<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Not having a TVS server won't be a problem moving from 7.x to 8.x since the SBD feature isn't present in 7.x. In bridge mode you get no services so the phones won't ever get an ITL or config file with a TVS server populated.<div><br></div><div>Since we're on the topic of SBD and Jason didn't do it himself he wrote a great document on SBD operation and troubleshooting that everyone running or supporting CUCM 8.x should read. </div><div><a href="https://supportforums.cisco.com/docs/DOC-17679">https://supportforums.cisco.com/docs/DOC-17679</a></div><div><br><div>
<div style="font-family: Helvetica; ">-Ryan</div>
</div>
<br><div><div>On Aug 23, 2011, at 4:13 PM, Carter, Bill wrote:</div><br class="Apple-interchange-newline"><span class="Apple-style-span" style="border-collapse: separate; font-family: 'Lucida Grande'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Jason,<o:p></o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks for helping us out here. I have about 5 UCM 7.X to 8.X upgrades scheduled. These all involve moving from Physical to Virtual servers. What process should be followed to prevent these ITL/TVS problems?<o:p></o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">In all cases we are doing a bridge upgrade. The problem I see is that we get the physical servers up to 8.0X, but because they are in bridge mode the phones cannot contact a TVS server until we restore to a Virtual UCM 8.0X server. Then we run the upgrade to 8.5.<o:p></o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">-Bill Carter<o:p></o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip-bounces@puck.nether.net" style="color: blue; text-decoration: underline; ">cisco-voip-bounces@puck.nether.net</a><span class="Apple-converted-space"> </span>[mailto:cisco-voip-bounces@puck.nether.net]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Jason Burns<br><b>Sent:</b><span class="Apple-converted-space"> </span>Saturday, August 20, 2011 7:42 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Nathan Reeves<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net" style="color: blue; text-decoration: underline; ">cisco-voip@puck.nether.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [cisco-voip] Issues with certificate security following upgrade to 8.6<o:p></o:p></span></div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; "><o:p> </o:p></div><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">Nathan, when you updated the servers to use dns, does that mean you added a domain name? Also, are you still on 8.0?<o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">If so, then that regenerated all of your certificates, including the itl file and tvs certs. With the previously mentioned defect that would explain the problem I think.<o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; "><a href="https://supportforums.cisco.com/docs/DOC-17679#Changing_Host_Names_or_Domain_Names" style="color: blue; text-decoration: underline; ">https://supportforums.cisco.com/docs/DOC-17679#Changing_Host_Names_or_Domain_Names</a><o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">Also, there is no way to do an upgrade to 8.6 without booting into 8.6. The install will ignore your pleas to do otherwise. This is pretty well documented in the upgrade pages after you install the special cop file(that new cop file allows the 8.6 advisory text to be displayed before upgrade), and in the 8.6 release notes. We need to boot into the new environment to run the binaries built for that environment because of the rhel upgrade.<o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">First compare the certs in the itl using show itl, to the certs in OS admin cert administration.<o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">Then compare the md5 of your itl in tftp to the md5 in the phone.<o:p></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; ">Compare the md5 of the itl with the md5 on the phone.<o:p></o:p></p><div><div style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-top: 0in; margin-bottom: 0.0001pt; ">On Aug 17, 2011 10:49 AM, "Nathan Reeves" <<a href="mailto:nathan.a.reeves@gmail.com" style="color: blue; text-decoration: underline; ">nathan.a.reeves@gmail.com</a>> wrote:<br>> Upgraded our cluster from 8.0.3 to 8.6.1 last weekend. Upgrade<br>> completed successfully (took a while but given it was a major jump I<br>> expected that). Everything appeared to be working fine but come<br>> Monday I started getting calls from users who couldn't use the<br>> corporate directory on their phones. When they attempted to access<br>> it, a 'host not found' error occurred. Ended up tracing this back to<br>> the phones being unable to access https based links due to a tvs /<br>> certain issue.<br>><span class="Apple-converted-space"> </span><br>> At this point, the manual deletion of the phones security tlv file<br>> fixes the issue. I think i've got about 100 phones affected, so the<br>> process isn't too bad to get done, just going to be time consuming.<br>><span class="Apple-converted-space"> </span><br>> What I want to try and work out is what I've done wrong in the upgrade<br>> process which has caused this issue. Basic overview of the steps<br>> taken is as follows:<br>> - upgraded pub to 8.6.1. Booted back into 8.0.3 following upgrade.<br>> - upgraded sub to 8.6.1. For some reason, even though I marked not<br>> to boot to the upgraded partition, it booted into 8.6.1.<br>> - booted pub into 8.6.1.<br>> - waited for phones to settle down. Eg from switchback to sub and<br>> firmware upgrades etc.<br>> - updated servers to use dns (previously dns was not set).<br>> - checked that db replication was successful (saw some issues which a<br>> reboot and updating reverse dns entries appeared to fix.)<br>> - 48 hours later installed new tomcat certs which had been signed by<br>> our windows domain CA.<br>><span class="Apple-converted-space"> </span><br>> In troubleshooting the cert issue on the phones, I can see it heads to<br>> the tvs to do a cert verify when it tries to access ssl links and<br>> secured tftp. On the phones I can see it send a request to the tvs<br>> and it lists a certificate serial which I'm assuming it is trying to<br>> verify. The request then fails and the phone fails to load the<br>> cnf.XML etc. If I check the two servers, both have a certificate<br>> which matches the serial listed on the phone when it is requesting the<br>> tvs to check the cert.<br>><span class="Apple-converted-space"> </span><br>> I saw the previus issue with 8.5.1 and the tftp tlv file failing to be<br>> written but it's a different issue to that. In looking at the tvs<br>> logs, I do see a file failed to be written but with an error -2. The<br>> file was ctlfile.tlv.<br>><span class="Apple-converted-space"> </span><br>> Have I caused this issue with the update of the dns settings on the<br>> servers and a possible regeneration of the certifates at this point.<br>> Was there a process I should have followed.<br>><span class="Apple-converted-space"> </span><br>> I'm considering contacting tac in the morning to see if theres<br>> anything obvious I've done wrong and if there's a way to resolve the<br>> issue without touching phones manually, but if it's obvious to someone<br>> here what I've screwed up it would be great to hear it.<br>><span class="Apple-converted-space"> </span><br>> Thanks<br>><span class="Apple-converted-space"> </span><br>> Nathan<br>> _______________________________________________<br>> cisco-voip mailing list<br>><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net" style="color: blue; text-decoration: underline; ">cisco-voip@puck.nether.net</a><br>><span class="Apple-converted-space"> </span><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" style="color: blue; text-decoration: underline; ">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></div></div></div>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" style="color: blue; text-decoration: underline; ">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" style="color: blue; text-decoration: underline; ">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br></div></span></div><br></div></body></html>