<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div><br>
</div>
Well, I guess we could use a PAT solution at the edge which opens up outbound access to the world and then migrate to using expressways at a later time. We’re currently at 10.4
<div><br>
</div>
<div>I’m wondering if I could setup just a pair of small ova exp-E servers without a C-pair. <br>
<br>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"><i>-sent from mobile device-</i></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"><b><br>
</b></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"><b>Lelio Fulgenzi, B.A.</b> | Senior Analyst<o:p></o:p></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);">Computing and Communications Services | University of Guelph<o:p></o:p></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);">Room 037 Animal Science & Nutrition Bldg | <a href="x-apple-data-detectors://1/0" dir="ltr" x-apple-data-detectors="true" x-apple-data-detectors-type="address" x-apple-data-detectors-result="1/0" style="-webkit-text-decoration-color: rgba(0, 0, 0, 0.258824);">50
Stone Rd E | Guelph, ON | N1G 2W1</a><o:p></o:p></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font color="#000000"><span style="caret-color: rgb(0, 0, 0); background-color: rgba(255, 255, 255, 0);"><a href="tel:519-824-4120;56354" dir="ltr" x-apple-data-detectors="true" x-apple-data-detectors-type="telephone" x-apple-data-detectors-result="1/1" style="-webkit-text-decoration-color: rgba(0, 0, 0, 0.258824);">519-824-4120
Ext. 56354</a> | <a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a><o:p></o:p></span></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font color="#000000"><span style="caret-color: rgb(0, 0, 0); background-color: rgba(255, 255, 255, 0);"><a href="http://www.uoguelph.ca/ccs">www.uoguelph.ca/ccs</a> | @UofGCCS on Instagram, Twitter and
Facebook<o:p></o:p></span></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span style="background-color: rgba(255, 255, 255, 0);"><img border="0" width="187" height="100" id="Picture_x0020_1" src="cid:image001.png@01D3DD7E.EC708050" alt="University of Guelph Cornerstone with Improve Life tagline" _mf_state="2" action="null" title="null" style="width: 1.9479in; height: 1.0416in;"></span></p>
</div>
<div><br>
On Aug 2, 2018, at 4:48 PM, Brian Meade <<a href="mailto:bmeade90@vt.edu">bmeade90@vt.edu</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">Sounds like a CYA type of thing similar to how call recording over MRA was for a while. I think x8.11 is supposed to be the release that the forward-proxy is officially supported for APNS.</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Thu, Aug 2, 2018 at 3:15 PM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I _thought_ I remember reading about that. That would have been my preference!<br>
<br>
8.10/8.11 womp womp womp<br>
<br>
CAUTION: At present the built-in Expressway forward proxy is not suitable for use with Cisco Unified<br>
Communications Manager and/or IM and Presence Service, and is not supported for those products. The<br>
forward proxy is in the Expressway user interface, but it should not be used. This means that if you<br>
require a forward proxy deployment, you need to use a suitable third-party HTTPS proxy.<br>
<br>
But is this referring to any forward proxy stuff or just non-APNS proxy?<br>
<br>
<br>
---<br>
Lelio Fulgenzi, B.A. | Senior Analyst<br>
Computing and Communications Services | University of Guelph<br>
Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<br>
519-824-4120 Ext. 56354 | <a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><br>
<br>
<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">www.uoguelph.ca/ccs</a> | @UofGCCS on Instagram, Twitter and Facebook<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: Patrick Robitaille <<a href="mailto:Patrick.Robitaille@aqr.com" target="_blank">Patrick.Robitaille@aqr.com</a>>
<br>
Sent: Thursday, August 2, 2018 2:08 PM<br>
To: Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>><br>
Cc: Matthew Loraditch <<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>>; voyp list, cisco-voip (<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>) <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
Subject: Re: [cisco-voip] setting up access for APNS - granular vs wide open internet access<br>
<br>
Check out release notes for Expressways too as they’re planning forward proxy for this purpose as well.<br>
<br>
- - -<br>
Patrick Robitaille, <a href="mailto:patrick.robitaille@aqr.com" target="_blank">patrick.robitaille@aqr.com</a><mailto:<a href="mailto:patrick.robitaille@aqr.com" target="_blank">patrick.robitaille@aqr.com</a>><br>
O: (203) 742-3797 | C: (203) 914-9572<br>
<br>
<br>
On Aug 2, 2018, at 12:42 PM, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><mailto:<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>>> wrote:<br>
<br>
Thanks Matthew – we’re on v11.5, so I’ll try to drum up the similar chapter.<br>
<br>
I’m not sure we’ve got URL based firewall rules implemented or available. I will have to ask.<br>
<br>
Good to hear you’ve not had problems with outbound access.<br>
<br>
As far as smart licensing is concerned, we were ok using the proxy there, since it would be ok if it went down. If we open up complete access though, the need for that goes away.<br>
<br>
<br>
<br>
---<br>
Lelio Fulgenzi, B.A. | Senior Analyst<br>
Computing and Communications Services | University of Guelph Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<br>
519-824-4120 Ext. 56354 | <a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><mailto:<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>><br>
<br>
<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">www.uoguelph.ca/ccs</a><<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">http://www.uoguelph.ca/ccs</a>> | @UofGCCS on Instagram, Twitter and Facebook<br>
<br>
<image001.png><br>
<br>
From: Matthew Loraditch <<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a><mailto:<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>>><br>
Sent: Thursday, August 2, 2018 12:33 PM<br>
To: Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><mailto:<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>>>; voyp list, cisco-voip (<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><mailto:<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>>)
<<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><mailto:<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>>><br>
Subject: RE: setting up access for APNS - granular vs wide open internet access<br>
<br>
See page 5 here: <a href="https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/12_0_1/systemConfig/cucm_b_system-configuration-guide-1201/cucm_b_system-configuration-guide-1201_chapter_01011000.pdf" rel="noreferrer" target="_blank">
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/12_0_1/systemConfig/cucm_b_system-configuration-guide-1201/cucm_b_system-configuration-guide-1201_chapter_01011000.pdf</a><br>
<br>
For what servers your servers will need to talk to, if you can do URL based firewall rules that would work.<br>
<br>
If not the servers are all Cisco’s and in the Webex cloud so the IP blocks aren’t that many:
<a href="https://collaborationhelp.cisco.com/article/en-us/WBX264" rel="noreferrer" target="_blank">
https://collaborationhelp.cisco.com/article/en-us/WBX264</a><br>
Now I’m not 100% certain if ALL webex services fall within those IPs. That article is designed for Teams and Meetings.<br>
<br>
I will add I’ve never operated in an environment as tight/regulated as yours, but I have 23 clusters that have been able to talk outbound to internet since their beginnings and never had an issue that had to do with that.<br>
<br>
Also you are going to have to think about this internet thing again when you go to 12.x+ and smart licensing so you may want to look up those requirements as well. A few more options exist there where going offline intermittently isn’t as much of a deal.<br>
<br>
<br>
<br>
<br>
<br>
<br>
Matthew Loraditch<br>
<br>
Sr. Network Engineer<br>
<br>
<br>
p: 443.541.1518<<a href="tel:443.541.1518">tel:443.541.1518</a>><br>
<br>
<br>
<br>
w: <a href="http://www.heliontechnologies.com" rel="noreferrer" target="_blank">www.heliontechnologies.com</a><<a href="http://www.heliontechnologies.com/" rel="noreferrer" target="_blank">http://www.heliontechnologies.com/</a>><br>
<br>
|<br>
<br>
e: <a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a><mailto:<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>><br>
<br>
<br>
<image002.png><br>
<br>
<br>
<image003.png><<a href="https://facebook.com/heliontech" rel="noreferrer" target="_blank">https://facebook.com/heliontech</a>><br>
<br>
<br>
<br>
<image004.png><<a href="https://twitter.com/heliontech" rel="noreferrer" target="_blank">https://twitter.com/heliontech</a>><br>
<br>
<br>
<image005.png><<a href="https://www.linkedin.com/company/helion-technologies" rel="noreferrer" target="_blank">https://www.linkedin.com/company/helion-technologies</a>><br>
<br>
<br>
<br>
<br>
<br>
<image006.jpg><<a href="https://heliontechnologies.com/events/14th-annual-automotive-cx-summit-hosted-thought-leadership-summits/" rel="noreferrer" target="_blank">https://heliontechnologies.com/events/14th-annual-automotive-cx-summit-hosted-thought-leadership-summits/</a>><br>
<br>
<br>
<br>
<br>
From: cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a><mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>> On Behalf Of Lelio
Fulgenzi<br>
Sent: Thursday, August 2, 2018 11:58 AM<br>
To: voyp list, cisco-voip (<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><mailto:<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>>) <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><mailto:<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>>><br>
Subject: [cisco-voip] setting up access for APNS - granular vs wide open internet access<br>
<br>
<br>
Another issue we are facing is setting up the collaboration servers (CUCM, IMP) to talk out of our private network to the internet to talk to Cisco and Apple servers.<br>
<br>
Just wondering what others have been doing.<br>
<br>
Our networking team has suggested the simplest way would be to add a PAT rule at our edge for the servers (or network) so that they can communicate out to the internet as required. There would be no ACLs applied, so they could talk to anywhere. By applying
the PAT on the edge, all internal communications would continue with the internal addressing. The PAT would only allow established communications – no outside-to-inside initiated talk allowed.<br>
<br>
The other alternative would be to put a bunch of xlate’s on our data centre firewall, one for each source collab server and cisco/apple dest pair – this could be 10s of statements.<br>
<br>
The first means I have no control over who the servers can talk to on the internet. Which scares me.<br>
<br>
The second would mean quite a bit of extra upfront work, and managing those statements if/when Cisco and apple update their ip addresses.<br>
<br>
There is the proxy option, but the current proxy service we have is likely not to be considered mission critical and attaching the APNS configuration to this likely wouldn’t go over well.<br>
<br>
What have others done in this situation?<br>
<br>
Thanks!<br>
<br>
<br>
---<br>
Lelio Fulgenzi, B.A. | Senior Analyst<br>
Computing and Communications Services | University of Guelph Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<br>
519-824-4120 Ext. 56354 | <a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><mailto:<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>><br>
<br>
<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">www.uoguelph.ca/ccs</a><<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">http://www.uoguelph.ca/ccs</a>> | @UofGCCS on Instagram, Twitter and Facebook<br>
<br>
<image001.png><br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><mailto:<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>
________________________________<br>
<br>
Disclaimer: This e-mail may contain confidential and/or privileged information. If you are not the intended recipient or have received this e-mail in error, please notify the sender immediately and destroy/delete this e-mail. You are hereby notified that any
unauthorized copying, disclosure or distribution of the material in this e-mail is strictly prohibited.<br>
<br>
AQR Capital Management, LLC, along with its affiliates (collectively "AQR") may collect certain personal information from you. AQR operates pursuant to a Global Privacy Policy which describes the types of personal information we obtain, how we use the information,
with whom we share it and the choices available to you regarding our use of the information. We also describe the measures we take to protect the security of the information and how you can contact us about our privacy practices. By providing your personal
information you agree to do so pursuant to the Global Privacy Policy. For a copy of the Global Privacy Policy please click here<<a href="https://www.aqr.com/Privacy-Policy" rel="noreferrer" target="_blank">https://www.aqr.com/Privacy-Policy</a>>.<br>
<br>
This communication is for informational purposes only. It is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction. All information contained in this communication is
not warranted as to completeness or accuracy and is subject to change without notice. Any comments or statements made in this communication do not necessarily reflect those of AQR Capital Management, LLC and its affiliates.<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
</div>
</blockquote>
</div>
</body>
</html>