Administering CUBE and analog gateways

What it is for

Under Gateways, EasyUC manages Cisco IOS devices via SSH. Analog GWs shows the VG gateways from the CUCM with registration status and number of active calls. CUBEs shows the Cisco Unified Border Elements that you enter in EasyUC yourself. EasyUC logs in to the device via SSH, reads its state with show commands and runs configuration commands on request.

On analog gateways you see voice ports with signaling and state, read the configuration of a port including the associated dial peers and apply stored config sets. On both device types you read network interfaces, system version, certificates and active calls and can end a call.

For CUBEs there is also the Debug capture. EasyUC switches on “debug ccsip messages” and “debug voip dialpeer inout” on the CUBE, receives the output via syslog and stores it for call diagnostics. A watchdog monitors the CUBE and switches off by itself on overload.

The Cisco CUBE is a separate device in the network. It is not the Teams SBC integrated in EasyUC.

Prerequisites

• License module cucm. The Gateways menu appears with ROLE_APP_GATEWAYS and at least one section permission.
• Viewing analog GWs: ROLE_APP_GATEWAYS_ANALOG. Changing, testing, switching ports, applying configuration: additionally ROLE_APP_GATEWAYS_ANALOG_EDIT.
• Viewing CUBEs: ROLE_APP_GATEWAYS_CUBE. Changing, testing, ending a call, switching the debug capture: additionally ROLE_APP_GATEWAYS_CUBE_EDIT.
• Administrators (ROLE_APP_ADMIN, ROLE_OWNER, ROLE_ADMIN, ROLE_SUPER_ADMIN) have all gateway permissions. ROLE_APP_TEMPLATE alone is not sufficient.
• Changing default credentials, creating a CUBE and setting the host or SSH port of a gateway: edit permissions for both areas (ROLE_APP_GATEWAYS_ANALOG_EDIT and ROLE_APP_GATEWAYS_CUBE_EDIT).
• The gateway can be reached from the EasyUC appliance via SSH. The SSH port is 22 by default.
• An SSH user on the gateway with the permissions for the desired action. If the device requires an enable password, it must be stored.
• Analog gateways are created in the CUCM. EasyUC reads the list from the active CUCM connection.
• For the debug capture: the CUBE reaches the EasyUC appliance via syslog (UDP). The syslog target is entered under Storage & syslog or on the CUBE.
• The SSH credentials for Details (SSH) of the CUCM nodes on the home page are a separate setting with the roles ROLE_APP_CUCM_NODE_DETAILS and ROLE_APP_CUCM_NODE_DETAILS_EDIT. They do not apply to gateways.

Step by step: storing default credentials for gateways

1. Open EasyUC Cisco → Gateways → Analog GWs.
2. Click Default Credentials at the top right. The Default SSH Credentials area opens. The sets apply to every gateway without its own credentials, for analog gateways and for CUBEs.
3. In the first set, enter Set (a name), Username, Password, if required Enable Password, and the Port.
4. For further logins, click Add credential set. The trash icon removes a set.
5. Order the sets so that the most common one is at the top. When connecting, EasyUC tries the sets from top to bottom.
6. Click Save.
7. Click Test on a gateway. EasyUC tries the sets one after the other and remembers the one that works. Its name appears in the Credentials column.

Step by step: giving an analog gateway its own host and login

1. Open Gateways → Analog GWs. The list shows Model, Name, IP Address, Description, Status, Active Calls and Credentials.
2. In the row of the gateway, click Credentials. The form Credentials for <Name> opens.
3. Under IP Address / Host, enter the address at which EasyUC reaches the gateway via SSH. This is necessary if the CUCM does not report an IP address.
4. Enter differing values for Username, SSH Port, Password and Enable Password. An empty field uses the default value.
5. Click Save. The Credentials column now shows Custom.
6. Click Test to check the login.
7. To remove the gateway's own credentials again, click the reset icon in the row and confirm Are you sure?.

Step by step: adding a Cisco CUBE

1. Open EasyUC Cisco → Gateways → CUBEs. The page is called CUBEs (SBC).
2. Click Create. The form Add Cisco CUBE (SBC) opens.
3. Enter Name and IP Address. Both are mandatory fields.
4. Check the SSH Port. The default is 22.
5. Enter Username (mandatory), Password and, if required, the Enable Password.
6. Click Save. The CUBE appears in the list with Name, IP Address, Username, SSH Port and the Debug column.
7. Click Open Ports or the row. The detail page opens with the Network tab.
8. Click Test Connection. The result appears below the header.

Step by step: checking and switching voice ports

1. Open Gateways → Analog GWs and click Ports on the gateway. The button appears as soon as an IP address is known or the gateway has its own entry.
2. The detail page opens the Voice Ports tab. The table shows Port, Signaling, Admin, Operational, Status and Active Call.
3. Click Show Config on a port. EasyUC reads the running configuration of the voice port and shows Associated dial-peer(s) below it.
4. Click Shutdown to switch a port off administratively, or Bring Up to switch it on again.
5. Click Refresh to read the port list again.

Step by step: creating a config set and applying it to a port

1. Open the detail page of an analog gateway and the Voice Ports tab.
2. Click Config Sets and then Add config set.
3. Assign a Name.
4. Under Voice-Port commands, enter the IOS commands for the voice port. Use {PORT} as the placeholder for the port.
5. Under Dial-Peer commands, enter the commands for the dial peer. Your own placeholders such as {DIALPEER} or {DN} are allowed.
6. Decide on the Replace mode. For a new set it is switched on.
7. Click Save on the set.
8. On the target port, click Apply Config and select the set.
9. Fill in the requested variables. Where possible, EasyUC prefills them from the current port configuration. {PORT} is set automatically.
10. Click Apply. EasyUC runs the commands on the gateway and shows the output under Applied.
11. Click Show Config again and compare the result.

Step by step: checking network, certificates and active calls

1. Open the detail page of an analog gateway or CUBE.
2. Select the Network tab. Under Interfaces you find Interface, IP Address, Status and Protocol. Below that, System / Version shows the version output of the device.
3. Select the Certificates tab. For each certificate you see Subject, Issuer, Serial, Valid from and Valid until. Raw CLI output shows the unmodified output.
4. Select the Active Calls tab. The table shows Call-ID, Direction, Number, Codec, Duration and Remote IP.
5. To disconnect a call, click End Call and confirm the prompt. The call is disconnected immediately.
6. In the Analog GWs list, a click on the Active Calls cell updates the number for this gateway.

Step by step: defining storage and syslog for the CUBE debug capture

1. Open Gateways → CUBEs and click Storage & syslog. The setting applies to the debug capture of all CUBEs.
2. Under Syslog targets (IP addresses of EasyUC), enter one IPv4 address per line at which the CUBEs reach the appliance. The first one applies to CUBEs without their own target.
3. Check the Syslog port (UDP). It is the receiving port of EasyUC and the destination port on the CUBE and must match the port opened in the cluster.
4. Define the Storage cap (MB). When it is reached, the receiver pauses. Nothing is deleted automatically.
5. Check Maximum lines per second per CUBE and decide on Do not store SIP OPTIONS (keepalives).
6. Click Save. If you change targets or port while CUBEs are switched on, EasyUC names the affected CUBEs with the commands. Saving takes place only after your confirmation.

Step by step: switching on and evaluating the debug capture on a CUBE

1. Open Gateways → CUBEs and click Debug capture on the CUBE. Alternatively, open the Debug tab on the detail page and click Settings.
2. Click Preflight check. EasyUC reads the CUBE with show commands only and assesses credentials, reachability, privilege level, logging, CPU, memory, clock and syslog target. An item marked Blocked prevents switching on.
3. Switch on Debug capture.
4. Check the selection under Debugs. Both debugs are the default. At least one must be selected.
5. Select the Retention: 1 day, 7 days, 30 days or Unlimited.
6. Leave Apply logging baseline active if EasyUC is to set timestamps, sequence numbers, “no logging console”, syslog target and “logging trap debugging” itself.
7. If required, enter a separate Syslog target (IP address of EasyUC). If empty, the global target applies.
8. Read the box Please read before switching on and the command preview EasyUC runs these commands:. Tick the box at I have read the effects. EasyUC may run the commands shown on the CUBE.
9. Click Save. Under Steps run you see which commands were successful. EasyUC does not run “write memory”.
10. On the detail page, open the Debug tab. Check live queries the status on the CUBE. The groups Debugs, Logging, CUBE, Receiver and Storage show the state.
11. Open the Capture tab. Select the period, search for a phone number or Call-ID and open a call. The Captured call page shows SIP ladder and Records. Raw text exports the redacted records.
12. After troubleshooting, switch the capture off again in the Settings. In an emergency, click Emergency stop on the Debug tab and confirm with Pull emergency stop.

Fields and options

Check the result and troubleshoot

• Success for SSH access: Test or Test Connection returns a result without errors and the tabs of the detail page fill.
• “No VG gateways found in this CUCM.”: the active CUCM connection contains no VG gateways. Check the selected connection.
• “No gateways configured yet.”: no CUBE has been entered under CUBEs yet.
• The Ports button is missing or gray: no IP address is known for the gateway or it has no entry of its own yet. A user with both gateway edit permissions must create the entry via Credentials.
• The Active Calls column shows a warning sign: the query has failed. The tooltip names the reason or “Query failed”. This says nothing about the state of the device.
• “No ports found.” or “No dial-peer references this port.”: the gateway reports no voice ports, or the port is not entered in any dial peer.
• “No saved config sets yet – create one under “Config Sets” above.”: save a set first.
• Default credentials affect all gateways without their own credentials. A change never affects just a single device.
• “The preflight check blocks switching on – nothing was changed on the CUBE.”: fix the blocking items of the preflight check, for example “logging console” set to debugging or a missing syslog target.
• “No syslog target – please enter one.”: enter an address under Storage & syslog or on the CUBE.
• “The CUBE cannot be reached via SSH.” or “No credentials for the CUBE.”: check address, SSH port and credentials.
• “The storage cap is reached: the receiver is paused, new lines are discarded.”: shorten the retention or raise the cap under Storage & syslog.
• “Switched off automatically at …” with a reason, for example “CPU load too high”: the watchdog has switched off. Clarify the cause and switch on again after a new preflight check.
• After deleting a CUBE with a running capture, a note may appear that the debugs on the device could not be stopped completely. In that case, check “show debugging” and the logging configuration on the CUBE manually.
• The entire debug output including phone numbers is stored. Authorization headers and SRTP keys are redacted before storing.