Mike Stacy's Blog

ICE/STUN/TURN with Polycom HDX and Office Communications Server 2007 R2

There is an interesting OCS-related update coming to the Polycom HDX line of videoconference systems with the 2.6.1 release scheduled this quarter.  First, a quick overview in case you’re not familiar with the HDX product set.  The most common use case for an HDX is as a room-based video conferencing system, such as the scenario depicted in the image below.

There are also other HDX systems designed for personal use and special use cases, like medical carts:

HDX 4000	HDX Medical Cart

   

There are a number of characteristics that all HDX systems share.  First, they can all act as native OCS endpoints.  Specifically they can register to OCS, publish presence, show an OCS contact list (including presence and groups), and make/receive video (and audio) calls to other OCS clients.  Second, all HDX systems are high definition (at least 720p and up to 1080p depending on the model).  This high definition experience includes OCS-based calling scenarios between HDXs, meaning that I can call from my personal HDX 4000 at home to a conference room in one of our offices and receive an high definition experience, even though OCS doesn’t have native support the for the H.264 codec being used in the call.

All that being said, the HDX is already a great complement to a Microsoft UC environment.  However, Polycom is strengthening the capability of the HDX line by adding OCS-compatible ICE/STUN/TURN to the software.

If you’re not already familiar with ICE, STUN, or TURN, there are plenty of resources on the internet that go into detail about these protocols.  The quick overview is that these methodologies are used in conjunction with SIP to enable media (such as audio and video) to traverse firewall/NAT devices.  If you’ve ever participated in a call to or from a Communicator client that was logged on via an OCS Edge server (from the internet without VPN), then you’ve used these protocols.

So what does adding ICE/STUN/TURN to HDX enable?  First, it extends HDX calling scenarios to remote users rather than just Communicator clients within the organization or connected over VPN.  Second, it enables HDXs outside the organization to register to OCS and participate in audio/video calls just like a Communicator client.  Usually these external systems will be HDX 4000s, but it would also be useful for organizations that have internet-connected branch offices or in the medical industry when a consult with an external physician is required.  Third, it enables federated scenarios whereby calls can be made between HDXs or MOC/HDX in separate organizations.

Because this connectivity only relies on the OCS Edge server, no additional infrastructure is required to support this capability.  This is consistent with the rest of Polycom’s OCS integration strategy, which leverages customers’ existing OCS architecture rather than requiring additional gateways or other hardware.

Stay tuned for periodic Microsoft UC updates from Polycom in the quarters ahead – the integration between these two is only going to get stronger.

Microsoft releases XMPP Gateway for OCS 2007 R2, enables free AOL connectivity

Today Microsoft released the XMPP gateway for OCS R2 (press release, download page).  This gateway enables connectivity to systems such as Google Talk and Jabber.  Simultaneously Microsoft has also announced that Public IM Connectivity (PIC) with AOL is now included in the licensing price, along with Windows Live, which was announced a few months ago.  Folks that need connectivity to Yahoo! will still require licensing but the license will be half price.

This significantly opens the connectivity options for OCS customers.  Albert Kooiman gives an architectural overview in a Channel9 interview (skip to the 4:00 mark to see the whiteboard architecture session).  More details forthcoming once I have a chance to install and configure the gateway…

Periodic Audio Drops during a call through the A/V Edge

This week I hit an issue at a customer where audio would drop periodically for external users.  The call would stay up but audio would disappear.  This happened in 2 situations…

- The user was in a quiet environment and was silently listening to the other caller

- The user was on mute

We could replicate this at will by calling a line with hold music and staying on mute.  It made no difference Initially we thought that silence detection of some sort was coming into play.  However, Netmon traces indicated that the A/V Edge was sending RTP packets the entire time but on the client side we would see large gaps in inbound RTP packets, each time lasting about 15 seconds.

After doing some research on this customer’s firewall, a Checkpoint, I noticed that Checkpoint includes a default UDP “Virtual Session Timeout” setting of 40 seconds.  Comparing this to the client side netmon I noticed that the first audio drop occurred 40 seconds into the call.  In fact, thinking back to the testing the audio drops would occur when the call timer in Communicator was around 37-38 seconds (the timer doesn’t start until the audio stream is fully up and running).  Following this we would get a break of ~15 seconds and then the audio would drop again around 1:34 into the call, or about 40 seconds after the audio was reestablished.  Now that I knew the default Checking timeout was 40 seconds it seemed unlikely that this was a coincidence.

The max setting for the Virtual Session Timeout is 3600 seconds on this customer’s version of Checkpoint, but you don’t want to needlessly crank this setting to the max.  There are implications on firewall performance based on the number of open sessions.  In our case we set this to 300 seconds:

 

This can be set as a global setting or on a per service basis.  We only changed it on the specific service that was created for OCS so as not to impact other firewall services.

OCS 2007 R2 Edge Management Tools

Now that more folks have their hands on OCS 2007 R2 a common question I’ve heard is “How do I manage my Edge server?”  If you’ve installed R2 one thing you’ve noticed is that Microsoft no longer automatically installs the OCS admin tools on any server role.  You must install these from the amd64/Setup folder on the OCS R2 media by running admintools.msi.  This applies to the Edge server as well.  Once that is complete you can find the Edge server tools right were they were before under Computer Management.  In Windows 2008 you can no longer access this by right clicking “Computer” and selecting “Manage” from the start menu (this brings up the new Server Manager interface now).  Instead you have to launch Computer Management from Administrative Tool or using Start/Run/compmgmt.msc.