Sounds like a CYA type of thing similar to how call recording over MRA was for a while. I think x8.11 is supposed to be the release that the forward-proxy is officially supported for APNS.
On Thu, Aug 2, 2018 at 3:15 PM Lelio Fulgenzi <[email protected]> wrote: > I _thought_ I remember reading about that. That would have been my > preference! > > 8.10/8.11 womp womp womp > > CAUTION: At present the built-in Expressway forward proxy is not suitable > for use with Cisco Unified > Communications Manager and/or IM and Presence Service, and is not > supported for those products. The > forward proxy is in the Expressway user interface, but it should not be > used. This means that if you > require a forward proxy deployment, you need to use a suitable third-party > HTTPS proxy. > > But is this referring to any forward proxy stuff or just non-APNS proxy? > > > --- > Lelio Fulgenzi, B.A. | Senior Analyst > Computing and Communications Services | University of Guelph > Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | > N1G 2W1 > 519-824-4120 Ext. 56354 | [email protected] > > www.uoguelph.ca/ccs | @UofGCCS on Instagram, Twitter and Facebook > > > > -----Original Message----- > From: Patrick Robitaille <[email protected]> > Sent: Thursday, August 2, 2018 2:08 PM > To: Lelio Fulgenzi <[email protected]> > Cc: Matthew Loraditch <[email protected]>; voyp list, > cisco-voip ([email protected]) <[email protected]> > Subject: Re: [cisco-voip] setting up access for APNS - granular vs wide > open internet access > > Check out release notes for Expressways too as they’re planning forward > proxy for this purpose as well. > > - - - > Patrick Robitaille, [email protected]<mailto: > [email protected]> > O: (203) 742-3797 | C: (203) 914-9572 > > > On Aug 2, 2018, at 12:42 PM, Lelio Fulgenzi <[email protected]<mailto: > [email protected]>> wrote: > > Thanks Matthew – we’re on v11.5, so I’ll try to drum up the similar > chapter. > > I’m not sure we’ve got URL based firewall rules implemented or available. > I will have to ask. > > Good to hear you’ve not had problems with outbound access. > > As far as smart licensing is concerned, we were ok using the proxy there, > since it would be ok if it went down. If we open up complete access though, > the need for that goes away. > > > > --- > Lelio Fulgenzi, B.A. | Senior Analyst > Computing and Communications Services | University of Guelph Room 037 > Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1 > 519-824-4120 Ext. 56354 | [email protected]<mailto:[email protected]> > > www.uoguelph.ca/ccs<http://www.uoguelph.ca/ccs> | @UofGCCS on Instagram, > Twitter and Facebook > > <image001.png> > > From: Matthew Loraditch <[email protected]<mailto: > [email protected]>> > Sent: Thursday, August 2, 2018 12:33 PM > To: Lelio Fulgenzi <[email protected]<mailto:[email protected]>>; voyp > list, cisco-voip ([email protected]<mailto: > [email protected]>) <[email protected]<mailto: > [email protected]>> > Subject: RE: setting up access for APNS - granular vs wide open internet > access > > See page 5 here: > https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/12_0_1/systemConfig/cucm_b_system-configuration-guide-1201/cucm_b_system-configuration-guide-1201_chapter_01011000.pdf > > For what servers your servers will need to talk to, if you can do URL > based firewall rules that would work. > > If not the servers are all Cisco’s and in the Webex cloud so the IP blocks > aren’t that many: https://collaborationhelp.cisco.com/article/en-us/WBX264 > Now I’m not 100% certain if ALL webex services fall within those IPs. That > article is designed for Teams and Meetings. > > I will add I’ve never operated in an environment as tight/regulated as > yours, but I have 23 clusters that have been able to talk outbound to > internet since their beginnings and never had an issue that had to do with > that. > > Also you are going to have to think about this internet thing again when > you go to 12.x+ and smart licensing so you may want to look up those > requirements as well. A few more options exist there where going offline > intermittently isn’t as much of a deal. > > > > > > > Matthew Loraditch > > Sr. Network Engineer > > > p: 443.541.1518<tel:443.541.1518> > > > > w: www.heliontechnologies.com<http://www.heliontechnologies.com/> > > | > > e: [email protected]<mailto: > [email protected]> > > > <image002.png> > > > <image003.png><https://facebook.com/heliontech> > > > > <image004.png><https://twitter.com/heliontech> > > > <image005.png><https://www.linkedin.com/company/helion-technologies> > > > > > > <image006.jpg>< > https://heliontechnologies.com/events/14th-annual-automotive-cx-summit-hosted-thought-leadership-summits/ > > > > > > > From: cisco-voip <[email protected]<mailto: > [email protected]>> On Behalf Of Lelio Fulgenzi > Sent: Thursday, August 2, 2018 11:58 AM > To: voyp list, cisco-voip ([email protected]<mailto: > [email protected]>) <[email protected]<mailto: > [email protected]>> > Subject: [cisco-voip] setting up access for APNS - granular vs wide open > internet access > > > Another issue we are facing is setting up the collaboration servers (CUCM, > IMP) to talk out of our private network to the internet to talk to Cisco > and Apple servers. > > Just wondering what others have been doing. > > Our networking team has suggested the simplest way would be to add a PAT > rule at our edge for the servers (or network) so that they can communicate > out to the internet as required. There would be no ACLs applied, so they > could talk to anywhere. By applying the PAT on the edge, all internal > communications would continue with the internal addressing. The PAT would > only allow established communications – no outside-to-inside initiated talk > allowed. > > The other alternative would be to put a bunch of xlate’s on our data > centre firewall, one for each source collab server and cisco/apple dest > pair – this could be 10s of statements. > > The first means I have no control over who the servers can talk to on the > internet. Which scares me. > > The second would mean quite a bit of extra upfront work, and managing > those statements if/when Cisco and apple update their ip addresses. > > There is the proxy option, but the current proxy service we have is likely > not to be considered mission critical and attaching the APNS configuration > to this likely wouldn’t go over well. > > What have others done in this situation? > > Thanks! > > > --- > Lelio Fulgenzi, B.A. | Senior Analyst > Computing and Communications Services | University of Guelph Room 037 > Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1 > 519-824-4120 Ext. 56354 | [email protected]<mailto:[email protected]> > > www.uoguelph.ca/ccs<http://www.uoguelph.ca/ccs> | @UofGCCS on Instagram, > Twitter and Facebook > > <image001.png> > > _______________________________________________ > cisco-voip mailing list > [email protected]<mailto:[email protected]> > https://puck.nether.net/mailman/listinfo/cisco-voip > > ________________________________ > > Disclaimer: This e-mail may contain confidential and/or privileged > information. If you are not the intended recipient or have received this > e-mail in error, please notify the sender immediately and destroy/delete > this e-mail. You are hereby notified that any unauthorized copying, > disclosure or distribution of the material in this e-mail is strictly > prohibited. > > AQR Capital Management, LLC, along with its affiliates (collectively > "AQR") may collect certain personal information from you. AQR operates > pursuant to a Global Privacy Policy which describes the types of personal > information we obtain, how we use the information, with whom we share it > and the choices available to you regarding our use of the information. We > also describe the measures we take to protect the security of the > information and how you can contact us about our privacy practices. By > providing your personal information you agree to do so pursuant to the > Global Privacy Policy. For a copy of the Global Privacy Policy please click > here<https://www.aqr.com/Privacy-Policy>. > > This communication is for informational purposes only. It is not intended > as an offer or solicitation for the purchase or sale of any financial > instrument or as an official confirmation of any transaction. All > information contained in this communication is not warranted as to > completeness or accuracy and is subject to change without notice. Any > comments or statements made in this communication do not necessarily > reflect those of AQR Capital Management, LLC and its affiliates. > _______________________________________________ > cisco-voip mailing list > [email protected] > https://puck.nether.net/mailman/listinfo/cisco-voip >
_______________________________________________ cisco-voip mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-voip
