Time2Market's Cloud Complete Unified Communications as a Service (UCaaS)

First off... this blog post is going to come across as a sales pitch and that is because it is. I'm not going to insult your intelligence... but there is a lot of confusion out there as to what is offered with various different Unified Communications as a Service (UCaaS) solutions and where they can fit into an organizations plan to further their communications. I'm not going to go into detail about all the other offerings out there, but what I'm going to do is offer you detail about Time2Market's Cloud Complete offering. We also offer a Cloud Custom option, that adds some additional functionality, but this blog post will focus on the Cloud Complete offering.

Anyone who knows me... knows that I'm not a fan of the "cloud". The reason is because I think it is one of those terms that gets thrown around and decisions made without really understanding the implications of turning over control to the cloud. I'm not saying that it doesn't make sense 100 percent of the time... because it actually does in a lot of scenarios.  I just don't like the blind run toward the cloud that I see a lot of people doing just because all the cool kids are doing it.

Having said that, Time2Market's Cloud Complete offering is a hosted UCaaS that is a Multi-tenant... Enterprise Voice... Skype for Business environment.

Yup.. you read that right... Skype for Business.

Time2Market's cloud is not based on the now defunct Lync Hosting Pack that was limited to the same feature set and Lync Online.

The is a Skype for Business hosted environment with feature sets that to my knowledge are currently not offered anywhere else. Those feature sets even include the new Broadcast Meeting offering that depends on a hybrid implementation with Office365. We even leverage Exchange Unified Messaging in Office365.

Now why would an organization want to do this. It is simple... instead of investing in all the equipment, server licenses and professional services to implement an on-premises solution that has costs as a capital expenditure. This allows an organization to move these costs to the operational expenditure column. The Cloud Complete offering scales and shrinks as you do and is a totally managed service from deployment to support. In short, you focus on your business, not running a Unified Communications infrastructure.

So what are some of the things that Time2Market offers in its Cloud Complete that make it unique...

• E-Faxing Services
• Advanced Call Routing Options
• DID Parking
• Common Area Phones
• Standalone Fax Services
• Unlimited Calling Plans
• Auto Attendant
• Dedicated Conference Bridge
• Room Systems and Video Integration
• Conference Room Audio Devices
• 800# Support
• Paging Applications
• Contact Center (Clarity)

But here is the really big key to Time2Market's offering, we have a whole organization that will help you every step along the way with a White Glove Service. Cloud Complete isn't a self service type of offering, instead it is an offering where you have a whole team of people who have been in the business of helping organizations communicate for decades. Here are some of the things we can help you with...

• Office365 Tenant Setup/Mail Migration
• Unified Messaging Setup
• IP Phone Setup
• On-Premises Active Directory Integration
• Auto Attendant Configuration
• Room System Installation
• Device Consultation

But wait.... there's more!! Sorry couldn't resist saying that.

But really there is more... Time2Market has created a Self Service web based portal that gives easy access to the following tasks...

• Password Reset
• Add New Users
• Assign DIDs
• Modify/Update Conferencing and Global Dialing Policies
• Update Federation Policies
• Get Support
• Access to Usage Reports and Billing Info
• Access to training, tips and tricks

What are you waiting for? Interested in Time2Market's Cloud Complete offering or have further questions? You can contact me by SIP or email using jonathan at t2mdev dot com or by calling 303 997 2100.

Using Wireshark to Decrypt Lync Communications

There is a sister blog post to this that shows how to decrypt HTTPS without using a private key. Some of the newer ciphers make this blog post impossible without removing them (Diffe Hellman for example and leaving RSA).


If you have never decrypted SSL/TLS using Wireshark... you have never really lived. There is nothing quite like being able to see exactly what is on the wire. Lync has some great debugging tools, but there are times, especially with web services, where I wish I could see more of what is being transmitted back and forth.

Now you are probably thinking this isn't anything special, I can do this with Fiddler.

Although Fiddler is a great tool, it doesn't work if you want to see what is happening with web services on Lync Phone Edition. It also doesn't work well if you want to see other packets along side the web services to correlate issues with STUN in Lync Web App. I would also argue that Fiddler became so popular because doing Wireshark decrypting in the past was not for the faint of heart and it got the job done. Good news is that when I recently checked on a new version of Wireshark, this process is immensely easier. Since I have a love for Wireshark already... I won't be using Fiddler any time soon.

This blog post aims to give you the tools necessary to see exactly what is on the wire, even when those packets are encrypted. Let's dig in...


Getting the Private Key
If you have ever installed OCS/Lync you are quite familiar with Certificates. I'm not going to go in to the detail of why and how certificates are used. You can read Wikipedia for that. Just know there is a key piece of information we need to do decryption in Wireshark and that little bit of goodness is a private key.

The private key is essentially the secret decoder ring that allows us to view what is in the packets as if they were not encrypted. So... how do you get the private key. That is quite easy as long as you have access to the server where it is stored.

Let me show you how...

Login in to the server where the private key is stored. This could be your reverse proxy or Lync Front End server. Which private key depends on where you client is and what servers they are communicating with.

Open up an instance of Microsoft Management Console (I prefer to just hit the run dialog box and type "mmc")

Next select Add/Remove Snap-in from the File Menu

Select Certificates and click "Add >"

Select "Computer account" and click "Next"

Make sure "Local computer" is selected and click "Finish"

You will notice a "Certificates (Local Computer)" displayed under Console Root. Click "OK".

Open up the Personal Certificate Store and Right-Click the certificate you would like to export (with the private key)

Look a wizard! Click "Next".

Select "Yes, export the private key" and click "Next".

Click "Next" (DO NOT select Delete the private key if the export is successful. It will ruin your day)

Give it a password you will remember and click "Next".

Keep in mind this password will be viewable in Wireshark so don't use you super secret passphrase

Give it a filename to store the certificate with private key. This should be a .pfx file.

Woohoo! Click "OK"

Now you should move the .pfx file to whatever machine will be running Wireshark.

Decrypting Packets in Wireshark
Don't have Wireshark yet? Get it here. You will want a fairly up to date version for what I'm about to show you. 1.8.x or later should be good. As of writing this blog the latest stable release is 1.10.3.

So if you have tried to decrypt packets in the past, you have no doubt become good friends with openssl and all the different commands to pull out the RSA key so that Wireshark could show you all that unencrypted goodness.

Guess what... no need to go through all that pain anymore. You can have your cake and eat it too!!

Wireshark will take the .pfx file straight out of your windows box and pull out the key for you... on the fly. Don't you just love it when software gets new features that is actually useful?

So here is how you configure Wireshark to decrypt SSL...

Fire up Wireshark and before you start a packet capture (you can do this after you have a capture too) select "Preferences" under the "Edit" menu

Behold... the Preferences Dialog

Open up the "Protocols" header and scroll down forever...

Click on "SSL" and then click on "Edit" next to "RSA keys list"

Click "New"

Put in the IP address for the server you are communicating with (example: Reverse Proxy or Front End).

Then specify the port the traffic is communicating on (443 for https).

Next, what protocol you are expecting after the packets are decrypted (http in this example).

Select your .pfx file and finally type in the password you entered when creating the file.



If you didn't fat finger something you should get a RSA key list that looks like this.

Next you need to enter in a SSL debug file. When done click "OK".

Now you are ready to do a packet capture. One key thing to remember when decrypting SSL is that it does no good to start in the middle of a packet conversation.

You need to capture the initial key exchange otherwise you will get nothing.

Sometimes this requires a reboot because the client machine will cache SSL keys and won't do a full key exchange.

Here is an example of capture I did for Lync Web App

Here is the packet detail all laid out nicely for us

Here is the packet byte section

 Notice down at the bottom you have several tabs. This indicates the original encrypted data in the "Frame" tab. Then the important bit is the "Reassembled SSL" tab which shows the complete data unencrypted and reassembled from multiple packets.

Not just for HTTP

Now you are probably thinking to yourself... if I can do this for https and technically Lync uses SSL/TLS for SIP... then I should be able to decrypt SIP as well... and you would be right.

Technically Wireshark can do this for sip.tcp, http. smtp, ldap, imap, pop, q931.tpkt (not sure about that one) and skinny.

Just go through the same process and instead of using port 443 and http for your protocol on the RSA key list, specify port 5061 and "sip" protocol.

Getting a good capture of SIP with Lync is a bit more tricky because you need to wait for a key exchange to happen. This can prove to be frustrating and most people just prefer to capture the SIP the old fashioned way using the Lync debugging tools. Which I agree with most of the time.

But there are a couple of instances where this technique can be handy.

1. Capturing sip and/or http traffic (ever have EWS yellow triangle) from Lync Phone Edition devices which have notoriously hard to read logs.
2. Capturing SIP traffic going through a Load Balancer (I know that is sooooo OCS 2007). Why? Because by the time it goes through the load balancer you can't figure out what the original endpoint was. Having view of the SIP packet details can help you troubleshoot connections where the Load Balancer might be the problem.

Feel free to make comments below on other ways to use this...

Want more Wireshark check out my other blog... http://blog.lyncdialog.com/2010/10/wireshark-tips-and-tricks-for-voipsip.html

Also check out a blog written by Matt Landis that also covers some quirks you might encounter... http://windowspbx.blogspot.com/2013/11/getting-started-with-lync-and-wireshark.html?utm_source=twitterfeed&utm_medium=twitter





Colorado Unified Communications User Group October Meeting

The next meeting of the Colorado Unified Communications User Group (COUCUG) will be held on October 24th from 4-6pm at the Microsoft offices in Denver, Colorado.

We are going to talk with Ryan Herbst from UnifiedCommunications.com about the new Lync Room Systems. In addition, I will be presenting on Better Together over Ethernet.

UnifiedCommunications.com will be sponsoring the meeting and providing food and beverages. Please feel free to check out their website and why they are one of the most popular choices for video solutions and audio devices for Microsoft Lync!

Microsoft Offices
7595 Technology Way
Suite 400
Denver, CO

Please visit www.coucug.org and click on the RSVP link to let us know you will be attending.

Better Together over Ethernet Experiences

I’ve been running with Polycom VVX 500 Better Together over Ethernet (BToE) since Monday, September 9th (Polycom released last Friday). It is reasonably easy to set up and won’t require administrative overhead other than a bit more work when you do the initial phone setup.

I also tried to setup the Snom version… since they responded by shipping their Beta on Monday. The Snom version looks like it was coded over the weekend and it is not deployable large scale by any stretch of the imagination. It has major administrative overhead to get it up and running (which I haven’t got it running yet). At this point I wouldn’t have called it a Beta… maybe more like pre-alpha/alpha version.

In my opinion.. Polycom is really the only choice at the moment.

A few things about the current Polycom version

• PC is required to connect to PC Port of phone for BToE pairing to work
    
• A separate application has to be running in the systray to allow BToE pairing.
   
• If connection to the PC Port is lost or disconnected, then pairing is lost and has to re-paired (not a big deal). Rumor is… this is a bug…and it should reestablish on its own, once paired.
   
• Exchange Calendar integration is not automatic. It has to be configured separately. Which is nice we have this option. The current version doesn’t seem to come back after the phone is rebooted. Might be a bug.
   
• I do not have details about deployment of it… but it does appear we have an option for paging through phone with the Polycom VVX series. At the surface it looks like it uses a Multicast address on the IP network.
   
• Voicemail is not retrievable on the phone like Lync Phone Edition. You have to call in to Exchange UM to retrieve VM (or retrieve through Outlook)
   
• Some Plantronics and Jabra USB headsets are supported as a headset option with these phones. I’ve been using the Voyager UC Pro and Voyager Legend with the phone.
   
• The Polycom seems limited in the features you can assign to “buttons” on the phone. You can have multiple users logged in with also the ability to do shared line appearance.
   
• The phone is aware of delegate scenarios and notifies user of those when a user is logged in.
   
• BToE pairing can be done with the phone not logged in (when pairing, the Lync client presents login for phone just like Lync Phone Edition)
   
• Transfer from Phone to other USB device on Lync works… but does not work to go back. This would seem to be a bug.
   
• Mute from the Lync client is not available. You can only Mute using the phone. There is also no notification in the Lync window you are muted and to others as well.
   
• Works with Lync 2010 client.
   
• The VVX phone is well engineered with a nice feel to it.
   
• There is an extra license fee from Polycom for the Lync “personality” of the phone. Plan on $15 added to the cost of the phone. But don't quote me on it :-). If you'd like a quote you can call Ryan Herbst at unifiedcommunications.com
   
• This is a good blog on the Polycom BToE experience http://windowspbx.blogspot.com/2013/07/how-will-lync-enhanced-better-together.html

A few things about the current Snom version (much more limited since I haven’t actually got it to work yet)

• Pairing is done via IP address (which I have reservations about since the user doesn’t have to be physically by the phone to control)
  
• The Snom has quite a large range of features we can assign to buttons on the phone.
  
• Snom firmware for Lync has been out in the wild longer.
  
• Biggest complaint from customers about Snom phones is the look and feel. They feel cheap and not well made.
  
• No extra license fee.