<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Excellent recommendations. Starting with the next few phone releases we'll also be getting CTL/ITL information displayed in the phone's web page and even sent back to CUCM where it can be parsed out of the syslog.
<div><br>
<div>-Ryan </div>
<br>
<div>
<div>On Jul 25, 2013, at 4:16 PM, Stephen Welsh <<a href="mailto:stephen.welsh@unifiedfx.com">stephen.welsh@unifiedfx.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>Sorry Ryan,</div>
<div><br>
</div>
<div>I was getting confused, in the past I’ve seen issues with mismatched certificate subject names when changing the hostname, I was under the impression this would apply when changing to IP Address. So it’s a hostname change that would cause and issue, but
as you state if the change is only in the process node table that does not map out to the certificate.</div>
<div><br>
</div>
<div>As you say the ITL File is regenerated (I always get nervous when that happens ;), but as long at the certs don’t change and the ITL File currently on the phone has valid cert entires then the new ITL File will be installed.</div>
<div><br>
</div>
<div>However, I do recommend for anyone performing CUCM Changes/Upgrades to do the following to ensure if any phones do get an ITL Issue they can be resolved remotely:</div>
<div>
<ul>
<li>Enable Settings Menu Access (This is the default, but sometimes public phones are set to Restricted/Disabled)</li><li>Enabled the phone web server (i.e. in Enterprise Phone Configuration)</li><li>Change the Secure Authentication URL to non-secure i.e. <a href="http://[IPAddress]:8080/ccmcip/authenticate.jsp">
http://[IPAddress]:8080/ccmcip/authenticate.jsp</a></li></ul>
</div>
<div>Thanks</div>
<div><br>
</div>
<div>Stephen</div>
<div><br>
<div>
<div>On 25 Jul 2013, at 19:27, Ryan Ratliff (rratliff) <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
CUCM 9.1(1a), default System->Server value from fresh install. This is from the OS Admin Certificate Management display of the CallManager.pem.
<div>
<blockquote type="cite">
<div> Version: V3</div>
<div> Serial Number: 99480614108321596406940253707831773761</div>
<div> SignatureAlgorithm: SHA1withRSA (1.2.840.113549.1.1.5)</div>
<div> Issuer Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US</div>
<div> Validity From: Thu Apr 25 14:28:18 EDT 2013</div>
<div> To: Tue Apr 24 14:28:17 EDT 2018</div>
<div> Subject Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US</div>
</blockquote>
<div><br>
</div>
<div>Here's the "show itl' output.</div>
<div>
<blockquote type="cite">
<div>admin:show itl</div>
<div>The checksum value of the ITL file: </div>
<div>a1fe51f30c31ed586dc839e9b51d1046(MD5)</div>
<div>cb3637f73ae2d0ccf1e9b11d9b4b2a6302428e18(SHA1)</div>
<div><br>
</div>
<div><br>
</div>
<div>Length of ITL file: 4243</div>
<div>The ITL File was last modified on Thu Apr 25 14:53:47 EDT 2013</div>
</blockquote>
</div>
<div><br>
</div>
<div><br>
</div>
After changing System->Server to IP address.</div>
<div>
<blockquote type="cite">
<div>[</div>
<div> Version: V3</div>
<div> Serial Number: 99480614108321596406940253707831773761</div>
<div> SignatureAlgorithm: SHA1withRSA (1.2.840.113549.1.1.5)</div>
<div> Issuer Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US</div>
<div> Validity From: Thu Apr 25 14:28:18 EDT 2013</div>
<div> To: Tue Apr 24 14:28:17 EDT 2018</div>
<div> Subject Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US</div>
</blockquote>
<div><br>
</div>
And the "show itl".</div>
<div>
<blockquote type="cite">
<div>admin:show itl</div>
<div>The checksum value of the ITL file: </div>
<div>00b6ca74a635657cd533080d8f970315(MD5)</div>
<div>8f9573112f81c8a37661f03e639379f1dba2874e(SHA1)</div>
<div><br>
</div>
<div><br>
</div>
<div>Length of ITL file: 4243</div>
<div>The ITL File was last modified on Thu Jul 25 14:20:05 EDT 2013</div>
</blockquote>
<div><br>
</div>
So in part you are correct, the ITL will be regenerated. We do this way too frequently (even changing a CM group regenerates ITLs) but the ITL itself isn't as important as the cert used to sign the ITL. That doesn't change just by changing the value in the
processnode table. </div>
<div><br>
</div>
<div>
<div>-Ryan</div>
<br>
<div>
<div>On Jul 25, 2013, at 12:41 PM, Stephen Welsh <<a href="mailto:stephen.welsh@unifiedfx.com">stephen.welsh@unifiedfx.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Hi Ryan,
<div><br>
</div>
<div>I have to disagree, changing from Hostname <-> IP Address will mean the subject name of the certificates (Callmanager.Pem & TVS.Pem) on the relevant nodes will change, so those certificates will be regenerated.</div>
<div><br>
</div>
<div>As long as you follow this document you should be okay:</div>
<div><br>
</div>
<div><a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/install/8_6_1/ipchange/ipchg861.html">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/install/8_6_1/ipchange/ipchg861.html</a></div>
<div><br>
</div>
<div>However, we do typically find during a change like this a small percentage of devices don't update their ITL Files correctly, so you may end up with 1-2% of endpoints with problems and not know it...</div>
<div><br>
</div>
<div>UnifiedFX (<a href="http://www.unifiedfx.com/">http://www.unifiedfx.com</a>) just announces a brand new version of PhoneView (Version 3.5) that allows you to detect, report and fix any ITL Issues, we just published this video showing the new features,
very relevant to Eric's project, or anyone upgrading/changing CUCM for that matter:</div>
<div><br>
</div>
<div><a href="http://www.youtube.com/watch?v=-2FH-_rzdnE">http://www.youtube.com/watch?v=-2FH-_rzdnE</a></div>
<div><br>
</div>
<div>Thanks</div>
<div><br>
<div apple-content-edited="true">
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Stephen Welsh</div>
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br>
</div>
</div>
<div>
<div>On 25 Jul 2013, at 16:47, "Ryan Ratliff (rratliff)" <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
It won't impact ITLs since they are based on the actual server info, nothing in the database.
<div><br>
</div>
<div>The biggest issue with doing this comes when changing the IP address of a server. if the value in System->Server doesn't match or cannot resolve to the IP of the server then the database won't start, and all kinds of bad things happen. </div>
<div><br>
<div>
<div>-Ryan</div>
<br>
<div>
<div>On Jul 25, 2013, at 10:32 AM, Eric Pedersen <<a href="mailto:PedersenE@bennettjones.com">PedersenE@bennettjones.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: 'Lucida Grande'; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div class="WordSection1" style="page: WordSection1;">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-CA">I'm considering changing the CUCM Servers to be configured as IP addresses instead of host names to remove the dependency of phones on DNS. Is this a safe thing to do? I couldn't find much information about this on the Cisco site. I'm particularly
concerned about ITL issues after change.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-CA"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-CA">Thanks,<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-CA">Eric</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-CA"> </span></div>
</div>
<pre>The contents of this message may contain confidential and/or privileged
subject matter. If this message has been received in error, please contact
the sender and delete all copies. Like other forms of communication,
e-mail communications may be vulnerable to interception by unauthorized
parties. If you do not wish us to communicate with you by e-mail, please
notify us at your earliest convenience. In the absence of such
notification, your consent is assumed. Should you choose to allow us to
communicate by e-mail, we will not take any additional security measures
(such as encryption) unless specifically requested.
_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" style="color: purple; text-decoration: underline;">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" style="color: purple; text-decoration: underline;">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br></pre>
</div>
</div>
<br>
</div>
</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a></blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
<br>
</div>
</body>
</html>