Accessing Cisco 7925 Web Interface

Sometimes you get so lucky to work for an organization that still have Cisco 7925 wireless phones in the environment. You’re SOL when they decommission all your Windows servers and no longer have any system with Internet Explorer 11 (Yes, yes, yes I know what you mean.)

Instead of modifying your go-to daily web browser’s security setting (Firefox, Chrome or Edge), try to get something else like Pale Moon and modify that instead.

Go to about:config

To address the TLS 1.0 concern, change the security.tls.version.min to 1

To address the SSL_ERROR_BAD_MAC_ALERT error message, change the security.tls.insecure_fallback_hosts to the IP address of the Cisco 7925 phone

Now do yourself a favor and submit a budget to replace all of your Cisco 7925’s.

Filed under: Cisco

CME Time is Correct but SIP Endpoints are on Different Timezone

If your Communications Manager Express (CME) clock and timezone configuration in telephony-service and voice register global are correct but SIP endpoints are a few hours behind or ahead (on a different timezone), you will need the timezone updater.

https://www.oracle.com/java/technologies/javase-tzupdater-downloads.html

1. Upload from TFTP to Flash.
2. Add the TFTP server configuration tftp-server flash:phones/tzupdater.jar alias tzupdater.jar
3. Update SIP Configuration and reset endpoints

voice register global
 no create profile
 create profile
 reset

Filed under: Cisco, Unified Communications

Cisco 44XX ISR Show Light Levels

If the command show interface [INTERFACE] transceiver status is not available, try using show hw-module subslot 0/0 transceiver [SFP SLOT] status. Here’s an example.


Cisco4451#show hw-module subslot 0/0 transceiver 3 status
The Transceiver in slot 0 subslot 0 port 3 is enabled.
  Module temperature                        = +24.316 C
  Transceiver Tx supply voltage             = 3357.2 mVolts
  Transceiver Tx bias current               = 13182 uAmps
  Transceiver Tx power                      = -7.1 dBm
  Transceiver Rx optical power              = -32.2 dBm
Cisco4451#

If it is still not working for you, check the output of show logging. Verify if the SFP that you are using is compatible with your equipment. It should not say %TRANSCEIVER-3-NOT_SUPPORTED
Example:


000046: *Jun  5 2020 09:59:28.694 CDT: %TRANSCEIVER-6-INSERTED:iomd:  transceiver module inserted in Gigabitethernet0/0/3

The output of show interface [INTERFACE] should not say media type is unknown media type. It should state the media-type if detected and compatible. In the example above, I am using GLC-LH-SMD= 1000BASE-LX/LH SFP transceiver module, MMF/SMF, 1310nm, DOM

The Transceiver Rx optical power should be between -3 to -8 dBm if interfacing within the same building or short-range optics.  Long range optics can go a lot lower depending on distance.  Anything less than -30 dBm is essentially no light received.  The sample above shows no light.

Check them here: https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/relevant-interfaces-and-modules.html

Filed under: Cisco

Cisco 8851 Partial Registered in CUCM

I’ve got a few Cisco 8851 phones that always come up as partial registered. I understand that partial registered usually means that one or more lines are unregistered or something to that effect. No matter how many times I reset remotely or power cycle the damn thing, it always come back as partial registered. To the users, everything is normal. Everything is normal so – meh. A few weeks later, got an aha moment.

Here’s what I forgot: our users use extension mobility and their device profiles were based on Cisco 7962 or 7965 device types and have all 6 lines associated with a directory number. Cisco 8800-series desk phones without a key expansion module (a.k.a sidecar) can only associate up to 5 lines. The user’s device profiles also have all 6 lines populated and after I disassociate that 6th line from the profile, things are back to normal. Well, it was already normal but you know what I mean.

Filed under: Call Manager, Cisco

New UCCX Team and CSQ not showing up in CUIC

A couple weeks ago, I recently added a new skill, assigned the skill to a Contact Service Queue (CSQ) and updated the assigned CSQ’s in the Team configuration and then renamed the Team name. When I logged in to Cisco Unified Intelligence Center (CUIC) to run a report, I do not see the new CSQ I created. The fix is to restart Cisco Unified Intelligence Center Reporting Service

The CUIC that we have is embedded (not standalone) in one of the UCCX nodes. Log in to both the UCCX nodes and check if Cisco Unified Intelligence Center Reporting Service is running then restart it.


admin:utils service list

Requesting service status, please wait...
~
Cisco Unified Intelligence Center Reporting Service[STARTED]
Cisco Unified Intelligence Center Serviceability Service[STARTED]
~

admin:utils service restart Cisco Unified Intelligence Center Reporting Service
 Don't press Ctrl-c while the service is getting RESTARTED.If Service has not Restarted Properly, execute the same Command Again
Service Manager is running
Cisco Unified Intelligence Center Reporting Service[STOPPED] Commanded Out of Service
Service Manager is running
Cisco Unified Intelligence Center Reporting Service[STARTING]
Cisco Unified Intelligence Center Reporting Service[STARTED]
admin:

Filed under: Cisco, Contact Center

UCCX Basic SQL Query

Most of the things that matter daily in UCCX 8.x, 9.x and perhaps 10.x are mostly done in CCX Administration (appadmin) and some troubleshooting done CCX Editor. There is one thing that Report Summary and User View did not do for me: List all users, along with their login ID‘s, and IPCC extensions so I can inform the Windows server team which users belong in the call center.

My solution was to do a SQL query. For those of you who are familiar with MySQL syntax, you will like this or roll your eyes on how easy it is and how unnecessary this post would be. My problem was that I did not know the name of the database and tables the agent info are stored.

See that * in the query below? Don’t do that if you have a lot of agents.


run uccx sql db_cra select * from resource

Or do it anyway to find out the names of the table columns so you can narrow down your search; but do it for one user.


run uccx sql db_cra select * from resource where resourceloginid like 'elton'

Be specific with the table columns instead.


run uccx sql db_cra select resourceloginid,extension,resourcename from resource where active!='f'

I use PuTTY and automatically log all session output so I don’t have to selectively highlight text to copy. Open the directory where you store the logs, open in Notepad++, copy, paste in Excel or Calc.

This is based on the UCCX 9.0 CLI Reference Guide:
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/crs/express_9_0/configuration/guide/UCCX_BK_C940F879_00_cli-reference-guide-for-uccx/UCCX_BK_C940F879_00_cli-reference-guide-for-uccx_chapter_00.html#UCCX_TP_CFB67B78_00

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/crs/express_9_02/configuration/guide/UCCX_BK_C007B99C_00_cli-reference-guide-release-902/UCCX_BK_C54B77AG_00_cli-reference-guide-902_chapter_0100.html#UCCX_TP_R1EEC0AE_00

As for SQL queries in Call Manager, check these out:
http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/117726-technote-cucm-00.html

Here’s a SQL user lookup example equivalent to viewing info in User Management > End Users


run sql select* from enduser where userid='elton'

William Bell has excellent CUCM SQL query tutorials as well. Don’t forget to check out the comment threads.
http://www.ucguerrilla.com/search/label/Query_Series

Basically, still using standard SQL syntax (yeah, that sounds redundant) prepended by “run sql” but it is just a matter of finding out the table and column names.

Here’s a SQL query to view them.


run sql select x.tabname, y.colname from systables x, syscolumns y where x.tabid=y.tabid order by x.tabname

Filed under: Call Manager, Cisco, Contact Center

Cisco Supervisor Desktop “No Service”

Symptoms:
CUCM 9.1
UCCX 9.0.2

A user called in to report that after logging in to Cisco Supervisor Desktop, selected a Team from the Team dropdown selection, it took a long time to load. It continues to state “No Service” in the bottom of the window after nothing has loaded and Team dropdown selection is greyed out.

If you download the Cisco Desktop Call/Chat Service trace logs, you will notice messages like:


2015-07-24 03:30:36:440 INFO STD0005 Client  disconnected from service at <10.0.11.39>.
2015-07-24 03:30:36:443 WARN LC0001 Error occurred while performing an LDAP operation.
2015-07-24 03:30:36:444 WARN LC0001 Error occurred while performing an LDAP operation.
2015-07-25 12:47:19:520 WARN FCCS3008 Network communication error  sending message to application .  The application will be logged out.
2015-07-27 08:44:34:074 INFO LC0007 Invalid Value.
2015-07-27 08:44:34:082 INFO LC0007 Invalid Value.


Solution:

  • Restart Cisco Desktop Call/Chat Service. This does not drop calls because once a call is answered, the CCX port is no longer used in that call. RTP media is now between endpoints. This does disrupt and refresh screens on agents who are exchanging chat messages but that shouldn’t be an issue, in my opinion.
  • Log out and back in.
  • If restarting the Cisco Desktop Call/Chat Service, did not work for you, restart Cisco Desktop Sync Service and Cisco Desktop Browser and IP Phone Agent Service.
  • Issue confirmed fixed. Notice, after selecting a team and while it is loading, the first thing that populates are the team’s agents and supervisors.

    What you want to see in the logs will be something like this

    
    2015-07-27 08:44:52:057 INFO FCCS0027 Service going into active mode.  Incoming requests will be accepted.
    2015-07-27 08:44:52:074 INFO LRMS0004 LRMClient is connected to the service at <10.0.11.39>.
    
    

    Filed under: Cisco, Contact Center, Unified Communications

    FTP server on Debian

    In this page, I will show you how to setup a basic FTP server in Debian. We will be using Pure-FTPd.

    Before install, check for existing FTP services.

    ps aux | grep ftp
    

    Check if you have an existing FTP server already installed (and not running?). Look for those lines that begins with “i”; that means the package is already installed. The “p” flag means it is a package that you can install.

    
    root@ftp-server:~# aptitude search pure-ftp
    p   mysqmail-pure-ftpd-logger                                                                  - real-time logging system in MySQL - Pure-FTPd traffic-logger
    p   pure-ftpd                                                                                  - Secure and efficient FTP server
    p   pure-ftpd-common                                                                           - Pure-FTPd FTP server (Common Files)
    p   pure-ftpd-ldap                                                                             - Secure and efficient FTP server with LDAP user authentication
    p   pure-ftpd-mysql                                                                            - Secure and efficient FTP server with MySQL user authentication
    p   pure-ftpd-postgresql                                                                       - Secure and efficient FTP server with PostgreSQL user authentication
    
    

    Install Pure-FTPd server with aptitude install pure-ftpd. The install looks like this.

    
    root@ftp-server:~# aptitude install pure-ftpd
    The following NEW packages will be installed:
      openbsd-inetd{a} pure-ftpd pure-ftpd-common{a}
    0 packages upgraded, 3 newly installed, 0 to remove and 0 not upgraded.
    Need to get 432 kB of archives. After unpacking 999 kB will be used.
    Do you want to continue? [Y/n/?] Y
    Get: 1 http://ftp.us.debian.org/debian/ wheezy/main openbsd-inetd amd64 0.20091229-2 [38.1 kB]
    Get: 2 http://ftp.us.debian.org/debian/ wheezy/main pure-ftpd-common all 1.0.36-1.1 [185 kB]
    Get: 3 http://ftp.us.debian.org/debian/ wheezy/main pure-ftpd amd64 1.0.36-1.1 [209 kB]
    Fetched 432 kB in 0s (472 kB/s)
    Preconfiguring packages ...
    Selecting previously unselected package openbsd-inetd.
    (Reading database ... 38866 files and directories currently installed.)
    Unpacking openbsd-inetd (from .../openbsd-inetd_0.20091229-2_amd64.deb) ...
    Selecting previously unselected package pure-ftpd-common.
    Unpacking pure-ftpd-common (from .../pure-ftpd-common_1.0.36-1.1_all.deb) ...
    Selecting previously unselected package pure-ftpd.
    Unpacking pure-ftpd (from .../pure-ftpd_1.0.36-1.1_amd64.deb) ...
    Processing triggers for man-db ...
    Setting up openbsd-inetd (0.20091229-2) ...
    [ ok ] Stopping internet superserver: inetd.
    [info] Not starting internet superserver: no services enabled.
    Setting up pure-ftpd-common (1.0.36-1.1) ...
    Setting up pure-ftpd (1.0.36-1.1) ...
    Starting ftp server: Running: /usr/sbin/pure-ftpd -l pam -O clf:/var/log/pure-ftpd/transfer.log -u 1000 -E -8 UTF-8 -B
    
    

    You will need to create a new system group for pure-ftpd but before doing that check if there are existing groups. Check /etc/groups if the name of the group you are planning to add already exist.

    Create a new system group for pure-ftpd.

    groupadd ftpgroup

    Create a default FTP user that has no access to home directories and cannot drop into a shell. You will not be prompted to create a password for this user.

    useradd -g ftpgroup -d /dev/null -s /etc ftpuser

    Create FTP users. You will prompted to create a new password for this user as well. The following example is an existing user and having it point to his existing home directory.

    pure-pw useradd elton -u ftpuser -g ftpgroup -d /home/elton

    You can create FTP users with storage limits. For more options check out the pure-pw man page, command is man pure-pw.

    pure-pw useradd bill -u ftpuser -g ftpgroup -d /home/pubftp/remo -N 10

    If you’re like me, you can sometimes create passwords on the fly and right away forget. I mean, it is faster for me to randomly come up with complex passwords and not have to use a password generator. Anyway, If you need to change it-

    pure-pw passwd [username]

    A reminder that pure-pw passwd is only for changing the FTP password. You still need to use passwd [username] to change users password.

    To apply adds and changes with pure-ftpd, don’t forget to issue the command pure-pw mkdb. The version of pure-ftpd that I have, version 1.0.36-1.1 does not need pure-pw mkdb after adding a new user.

    User info are stored in the /etc/pure-ftpd/pureftpd.passwd database file. Instead of checking that file, you can also list users with

    pure-pw list

    If you are looking for info on one specific user, pure-pw show [username]

    Here’s an example.

    
    root@ftp-server:~# pure-pw show elton
    
    Login              : elton
    Password           : $1$pVSkjNe0$OVr6W4ArAcFTxsXWa8OGR1
    UID                : 1001 (ftpuser)
    GID                : 1001 (ftpgroup)
    Directory          : /home/elton/./
    Full name          :
    Download bandwidth : 0 Kb (unlimited)
    Upload   bandwidth : 0 Kb (unlimited)
    Max files          : 0 (unlimited)
    Max size           : 0 Mb (unlimited)
    Ratio              : 0:0 (unlimited:unlimited)
    Allowed local  IPs :
    Denied  local  IPs :
    Allowed client IPs :
    Denied  client IPs :
    Time restrictions  : 0000-0000 (unlimited)
    Max sim sessions   : 0 (unlimited)
    
    

    Notice /home/elton/./ in the Directory value. The ./ after the directory path means that chroot will prevent this user from going above or outside that directory. This will make sense when you test FTP login using a FTP client.

    To save time, you can test your FTP login and server with

    ftp 127.0.0.1

    Better still, get FileZilla FTP Client.

    To start, stop, restart, force-reload, and view status of pure-ftpd, begin your command with /etc/init.d/pure-ftpd

    
    root@ftp-server:~# /etc/init.d/pure-ftpd
    Usage: /etc/init.d/pure-ftpd {start|stop|restart|force-reload|status}
    
    

    Remember that SFTP and FTPS are not the same. SFTP basically is FTP using SSH while FTPS uses TLS. This means that if you’ve enabled SSH on the server (and for the user), then SFTP (port 22) will work as well.

    Filed under: Debian, Linux

    Firefox 39.0 SSL Error: Weak Ephemeral Diffie-Hellman key

    Recently updated Firefox to version 39.0 and tried to access Call Manager and Contact Center Express. Got the following Firefox error:

    SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key)

    Solution documented in https://support.mozilla.org/en-US/questions/1066238

    Explanation: http://arstechnica.com/security/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web-and-mail-servers/

    1. In Firefox, Enter “about:config” in the URL field and press enter.
    2. Accept the “This might void your warranty!” warning by clicking “I’ll be careful, I promise!” button.
    3. In the search field, enter “security.ssl3.dhe_rsa_aes”.
    4. Double click each result (128 SHA and 256 SHA) to toggle the Value to “false”.

    No need to close and reopen the browser.

    Filed under: Firefox, Security, Web browser

    Cisco IOS Configuration Change Logging

    Someone or something caused your router to reboot. You want to log configuration changes to rule that out without using TACACS. Here’s what it looks like.

    
    router(config)# archive
    router(config-archive)# log config
    router(config-archive-log-cfg)# logging enable
    router(config-archive-log-cfg)# logging size 1000
    router(config-archive-log-cfg)# notify syslog
    router(config-archive-log-cfg)#
    
    

    To display configuration log entries by record numbers starting with the first recorded command
    show archive log config 1

    To display all configuration log files as they would appear in a configuration file rather than in a tabular format
    show archive log config all provisioning

    To view statistics
    show archive log config statistics

    
    router# show archive log config statistics
    Config Log Session Info:
            Number of sessions being tracked: 1
            Memory being held: 3909 bytes
            Total memory allocated for session tracking: 187657 bytes
            Total memory freed from session tracking: 183748 bytes
    
    Config Log log-queue Info:
            Number of entries in the log-queue: 63
            Memory being held by the log-queue: 16356 bytes
            Total memory allocated for log entries: 16356 bytes
            Total memory freed from log entries: 0 bytes
    
    

    For more information: http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/configuration/guide/15_1s/cf_15_1s_book/cf_config-logger.html

    Filed under: Cisco, IOS