Step 5. Deploy a Media Gateway

Requirements

To install or activate Mediation Server you must be a member of the RTCUniversalServerAdmins group or have been delegated to perform these tasks by a member of that group.

Mediation Server must be installed on Windows Server 2003 SP1 (or later) and must not be installed with any other application.

Microsoft .NET Framework 2.0 (available on the Communications Server 2007 CD) must be installed on the Mediation Server.

The minimum recommended hardware configuration (for up to 125 concurrent calls or 5 T1) is as follows. For more details, see Mediation Server Hardware Requirements, in Plan for Media Gateways in Office Communications Server.

• Single Processor Dual Core running at 3GHz

• 2GB RAM

• 30GB hard disk

• A single network interface card is the minimal requirement, but two cards are recommended for all deployments, including those where TLS has been enabled for the gateway link.

A certificate is required.

Recommendations

• Even if you enable TLS on the gateway link, two network interface cards are recommended on the Mediation Server for additional security: one card to communicate with the gateway and a separate card to communicate with the Office Communications Server internal infrastructure.

• You can install Mediation Server on multiple computers, but each Mediation Server must have a corresponding basic media gateway. If you are planning to install multiple Mediation Servers, it is good practice to install and test a single Mediation Server before attempting to deploy them all.

• To optimize performance, Mediation Server should not be collocated with any other Communications Server 2007 server role, and all unnecessary applications and services should be disabled on the computer.

To configure Mediation Server

1. Log on to a Communications Server 2007 Mediation Server.

2. Click Start, point to Administrative Tools, and then click Office Communications Server 2007.

3. Expand the appropriate forest node.

4. Expand the Mediation Servers node, right-click the Mediation Server to be configured, click Properties, and then click the General tab.

   

5. In the FQDN box, make sure the FQDN listed matches that of the Mediation Server you have selected.

6. Open a command prompt, change to the root directory, and type nslookup <FQDN of Mediation Server>, using the FQDN displayed on the Mediation Server General tab, and then press ENTER.

7. From the list of IP addresses displayed in the Communications Server listening IP address list, select the IP address returned in step 6.

   Important

   If the IP address selected in step 7 does not match the IP address in step 6, Communications Server traffic will be directed toward an interface that is not listening for such traffic and away from the one that is.

8. From the list of two IP addresses displayed in the Gateway listening IP address list, select the other IP address (that is, the one not already selected in step 7).

   Note

   The address selected in step 8 can be that of either a media gateway or a PBX.

9. From the A/V Edge Server list, select the A/V Edge Server that hosts the A/V Authentication Service for this Mediation Server.

   Important

   If the A/V Edge Server that hosts the A/V Authentication Service for this Mediation Server does not appear in the list, then the A/V Edge Server on which the service is collocated has not been entered into the A/V Edge Servers list on the Edge Servers tab of the Global Properties page. You will need to add the A/V Edge Server to the previous list before it will appear in the A/V Edge Server list on the Mediation Server tab. For more information, see the Microsoft Office Communications Server 2007 Edge Server Deployment Guide.

10. In the Default location profile list, select the default location profile for this Mediation Server.

    Important

    The default range media port range enables the server to handle up to 1000 simultaneous calls. Reducing the port range greatly reduces server capacity and should be undertaken only for specific reasons by an administrator who is knowledgeable about media port requirements, and scenarios. For this reasons, altering the default port range is not generally recommended.
    Organizations that employ IPSec for packet security are advised to disable it for media ports because the security handshake required by IPSec delays call setup. IPSec is unnecessary for media ports because SRTP encryption secures all media traffic between the Mediation Server and the internal Communications Server network.

11. In Media port range accept the default range of 60,000 to 64,000.

12. Click the Next Hop Connections tab.

    

13. On the Next Hop Connections tab under Office Communications Server next hop:

    • In the FQDN list, select the FQDN of the next-hop internal server. This server could be a Director or pool.

    • In the Port box, accept the default of 5061 for TLS.

14. On the Next Hop Connections tab under PSTN Gateway next hop:

    • In the IP address box, specify the IP address of the PSTN Gateway or the PBX associated with this Mediation Server.

    • In the Port box, accept the default of 5060 for TCP.

15. Click OK.

To configure the media gateway link for TLS

1. Download and install the two following hotfixes from https://r.office.microsoft.com/r/rlidOCS?clid=1033&p1=MediationServerHotFix.:

   • Office Communications Server 2007, Unified Communications Managed API v1.0 Redist: December 17, 2007 KB 944285 Version 3.0.6362.36

   • Description of the Update for Office Communication Server 2007, Mediation Server: December 17, 2007 KB 944285 Version 3.0.6362.36

2. Configure a certificate on the media gateway. This certificate must be from a CA that is trusted by the Mediation Server.

3. In a text editor, create an XML file in the following format:

   <?xml version="1.0" encoding="utf-8" ?>
   <configuration>
     <appSettings>
       <add key="GatewayTls" value="On" />
       <add key="GatewayFqdn" value="gateway.domain.com" />
     </appSettings>
   </configuration>
   

   The GatewayTls property can have a value of either “On” or “Off”. To enable TLS on the gateway link, this property must be set to “On”. If you set the value to “Off”, the transport protocol for the gateway link will revert to TCP. Setting the value to “Off” is the same as deleting the file. However, should you have reason to temporarily revert to TCP, you can enable TLS once again by resetting the property back to “On” and saving the file.

   The GatewayFqdn property must match the FQDN in the certificate provided by the gateway. For more information on certificate requirements for a media gateway, see Deploy a Media Gateway.

To download the CA certification path for the Mediation Server

1. With your Enterprise root CA offline and your Enterprise subordinate (issuing) CA Server online, log on to the Mediation Server as a member of the RTCUniversalServerAdmins group.

2. Click Start, click Run, type http://<name of your Issuing CA Server>/certsrv, and then click OK.

3. Under Select a task, click Download a CA certificate, certificate chain, or CRL.

4. Under Download a CA Certificate, Certificate Chain, or CRL, click Download CA certificate chain.

5. In the File Download dialog box, click Save.

6. Save the .p7b file to the hard disk on the server, and then copy it to a folder on the Mediation Server. If you open this file, the file should contain all the certificates that are in the certification path. To view the certification path, open the server certificate and click the certification path.

To install the CA certification chain for the Mediation Server

1. In the Deployment Wizard (which should still be open), click Deploy Other Server Roles, and then click Deploy Mediation Server.

2. On the Deploy Mediation Server page, next to Step 4 Configure Certificates, click Run to start the Communications Certificate Wizard.

3. On the Welcome page, click Next.

   

4. On the Available certificate tasks page, click Import a certificate chain from a .p7b file, and then click Next.

5. On Import Certificate Chain page, click Browse to locate the .p7b file, locate the file, and then click Next.

6. Click Finish.

To verify that your CA is in the list of trusted root CAs

1. Open an MMC console. Click Start, and then click Run. In the Open box, type mmc, and then click OK.

2. On the File menu, click Add/Remove Snap-in, and then click Add.

3. In the Add Standalone Snap-ins box, click Certificates, and then click Add.

4. In the Certificate snap-in dialog box, click Computer account, and then click Next.

5. In the Select Computer dialog box, ensure that the Local computer: (the computer this console is running on) check box is selected, and then click Finish.

6. Click Close, and then click OK.

7. In the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

8. In the details pane, verify that your CA is on the list of trusted CAs.

To create the certificate request for the Mediation Server

1. In Deployment Wizard, on the Deploy Mediation Server page, next to Step 3, Configure Certificates for the Mediation Server, click Run to start the Communications Certificate Wizard.

2. On the Welcome page, click Next.

3. On the Available Certificate Tasks page, click Create a new certificate, and then click Next.

   Note

   If you already have a certificate available, click Assign an Existing Certificate and continue with steps 3 through 7 in the procedure To Assign the Certificate to the Mediation Server later in this section.

4. On the Delayed or Immediate Request page, select one of the following options:

   • Prepare the request now, but send later, if you intend to output your request to a text file and then send that file to an offline CA.

     Note

     If you choose this option, you will later have to import the certificate and assign it to the Mediation Server.

   • Send the request immediately to an online CA, in which case you will not have to import the certificate but will still have to assign it to the Mediation Server.

   When you are done, click Next.

5. On the Name and Security Settings page, type a friendly name for the certificate, and specify the bit length (typically, the default of 1024), select the Mark certificate as exportable check box, and then click Next.

6. On the Organization Information page, enter the name for the organization and the organizational unit (such as a division or department, if appropriate), and then click Next.

7. On the Your Server's Subject Name page, type or select the subject name and subject alternate name of the Mediation Server. The subject name should match the FQDN of the Mediation Server:

   If your deployment includes multiple SIP domain names, in Subject alternate name, do the following:

   • Type the same name that you typed in Subject name, and then click Add.

   • Type each additional SIP domain name, separating each name with a comma.

8. Click Next.

9. On the Geographical Information page, type the location information, and then click Next.

10. The next page you see depends on which option you chose in Step 4:

    • If you selected Send the request immediately to an online CA in Step 4, then on the Choose a Certification Authority page, select your certification authority (CA) from the list or type the name of your CA in the Certification Authority box. If you type an external CA name, a dialog box appears. Type the user name and password for the external CA, and then click OK. When you are finished, click Next.

    • If you selected Prepare the request now but send later in Step 4, then type the file name and path to which the request is to be saved, and then click Next. Submit this file to your CA (by e-mail or other method supported by your organization for your Enterprise CA) and, when you receive the response file, copy the new certificate to this computer so it is available for import.

11. On the Request Summary page, click Next.

12. On the Certificate Wizard Completed page, verify successful completion, and then click Finish.

To import the certificate for the Mediation Server

1. In Deployment Wizard, on the Deploy Mediation Server page, next to Step 4, Configure Certificates, click Run to start the Communications Certificate Wizard.

2. On the Welcome page, click Next.

3. On the Pending certificate tasks page, click Process a pending request and import the certificate, and then click Next.

4. In the Path and file name box, type the full path and file name of the certificate that you requested for the Mediation Server (or click Browse to locate and select the certificate), and then click Next.

5. On the wizard completion page, verify successful completion, and the click Finish.

To assign the certificate to the Mediation Server

1. In the Deployment Wizard, on the Deploy Mediation Server page, next to Step 4, Configure Certificates, click Run to start the Communications Certificate Wizard.

2. On the Welcome page, click Next.

3. On the Available certificate tasks page, click Assign an existing certificate, and then click Next.

4. On the Available Certificates page, select the certificate that you requested for the Mediation Server, and then click Next.

5. Review your settings, and then click Next to assign the certificates.

6. On the Certificate Wizard Completed page, click Finish.

To start Mediation Server

1. On a Front End Server, click Start, point to Programs, point to Administrative Tools, and then click Office Communications Server 2007.

2. Expand the Mediation Servers node.

3. Right-click the appropriate Mediation Server, and then click Start.

4. On the Mediation Server, open the Windows 2003 Start menu, click Run, and then type services.msc. Verify that Office Communications Server Mediation appears in the list of services.