Push Notifications Deployment for Cisco Jabber on iPhone ... · CHAPTER 3 PushNotifications(CloudDeployment) 25 CloudDeploymentswithWebExMessenger 25 CHAPTER 4 CertificatesandPerformanceMonitoring

Push Notifications Deployment for Cisco Jabber on iPhone and iPadwith Cisco Unified Communications ManagerFirst Published: 2017-12-04

Last Modified: 2021-05-25

Americas HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706USAhttp://www.cisco.comTel: 408 526-4000

800 553-NETS (6387)Fax: 408 527-0883

© 2020 Cisco Systems, Inc. All rights reserved.

C O N T E N T S

Preface 1C H A P T E R 1

Purpose of this Document 1

Apple Push Notification Service Upgrade Requirements 1

Push Notifications (On-Premises Deployments) 3C H A P T E R 2

Push Notifications Overview 3

Push Notifications High Availability for IM and Presence 7

Proxy Support for Cloud Connection 8

Push Notifications Prerequisites 11

Push Notifications Configuration Task Flow 13

Synchronize Licenses 14

Open Ports for Push Notifications 15

Enable Push Notifications 16

Enable Push Notifications High Availability 17

Configure OAuth Refresh Logins 18

Configure OAuth Refresh Logins in Unified Communications Manager 19

Confirm OAuth Configuration in Expressway 20

Enable OAuth on Unity Connection 20

Refresh Settings from Expressway 21

Configure Troubleshooting Options 21

Push Notifications Troubleshooting 22

Upgrades from 11.5(1)SU2 with Push Notifications Enabled 23

Update Refresh Token Manually 24

Push Notifications Interactions and Restrictions 25

Push Notifications (Cloud Deployment) 27C H A P T E R 3

Push Notifications Deployment for Cisco Jabber on iPhone and iPad with Cisco Unified Communications Manageriii

Cloud Deployments with WebEx Messenger 27

Certificates and Performance Monitoring 29C H A P T E R 4

Certificates for Cloud Connection 29

Push Notifications Alarms 31

Performance Counters for Push Notifications 33

Push Notifications Deployment for Cisco Jabber on iPhone and iPad with Cisco Unified Communications Manageriv

Contents

C H A P T E R 1Preface

• Purpose of this Document, on page 1• Apple Push Notification Service Upgrade Requirements, on page 1

Purpose of this DocumentThis document describes how to configure Push Notifications for Cisco Unified Communications Managerand the IM and Presence Service. With Push Notifications, your deployment uses Apple's cloud-based PushNotification service to push voice calls, video calls, and instant message notifications to Cisco Jabber foriPhone and iPad clients that are running in the background. You must enable Push Notifications to maintainpersistent communication with Cisco Jabber for iPhone and iPad.

This document describes how to enable Push Notifications for the following deployment types:

• Push Notifications (On-Premises Deployments)—For on-premises deployments of Cisco UnifiedCommunications Manager and IM and Presence Service, refer to Chapter 2 for instructions on how toenable Push Notifications. This includes deployments where Cisco Jabber for iPhone and iPad clientsregister to an on-premises Cisco Unified Communications Manager and IM and Presence Service viaExpressway's Mobile and Remote Access (MRA) feature.

• Push Notifications (Cloud Deployment)—For cloud deployments with WebEx Messenger, refer toChapter 3 for deployment requirements.

Apple Push Notification Service Upgrade RequirementsIn alignment with Apple's changes to the iOS notification architecture, Cisco Jabber is implementing ApplePush Notification support for notifications. We highly recommend that customers upgrade Cisco UnifiedCommunicationsManager, IM and Presence Service, Cisco Expressway, and Cisco Jabber as soon as possible.Failure to upgrade in a timely manner will result in loss of voice, video, and IM notifications for Jabber iOSusers.

For up to date support information that is related to Push Notifications with iOS 13, including upgraderequirements, refer to Apple Push Notification Service Updates at https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cucm/push_notifications/APNSUpdates.pdf.

Push Notifications Deployment for Cisco Jabber on iPhone and iPad with Cisco Unified Communications Manager1

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cucm/push_notifications/APNSUpdates.pdf

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cucm/push_notifications/APNSUpdates.pdf


PrefaceApple Push Notification Service Upgrade Requirements

C H A P T E R 2Push Notifications (On-Premises Deployments)

• Push Notifications Overview, on page 3• Push Notifications Prerequisites, on page 11• Push Notifications Configuration Task Flow, on page 13• Push Notifications Troubleshooting, on page 22• Push Notifications Interactions and Restrictions, on page 25

Push Notifications OverviewWhen your cluster is enabled for Push Notifications, Cisco Unified Communications Manager and the IMand Presence Service use Apple’s cloud-based Push Notification service to push notifications for voice andvideo calls, instant messages, and Cisco WebEx invitations to Cisco Jabber for iPhone and iPad clients thatare running in suspended mode (also known as background mode). Push Notifications allows your system tomaintain a persistent communication with Cisco Jabber. Push Notifications is required both for Cisco Jabberfor iPhone and iPad clients that connect from within the enterprise network, and for clients that register to anon-premise deployment via Expressway's Mobile and Remote Access (MRA) feature.

How Push Notifications Work

At startup, Cisco Jabber clients that are installed on iPhone and iPad devices register to Cisco UnifiedCommunications Manager, the IM and Presence Service and to the Apple cloud. With MRA deployments,the Cisco Jabber for iPhone or iPad client registers to the on-premises servers via Expressway. So long as theJabber client remains in foreground mode, Cisco Unified Communications Manager and the IM and PresenceService can send calls and instant messages to the Jabber client directly.

However, once the Cisco Jabber client moves to suspended mode (for example, to maintain battery life), thestandard communication channel is unavailable, preventing Cisco Unified Communications Manager and IMand Presence Service from communicating directly with the client. Push Notifications provides another channelto reach the Jabber client via the Cisco and Apple clouds.

Cisco Jabber is considered to be running in suspended mode if any of the following conditions are true:

• the Cisco Jabber application is running off-screen (i.e., in the background)

• the iPhone or iPad is locked

• the iPhone or iPad screen is turned off

Note


Figure 1: Push Notifications Architecture for Cisco Jabber for iPhone and iPad

The above diagram displays what happens when Cisco Jabber for iPhone and iPad clients run in the backgroundor are stopped. The figure illustrates: (1) an MRA deployment where the Cisco Jabber client that connectswith an on-premises Cisco Unified Communications Manager and IM and Presence Service deployment viaExpressway, and (2) a Cisco Jabber for iPhone or iPad client that connects directly to the on-premisesdeployment from within the enterprise network.

With iOS 13, voice calls and messages use separate Push Notifications channels ('VoIP' and 'Message') toreach a client that is running in background mode. However, the general flow is the same for both channels.

Note

How Push Notifications Work in iOS 13

From Jabber 12.9 release, all new iOS applications and updates will be built using iOS 13. Under iOS 13,Apple processes Push Notifications for suspended applications differently than it did with iOS 12:

• Push Notifications under iOS 13 are delivered using a "VoIP" channel for calls and a separate "Message"channel for messaging. This is in contrast to iOS 12 where all Push Notifications traffic are deliveredusing the same channel.

• The iOS client, upon receiving the notification, launches CallKit immediately to indicate an incomingcall.

• Push Notifications "VoIP" traffic includes caller identity information (Display Name, Number), whichthe client uses to populate the CallerID field in CallKit.

• Push Notifications of type "VoIP" are considered high priority and are delivered without delay.

The following image provides a breakdown of what happens when a VoIP Push Notification is sent underiOS13. For a matching image with iOS 12, see the Appendix.


Push Notifications (On-Premises Deployments)Push Notifications Overview

Figure 2: VoIP Push Notification Behaviour when sent under iOS13

Push Notifications Behavior for Cisco Jabber on iPhone and iPad

The following table describes the behavior under iOS 12 and iOS 13 for Cisco Jabber iOS clients that areregistered to Cisco Unified Communications Manager and the IM and Presence Service.

Jabber is running on an iOS13 DeviceJabber is running on an iOS12 DeviceJabber client isrunning in...

The behaviour is the same as with iOS12.Standard communication channels are used forvoice, video, IM and Presence:

• For on-premises mobile clients, CiscoUnified Communications Manager and IMand Presence Service send the call or instantmessage to the Jabber client directly.

• ForMRA clients, the call or IM notificationis sent to the Jabber client via Expressway.

For voice and video calls, the PushNotification is still sent via the PushNotification channel, but Cisco Jabberuses the standard channel.

Note

Foreground Mode



Jabber is running on an iOS13 DeviceJabber is running on an iOS12 DeviceJabber client isrunning in...

With iOS13, call traffic and message traffic issplit into separate Push Notifications channels: a'VoIP' channel for calls, and a "Message" channelfor messaging.

Voice or Video Calls

Standard communication channel is unavailable.Unified CM uses Push Notifications 'VoIP'channel.

Upon receiving the VoIP notification, Jabberlaunches CallKit with Caller ID.

This behavior holds for Cisco Jabber iOS clientsand for Cisco Webex Teams.

Messaging

Standard communication channel is unavailable.IM and Presence Service uses Push Notifications'Message' channel.

1. IM and Presence Service sends the IMnotification to the Push REST service in theCisco cloud, which forwards the notificationto the Apple cloud.

2. The Apple cloud pushes the IM notificationto the Jabber client.

3. When the user clicks the notification, Jabbermoves to foreground mode. Jabber resumesthe session with the IM and Presence Serviceand downloads the message.

While Jabber is in suspended mode,the user Presence displays as Away.

Note

Voice or Video Calls

Standard communication channel is unavailable.Unified CM uses the Push Notifications channel.

Upon receiving the notification, the Jabber clientre-enters foreground mode automatically, and theclient rings.

Messaging

Standard communication channel is unavailable.IM and Presence Service uses the PushNotifications channel to send IM notifications asfollows:

1. IM and Presence Service sends the IMnotification to the Push REST service in theCisco cloud, which forwards the notificationto the Apple cloud.

2. The Apple cloud pushes the IM notificationto the Jabber client and a notification appearson the Jabber client.

3. When the user clicks the notification, theJabber client moves back the foreground. TheJabber client resumes the session with theIM and Presence Service and downloads theinstant message.

While the Cisco Jabber client is insuspended mode, the user's Presencestatus displays as Away.

Note

Suspended Mode(Backgroundmode)

Comparison of Push Notification Calling Experience for Cisco Jabber client with iOS13 APNS changes

The following table describes the user experience behavior when the Client is upgraded and Server not upgradedor the Client is not upgraded and the Server is Upgraded.

Unified Communications Manager 11.5(1)SU8Cisco Jabber Version

Unlocked ScreenLocked Screen

• Client gets the push notification

• CallKit view along with CallerIDof the caller is displayed in theincoming call notification

• Cisco Jabber app launches when auser answers the call with callerdetails (Caller Name and Caller ID)


• Callkit view along with CallerIDof the caller is displayed on thescreen

• Users can answer or reject callfrom the Callkit without unlockingthe device

12.9



Unified Communications Manager 11.5(1)SU8Cisco Jabber Version


• The notification causes CiscoJabber app to register and users seecall information in it

• Users can answer the call directlyfrom the app


• The notification causes CiscoJabber app to register and users seecall information in it

• Users can answer the call fromlocked device

12.8 and lower

There is no change in user experience behavior for message push notifications.Note

Push Notifications High Availability for IM and PresencePush Notifications High Availability provides failover and redundancy for Push Notifications-enabled IMand Presence sessions for Cisco Jabber on iPhone and iPad clients. With this feature, the IM and PresenceService saves the IM session in the local in-memory database (IMDB), which gets replicated automaticallyto the in-memory database on the subcluster backup node. This ensures that the backup node has the sessioninformation and can take over the session without user action from the Jabber user.

IM History

When Push Notifications High Availability is configured, the Jabber user does not lose the chat history whenfailover occurs.

Unread Message Queue when Jabber is in Suspended Mode

For Push Notifications-enabled IM sessions, when a Cisco Jabber for iPhone or iPad client moves intosuspended mode, the IM and Presence Service sends Push Notifications to the Jabber client, but stops sendingunread instant messages, Presence updates, and other XMPP stanzas (for example, chat room invites). Instead,these messages are queued on the local server until the Jabber client clicks on a Push Notification, or reentersforeground mode.

There is a limitation involving the unread message queue for Push Notifications-enabled IM sessions whereCisco Jabber is in suspended mode. In some failover use cases, the unread message queue is lost. See"Redundancy and Failover Use Cases" for a description of when this occurs.

Redundancy and Failover Use Cases

The following use cases are covered by this feature:

• Node failure (automatic failover)—If a node fails suddenly, the backup node takes over the IM sessionand Push Notifications continue to be sent to the Jabber user, this time from the backup node. Jabberusers can continue working without any user action or loss of IM history. However, the unread messagesthat were queued on the failed server while Jabber was in suspended mode, and which had not yet beensent to the Jabber client, are lost.

• Node shutdown (manual failover)—If a node is shut down gracefully, the backup node takes over theIM session and Push Notifications continue to be sent, this time from the backup node. Jabber users can


Push Notifications (On-Premises Deployments)Push Notifications High Availability for IM and Presence

continue working without any user action or loss of IM history. The unread messages that were queuedon the original node, and which were waiting to be sent to the Jabber client, are lost temporarily whenthe backup node takes over. However, after the original node comes back up, and the user falls back tothe original node, that message queue is retrieved, and is sent to the user.

• Cisco XCP Router crash—If the Cisco XCP Router crashes suddenly, once the router comes back up,the node resumes the session and continues to send Push Notifications. The IM history is maintained,and Jabber users can continue working without any user action. However, the unread messages that werequeued on the server prior to the router crash, and which had not yet been sent to the Jabber client, arelost

• Cisco XCP Router restarts—If an administrator restarts the Cisco XCP Router, such as may happen aftera configuration update, both the IM history and the unread message queue are maintained. Once therouter restarts, the IM and Presence Service resumes sending Push Notifications. The unread messagequeue is sent once the Jabber client logs in again.

For voice and video calls, redundancy and failover is handled by Cisco Unified Communications ManagerGroups.

Note

Supported Re-login Rate during HA Event for Push v3 Enabled Devices

This sections provides you the information about how to calculate the client relogin rate during HA event forPUSH v3 enabled devices depending on your deployment need.

This procedure assumes that you have 15,000 OVA and it is distributed in the following order:

• 2,000 users registered to the IM and Presence Publisher node are Push v3 enabled,

• 5,500 users registered to IM and Presence Publisher node directly are not Push enabled, and

• 7,500 users registered to IM and Presence Subscriber node directly and are not Push enabled.

In case of High Availability event, the supported failover rate should be 4 users/sec, or lower. You can achievethis rate using the following measurement:

If the client re-login lower limit is set to 200, then the client re-login upper limit should be set to 2075, so thatthe re-login rate is calculated in the following manner:

7500/(2075-200)= 4 users/sec

• The above result is measured for UCS-C220-M4S Intel Xeon CPU E5-2660 [email protected] platform.

• This calculation is applicable to IM and Presence Release 11.5 deployments only.

Note

Proxy Support for Cloud ConnectionFor some deployments, you may need to use a proxy server to connect to the Cisco cloud. This is particularlytrue if your on-premise deployment is behind a company firewall that does not allow direct access to the cloud.


Push Notifications (On-Premises Deployments)Proxy Support for Cloud Connection

Cisco Unified Communications Manager supports the Cisco Web Security Appliance as an HTTPS proxyserver. However, you can use any HTTP or HTTPS proxy server that supports one of the below call flows.Note that if you decide to use an HTTP proxy with authentication enabled, Cisco recommends that youconfigure digest authentication for the proxy server for credential security.

Supported Call Flow for HTTPS Proxy



Supported Call Flow for HTTP Proxy

Capacity Requirements for Proxy Servers

Use the Proxy Server Capacity Calculator for Push Notifications to estimate capacities that your Proxy Servermust be able to handle. Enter the information that applies to your deployment and the calculator outputs thenumber of transactions that your HTTP(S) Proxy server must be able to handle for Push Notificationsdeployments.

DNS Requirements for Proxy Servers

• For the Cisco Unified Communications Manager to proxy server connection, if you use a FQDN addressfor the proxy server, DNS is used to connect to the proxy server. If the proxy server FQDN resolves tomultiple IP addresses, Unified CommunicationsManager tries the first IP address and waits two secondsbefore moving on to the second address.

• After sending a push notification, Cisco Unified Communications Manager waits five seconds for aconfirmation before trying the second address.

• For the proxy server to Cisco cloud connection, Cisco recommends that you configure the proxy serverwith a low failover rate in order to speed up the failover process for connection failures.

• If you are deploying the Cisco Web Security Appliance, the FQDN must map to the WSA’s virtual IPaddress.



https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cucm/push_notifications/APNS_Proxy_scale.xlsm

The default Time To Live (TTL) for proxy IP addresses is one hour. As a result, if an IP address is changed,it may take up to one hour for that change to be available for DNS requests.

Note

Push Notifications PrerequisitesThe following prerequisites are required to onboard Push Notifications for on-premises deployments:

• DNS must be configured in both Cisco Unified Communications Manager and IM and Presence Serviceand must be able to resolve externally routable addresses.

• Connectivitymust be enabled fromCiscoUnified CommunicationsManager and IM and Presence Serviceover port 443 for the following connections to the Cisco cloud:

• Fusion Onboarding Service at fos-a.wbx2.com—Cisco Unified Communications Managerconnects to this service for Push Notification subscription requests. Cisco Unified CommunicationsManager communicates with the FusionOnboarding Service (FOS) in order to provision a CommonIdentity (CI) machine account.

• Push REST service at push.webexconnect.com—Cisco Unified Communications Managerand IM and Presence Service connect to this service to send Push Notifications.

• Common Identity service at idbroker.webex.com—Cisco Unified CommunicationsManagerand IM and Presence Service authenticates to this service prior to sending a Push Notification.

• Make sure that your underlying iOS network allows traffic from the Apple Push Notifications Servicecoming in from the 17.0.0.0/8 range. This is necessary so that access control lists don't block PushNotifications that are sent from the Apple cloud to Cisco Jabber clients.

• The Multiple Device Messaging feature must be configured on the IM and Presence Service. For details,see theConfiguration and Administration of IM and Presence Service on Cisco Unified CommunicationsManager at http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-installation-and-configuration-guides-list.html.

• The Stream Management feature must be configured on the IM and Presence Service. For details, seethe Release Notes for Cisco Unified Communications Manager Release 10.5(2) and IM and PresenceService Release 10.5(2b) at https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/10_5_2/CUCM_BK_C6A7E384_00_cucm-release-notes-1052/CUCM_BK_C6A7E384_00_cucm-release-notes-1052_chapter_010.html.

• Push Notifications is dependent on the following network services, which were introduced with Release11.5(1)SU3. You can confirm that these services are running in the Control Center - Network Serviceswindow of Cisco Unified Serviceability. Both services are enabled by default.

• Cisco Push Notification Service—handles the Push Notification for voice and video calls.

• Cisco Management Agent Service—handles the sending of troubleshooting information relatedto Push Notifications.

• The iOS device must be configured to allow notifications from the Cisco Jabber application.


Push Notifications (On-Premises Deployments)Push Notifications Prerequisites

http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-installation-and-configuration-guides-list.html

http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-installation-and-configuration-guides-list.html

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/10_5_2/CUCM_BK_C6A7E384_00_cucm-release-notes-1052/CUCM_BK_C6A7E384_00_cucm-release-notes-1052_chapter_010.html



• If you require a proxy server for the cloud connection, refer to Proxy Support for Cloud Connection, onpage 8 for HTTP(S) proxy support.

Licensing Prerequisites

• For 11.5(x) releases, Cisco Unified Communications Manager uses Cisco Prime License Manager forlicensing. As part of the Push Notifications onboarding process, you will be required to synchronizelicenses in Prime License Manager.

• For 12.x and later releases, Cisco Unified Communications Manager uses Smart Licensing for licensing.Smart Licensing must be configured before you onboard the cluster for Push Notifications. For detailson how to setup Cisco Unified Communications Manager for Smart Licensing, see the "Smart SoftwareLicensing" chapter of the System Configuration Guide for Cisco Unified Communications Manager.

• FromRelease 12.5(x) and onward, Push Notifications is not supported when Smart Licensing is configuredwith Specific License Reservation. The Specific License Reservation feature must be disabled for PushNotifications to work.

Certificate Prerequisites

• IfMRA is configured, youmust exchange certificates between Cisco Unified CommunicationsManager,the IM and Presence Service, and Cisco Expressway-C. Cisco recommends that you use CA-signedcertificates with the same CA for each system. In this case:

• Install the CA root certificate chain on each system (for Cisco Unified Communications Managerand the IM and Presence Service install the certificate chain to the tomcat-trust store).

• For Cisco Unified Communications Manager, issue a CSR to request CA-signed tomcat and CiscoCallManager certificates.

• For the IM and Presence Service, issue a CSR to request CA-signed tomcat certificates.

If you use different CAs, you must install each CA's root certificate chain onCisco Unified Communications Manager, IM and Presence Service, andExpressway-C.

Note

You can also use self-signed certificates for both Cisco Unified CommunicationsManager and the IM and Presence Service. In this case, you must upload ontoExpressway-C the tomcat and Cisco CallManager certificates for Cisco UnifiedCommunications Manager and a tomcat certificate for the IM and PresenceService.

Note

Minimum Release Requirements for Push Notifications Solution

Make sure that your deployment meets the minimum release requirements for Push Notifications as per thebelow table:


Push Notifications (On-Premises Deployments)Push Notifications Prerequisites

Table 1: Minimum Release Requirements for Push Notifications Solution

Minimum Release Requirements with iOS13Minimum Release Requirements with iOS12

• Cisco Unified Communications Manager11.5(1)SU8 for 11.x releases, 12.5(1)SU3 for12.x releases

• IM and Presence Service 11.5(1)SU8 for 11.xreleases, 12.5(1)SU3 for 12.x releases

• Cisco Jabber 12.9

• Cisco Expressway 12.6 (if IM&P is deployed)

• Cisco Unified Communications Manager11.5(1)SU4 or higher (Recommended:11.5(1)SU7 or 12.5(1)SU2)

• IM and Presence Service 11.5(1)SU4 or higher(Recommended: 11.5(1)SU7 or 12.5(1)SU2)

• Cisco Jabber 11.9 (Recommended: 12.8)

• Cisco ExpresswayX8.10.1—ifMRA is deployed(Recommended: X12.6)

Push Notifications Configuration Task FlowComplete the following tasks to configure Cisco Unified Communications Manager and IM and PresenceService clusters for Push Notifications. This configuration is required for Cisco Jabber clients that are installedon iPhone and iPad devices.

Before you begin

Push Notifications Prerequisites, on page 11

Procedure

PurposeCommand or Action

Release 11.5(1)SUx only. Synchronize yoursystem licensing in Cisco Prime License

Synchronize Licenses, on page 14Step 1

Manager. This is a mandatory task regardlessof whether you have added new licenses.

You can skip this task for CiscoUnified Communications ManagerRelease 12.0(1) and higher as PrimeLicense Manager is replaced bySmart Licensing.

Note

Open the ports that are required for PushNotifications.

Open Ports for Push Notifications, on page 15Step 2

Onboard the Cisco Unified CommunicationsManager and IM and Presence Service clustersfor Push Notifications.

Enable Push Notifications, on page 16Step 3

For IM and Presence deployments, enable PushNotifications High Availability.

Enable Push Notifications High Availability,on page 17

Step 4


Push Notifications (On-Premises Deployments)Push Notifications Configuration Task Flow


Complete this set of tasks to deploy OAuthRefresh Logins for faster Cisco Jabber logins.

Configure OAuth Refresh Logins, on page 18Step 5

On the Expressway-C, refresh your UnifiedCommunications Manager servers to allow for

Refresh Settings from Expressway, on page 21Step 6

a resync of the Authz certificate. After you aredone, restart the Expressway-C.

Configure troubleshooting parameters thatdetermine how often Cisco Unified

Configure Troubleshooting Options, on page21

Step 7

Communications Manager sends PushNotifications alarms to the Cisco Cloud, andfor which alarm severities.

For Mobile and Remote Access (MRA) deployments with Cisco Expressway, see the Mobile and RemoteAccess via Cisco Expressway Deployment Guide at the below URL for information about Push Notificationswith Expressway.

http://www.cisco.com/c/en/us/support/unified-communications/expressway-series/products-installation-and-configuration-guides-list.html

Note

Synchronize LicensesFor 11.5(1)SU systems, use this procedure in Cisco Prime License Manager to synchronize your systemlicensing. This is a mandatory task to enable Push Notifications for on-premises deployments, regardless ofwhether you have updated your licensing.

This task is required for Cisco Unified Communications Manager 11.5(1)SU releases only. You can skip thistask for Release 12.0(1) and higher as Smart Licensing replaces Prime License Manager.

Note

Before you begin

For details on licensing, including procedures for adding licenses or product instances, refer to the CiscoPrime License Manager User Guide:

http://www.cisco.com/c/en/us/support/cloud-systems-management/prime-license-manager/products-user-guide-list.html

Procedure

Step 1 In Cisco Prime License Manager, select the Product Instance tab.Step 2 Click Synchronize Licenses.


Push Notifications (On-Premises Deployments)Synchronize Licenses





What to do next

Open Ports for Push Notifications, on page 15

Open Ports for Push NotificationsMake sure that the following outbound ports are open in Cisco Unified Communications Manager, IM andPresence Service, and in your Cisco Jabber for iPhone or iPad client.

Table 2: Port Requirements for Push Notifications

Port DescriptionPortToFrom

HTTPS-based communications:

• Subscription requests from CiscoUnified CommunicationsManager toFusion Onboarding Service atfos-a.wbx2.com from publishernode

• Authentication requests to CommonIdentity Service atidbroker.webex.com

• Push notifications to the Push RESTservice atpush.webexconnect.com

This port should be open for all clusternodes.

443/TCPCisco cloudCisco UnifiedCommunicationsManager / IM andPresence Service

Communications with Apple PushNotification service.

5223/TCPApple cloud(17.0.0.0/8)*

Cisco Jabber client(when operatingbehind a firewall)

Fallback port for 5223 if wi-fi is used.443/TCPApple cloud(17.0.0.0/8)*

Cisco Jabber client

* Apple Push Notifications Service uses the 17.0.0.0/8 range. Make sure that your network doesn't have anaccess control list that blocks this range.

In addition, port 9966 is used internally by the Cisco Push Notification Service to communicate with the CiscoCallManager Service on all Cisco Unified Communications Manager cluster nodes. This port needs to beopen in the firewall if communication between nodes in your cluster traverse through a firewall (for examplethe nodes are located in a different subnet if as an example they are clustered over the WAN). In this case,this port needs to be open in the firewall so that these services can communicate.

Note

What to do next

Enable Push Notifications, on page 16


Push Notifications (On-Premises Deployments)Open Ports for Push Notifications

Enable Push NotificationsUse this procedure to set up the Push Notifications feature for Cisco Jabber for iPhone and iPad clients. Thisrelease provides Push Notifications support for voice calls and instant messaging with High Availability.

Before you begin

Make sure of the following:

• Port 443 must be open from the Cisco Unified Communications Manager publisher node for outboundHTTPS requests.

• Both theCisco Push Notification Service and theCisco Management Agent Service network servicesmust be running in Cisco Unified Serviceability. Both services are enabled by default.

Procedure

Step 1 Log in to the Cisco Unified Communications Manager publisher node.Step 2 From Cisco Unified Communications Manager Administration, choose Advanced Features > Cisco Cloud

Onboarding.The page may take a minute to load while Cisco Unified Communications Manager checks whether the Ciscocloud is reachable, and whether certificates are present.

Step 3 Click the Generate Voucher button to synchronize system licensing.

For more information, refer to Chapter 2 for Licensing Prerequisites under the Push Notifications Prerequisites.

Step 4 Check the Enable Push Notifications check box.Step 5 Check the I want Cisco to manage the Cisco Cloud Service CA Certificates required for this trust check

box to have the system update certificates automatically.

If you check this check box, Cisco installs your cloud certificate requirements automatically.However, if a new certificate requirement is added that was not included in the file that you usedto install your system, you may need to obtain cloud certificates manually. For information onuploading certificates manually, see Certificates for Cloud Connection, on page 29.

Note

Step 6 If you require an HTTP(S) Proxy to reach the Cisco cloud, check the Enable HTTP(S) Proxy check box andenter the server details.

Cisco supports Basic andDigest authentication for the proxy server. The recommended authenticationmethod is digest authentication.

Note

Step 7 Click Save.Step 8 On the publisher node only, restart the Cisco Tomcat service to install Cisco-managed certificates.

a) Log in to the Command Line Interface.b) Run the utils service restart Cisco Tomcat command.

After the Cisco Tomcat service restarts, the Status in the Cisco Cloud Onboarding Configurationwindow displays the message "Cisco Cloud Onboarding Pending".

Step 9 In the Cisco Cloud Onboarding Configuration window, make sure that the Enable Push Notifications andthe I want Cisco to manage the Cisco Cloud Service CA Certificates required for this trust check boxesare still checked. You may need to recheck them.


Push Notifications (On-Premises Deployments)Enable Push Notifications

Step 10 Optional. Configure troubleshooting settings to ensure that system issues can be resolved quickly. See theonline help for field descriptions.a) Check the Send Troubleshooting Information to the Cisco Cloud check box.b) Check the Send encrypted PII to the Cisco Cloud for troubleshooting check box.

Step 11 Click Save.The cluster initiates a Push Notifications subscription request. When the request completes, and PushNotifications is enabled, the Status displays the message "Cloud Onboarding Completed".

Step 12 If your deployment includes the IM and Presence Service, restart theCisco XCP Config Manager andCiscoXCP Router service for all IM and Presence Service cluster nodes:a) Click the Control Center - Network Services link that appears in the Status area of the Cisco Cloud

Onboarding window. If no link appears, log in to the Cisco Unified Serviceability interface and selectTools > Control Center - Network Services.

b) From the Server drop-down list box, choose the IM and Presence database publisher node, and click Go.c) Select the Cisco XCP Config Manager service and click Restart.d) Select the Cisco XCP Router service and click Restart.e) Repeat this step for all IM and Presence cluster nodes.

If you get a message that says "No phones are enabled in theDevice Defaults page to use ActivationCode Onboarding", it doesn't mean that the onboarding has failed, but it indicates that no devicesin the Device Defaults page have been configured to use the activation code for the On-premiseOnboarding method.

Note

Restarting the Cisco XCP Router does not update the Status message in the Cisco Cloud OnboardingConfigurationwindow. If you complete the above procedure for all nodes and then return to theCisco CloudOnboarding Configurationwindow, the Statusmessage will still say that you need to restart the Cisco XCProuter. However, you need restart it only once on each IM and Presence cluster node.

Note

To disable Push Notifications, uncheck the Enable Push Notifications check box and click Save. Aftersaving, restart the Cisco XCP Router on all IM and Presence Service cluster nodes.

Note

What to do next

Enable Push Notifications High Availability, on page 17

Enable Push Notifications High AvailabilityUse this procedure to confirm that Push Notifications High Availability is enabled. This feature is requiredto provide redundancy and failover for Cisco Jabber on iPhone and iPad clients that are in suspended mode.


Push Notifications (On-Premises Deployments)Enable Push Notifications High Availability

Procedure

Step 1 From Cisco Unified CM IM and Presence Administration, choose System > Service Parameters.Step 2 From the Server drop-down, choose an IM and Presence node.Step 3 From the Service drop-down, choose Cisco XCP Router (Active).Step 4 Under Push Notifications (Clusterwide), set the Push Notifications High Availability service parameter

to Enabled.Step 5 Click Save.Step 6 If you edited the setting of this service parameter, restart theCisco XCP Router on all IM and Presence nodes.

Otherwise, you can go to the next task:a) From Cisco Unified Serviceability, choose Tools > Control Center - Network Services.b) From the Server drop-down, choose an IM and Presence cluster node and click Go.c) Select Cisco XCP Router and click Restart.d) Repeat this procedure on all IM and Presence cluster nodes.

What to do next

Configure OAuth Refresh Logins in Unified Communications Manager, on page 19

Configure OAuth Refresh LoginsComplete these tasks to set up OAuth Refresh Logins for your Cisco Jabber deployment. OAuth RefreshLogins are an optional deployment that provides a faster login for Cisco Jabber.

OAuth Refresh Logins are enabled by default in Cisco Expressway, but are disabled by default in CiscoUnified Communications Manager. If you use the default settings for both systems, a configuration mismatchoccurs.

Note

Procedure


Configure Refresh Logins with OAuth accesstokens and refresh tokens in Cisco UnifiedCommunications Manager.

Configure OAuth Refresh Logins in UnifiedCommunications Manager, on page 19

Step 1

OAuth Refresh Logins are anoptional deployment in CiscoUnified Communications Manager.

Note

If you have Cisco Expressway deployed, makesure that theOAuth Refresh Login configuration

Confirm OAuth Configuration in Expressway,on page 20

Step 2

on Expressway matches your Cisco UnifiedCommunications Manager configuration.


Push Notifications (On-Premises Deployments)Configure OAuth Refresh Logins


In Cisco Unity Connection, enable OAuthRefresh Logins and assign the Cisco Unified

Enable OAuth on Unity Connection, on page20

Step 3

Communications Manager publisher node asan Authz server.

Configure OAuth Refresh Logins in Unified Communications ManagerUse this procedure in Cisco Unified Communications Manager to configure Refresh Logins with OAuthaccess tokens and refresh tokens for Cisco Jabber clients. OAuth Refresh Logins provide a streamlined loginflow that doesn't require Jabber users to re-login after network changes.

To ensure compatibility, make sure that the various Unified Communications components of your deployment,such as Cisco Jabber, Cisco Expressway and Cisco Unity Connection, support refresh logins. Once OAuthRefresh Logins are enabled, disabling the feature requires you to reset all Cisco Jabber clients.

Note

Cisco recommends that you enable OAuth Refresh Logins, which are disabled by default in Cisco UnifiedCommunications Manager, but are enabled by default in Cisco Expressway. If you are have both systemsdeployed, and you are using the default settings, you must either enable Refresh Logins in Cisco UnifiedCommunicationsManager or disable them in Cisco Expressway. Otherwise, a configurationmismatch results.

Caution

Procedure

Step 1 From Cisco Unified CM Administration, choose System > Enterprise Parameters.Step 2 Under SSO Configuration, do either of the following:

• To enable OAuth Refresh Logins, set the OAuth with Refresh Login Flow enterprise parameter toEnabled.

• To disable OAuth Refresh Logins, set the OAuth with Refresh Login Flow enterprise parameter toDisabled. This is the default setting.

Step 3 If you enabled OAuth Refresh Logins, configure expiry timers for access tokens and refresh tokens byconfiguring the following enterprise parameters:

• OAuth Access Token Expiry Timer (minutes)—This parameter specifies the expiry timer, in minutes,for individual OAuth access tokens. The OAuth access token is invalid after the timer expires, but theJabber client can request and obtain new access tokens without the user having to re-authenticate so longas the refresh token is valid. The valid range is from 1 - 1440 minutes with a default of 60 minutes.

• OAuth Refresh Token Expiry Timer (days)—This parameter specifies the expiry timer, in days, forOAuth refresh tokens. After the timer expires, the refresh token becomes invalid and the Jabber clientmust re-authenticate to get a new refresh token. The valid range is from 1 - 365 days with a default of60 days.

Step 4 Click Save.


Push Notifications (On-Premises Deployments)Configure OAuth Refresh Logins in Unified Communications Manager

Once you've saved the configuration, reset all Cisco Jabber clients.Note

What to do next

Make sure that the OAuth Refresh Login configuration in Cisco Expressway matches your Cisco UnifiedCommunications Manager setting. For details, Confirm OAuth Configuration in Expressway, on page 20.

Confirm OAuth Configuration in ExpresswayIf you have Cisco Expressway deployed, make sure that the OAuth Refresh Login configuration on Expresswaymatches your Cisco Unified Communications Manager configuration.

OAuth Refresh Logins are enabled by default in Cisco Expressway, but are disabled by default in CiscoUnified Communications Manager. If you use the default settings for both systems, a configuration mismatchoccurs. In Cisco Unified Communications Manager, OAuth Refresh Logins are configured via the OAuthwith Refresh Login Flow enterprise parameter.

Note

Procedure

Step 1 Sign in to Cisco Expressway-C.Step 2 Choose Configuration > Unified Communications > MRA Access Control.

• If OAuth Refresh Logins are enabled in Cisco Unified Communications Manager, set the Authorize byOAuth token with refresh setting to On. This is the default setting.

• If OAuth Refresh Logins are disabled in Cisco Unified Communications Manager, set the Authorize byOAuth token with refresh setting to Off.

Step 3 Click Save.

Enable OAuth on Unity ConnectionIf you have Cisco Unity Connection deployed and you are deploying OAuth Refresh Logins for Jabber, usethis procedure to enable this feature in Unity Connection. As part of your OAuth configuration for CiscoUnity Connection, you must also assign the Cisco Unified Communications Manager publisher node as anAuthz server.

Procedure

Step 1 Enable OAuth Refresh Logins on Cisco Unity Connection:a) From Cisco Unity Connection Administration, chooseSystem Settings > Enterprise Parameters.b) Configure the settings under SSO and OAuth Configuration.c) Set the OAuth with Refresh Login enterprise parameter to Enabled.d) Click Save.


Push Notifications (On-Premises Deployments)Confirm OAuth Configuration in Expressway

Step 2 Add the Cisco Unified Communications Manager publisher node as the Authz server for Cisco UnityConnection:a) From Cisco Unity Connection Administration, choose System Setting > Authz Server.b) Do one of the following:

• To edit an existing Authz server configuration, select the server.

• To add a new Authz server, click Add New.

c) Configure the fields on the page.d) Click Save.

Refresh Settings from ExpresswayUse this procedure to refresh settings on Cisco Expressway for Push Notifications. This will allow Expresswayto sync configurations and certificates with Cisco Unified Communications Manager.

For detailed information on Cisco Expressway configurations, see theCisco Expressway Administrator Guidefor your release at the Expressway Maintain and Operate Guides page.

Note

Procedure

Step 1 Log in to Expressway-C.Step 2 Refresh the Cisco Unified Communications Manager servers:

a) On the Expressway-C, go to Configuration > Unified Communications > Unified CM servers .b) Click Refresh Servers.

Expressway synchronizes the Authz certificate with Cisco Unified Communications Manager.

Step 3 After the servers refresh, restart the Expressway-C. Until the restart, Expressway-C doesn’t recognize thepush capability on the IM and Presence Service, and does not send PUSH messages to the Jabber clients:a) Select Maintenance > Restart options.b) Click Restart.

Configure Troubleshooting OptionsUse this procedure on the Cisco Unified Communications Manager publisher node to configure parametersthat determine how often you send Push Notifications alarms to the Cisco cloud, and for which alarm severities.

Before you begin

TheCisco Management Agent Service network service must be running for Cisco Unified CommunicationsManager to send Push Notifications alarms to the Cisco Cloud. You can confirm that the service is running


Push Notifications (On-Premises Deployments)Refresh Settings from Expressway

http://www.cisco.com/c/en/us/support/unified-communications/expressway-series/products-maintenance-guides-list.html

in the Control Center - Network Services window of Cisco Unified Serviceability. The service is enabledby default.

Procedure

Step 1 Log in to the Command Line Interface.Step 2 To configure how often Push Notifications alarms are sent to the cloud, run the utils managementAgent

alarms pushfrequency <minutes > command where <minutes> represents an integer between 5 and 90minutes. The default value is 30 minutes.

Step 3 To configure the minimum alarm severity for sending Push Notifications alarms to the Cisco Cloud, run theutils managementAgent alarms minpushlevel <alarm_level> commandwhere <alarm_level> representsthe minimum severity. Push Notifications alarms below this severity will not be sent to the Cisco Cloud.

For Push Notifications, the <alarm_level> options from most-to-least severe are as follows:

• Critical

• Error (Default value)

• Warning

• Notice

• Information

Step 4 If you want to send Push Notifications alarms to the Cisco Cloud immediately, and can't wait for the scheduledupload, run the utils managementAgent alarms pushnow command.

Push Notifications TroubleshootingPush Notifications impacts many different components, some of which are hosted locally and some of whichare in the cloud. It's important to configure Push Notifications troubleshooting so that Cisco TAC has therequired information to troubleshoot system issues proactively.

Send Troubleshooting information to Cisco Cloud

By default, Cisco Unified Communications Manager sends Push Notifications troubleshooting informationto the Cisco Cloud at regular intervals. Cisco may use this information for proactive debugging of PushNotifications and system components. This speeds up system troubleshooting by ensuring that PushNotificationsalarms can be accessed quickly by Cisco TAC.

This option is enabled by default after Push Notifications is enabled, but administrators can disable it in theCisco Cloud Onboarding Configurationwindow.When this option is enabled, CiscoUnified CommunicationsManager also generates a Customer Cluster ID and saves the ID in the customer's home Cisco UnifiedCommunicationsManager cluster. Customers who call Cisco TAC for Push Notifications issues must providethe ID so that TAC personnel can locate the customer's Push Notifications alarms.


Push Notifications (On-Premises Deployments)Push Notifications Troubleshooting

Personally-Identifiable Information (PII) Encryption

You can also configure Cisco Unified CommunicationsManager to encrypt personally-identifiable information(PII) that is saved with the Push Notifications alarms. PII data includes any data that allows you to identify aspecific person, such as a username, hostname, or device name. Select the Send encrypted PII to the CiscoCloud for Troubleshooting option to enable this feature.

To provide greater security, the Cisco Support Token that decrypts the PII data is provided only in the CiscoCloud Onboarding Configurationwindow of the customer's Cisco Unified CommunicationsManager server.Cisco cannot decrypt this data unless you provide the token. Customers who call Cisco TAC for PushNotifications issues must provide the token (assuming that PII encryption is configured) so that TAC can readthe encrypted information with the Push Notifications alarms.

If you don't select this option, no personally-identifiable information is sent to the Cisco Cloud.

CLI Commands for Troubleshooting Push Notifications

Push Notifications provides the following CLI commands, which can be run on the Cisco UnifiedCommunications Manager publisher node for troubleshooting:

• utils managementAgent alarms pushfrequency—Run this command to configure the interval followingwhich Cisco Unified CommunicationsManager sends Push Notifications alarms to the Cisco Cloud. Thedefault value is 30 minutes.

• utils managementAgent alarms pushlevel—Run this command to configure the minimum severitylevel for which Cisco Unified Communications Manager sends Push Notifications alarms to the CiscoCloud. The default severity is Error.

• utils managementAgent alarms pushnow—Run this command to upload Push Notifications alarms tothe Cisco Cloud immediately, without waiting for the interval to expire.

Traces

You can also run traces on the Cisco Management Agent Service and the Cisco Push Notification Service.By default, traces are set to the Info level and get saved to the following location:

• Cisco Management Agent Service—/var/log/active/cm/trace/cmas/log4j/

• Cisco Push Notification Service—/var/log/active/cm/trace/ccmpns/log4j/

For details on how to configure trace, refer to the "Traces" chapter of the Cisco Unified ServiceabilityAdministration Guide at http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-maintenance-guides-list.html.

Upgrades from 11.5(1)SU2 with Push Notifications EnabledIf you are upgrading from the 11.5(1)SU2 release and you had Push Notifications enabled in the old release,you must disable Push Notifications in the current release and then follow the onboarding process to enablePush Notifications once again. This is required due to API changes in this release that were not a part of the11.5(1)SU2 release. Your upgraded system will not be able to send troubleshooting logs to the Cisco Cloudunless you disable Push Notifications and then follow the onboarding process for this release.

After you upgrade your system to the new release, do the following:


Push Notifications (On-Premises Deployments)Upgrades from 11.5(1)SU2 with Push Notifications Enabled

http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-maintenance-guides-list.html

http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-maintenance-guides-list.html

Procedure


Follow these steps:Disable Push NotificationsStep 1

a. From Cisco Unified CM Administration,chooseAdvanced Features >Cisco CloudOnboarding

b. Uncheck the following check boxes:

• Enable Push Notifications

• Send Troubleshooting informationto the Cisco Cloud

• Send encrypted PII to the CiscoCloud for troubleshooting

c. Click Save.

For the full onboarding process, see PushNotifications Configuration Task Flow, on page13.

Enable Push Notifications for this release.Step 2

Update Refresh Token ManuallyIf you receive a 400 Bad Requestmessage then your machine access token to the Push Notifications servicehas expired and you need to update the access token manually. Follow this process to update your accesstoken manually.

DetailsStep

For installation instructions, see the InstallationGuide for Cisco Unified CommunicationsManager and the IM and Presence Service.

Install a new Cisco Unified CommunicationsManager server using the same version as theaffected machine

Step 1

See the "Smart Software Manager" chapter ofthe System Configuration Guide for CiscoUnified Communications Manager.

License your new nodeStep 2

Follow the onboarding instructions in thisdocument.

Upload the necessary certificate chains totomcat-trust and onboard your new node forPush Notifications

Step 3

Restart the Cisco Push Notification Service byrunning the utils service restart Cisco

Push Notification service command.

View logs and ensure that a token was retrievedsuccessfully.

Verify that onboarding was successfulStep 4


Push Notifications (On-Premises Deployments)Update Refresh Token Manually

DetailsStep

On the original node with the expired tokenobtain machine details by running the run sql

select * from machine account details

CLI command.

Get the refresh token from your new machineStep 5

Run the run sql * from

machineaccountdetails CLI command.Get the machine details from your original nodeStep 6

Run the run sql update

machineaccountdetails set

refreshtoken=<actual_token_text> CLIcommand

Update the customer's refresh tokenStep 7

Run the following CLI command on all nodesacross the Cisco Unified CommunicationsManager and IM and Presence Service clusters:

run sql select refreshtoken from

machineaccountdetails

Update the refresh token across your clusterStep 8

Push Notifications Interactions and RestrictionsThe following feature interactions and restrictions have been observed with Push Notifications.

Table 3: Feature Interactions and Restrictions for Push Notifications

Interactions and RestrictionsFeature

Cisco recommends that you configure NAT and Firewall devices tokeep idle TCP connections to the Push REST service open for at least30minutes. Push notifications do not get retried on newTCP connectionswhen an error occurs on an existing connection. Keeping existingconnections open ensures that errors are not introduced due to prematuretermination by NAT and Firewall devices.

NAT and Firewall Connections

For voice and video calls, where Cisco Jabber is in suspended mode,there may be a delay in connecting a call while the Push Notificationschannel is established. After 5 seconds, if Unified CM hasn't receiveda ring back from the iOS device, Unified CM provides a ring on thecalling device.

If there is a delay in the Push Notifications process that prevents UnifiedCM from offering the call to the IOS device, Unified CM drops the callafter 13 seconds.

Voice calls


Push Notifications (On-Premises Deployments)Push Notifications Interactions and Restrictions

Interactions and RestrictionsFeature

High Availability is supported for Push Notifications deployments asof 11.5(1)SU3. If Push Notifications is enabled, and a node fails over,the following occurs for Cisco Jabber on iPhone and iPad clients:

• For Cisco Jabber clients in foreground mode, the Jabber client logsin automatically to the backup node, which takes over until themain node recovers. There is no interruption in services, eitherwhen the backup node takes over, or when the main node recovers.

• For Cisco Jabber clients in background mode, the backup nodetakes over, but there is a delay before any Push Notifications aresent. Because the Jabber client is in background mode, it does nothave an active connection to the network so it doesn’t log inautomatically to the backup node. The backup node must recreateJSM sessions for all failed over users who were in backgroundmode before any Push Notifications can be sent.

The length of the delay depends on the system load. Testing hasshown that for a 15,000 user OVA with users evenly distributed inan HA pair, it takes 10-20 minutes for Push Notifications to be sentfollowing a failover. This delay is observed when the backup nodetakes over, and again after the main node recovers.

In the event of a node failure or unexpected crash of the CiscoXCP Router, the user's IM session, including the IM history,is maintained without the need for any user action. However,if the Cisco Jabber on iPhone or iPad client was in suspendedmode, it will be unable to retrieve unread messages that werequeued on the server when it crashed.

Note

Push Notifications HighAvailability

Stopping the application without logging out can cause inconsistentbehavior with Push Notifications. This refers to these situations:

• On an iPhone, double-tapping the home button and swiping up.

• If the IOS stops the application randomly while Jabber is in thebackground.

To ensure that behavior remains consistent, log out of Cisco Jabber tostop the application.

Stopping the application withoutlogging out


Push Notifications (On-Premises Deployments)Push Notifications Interactions and Restrictions

C H A P T E R 3Push Notifications (Cloud Deployment)

• Cloud Deployments with WebEx Messenger, on page 27

Cloud Deployments with WebEx MessengerAt startup, Cisco Jabber for iPhone and iPad clients register both to CiscoWebExMessenger and to the Applecloud. If a Cisco Jabber for iPhone or iPad client moves into the background, the standard communicationchannel from WebEx Messenger to Cisco Jabber becomes unavailable. Push Notifications provides analternative channel to reach the Jabber client.

For instant messages, an IM notification gets sent to the Jabber client via the Apple cloud. When the userclicks the IM notification, the Jabber client moves back into the foreground, resumes the session with WebExMessenger, and downloads the instant message.

For voice and video calls, the call gets sent to the Jabber client via the Apple cloud. When the Cisco Jabberclient receives the push notification, the client moves back to the foreground and the client rings.

Push Notifications Configuration

For IM-only cloud deployments, no configuration is required to enable Push Notifications–WebExMessengersupports Push Notifications for Cisco Jabber on iPhone and iPad by default.

To add voice and video call support, youmust onboard an on-premise Cisco Unified CommunicationsManagerfor Push Notifications. For details, refer to the prerequisites and configuration tasks in the chapter PushNotifications (On-Premises Deployments), on page 3.

For general Cisco WebEx Messenger setup, see the Cisco WebEx Messenger Administration Guide athttp://www.cisco.com/c/en/us/support/unified-communications/webex-messenger/products-installation-guides-list.html.

Terminated Push Notifications for Cloud Deployments

If WebEx Messenger shuts down gracefully, a terminated push notification gets sent to the Cisco Jabber foriPhone or iPad client. The terminated push notification notifies the user of the server shutdown and notifiesthe user that all queud instant messages, Presence updates, and other XMPP stanzas (for example, chat roominvites) are lost. The user must move Cisco Jabber back to the foreground to start a new session with PushNotifications enabled for the new session.

If the WebEx Messenger server fails, no terminated push notification is sent. All queued instant messages,Presence updates, and XMPP stanzas that are queued on the server and waiting to be delivered to the client,


http://www.cisco.com/c/en/us/support/unified-communications/webex-messenger/products-installation-guides-list.html

http://www.cisco.com/c/en/us/support/unified-communications/webex-messenger/products-installation-guides-list.html

are lost. The user must move Cisco Jabber back to the foreground to begin a new session with Push Notificationsenabled in the new session.


Push Notifications (Cloud Deployment)Cloud Deployments with WebEx Messenger

C H A P T E R 4Certificates and Performance Monitoring

• Certificates for Cloud Connection, on page 29• Push Notifications Alarms, on page 31• Performance Counters for Push Notifications, on page 33

Certificates for Cloud ConnectionFor on-premises deployments, you must obtain and upload certificates manually if you choose not to haveCiscomanage cloud certificates automatically, or if a new certificate requirement is added that was not includedin your system installation file. In these instances, you will have to download certificates manually from theCA site and upload them to Cisco Unified CommunicationsManager and IM and Presence Service. To choosethis option, uncheck the I want Cisco to manage the Cisco Cloud Service CA Certificates required forthis trust check box in the Cloud Onboarding Configuration window in Cisco Unified CommunicationsManager.

Root Certificates for Cloud Connection

Refer to the below table for the root certificates that you must obtain if you are uploading certificates manually.For details on how to upload certificates to Cisco Unified Communications Manager and IM and PresenceService, refer to the Certificates sections in the Security Guide for Cisco Unified Communications Manager.Make sure to select tomcat-trust as the Certificate Purpose.


Table 4: Root Certificates for Cloud Connection

Fingerprint (Thumbprint)in SHA256

Issuing CAFor this purposeMust be trusted byCloud hosts signed bythis CA

85 A0 DD 7D D7 20 ADB7 FF 05 F8 3D 54 2B20 9D C7 FF 45 28 F7D6 77 B1 83 89 FE A5E5 C4 9E 86

O=QuoVadis Limited

CN=QuoVadis Root CA2

1. Cisco UnifiedCommunicationsManager requests aCI machine token toauthenticate withCisco Push RESTservice.

2. Secure httpscommunicationbetween CiscoUnifiedCommunicationsManager, IM andPresence Service,and the Cisco PushREST service.

Cisco UnifiedCommunicationsManager and IM andPresence Service

Common Identity (CI)service

C3 84 6B F2 4B 9E 93CA 64 27 4C 0E C6 7C1E CC 5E 02 4F FC ACD2 D7 40 19 35 0E 81FE 54 6A E4

O = The Go DaddyGroup, Inc.

OU = Go Daddy Class 2Certification Authority

Cisco UnifiedCommunicationsManager communicateswith Fusion OnboardingService (FOS) toprovision CI machineaccount.

Cisco UnifiedCommunicationsManager and IM andPresence Service

Cisco Webex

Scenarios Where Cloud Certificates can be Uploaded Automatically

The following table shows whether onboarding will be successful with the I want Cisco to manage the CiscoCloud Service CA certificates required for this trust check box selected in the Cisco Cloud OnboardingConfigurationwindow, or whether certificates need to be uploadedmanually for onboarding to be successful.

Table 5: Scenarios Where Cloud Certificates can be Uploaded Automatically

Onboarding is Successful?You have chosen to have Ciscomanage certificaterequirements

Installation iso file included therequired certificates?

Scenario

YesYesYesOnboarding for first time

No. Youmust obtain and uploadthe new certificates manually.See the preceding table "RootCertificates for CloudConnection".

YesNo. The certificate requirementschanged sometime after theinstallation iso was created

Onboarding for first time


Certificates and Performance MonitoringCertificates for Cloud Connection

https://www.quovadisglobal.com/QVRepository/DownloadRootsAndCRL/QuoVadisRootCA2-PEM.aspx

https://www.quovadisglobal.com/QVRepository/DownloadRootsAndCRL/QuoVadisRootCA2-PEM.aspx

https://ssl-ccp.godaddy.com/repository?originCALLISTO

https://ssl-ccp.godaddy.com/repository?originCALLISTO

Onboarding is Successful?You have chosen to have Ciscomanage certificaterequirements

Installation iso file included therequired certificates?

Scenario

Yes. The system can fetch andinstall new certificatesautomatically.

YesYour installation will notinclude the required certificates

You are already onboarded, butnow a new certificaterequirement has arisen

Push Notifications AlarmsThe following table highlights alarms that were added to support Push Notifications call support in CiscoUnified Communications Manager and IM and Presence Service Release 11.5(1)SU3.

Table 6: Alarms for Push Notifications

DescriptionAlarm

Cisco CallManager Alarms

Description: Unable to connect with Cisco Push Notification Service. The CallManagerservice requires a connection in order to send Push Notifications to the Cisco Cloud.

Severity: ALERT_ALARM

Action: In Cisco Unified Serviceability, check that the Cisco Push Notification Servicestatus is running. If the service is stopped, start it. If the service is running, restart it.

PushNotificationServiceUnavailable

Description: Cloud returned Error code 410 for PushNotification sent fromCallManagerService due to invalid device token. Push Notification for this IOS Jabber device willbe stopped until valid device token is set by IOS Jabber device.

Severity: ERROR_ALARM

Action: User should log out and log back in to Jabber client on that IOS device .

PushNotificationInvalidDeviceTokenResponse

Description:Cisco Push Notification Service (CPNS) does not have a valid AccessToken. Cisco Unified Communications Manager requires valid Access Token to sendPush Notifications to Cloud. This Access Token is not available from Cloud due toauthentication or network error.


Action: Check the Cisco Cloud Onboarding Configuration window to confirm thatthe onboarding process has completed successfully. If the issue persists contact CiscoTAC for further assistance..

PushNotificationServiceAccessTokenUnavailable

Cisco Push Notification Service Alarms


Certificates and Performance MonitoringPush Notifications Alarms

DescriptionAlarm

Description: This alarm indicates that an internal failure prevented the Cisco PushNotification Service from starting

Severity: CRITICAL_ALARM

Action: Try restarting the Cisco Push Notification Service. If the issue persists checkthe Cisco Push Notification Service application logs and contact Cisco TAC for furtherassistance.

StartFailed

Description: This alarm indicates that current access token is expired and becomeinvalid and new access token is unavailable.


Action: Check the Cisco Cloud Onboarding Configuration window to confirm thatthe onboarding process has completed successfully. If the issue persists, contact CiscoTAC for further assistance.

AccessTokenInvalid

Description: Indicates an error in creating the Http Client connection pool


Action: Check the Cisco Cloud Onboarding Configuration window and verify thatthe HTTP proxy settings are correct. In addition, verify that the on-boarding processhas completed.

HttpClientPoolCreationError

Cisco XCP Config Manager

Description: Cisco XCP Config Manager was not able to send Push Notification.


Action: Check the Error Code and follow the Error action that is directed.

PushNotificationFailed

Description: An attempt to send a Push Notification to the Cisco Cloud failed due toan invalid device token.


Action: User should re-login to Jabber.

PushNotificationFailedInvalidDeviceToken

Description: An attempt to send a Push Notification to the Cisco Cloud failed due toan invalid access token.


Action: Look at the IM and Presence Service Cisco XCP Config Manager service logsto verify whether the AccessToken was fetched and refreshed on a timely basis. If theAccessToken was fetched and refreshed it on timely basis then do check the Cisco Cloudfor further debugging.

PushNotificationFailedInvalidAccessToken

Description: Cisco XCP Config Manager was unable to fetch the Access Token.


Action: Check the Error Code and follow the Error action that is directed

AccessTokenFetchFailed


Certificates and Performance MonitoringPush Notifications Alarms

DescriptionAlarm

Description: Cisco XCP Config Manager was unable to fetch the access token.

Severity:

Action: IM and Presence Service nodes must connect to the Cisco cloud to obtain theAccess Token. Verify the following:

• Verify that the access token URL and refresh token are valid.

• Verify that the proxy details are correct on theCisco Cloud Onboardingwindow.

• Check connectivity to the Cisco cloud.

XCPConfigMgrAccessTokenIsNull

Cisco Jabber Alarms

Description: An iOS Jabber client was unable to process an Push Notification.


Action: Contact Cisco TAC for further assistance.

APNSAlarm

Description: An iOS Jabber client gets the following message: Unread messages mightbe deleted from server due to timeout. Please sign in Jabber to check unread messages.


Conditions: Cisco Jabber for iPhone running in the background. The user did not signout of Cisco Jabber prior to closing the application.

Unread Messages alert

This alert appears only inreleases prior to 12.5(1). Theissue is fixed as of 12.5(1).

Note

Performance Counters for Push NotificationsThe following table shows the counters that have been added to the Cisco Unified Real TimeMonitoring Toolto support Push Notifications for on-premises deployments of Cisco Unified Communications Manager andIM and Presence Service Release 11.5(1)SU3. Note that the counters increment only for specific APNSsubscriber services (for example, APNS, APNS:beta, APNS:dev, APNS:test, APNS:load). For example, ifthe subscriber service is 'APNS:beta' only the APNS:beta counters increment, and none of the APNS:devcounters increment. The Cisco Jabber service type determines which subscriber service is used.

Counter increments if the Subscriberservice is set to...

Counter DescriptionRTMT Counter

Cisco CallManager Counters

Any APNS Subscriber Services.The total number of Push Notification Requests sent bythe Cisco CallManager Service.

NumberOfPushReqSent

The total number of Push Notification Responsesreceived by the Cisco CallManager Service.

NumberOfPushResReceived

The total number of Push Notification Responsesreceived by Cisco CallManager Service with responsecode other than 200 OK.

NumberOfPushErrorResReceived


Certificates and Performance MonitoringPerformance Counters for Push Notifications



Cisco Mobility Manager Counters

Any APNS Subscriber Services.This represents the total number of calls sent to theMobility Identity destination where Jabber did notregister after receiving push notification before the"Jabber Dual Mode (iPhone) Incoming Call PushNotification Wait Timer" expired.

MobilityPushNotificationCallsExtended

ToMIDueToTimeout

This represents the total number of calls sent to Jabberwhere Jabber registers successfully after receiving pushnotification before the "Jabber Dual Mode (iPhone)Incoming Call Push Notification Wait Timer" expired.

MobilityPushNotificationCallsExtended

ToJabber

Cisco XCP Config Manager Counters

Any APNS Subscriber Services.Number of successful Push Notifications sent.NumberOfPushSuccess

Number of failed attempts to send Push Notifications.NumberOfPushFailure

Total number of Push Notification failures due to aninvalid target.

TargetInvalid

Total number of Push Notification failures due to anexpired target.

TargetExpired

Cisco XCP Push Counters

APNSNumber of push enabled sessions for APNS clients withAPNS as the subscriber service. The counter getsincremented when push notifications is enabled anddecrements when push notifications is disabled or asession terminates.

PushEnabledSessionsApns

Number of push enable requests received for clientswith APNS as the subscriber service, during the 60second interval. This counter resets to 0 every 60seconds.

PushEnableReqRcvdApns

Number of push errors received during the 60 secondinterval. This counter resets to 0 every 60 seconds.

PushErrorsApns

Number of messages sent to sessions in silent modeduring the 60 second interval. This counter resets to 0every 60 seconds.

PushSentSilentApns

Number of messages sent to sessions in suspended stateduring the 60 second interval. This counter resets to 0every 60 seconds.

PushSentDisconnApns





APNS:betaNumber of push enabled sessions for clients withAPNS:beta as the subscriber service. The counter getsincremented when push notifications is enabled anddecrements when push notifications is disabled or asession terminates.

PushEnabledSessionsApnsBeta

Number of push enable requests received for clientswith APNS:beta as the subscriber service, during the 60second interval. This counter resets to 0 every 60seconds.

PushEnableReqRcvdApnsBeta

Number of push errors received during the 60 secondinterval where the subscriber service is APNS:beta. Thiscounter resets to 0 every 60 seconds.

PushErrorsApnsBeta

Number of messages sent to sessions in silent modeduring the 60 second interval where the subscriberservice is APNS:beta. This counter resets to 0 every 60seconds.

PushSentSilentApnsBeta

Number of messages sent to sessions in suspended stateduring the 60 second interval where the subscriberservice is APNS:beta. This counter resets to 0 every 60seconds.

PushSentDisconnApnsBeta

APNS:devNumber of push enabled sessions for clients withAPNS:dev as the subscriber service. The counter getsincremented when push notifications is enabled anddecrements when push notifications is disabled or asession terminates.

PushEnabledSessionsApnsDev

Number of push enable requests received for clientswith APNS:dev as the subscriber service, during the 60second interval. This counter resets to 0 every 60seconds.

PushEnableReqRcvdApnsDev

Number of push errors received during the 60 secondinterval where the subscriber service is APNS:dev. Thiscounter resets to 0 every 60 seconds.

PushErrorsApnsDev

Number of messages sent to sessions in silent modeduring the 60 second interval where the subscriberservice is APNS:dev. This counter resets to 0 every 60seconds.

PushSentSilentApnsDev

Number of messages sent to sessions in suspended stateduring the 60 second interval where the subscriberservice is APNS:dev. This counter resets to 0 every 60seconds.

PushSentDisconnApnsDev





APNS:loadNumber of push enabled sessions for clients withAPNS:load as the subscriber service. The counter getsincremented when push notifications is enabled anddecrements when push notifications is disabled or asession terminates;

PushEnabledSessionsApnsLoad

Number of push enable requests received for clientswith APNS:load as the subscriber service, during the 60second interval. This counter resets to 0 every 60seconds.

PushEnableReqRcvdApnsLoad

Number of push errors received during the 60 secondinterval where the subscriber service is APNS:load. Thiscounter resets to 0 every 60 seconds.

PushErrorsApnsLoad

Number of messages sent to sessions in silent modeduring the 60 second interval where the subscriberservice is APNS:load. This counter resets to 0 every 60seconds.

PushSentSilentApnsLoad

Number of messages sent to sessions in suspended stateduring the 60 second interval where the subscriberservice is APNS:load. This counter resets to 0 every 60seconds.

PushSentDisconnApnsLoad

APNS:testNumber of push enabled sessions for clients withAPNS:test as the subscriber service. The counter getsincremented when push notifications is enabled anddecrements when push notifications is disabled or asession terminates.

PushEnabledSessionsApnsTest

Number of push enable requests received for clientswith APNS:test as the subscriber service, during the 60second interval. This counter resets to 0 every 60seconds.

PushEnableReqRcvdApnsTest

Number of push errors received during the 60 secondinterval where the subscriber service is APNS:test. Thiscounter resets to 0 every 60 seconds.

PushErrorsApnsTest

Number of messages sent to sessions in silent modeduring the 60 second interval where the subscriberservice is APNS:test. This counter resets to 0 every 60seconds.

PushSentSilentApnsTest

Number of messages sent to sessions in suspended stateduring the 60 second interval where the subscriberservice is APNS:test. This counter resets to 0 every 60seconds.

PushSentDisconnApnsTest



Documents

Push Notifications Deployment for Cisco Jabber on iPhone ... · CHAPTER 3 PushNotifications(CloudDeployment) 25 CloudDeploymentswithWebExMessenger 25 CHAPTER 4 CertificatesandPerformanceMonitoring