p\u003e","title":"Messing with WEP - Part II"},{"content":"It\u0026rsquo;s been long known that WEP is a very insecure wireless encryption protocol, and this is due to weak Initialization Vectors (IV) being used within. See, the engineers that designed the WEP protocol attempted to create a stronger encryption by adding a 24 bit IV to the cypher key that changes constantly, thus \u0026ldquo;eliminates\u0026rdquo; the repeated encryption of data with the same key over an over. The problem is, these IV\u0026rsquo;s are too short, and are periodically reused\u0026hellip; which means that if we can sniff enough data over the air, and get the AP to reuse IV\u0026rsquo;s eventually, we can figure out the key.\nIn this tutorial I plan to do exactly that, grabbing the WEP key of my own \u0026ldquo;public\u0026rdquo; wireless network, which I made \u0026ldquo;1234512345\u0026rdquo;. Simple.\nFirst, we\u0026rsquo;ll start by grabbing a copy of BackTrack. BackTrack is a live Linux distro that has a (pretty big) collection of little tools that aid security professionals in penetration testing. Of course, put in the wrong hands, this distro can do some serious damage. Fortunately, we won\u0026rsquo;t be doing any of that here.\nYou can grab the distribution by going to http://www.remote-exploit.org/backtrack_download.html and downloading the ISO. I\u0026rsquo;ve been using the BackTrack 4 Beta lately, so i\u0026rsquo;ll be showing that one around.\nOnce you got the ISO cooked and ready to go, reboot your PC and watch that kernel uncompress\u0026hellip; sweet\u0026hellip; after a while you\u0026rsquo;ll be presented with this:\nWe\u0026rsquo;re going to login as root with password toor. After we\u0026rsquo;re in, we\u0026rsquo;ll type in startx to start X and KDE so we can get some GUI and multitask on command windows easily. After the GUI is loaded, you\u0026rsquo;ll see KDE which looks like this:\nAnd that\u0026rsquo;ll be all for today. I\u0026rsquo;ll continue the guide later so we can put your wireless card to better use.\n","permalink":"https://blog.escarra.org/posts/messing-with-wep-part-i/","summary":"\u003cp\u003eIt\u0026rsquo;s been long known that WEP is a very insecure wireless encryption protocol, and this is due to weak Initialization Vectors (IV) being used within. See, the engineers that designed the WEP protocol attempted to create a stronger encryption by adding a 24 bit IV to the cypher key that changes constantly, thus \u0026ldquo;eliminates\u0026rdquo; the repeated encryption of data with the same key over an over. The problem is, these IV\u0026rsquo;s are too short, and are periodically reused\u0026hellip; which means that if we can sniff enough data over the air, and get the AP to reuse IV\u0026rsquo;s eventually, we can figure out the key.\u003c/p\u003e","title":"Messing with WEP - Part I"},{"content":"So, since I recently wiped my ESXi box and installed CentOS 5.3 on it instead, I went with Zimbra for my e-mail solution, with LDAP authentication, and I have to say so far it works amazing\u0026hellip; but e-mail push is a feature i\u0026rsquo;ll be missing on my phone\u0026hellip;\nI found the solution to be something called Funambol. It is similar to what BES is for Exchange or Notes. It provides a sync interface for end devices into Zimbra, or Exchange, or others. I\u0026rsquo;ve been spending the weekend configuring Funambol and Zimbra to see each other, and my phone to sync with it.\nHere\u0026rsquo;s the guide i\u0026rsquo;ve been following: http://wiki.zimbra.com/index.php?title=Open_Source_Mobile_Calendar_and_Contact_Synchronization\n","permalink":"https://blog.escarra.org/posts/zimbra-and-funambol-integration/","summary":"\u003cp\u003eSo, since I recently wiped my ESXi box and installed CentOS 5.3 on it instead, I went with Zimbra for my e-mail solution, with LDAP authentication, and I have to say so far it works amazing\u0026hellip; but e-mail push is a feature i\u0026rsquo;ll be missing on my phone\u0026hellip;\u003c/p\u003e\n\u003cp\u003eI found the solution to be something called Funambol. It is similar to what BES is for Exchange or Notes. It provides a sync interface for end devices into Zimbra, or Exchange, or others. I\u0026rsquo;ve been spending the weekend configuring Funambol and Zimbra to see each other, and my phone to sync with it.\u003c/p\u003e","title":"Zimbra and Funambol integration"}]