Cisco CUCM Configuration
This topic contains detailed configuration guidelines to enable call recording for Cisco Active:
Step | Reference | Description |
---|---|---|
1 | Set up Active Recording using the CUCM. | |
2 | Set up Secure Active Recording using the CUCM. | |
3 | Set up Secure JTAPI connection using the CUCM. |
Note
The configuration steps detailed in this Technical Guide:
Cover pre-requisite installation/configuration steps prior to a Uniphore engineer install of the U‑Capture Cisco Active integration, and provide for general Cisco CUCM config updates (if needed).
Should be performed by a suitably qualified Cisco engineer/administrator only. Uniphore recommends this is performed as an assisted/supervised install with a Uniphore engineer, please contact your Uniphore representative to discuss options.
Illustrate use of Cisco admin tools and processes. These are subject to regular changes from Cisco and although the configuration steps covered here will be maintained to ensure the correct process is followed, there may be some differences present.
Active Recording – CUCM Configuration
Most of the configuration required to enable recording using Cisco DMS is performed using the Cisco Unified Communications Manager (CUCM). This section describes the required process to follow, with the following points showing the high-level steps in the configuration process:
Create a Route Group, a Route List and a Route Pattern
Optional config for Recording-Enabled Gateway (CUCM 10.5.x only).
Configuration steps should be carried out by a suitably trained engineer. All configuration details including graphics/screenshots are provided for guidance only.
Create the SIP Trunk and Enable Recording
Create the SIP Trunk
Additional Requirements for Failover Systems
Enable SIP Options Ping (Optional)
You can now apply this newly created profile to a trunk, as detailed in Create the SIP Trunk.
Create a Route Group
Create a Route List
Create a Route Pattern
Change System Parameters
Create a Recording Profile
Enable Phones for Recording
Create the CTI Enabled User
Install TAPI
CUCM 10.5.x – Recording-Enabled Gateway
To view further information about WSAPI and XMF – see References and Supporting Information and follow the link provided.
Secure Active Recording – CUCM Configuration
Secure Active Recording builds on the configuration for Cisco Active Recording – see Active Recording – CUCM Configuration. This section describes the required process to follow, with the following points showing the high-level steps in the configuration process:
Create a SIP Security Profile
To be able to setup a SIP trunk as a secure trunk, a SIP Security Profile must be created. This produces a profile that can be shared across multiple SIP devices in the CUCM. This profile will only be applied to the SIP Trunk for recording.
From the drop-down menu at the top right side of the Cisco Unified Operating System Administration page, select Cisco Unified CM Administration and click Go.
Select System > Security > SIP Trunk Security Profile and click Add New.
Create a new SIP Security Profile with:
Name – Secure SIP Recording
Device Security Mode – Encrypted
Incoming Transport Type – TLS
Ougoing Transport Type – TLS
X.509 Subject Name – RedBoxRecorder
Incoming Port – 5061
Click Save and then click Reset to confirm.
Configure the SIP Trunk for Security
The SIP Trunk must be configured to use the SIP Security Profile and treat calls as secure. When complete, the CUCM will use a secure connection to the Collector and allow encrypted calls to be recorded.
Select Device > Trunk and click on the SIP Trunk configured for recording.
Scroll down the Device Information section and click on the SRTP Allowed tick box.
Scroll down to the SIP Information section and in the Destination Port field enter 5061 and click Save.
Select System > Security > SIP Trunk Security Profile and click Save.
Verification
Start sniffing with Wireshark. Dial the route pattern for the trunk from any Cisco phone registered with the CUCM. This will cause the CUCM to send secure SIP to the Collector.
In Wireshark using the display filter tcp.port == 5061 confirm that SSL protocol is being used between the CUCM and the Collector. Confirm that there is data being exchanged. The data will be encrypted so reading it will not be possible.
Port 5061 is the secure SIP port. If there’s SSL data on it, then the CUCM and the Collector are using secure SIP.
Create a SIP Security Profile
To be able to setup a SIP trunk as a secure trunk, a SIP Security Profile must be created. This produces a profile that can be shared across multiple SIP devices in the CUCM. This profile will only be applied to the SIP Trunk for recording.
From the drop-down menu at the top right side of the Cisco Unified Operating System Administration page, select Cisco Unified CM Administration and click Go.
Select System > Security > SIP Trunk Security Profile and click Add New.
Create a new SIP Security Profile with:
Name – Secure SIP Recording
Device Security Mode – Encrypted
Incoming Transport Type – TLS
Ougoing Transport Type – TLS
X.509 Subject Name – RedBoxRecorder
Incoming Port – 5061
Click Save and then click Reset to confirm.
Verification
Start sniffing with Wireshark. Dial the route pattern for the trunk from any Cisco phone registered with the CUCM. This will cause the CUCM to send secure SIP to the Collector.
In Wireshark using the display filter tcp.port == 5061 confirm that SSL protocol is being used between the CUCM and the Collector. Confirm that there is data being exchanged. The data will be encrypted so reading it will not be possible.
Port 5061 is the secure SIP port. If there’s SSL data on it, then the CUCM and the Collector are using secure SIP.
Configure the SIP Trunk for Security
The SIP Trunk must be configured to use the SIP Security Profile and treat calls as secure. When complete, the CUCM will use a secure connection to the Collector and allow encrypted calls to be recorded.
Select Device > Trunk and click on the SIP Trunk configured for recording.
Scroll down the Device Information section and click on the SRTP Allowed tick box.
Scroll down to the SIP Information section and in the Destination Port field enter 5061 and click Save.
Select System > Security > SIP Trunk Security Profile and click Save.
Cisco Secure JTAPI – CUCM Config
Note
These steps should be performed by a suitably qualified Cisco engineer/administrator only. Uniphore recommends this is performed as an assisted/supervised install with a Uniphore engineer, please contact your Uniphore representative to discuss options.
Complete the Installation/Configuration
As stated previously, the configuration steps detailed in this guide are intended to provide pre-requisite installation/configuration steps prior to a Uniphore engineer install of the Cisco Active recording integration. In order to complete the Cisco integration, please contact your Uniphore representative to arrange an engineer installation to complete the process.