IBM Sametime Media Manager and the importance of the FQDN

Posted by:

To be able to deliver audio and video services with IBM Sametime 8.5.2 you have to install the Sametime Media Manager Server. The Sametime Media Manager uses the Session Initiation Protocol (SIP) to provide Sametime clients with support for peer-to-peer VoIP, video chats and for web conferencing within the meeting rooms. For security it uses by default TLS encryption to secure audio/video communication.

Then installing Sametime Media Manager you have several choices to make, should you install all three components (SIP Proxy/Register, Conference Manager and Packet Switcher) on the same server or should you install them on three different machines? Should you install it in DMZ for external access or not? One thing that is VERY important then installing, is which FQDN (Fully qualified domain name) your are going to use for Sametime Media Manager. So why is this so important? Its because of this:

The installer program for Sametime Media Manager uses the operating system machine name FQDN to create a self-sign certificate which later is used for TLS encryption!

This means that if you install Sametime Media Manager on a Windows 2008 R3 server which machine name FQDN is winsrv034.corp.company.com, the self-sign certificate will get created with that FQDN. To get audio/video to work between two Sametime clients, both clients needs to “connect” or register with the Sametime Media Manager. The Sametime client does this by asking its Sametime Community Server which FQDN to use for connecting to the Sametime Media Manager. In this case the Sametime client will use the FQDN winsrv034.corp.company.com.

OK, but what If I does not want to install Sametime Media Manager using the operating system name. Say you like to use a DNS Alias, which are quite common then installing application servers. What will happens then?

If you install Sametime Media Manager using a DNS Alias (like stmedia.company.com) the certificate used for TLS encryption of A/V will still use the FQDN winsrv034.corp.company.com . Then a Sametime client then tries to create a A/V session with another Sametime client, the A/V session will fail because the client will try to use the FQDN stmedia.company.com , but the certificate used for TLS encryption will only work if the Sametime Media Manager Server FQDN are winsrv034.corp.company.com…

This is the reason why IBM writes this in the “IBM Sametime 8.5.2 – Installation From Zero to Hero  – 8.5.2” presentation.

“…The Media Manager Server does not work when installing with a DNS alias. You
must configure the full qualified machine host name (including domain part)
and use this for the installation. This name does not need to be configured
anywhere else and the client does not see it.”

OK, so I need to install the Sametime Media Manager with its operating system FQDN. Is that so bad? No not if you are only going to use Sametime A/V on your intranet. Then it may be OK to use a OS FQDN. But if your Sametime environment also are going to be accessible from the Internet this will cause problems.

To be able to deliver Sametime A/V services between internal Sametime Servers/clients and external Sametime clients, you have to install a couple for Sametime Edge Servers in DMZ. Then you have to use a “split DNS” configuration so external clients can use the same FQDN to Sametime Servers as the internal Sametime clients. One of the Edge Servers you need to install in DMZ are the Lotus SIP Edge Proxy Server. This server must have the same FQDN as the Sametime Media Manager Server standing on the internal network!

Internal Sametime Client —> Sametime Media Manger (winsrv034.corp.company.com) —> | DMZ— Lotus SIP Edge Proxy Server (winsrv034.corp.company.com) …DMZ | <—  External Sametime Client

The above configuration demands that you put internal server names in the external DNS, and FW/DNS/network guys sometimes have a problem with that… So if you are going to deliver A/V services to Sametime clients on the internet, deciding the FQDN for the Sametime Media Manager Server when installing is VERY important.

You have to decide the following before installing Sametime Media Manager:
– Will we deliver Sametime A/V services to Sametime clients connected to the Internet?
– Is it OK to have intranet operating system machine FQDN in the external DNS?

OK, say that you answer yes on the first question and no on the second one. Well one of the solution then is to install the Sametime Media Manager with a FQDN which are OK to have in the external DNS. A FQDN like stmedia.company.com. But then you may end up having trouble with the internal server management/monitoring teams. They may have strict rules about naming internal server names. Internal sub domains and so on. So what to do?

Well you could do this:

1. Set the operation system machine names FQDN to stmedia.company.com
2. Install Sametime Media Manager using the FQDN stmedia.company.com
3. After installation and configuration of Sametime Media Manager is complete, change the operating system machine name back to what is was before

This work around has been approved by IBM and I am going the try it on one of our customers next week. 🙂

5

Comments

  1. vijay  August 23, 2013

    Where to get the Media manager server pal? Any downloads available or have to buy it? If to buy, how much is it?

    reply
  2. ceklundh  January 18, 2013

    Hi Ben, yes in this setup we used the Sametime Media Manager “all components” install.

    reply
  3. collaborationbenen Williams  October 4, 2012

    Nice write up of your observations. I’ll be interested in how it works out for you.

    reply
    • Christer Eklundh  November 16, 2012

      It worked out great. We change OS host name to stmedia.company.com, installed Sametime Media Manger with FQDN stmedia.company.com, then changed OS host name to winsrv034.corp.company.com and added it to the AD domain. Now A/V works without any problems, both internally and externally using a Lotus SIP Edge Proxy Server in DMZ. 🙂

      reply
      • Ben Williams  January 18, 2013

        BTW – was this an “all components” install of the Media Manager or did you split all three components out into their own JVMs and run them as primary nodes on the same host?

        reply

Leave a Reply to Ben Williams
click here to cancel reply