sipXecs News, Tips and Equipment

Building CentOS 5.7 images for Amazon EC2

2011-11-24T05:55:00.005-05:00

I'm new to Amazon's EC2 platform so I've struggled a bit with it as of late. I had been using Rightscale's excellent AMI's (thanks guys). But I ran into some performance issues with conference bridges and sipXecs (openUC) when running in AWS space. According to the Freeswitch mailing list performance should have been better than what I was experiencing (any sort of media services in a virtual environment will at some point experience some quality issues, don't expect otherwise).

To help get to the root of the problem I wanted to find a bare-bones CentOS 5.7 64 bit AMI that was EBS (elastic block storage - storage maintained when server is rebooted) vs. Instance storage (storage that's reset to the base image each time the server is shutdown or rebooted). Well, guess what... there wasn't a public AMI available. This left me with two options, try to adapt somebody else's image or build my own. Not being the trust-in-others type I went for the second option.

I'll spare the trials and tribulations of what I went through and get to exactly how I now build my images...

Overview

The basic process I am using is as follows:

Build a CentOS 5.7 64 bit machine to create the image on (this machine is not imaged, just used to build the image on).
Use modified Rightscale build script to build image and load to AWS
Register AMI in AWS.
Convert Instance Store AMI to EBS backed AMI

If anybody has a better process, by all means please let me know...

Build a CentOS 5.7 64 bit machine

So it simplifies the process a bit to build on the same machine type as you want to end up with. I build a box on my Citrix Xen Server with 4 processors, 4 GB of RAM and 60 GB of hard disk (you'll want enough storage because we're going to build a 10 GB image plus have a bunch of files on the disk for a short period).

In building the server I select CentOS 5 as my image type, use a CentOS DVD in the system drive but when the install procedure begins select install from http server. Josh Patten had a bit of an explanation about this in a sipXecs blog post. Also this information on using the CentOS netinstall feature is handy.

I build the box with base packages only (de-select Workstation and any other packages).

Once the machine boots, install ruby:

yum install ruby

Rightscale Script

So Rightscale has creating these Amazon AMI's down to a science. It's fully scripted and installs customization tweaks for their cloud platform. Luckily they posted their scripts (although I haven't been able to find the version 4 scripts). The original blog post I found referenced version 1 scripts and I worked on this a bit but I later found version 3 scripts:

These of course still loaded all of the Rightscale tweaks but it was a great place to start.

The script I ended up with is here: http://www.box.com/s/rmt719k3ayjf2yzk5sst

In the CentOS system you created initially create a folder called /root/ec2:

cd /root

mkdir ec2

Then copy the script into that folder:

cd /root/ec2

wget http://www.box.com/s/rmt719k3ayjf2yzk5sst

Make the script executable:

chmod +x Cent5.0X86_64V3.0.0InstallMWP.sh

Execute the script:

./Cent5.0X86_64V3.0.0InstallMWP.sh

Then the following menu will appear:

Hello root, Lets get started installing CentOS 5

........................................

Please Select an Option or 8 to quit

0) Set EC2 Variables

1) Create and Mount Image

2) Installing Yum and CentOS 5 Base

3) Install Additional Packages

4) Install RightScale Customizations

5) Clean Up FileSystem and Bundle Image

6) Upload Image

7) Clean Up

8) Quit

Now it's a matter of stepping through each of the menu options.

Step 0 - Set EC2 Variables

Please Select an Option or 4 to quit

1) Set EC2 Variables

2) Show EC2 Variables

3) Set AWS Bucket, Image Name & Kernel ID

4) Back

You'll need to set the following EC2 Variables:

EC2_CERT=/root/ec2/etc/cert-xxxxxxxxxxxxxxxx.pem

EC2_HOME=/root/ec2

EC2_PRIVATE_KEY=/root/ec2/etc/pk-xxxxxxxxxxxxxxx.pem

The EC2 Cert and Private key are the X.509 Certificates associated with your AWS account (I've assumed you're already signed up). In the upper right of your AWS console, click on your account name drop down and select 'Security Credentials'. On that page under Access Credentials you'll see a tab for X.509 Certficates, click on that and Create a new certificate if you don't have one already then download the cert-xxxxxxxxxxxxxx.pem file and the private key pk-xxxxxxxxxxx.pem file and save to your computer. Then on your CentOS machine, create a /root/ec2/etc folder and copy the files there (I use winscp because I'm a Windows weenie sometimes).

AWS_ACCOUNT_NUMBER=

Your AWS Account Number is displayed on the 'Security Credentials' page in the upper right.

AWS_ACCESS_KEY_ID=

AWS_SECRET_ACCESS_KEY=

Your AWS Access Key ID and Secret Access Key are also available on the Security Credentials page under Access Credentials.

Now set the AWS Bucket, Image Name and Kernel ID

AWS_BUCKET=

The AWS Bucket is an S3 bucket that you must create in your AWS console prior to running this script. It is simply the bucket name.

IMAGE_NAME=

The Image Name is simply what you'd like to name this image. I avoided any noon alpha-numeric characters.

KERNEL_ID=

The Kernel ID is the Amazon Kernel ID you'd like to use. Amazon only allows certain kernels on their infrastructure.

The Current Amazon Kernel ID's for CentOS 5 (2.6.18) as of this writing are:

US region32-bit:

aki-f5c1219c

ari-dbc121b2

64-bit:

aki-e5c1218c

ari-e3c1218a

EU region

32-bit:

aki-966a41e2

ari-906a41e4

64-bit:

aki-aa6a41de

ari-946a41e0

I used aki-e5c1218c for my system.

Once you have all of the variables and bucket info setup, simply run down through menu options 1 - 8 to complete the process.

Register AMI in AWS

Ok, now with the Image fully loaded to your S3 bucket, now we can register the AMI in your AWS console. In the EC2 tab of the console, click on 'AMIs' under the Images section of the left side menu.

Now click on the 'Register New AMI' button. A Register Image dialog box will appear asking for the AMI Manifest Path. In the box enter your bucketname/imagename.manifest.xml

So if your bucket name was centos and your image name was centos5764 you would enter:

centos/centos5764.manifest.xml

Next, click the 'Register' button and your new AMI will be displayed as an AMI owned by you. It will be an Instance store at this point however.

Convert Instance Store AMI to EBS backed AMI

There are a number of web sites the explain how to create an EBS backed AMI from an Instance Store AMI. The process is basically to create a new EBS Volume, mount it in a running version of your instance store system, copy the instance store drive to the EBS volume.

I found a handy web site for doing this. The guys at CloudyScripts created a bunch of tools for working with cloud systems. The tool for making this conversion is here: https://cloudyscripts.com/tool/show/2

You'll want to create a separate Access Key (on the AWS Security Credentials Page) for your AWS account that you can disable / delete and a temporary account key pair (in your EC2 management console, left side menu at the bottom) that the service can use to log in to the AMI while it is working. Also, in the security group that you specify in the tool, you'll need to temporarily allow SSH access inbound from anywhere (0.0.0.0/0).

Conclusion

Hopefully I haven't left anything out. I went through quite a few days of pain to figure all of this out and end up with something that was very reusable by me. I hope others will find it useful!

Installing sipXecs / openUC from USB Memory Stick

2011-03-22T16:45:00.005-04:00

Jim Canfield of EMStar Solutions posted this in the sipx-users mailing list and I thought I'd share it...

1. Download<>the Fedora *liveusb-creator-x-x.zip* and extract to your PC
2. Download<>the *sipxecs-4.2.1-100820-x86_64.iso*
3. Navigate to the *liveusb-creator-x-x* folder and click * liveusb-creator.exe* to launch the tool

1. Under *Use existing Live CD*, browse to where you saved the *
sipxecs-4.2.1-100820-x86_64.iso* and select it
2. Set the *Target Device* to point to your USB flash drive
3. Click *Create Live USB* to begin the creation process

ISSUES:

- SEE COMMENTS BELOW - sipxecs setup script is looking specifically for device CDROM during the install. I suggest using the CentOS netinstall method described in the comments section if you don't have a CDROM (or DVD for new 4.4 install).

- Depending on your bios, you may have to edit you grub.conf after install because the install will assume the USB drive is (hd0,0) and the primary hard drive is (hd1,0). To fix, simply edit on boot fail the first time, then edit grub.conf manually once booted. Press ENTER on the fail message, at the menu screen press 'e' and then 'e' again to edit the 'root(hd1,0)' line and change to 'root (hd0,0)', Press ENTER and then press 'b' to boot. After you boot, to edit grub.conf 'nano -w /etc/grub.conf' and change all references to 'root (hd1,0)' to 'root (hd0,0)'.

- Windows 7 users must "run as administrator"

Java memory problems...

2011-03-19T08:33:00.001-04:00

Java virtual machine running out of memory in sipXecs / openUC?

This will manafest itself as Configuration pages not loading and other
Java related errors...

Edit /usr/bin/sipxconfig.sh and change a command that looks like this:

exec $JavaCmd \
$SystemProps \
$JavaOpts \
$TrustStoreOpts \
$KeyStoreOpts \
-classpath "$Classpath" \
....

to one that looks like this:

exec $JavaCmd \
-XX:MaxPermSize=128M \
-Xmx1024m \
$SystemProps \
$JavaOpts \
$TrustStoreOpts \
$KeyStoreOpts \
-classpath "$Classpath" \
.....

That should increase the fixed memory allocated in the JVM...

Exchange 2010 / Lync

2011-02-08T16:41:00.002-05:00

/rant

How did Microsoft manage to make Exchange 2010 such a pig?

Can you tell I'm a little frustrated? I'm trying to with with Exchange 2010 Unified Messaging to test out interoperability with sipXecs/openUC. I've been at this now for well over 2 days worth of time between installing and trying to get systems upgraded.

I'm trying to install Exchange 2010 SP1 at this point and the requirements are killing me. First off, stupid IE won't download anything on the 2008 R2 server so I have chrome installed on that box which works but you can't directly click on the pre-reqs in Microsoft's setup tool. The links don't come up correctly in Chrome. Ok, so I type them all in and get to the last one... Microsoft Speech Server Runtime. The freaking thing won't install because something else is in place. Well, MS in their wisdom upgraded another component that replaced this piece but the server needs this one installed in order to do the upgrade.

What happened to the nice simple days of Exchange 5.5? Man they've gone down hill with this product since then. At least 5.5 was manageable (even if the database puked once in a while, it was easy to fix).

I'm sure Lync will be much better to work with.... gack! No praise coming from this camp.

/rant

Disaster Recovery & sipXecs

2011-01-20T14:11:00.002-05:00

Wrote a blog post on Disaster Recovery & sipXecs over at sipFoundry.org web site...

Disaster Recovery & sipXecs

Capture Traffic on your sipXecs Server

2010-05-12T07:48:00.002-04:00

Just a quick note on capturing traffic directly on the sipXecs PBX.

Personally, I'm a network guy and I like to use Wireshark to evaluate network traffic. Sure SipViewer shows you what the PBX is seeing for SIP traffic, but I want it all...

To capture directly on the sipXecs server, use the following command:

sipXecs: tcpdump -n -s 0 -i any -w filename.cap

Then you'll be able to use winscp to copy the file to your PC and open it with wireshark.

sipXecs... the alternate build...

2010-05-01T07:04:00.002-04:00

It's kind of like an alternate movie ending, or director's cut...

Douglas Hubler (aka, Lazyboy, aka, lazieburd) (Douglas' Blog) a long time sipXecs contributor and former Pingtel employee is offering up an alternative sipXecs build to the community build offered by Avaya.

Douglas has added back in some code that had 'disappeared' before 4.2.0 was released. Also, he is setting up build shop on the open suse build service which makes it easier to build for many other distributions. There are also some more builds for other distros than supported by the Avaya builds.

Basically the process to start using the new builds is to change your sipxecs.repo file and do a 'yum update'.

Backup your system and get the backup off of the PBX (the update does an in-place upgrade, but you can never be too safe).

Comment out the existing sipXecs yum info with '#' in front of each line.

Add the following lines to the bottom of the repo:

[home_sipfoundry]

name=SIPfoundry sipXecs IP PBX Unified Communications Solution (CentOS_5)

type=rpm-md

baseurl=http://download.opensuse.org/repositories/home:/sipfoundry/CentOS_5/

gpgcheck=0

gpgkey=http://download.opensuse.org/repositories/home:/sipfoundry/CentOS_5/repodata/repomd.xml.key

enabled=1

The above is for a CentOS_5 distro... (ie., the sipXecs install from ISO). Check out http://download.opensuse.org/repositories/home:/sipfoundry for other builds. Builds are currently available in 32 bit and 64 bit for:

CentOS 5
Fedora 10, 11, 12
RHEL 5
Suse Enterprise Linux 10 & 11
openSuse 11.1 and 11.2

Once you have your .repo file setup properly, run a 'yum clean' and then a 'yum update' from the command line.

I rebooted my sipXecs box after the yum completed.

Big thanks to Douglas for the hard work he's putting in!

A little off-topic... ok, a lot off topic...

2010-04-25T13:16:00.003-04:00

Just finished re-writing a configuration I built for a Proxy server.

Proxy servers are a great way to tighten up your network security. Point all your users at the proxy server in their browser settings and allow only the proxy server to go out to the Internet in your inside interface firewall rules.

This example is built on CentOS 5.4 and utilizes squid, dansguardian, clamav and webmin. Daily downloads of malware and various blacklists are included.

Here's the build doc: SetupProxyServer.pdf

Very low overhead for this box. I built it on a single processor virtual machine with 512 MB RAM and a 10 GB virtual drive.

Some things I'd like to add include logging of userid to make logging a little nicer than just by IP address.

sipXecs 4.0.4 to 4.2.0 upgrade notes and impressions

2010-04-16T06:45:00.001-04:00

Upgrade Notes:

Installed 4.0.4 fresh from ISO (dev build 4.1.7 on my test system was trashed).
Added a user / tested.
Fixed sipxecs.repo file replacing all '5.2' mirror references with '5'. (see previous blog post)
Ran YUM update from command line (265 items to be installed / upgraded, 374 MB worth).
Rebooted server.
A little patience was required on my relatively slow lab machine (800 MHz, Xeon w/1GB of RAM)... web services came up after a couple minutes.

Impressions:

New login screen is a little bland w/o graphic image.

Background job listed as failed on first login (problem listed as File replication: sipxpage.properties).
Created a paging group and re-sent the server profile and paging seemed to come up properly.

New GUI is better? different? I wish the tabs were starting from the left instead of centered.

Domain aliases of system IP address and host name are added automatically.

New user portal is nicer. Can't seem to import GMail contacts.

Branch concept in place... need to test.

Still no live attendant option as part of Auto Attendant.

Special Mode Auto Attendant configuration prominently available on Auto Attendants page.

GUI is much more sluggish on my dog of a test system (800 MHz, Xeon w/1GB of RAM)... time to upgrade I guess :-)

NTP server config in GUI is a nice add.

Alarm SNMP MIB now available on Alarm Configuration screen.

Alarm groups are now available for different notifications to different users (now including SMS and SNMP notification methods)

Much more but that's all I have time for at the moment...

Upgrading from sipXecs 4.0.4 to 4.2.0

2010-04-16T04:37:00.002-04:00

One note that went across the mailing list (in case you missed it...).

Important Note on Upgrading:

There is a bug in 4.0.4 that breaks upgrading from the web user

interface. Specifically, it disables to use of the CentOS

repositories during the upgrade, which causes some prerequisites

to be unavailable, which makes the upgrade fail. The bug has

been fixed in 4.2 (and a bunch of other improvements to the

upgrade interface have been made too).

The best way to avoid the problem is to just do the upgrade from

the command line. Modify your yum repository configuration to

point to the repo where the 4.2 version is, and run 'yum

update', and when it's done, reboot.

I'm working on testing a 4.0.4 to 4.2.0 upgrade now.

sipXecs Version 4.2 just released!

2010-04-15T20:38:00.001-04:00

Al Campbell posted today on the sipfoundry web site that version 4.2 is officially released!

http://www.sipfoundry.org/component/content/article/54-sipxecs42.html

Using sipviewer on your PC for Windows guys

2010-03-30T04:41:00.002-04:00

Get the following applications loaded to your PC:

Putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)
WinSCP (http://winscp.net/eng/download.php)
Java (http://www.java.com)
sipviewer (http://sipxecssw.org/temp/sipXecs/sipviewer-install.jar)

Run Putty and WinSCP programs and login to your sipXecs server with each. Open sipviewer on your local machine.

With Putty go to /var/log/sipxpbx.

cd /var/log/sipxpbx

Navigate to the same folder in WinSCP.

In the Putty window, run the following command if you want to clear your log files:

logrotate -f /etc/logrotate.d/sipxchange

Try placing the call that you are attempting to diagnose.

From Putty run the following command to create a single log file with all of the sipXecs log files merged into one file:

merge-logs

In WinSCP, refresh the right window directory display. In that directory will be the new file named merged.xml that was just created.

With WinSCP copy the merged.xml file to your local hard drive and open it with sipviewer. You should be able to see a diagram of what your call did (according to sipXecs).

For more information on sipviewer see the Wiki page: http://wiki.sipfoundry.org/display/xecsuserV4r0/Display+SIP+message+flow+using+Sipviewer

Mount USB Key for sipXecs Backups

2009-12-29T07:17:00.005-05:00

Ok, so you don't want to bother setting up an FTP server to store backups of your sipXecs system. Here's how to mount a USB Key to your backup folder.

Most USB keys will setup SCSI drive device (in my case it was /dev/sda1). Plug in a USB key and check out the /var/log/messages file to see what device was created.

You'll want to get a little program installed on your system called 'scsiadd'. This allows you to remove USB scsi devices from the system without causing them damage. It's available here: http://llg.cubic.org/tools/

The following assumes you are logged into the system as root...

Add required packages:
yum install lsscsi

If you don't have development tools on your sipXecs system yet, add them:
yum install gcc gcc-c++ kernel-devel

Download, build and install scsiadd:
cd $HOME
mkdir scsiadd
cd scsiadd
wget http://llg.cubic.org/tools/scsiadd-1.97.tar.gz
tar -xf scsiadd-1.97.tar.gz
cd scsiadd-1.97
./configure
make install

Command line options:
scsiadd 1.97 - add and remove devices from the scsi subsystem
---------------------------------------------------------------
syntax: scsiadd {-a|-r}
scsiadd {-a|-r}
scsiadd {-a|-r}
scsiadd {-a|-r}
scsiadd [-i maxid] -s
scsiadd [-i maxid] -s
scsiadd -p
parameters not given are assumed 0
-a: add a device (default if no command given)
-r: remove device
-s: scan for devices
-p: print scsi status
-h: print this help message
-i: maximum SCSI ID which is scanned

Here's a good blog article on using scsiadd: http://blog.shadypixel.com/safely-removing-external-drives-in-linux/

Essentially, to remove a scsi device while the system is running, first find the device with lsscsi and then use scsiadd -r to remove it...

[root@sipx scsiadd-1.97]# lsscsi
[3:0:0:0] disk CBM USB 2.0 5.00 /dev/sdb
[root@sipx scsiadd-1.97]# scsiadd -r 3
could not remove device 0 0 3 0 : No such device or address
[root@sipx scsiadd-1.97]# scsiadd -r 3 0 0 0
[root@sipx scsiadd-1.97]#

Ok, now let's get to making the USB work:

Convert your USB drive from FAT16 or whatever it is to ext3:

mkfs.ext3 /dev/sda1

Modify /etc/fstab:

nano -w /etc/fstab

Add the following line at the bottom:

/dev/sda1 /var/sipxdata/backup vfat auto,user,rw,sync 0 0

Test your fstab file now:

mount -a

And check to see that it is mounted:

mount

Change ownership on backup folder:

chown -R sipxchange:sipxchange /var/sipxdata/backup

Perform a test backup from the GUI.

How to fix the yum repos file for sipXecs 4.0.4

2009-12-28T21:53:00.000-05:00

Edit the /etc/yum.repos.d/sipxecs.repo

nano -w /etc/yum.repos.d/sipxecs.repo

on all the lines that begin with mirrorlist and baseurl change the 5.2 to be just 5.

Here's the resulting sipxecs.repo file.

[centos-5.2-base]
name=CentOS-5.2 - Base
mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/5/os/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#released updates
[centos-5.2-updates]
name=CentOS-5.2 - Updates
mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=updates
#baseurl=http://mirror.centos.org/centos/5/updates/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#packages used/produced in the build but not released
[centos-5.2-addons]
name=CentOS-5.2 - Addons
mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=addons
#baseurl=http://mirror.centos.org/centos/5/addons/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that may be useful
[centos-5.2-extras]
name=CentOS-5.2 - Extras
mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=extras
#baseurl=http://mirror.centos.org/centos/5/extras/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that extend functionality of existing packages
[centos-5.2-centosplus]
name=CentOS-5.2 - Plus
mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=centosplus
#baseurl=http://mirror.centos.org/centos/5/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

[sipxecs-stable]
name=SIPfoundry sipXecs pbx - latest stable version
baseurl=http://sipxecs.sipfoundry.org/pub/sipXecs/LatestStable/CentOS/5/$basearch/RPM
gpgcheck=0

DNS concepts for sipXecs

2009-10-05T07:41:00.002-04:00

Published a new whitepaper on dealing with DNS and sipXecs.

http://sipx-wiki.calivia.com/images/0/0b/SipXecsDNSConcepts.pdf

Let me know if there are any glaring problems. I'll likely add other scenarios as time goes along. If you have a specific need please let me know.

Updated document on Installing OpenSBC on Vyatta 5

2009-09-25T18:04:00.002-04:00

Sorry for the delay all but a project finally forced my hand on this. Here's a link to the updated document for installing OpenSBC on Vyatta 5.0.

Install OpenSBC on Vyatta 5.0

The original document was built with Vyatta 5.0 beta and there were some changes with the final release of Vyatta 5.0.

An Interview with... Me!

2009-09-22T06:14:00.001-04:00

Packt Publishing just released an interview they did with me.

http://authors.packtpub.com/content/interview-michael-picher

Setting up DNS for Internet Calling

2009-09-14T06:07:00.004-04:00

Somebody questioned how I was handling DNS inside and outside my network so I figured I'd document what I'm doing for remote users and Internet dialing.

I have the following setup at home right now. This same configuration would apply for a small business that doesn't have static IP's (I'm sure you could cherry pick info here if you do have static IP's too).

My home sip server is in SIP domain xyzcompany.com (just one i made up while i was writing the book)

I'm on a DSL connection at home with a non-static IP.

My sipxecs.info domain is hosted at GoDaddy.com

DynDNS

My firewall (pfSense) updates sipxecs.dyndns.info with my current IP address

GoDaddy

sipx.sipxecs.info is a CNAME pointing to sipxecs.dyndns.info
_sip._udp.sipxecs.info priority 0, weight 0, port 5060 points to sipx.sipxecs.info

DNS on PBX

Copied existing xyzcompany.com.zone to sipxecs.info.zone in /var/named
Modified sipxecs.info.zone file and replaced all references to 'xyzcompany.com' with 'sipxecs.info'.
Edit /etc/named.conf and duplicated info from xyzcompany.com domain for new sipxecs.info domain.
Restart DNS and make sure you can ping / dig new domain.

sipXecs Configuration Server

Buy my book :-)
Add alias to domain (Domain is under System menu) for sipxecs.info.
Restart all services that request restart.
Add the SIP Trunking services to the SIP Server (Click on server in System->Servers).
Restart all services that request restart.
Enable Internet Dialing and set your internal IP range (under System menu), set the SBC to be sipXbridge-1. Added *.sipxecs.info as an Intranet Domain.
Enable NAT Traversal and let sipXecs know it is behind a NAT (Click on Internet Calling in System then NAT is on LEFT menu).

Internal Workstations / Phones

Determine where you are pointing for DNS.
If you are pointing at the PBX machine then no worries.
If you are pointing at some other DNS server you'll need to figure out how to get that machine to point to the PBX to resolve your domain (in my case all resolves for the sipxecs.info domain can be redirected by pfSense to the PBX and I point to pfSense for my DNS server).

pfSense Firewall Configuration

Turn off automatic NAT so NAT port translation is static (See earlier Blog Entry)
For the following NAT entries, allow pfSense to also create the required firewall rules.
Add NAT entry for External IP port 5060 udp to sipXecs internal IP port 5060 udp.
Add NAT entry for External IP port 5080 udp to sipXecs internal IP port 5080 udp. (only needed if you do SIP Trunks).
Add NAT entry for External IP port range 30000-31000 udp to sipXecs internal IP port range starting at 30000.

So, what does all this do?

Allows my roaming users and other users on the internet to find my sipXecs server via an external IP address that is forwarded in to my PBX.

Allows my internal users to find my sipXecs via an internal IP address.

Allows anybody on the internet to reach me at myextension 'at' sipxecs 'dot' info.

Also, if you add an alias onto your sipXecs user extension that is equal to your e-mail alias, now users can phone you (with url dialing in their softphone) or email you at exactly the same address... voila!

sipXecs 4.0.2 Released

2009-09-12T02:37:00.002-04:00

sipXecs version 4.0.2 was officially released yesterday. There were a bunch of bug fixes (23) and some minor improvements (5) and one feature added.

Release Notes

Of note is the new Skype for SIP ITSP Template. The sipXecs development team has tested Skype for SIP but Skype has not made this generally available. When Skype finally gets this rolling it will be an easy add to our systems. I'll try to post it in the blog as soon as I get my account. I'm signed up for the Beta program and just waiting on Skype.

I tested the 4.0.2 upgrade on one of my sandbox systems and all went well. I'll test it on another any only post if I run into problems.

There is one change in the 4.0.2 upgrade procedure that everybody should note (documented on the upgrade page (http://sipx-wiki.calivia.com/index.php/SipXecs_4.0.2_Upgrade):

The local domain bind zone is overwritten; if: You are using the system as a DNS server, and You have made any manual changes to the zone file then before doing the upgrade, you should add the following lines to the beginning of the file /etc/named.conf:

// WARNING: Name server configuration is a sipX automatically generated file.
// Contents may be overwritten unless you change the mode to "Manual".
// Available modes:
// "Master" - Master name server (on primary server).
// "Slave" - Slave named server (on distributed server).
// "Caching" - Caching only name server.
// "Manual" - Blocks future automatic updates.
// DNS_MODE="Manual"

this will protect your changes from any automated updates by sipXconfig.

Backup your /etc/named.conf file as well as any DNS zone files you may have tweaked (if you installed from ISO they are in /var/named/xxxxx.zone).

pfSense with Freeswitch for SIP Trunks to sipXecs

2009-09-05T16:39:00.004-04:00

Ok, so here's a bit of a new twist. I was toying with the thought of trying to get OpenSBC running on pfSense firewall. Long story short, I couldn't get the developer version of pfSense running in a virtual on my machine so I decided to give the FreeSwitch pfSense package a go.

What do you know... I actually got it going as a bridge pretty easily. So I figured I'd document it for others who follow...

The purpose of this exercise was to have pfSense with FreeSwitch register to my Gizmo account and forward calls in to sipXecs. This is just a starting point but shows great promise as a way to front-end a sipXecs server.

1. In pfSense install the FreeSwitch package (System -> Packages - FreeSwitch) (I picked the Dev version to run on my pfSense 1.2.3 rc1 install).

2. Once installed, go to Services -> FreeSwitch.

3. Click on the Gateways tab and then the + sign on the right to add a new gateway.

4. At the top of the Gateway Setup form is a handy hyperlink to examples for different SIP Providers. Here is my Gizmo configuration:

Gateway: gizmo
Username: 1747xxxxxxx
Password: xxxxxxxx
From-user: 1747xxxxxxx
From-domain: proxy01.sipphone.com
Proxy: proxy01.sipphone.com
Expire-seconds: 3600
Register: true
Retry-seconds: 3600
Caller-id-in-from: false
Enabled: true
Gateway Description: Gateway to gizmo account

5. Click the Save button at the bottom of the page.

6. Click on the Public tab at the top of the page.

7. Click on the + sign over on the right hand side of the Public table to create a new extension.

8. Create the following extension:

Extension Name: sipXecs
Enabled: true
Order: 000
Description: Transfer to internal spiXecs Server

9. Add the following conditions and actions at the bottom of this page (hit the + sign to add each one).

Tag: condition
Type: destination_number
Data: 1747xxxxxxx
Order: 000

Tag: action
Type: bridge
Data: sofia/lan/100@ip.addr.of.sipxecs (what sipXecs extension to route it to)
Order: 001

10. On the Status tab, click the 'reloadxml' button. You should see your gateway in the 'sofia status' section as 'REGED' if you have done things properly.

11. Create 2 firewall rules in pfSense (Firewall -> Rules):

Action: Pass
Interface: WAN
Protocol: UDP
Source: any
Destination: WAN address
Destination port range: 5080

Action: Pass
Interface: WAN
Protocol: UDP
Source: any
Destination: WAN address
Destination port range: 10000 – 35000 (* - I haven’t tried narrowing this down…)

12. Try dialing your Gizmo number and your sipXecs server should answer the call!

Tip, if you get a Google Voice account you can make it ring inbound to your Gizmo account and have free inbound calling.

Tale of an old sipXecs install...

2009-08-19T06:48:00.003-04:00

So, I had a customer with an old sipXecs install... version 3.8 on Fedora 6 to be exact (I've still got one out there with 3.4 but that will be a complete re-do).

My plan was to upgrade in-place to 3.10.2, get a backup, install 3.10.2 on CentOS from ISO, do a restore, upgrade to 3.10.3 in place, upgrade to 4.0.1 in-place and see where I sat.

This would have been much easier if Yum was cooperating. Seems as though Yum from Fedora Core 6 had some issues. It would bomb with a header error on the large sipX files.

So smart me figures I'd just go update Yum... not so easy. All of the Fedora files are now archived and my .repo files were out of date. Thus begins the odyssey... I had to do a little mixing and matching of Fedora 6 and 7 yum repos to resolve all of the dependency issues.

I'm posting my .repo files here in hopes of helping somebody else... Keep in mind that I'm no Linux expert and there might be a much simpler way to make this work!

fedora-core.repo
[core]
name=Fedora Core $releasever - $basearch
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/core/$releasever/$basearch/os/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/$basearch/os/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-$releasever&arch=$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

[core-debuginfo]
name=Fedora Core $releasever - $basearch - Debug
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/$basearch/debug/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-debug-$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

[core-source]
name=Fedora Core $releasever - Source
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/source/SRPMS/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-source-$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

fedora-core6.repo
[core6]
name=Fedora Core $releasever - $basearch
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/core/6/i386/os/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/$basearch/os/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-$releasever&arch=$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

[core6-debuginfo]
name=Fedora Core $releasever - $basearch - Debug
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/$basearch/debug/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-debug-$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

[core6-source]
name=Fedora Core $releasever - Source
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/source/SRPMS/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=core-source-$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora file:///etc/pki/rpm-gpg/RPM-GPG-KEY

fedora-everything.repo
[everything]
name=Fedora Everything $releasever - $basearch
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/releases/7/Everything/i386/os/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/extras/$releasever/$basearch/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-$releasever&arch=$basearch
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=0

[everything-debuginfo]
name=Fedora Everything $releasever - $basearch - Debug
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/releases/7/Everything/i386/debug/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-debug-$releasever&arch=$basearch
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=0

[everything-source]
name=Fedora Everything $releasever - Source
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/releases/7/Everything/source/SRPMS/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-source-$releasever&arch=$basearch
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=0

fedora-extras.repo
[extras]
name=Fedora Extras $releasever - $basearch
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/extras/6/i386/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/extras/$releasever/$basearch/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-$releasever&arch=$basearch
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=1

[extras-debuginfo]
name=Fedora Extras $releasever - $basearch - Debug
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/extras/$releasever/$basearch/debug/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-debug-$releasever&arch=$basearch
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=1

[extras-source]
name=Fedora Extras $releasever - Source
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/extras/$releasever/SRPMS/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=extras-source-$releasever&arch=$basearch
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=1

fedora-updates.repo
[updates]
name=Fedora Core $releasever - $basearch - Updates
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/updates/7/i386/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/updates/$releasever/$basearch/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-fc$releasever&arch=$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

[updates-debuginfo]
name=Fedora Core $releasever - $basearch - Updates - Debug
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/updates/$releasever/$basearch/debug/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-debug-fc$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

[updates-source]
name=Fedora Core $releasever - Updates Source
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/updates/7/SRPMS/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-source-fc$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

fedora-updates6.repo
[updates6]
name=Fedora Core 6 $releasever - $basearch - Updates
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/core/updates/6/i386/
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/updates/$releasever/$basearch/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-fc$releasever&arch=$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

[updates-debuginfo]
name=Fedora Core $releasever - $basearch - Updates - Debug
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/updates/$releasever/$basearch/debug/
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-debug-fc$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

[updates-source]
name=Fedora Core $releasever - Updates Source
baseurl=http://archive.fedoraproject.org/pub/archive/fedora/linux/updates/7/SRPMS/
#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-source-fc$releasever&arch=$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

Once you have all the repos in place in the /etc/yum.repos.d folder you'll still need to remove a couple packages that complain...

rpm -e authconfig firstboot-tui-1.4.23-1.noarch

And then you should be able to do a:

yum update yum

After that completes yum should work properly, remove the repos from the /etc/yum.repos.d folder and create sipxecs-stable-fc.repo (nano /etc/yum.repos.d/sipxecs-stable-fc.repo) with the following information:

[sipxecs-stable]
name=SIPfoundry sipXecs pbx - latest stable version
baseurl=http://sipxecssw.org/pub/sipXecs/3.10.3/FC/6/i386/RPM/
gpgcheck=0
gpgkey=https://secure2.pingtel.com/RPM-GPG-KEY-pingtel
enabled=1

SIP Trunking Gotcha with pfsense & m0n0wall

2009-08-07T07:37:00.002-04:00

Jonathan Peterson from Ontra ran into some trouble with SIP Trunking and sipXecs that was actually being introduced by pfsense & m0n0wall.

I thought I'd just document it here for future reference (mine as well as others)...

It seems that some firewalls will randomize outbound ports. This can mess up certain protocols such as SIP. With SIP, if the source port for the REGISTER does not match the source port for the INVITE you may get an SIP error 403.

The solution is to statically map the ports for the NAT traversal. The solution to the problem is documented here.

Thanks to Jonathan for putting in the hard work!

sipXecs Version 4.2 Roadmap

2009-08-07T07:04:00.002-04:00

Development is pushing on with sipXecs despite the turmoil going on with Nortel. Looks like the group working on the SCS / sipXecs project will end up heading to Avaya if all goes well. I'm hoping that Avaya can keep the ball rolling with this project as it has really become one of the top options out there for Open Source systems.

For version 4.2 the developers are working on a bunch of new or enhanced features. The complete list is here, but this is my take on the additions:

Openfire Integration - This will bring the ability to sync your availability with many different IM systems. I'm not a huge IM user so to me this will probably have limited usefulness.

Dimdim Integration - Dimdim is an open source web conferencing solution. Due to the distributed nature of many sipXecs installations, the integration of Dimdim project with sipXecs will be a great benefit to many.

New Voicemail System - I think the current Voicemail System works pretty well in most cases. It does fall down a bit with the dial by name directory so hopefully this will be addressed.

Branch Office Survivable Solution - I'm on the fence about this one. I've been setting up most customers with individual PBX's at each site. This simplifies the installation quite a bit. Each time I have to upgrade a HA installation I dread it because something always breaks. It sounds great to have a single system that is managed centrally, but in my book simplicity breeds reliability.

Bridged Line Appearances - This will be great for those small offices that just need to know "What line is that call on?".

Auto Attendant Improvements - Again, the AA is pretty good now. It just lacks the ability to have a live operator during the day. I usually end up routing calls to a Phantom user and have it do some time of day routing for how I want the calls to actually ring.

Call Detail Record Improvements - These can only get better. What is in the system now is not overly usable to an administrator.

Improved User Portal - The current user portal is pretty drab. While that is fine for administering the system, the user needs a little more pizazz. Here are some ideas that are being tossed around. Maybe users will actually use the portal if it is a little slicker!

Enhanced Directory Services - How about making it sync with Outlook or my Google Contacts? That would be pretty sweet.

Multiple ACD Servers in a Cluster - I wish they would just rip out the present ACD and put in one that works. The current ACD is junk mostly because it doesn't like it when you transfer calls out of Queue. Who cares about multiple ACD servers that still are useless.

E911 Notification by SMS - This will be a cool add-on to the detection of 911 dialing. When a user dials 911 in addition to being able to send an e-mail (as the system does now), the system will be able to send an SMS message.

Microsoft Kills Response Point

2009-07-17T08:28:00.003-04:00

A blog post at TMC by Tom Keating is indicating that Response Point is dead.

Personally I never thought this product would go much of anywhere... although I must admit I was keeping a weary eye on it. If MS makes up their mind to go after something it can do it. I think MS realized that the customers who might deploy this type of solution don't want to put more reliance in MS products... And the vendors who might choose to install this type of product might not understand it and do poor jobs implementing it.

I think it had some potential but Microsoft has a real muddied message here with Response Point and Office Communications Server. Personally, I'm not thinking that OCS is going to go anywhere either.