<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thank you for testing this out Ryan! If I understand SBD correctly, phones only lose the ITL trust if the CM cert and TVS cert change and from your test changing
from hostname to IP doesn't regenerate the CM cert. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Do you think we will need to reboot the cluster after each Server change or can wait until they are all changed since the IP addresses aren't actually changing?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Ratliff (rratliff) [mailto:rratliff@cisco.com]
<br>
<b>Sent:</b> 25 July 2013 12:27 PM<br>
<b>To:</b> Stephen Welsh<br>
<b>Cc:</b> Eric Pedersen; cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] Changing CUCM Servers to use IP instead of DNS<br>
<b>Importance:</b> High<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CUCM 9.1(1a), default System->Server value from fresh install. This is from the OS Admin Certificate Management display of the CallManager.pem.
<o:p></o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"> Version: V3<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Serial Number: 99480614108321596406940253707831773761<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> SignatureAlgorithm: SHA1withRSA (1.2.840.113549.1.1.5)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Issuer Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Validity From: Thu Apr 25 14:28:18 EDT 2013<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> To: Tue Apr 24 14:28:17 EDT 2018<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Subject Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Here's the "show itl' output.<o:p></o:p></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">admin:show itl<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The checksum value of the ITL file: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">a1fe51f30c31ed586dc839e9b51d1046(MD5)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">cb3637f73ae2d0ccf1e9b11d9b4b2a6302428e18(SHA1)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Length of ITL file: 4243<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The ITL File was last modified on Thu Apr 25 14:53:47 EDT 2013<o:p></o:p></p>
</div>
</blockquote>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">After changing System->Server to IP address.<o:p></o:p></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">[<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Version: V3<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Serial Number: 99480614108321596406940253707831773761<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> SignatureAlgorithm: SHA1withRSA (1.2.840.113549.1.1.5)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Issuer Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Validity From: Thu Apr 25 14:28:18 EDT 2013<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> To: Tue Apr 24 14:28:17 EDT 2018<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Subject Name: L=NC, ST=RTP, CN=ucm9a-new, OU=TAC, O=Cisco, C=US<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">And the "show itl".<o:p></o:p></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">admin:show itl<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The checksum value of the ITL file: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">00b6ca74a635657cd533080d8f970315(MD5)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">8f9573112f81c8a37661f03e639379f1dba2874e(SHA1)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Length of ITL file: 4243<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The ITL File was last modified on Thu Jul 25 14:20:05 EDT 2013<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">So in part you are correct, the ITL will be regenerated. We do this way too frequently (even changing a CM group regenerates ITLs) but the ITL itself isn't as important as the cert used to sign the ITL. That doesn't change just by changing
the value in the processnode table. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">-Ryan <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Jul 25, 2013, at 12:41 PM, Stephen Welsh <<a href="mailto:stephen.welsh@unifiedfx.com">stephen.welsh@unifiedfx.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Ryan, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have to disagree, changing from Hostname <-> IP Address will mean the subject name of the certificates (Callmanager.Pem & TVS.Pem) on the relevant nodes will change, so those certificates will be regenerated.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As long as you follow this document you should be okay:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/install/8_6_1/ipchange/ipchg861.html">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/install/8_6_1/ipchange/ipchg861.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">However, we do typically find during a change like this a small percentage of devices don't update their ITL Files correctly, so you may end up with 1-2% of endpoints with problems and not know it...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">UnifiedFX (<a href="http://www.unifiedfx.com/">http://www.unifiedfx.com</a>) just announces a brand new version of PhoneView (Version 3.5) that allows you to detect, report and fix any ITL Issues, we just published this video showing the
new features, very relevant to Eric's project, or anyone upgrading/changing CUCM for that matter:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.youtube.com/watch?v=-2FH-_rzdnE">http://www.youtube.com/watch?v=-2FH-_rzdnE</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica","sans-serif"">Stephen Welsh<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">On 25 Jul 2013, at 16:47, "Ryan Ratliff (rratliff)" <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">It won't impact ITLs since they are based on the actual server info, nothing in the database.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The biggest issue with doing this comes when changing the IP address of a server. if the value in System->Server doesn't match or cannot resolve to the IP of the server then the database won't start, and all kinds of bad things happen. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">-Ryan <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Jul 25, 2013, at 10:32 AM, Eric Pedersen <<a href="mailto:PedersenE@bennettjones.com">PedersenE@bennettjones.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I'm considering changing the CUCM Servers to be configured as IP addresses instead of host names to remove the dependency of phones on DNS. Is this a safe thing
to do? I couldn't find much information about this on the Cisco site. I'm particularly concerned about ITL issues after change.</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Thanks,</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Eric</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<pre>The contents of this message may contain confidential and/or privileged<o:p></o:p></pre>
<pre>subject matter. If this message has been received in error, please contact<o:p></o:p></pre>
<pre>the sender and delete all copies. Like other forms of communication,<o:p></o:p></pre>
<pre>e-mail communications may be vulnerable to interception by unauthorized<o:p></o:p></pre>
<pre>parties. If you do not wish us to communicate with you by e-mail, please<o:p></o:p></pre>
<pre>notify us at your earliest convenience. In the absence of such<o:p></o:p></pre>
<pre>notification, your consent is assumed. Should you choose to allow us to<o:p></o:p></pre>
<pre>communicate by e-mail, we will not take any additional security measures<o:p></o:p></pre>
<pre>(such as encryption) unless specifically requested.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net"><span style="color:purple">cisco-voip@puck.nether.net</span></a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip"><span style="color:purple">https://puck.nether.net/mailman/listinfo/cisco-voip</span></a><o:p></o:p></pre>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>
<pre>The contents of this message may contain confidential and/or privileged
subject matter. If this message has been received in error, please contact
the sender and delete all copies. Like other forms of communication,
e-mail communications may be vulnerable to interception by unauthorized
parties. If you do not wish us to communicate with you by e-mail, please
notify us at your earliest convenience. In the absence of such
notification, your consent is assumed. Should you choose to allow us to
communicate by e-mail, we will not take any additional security measures
(such as encryption) unless specifically requested.