WEBVTT 00:00:00.000 --> 00:00:03.472 align:middle line:90% 00:00:03.472 --> 00:00:06.944 align:middle line:90% [AUDIO LOGO] 00:00:06.944 --> 00:00:09.930 align:middle line:90% 00:00:09.930 --> 00:00:12.035 align:middle line:90% Hello, and welcome to INE. 00:00:12.035 --> 00:00:13.410 align:middle line:84% Today in this video, we will look 00:00:13.410 --> 00:00:16.650 align:middle line:84% at the Cisco Expressway, basically, section 5. 00:00:16.650 --> 00:00:20.280 align:middle line:84% And here in this video, we will look at the solution 00:00:20.280 --> 00:00:23.230 align:middle line:90% for section 5.1. 00:00:23.230 --> 00:00:25.680 align:middle line:84% Now, if you look at this task, it 00:00:25.680 --> 00:00:30.960 align:middle line:84% says INE has decided to allow some users to work from home. 00:00:30.960 --> 00:00:35.550 align:middle line:84% And to accomplish this, you have suggested MRA as a solution. 00:00:35.550 --> 00:00:39.030 align:middle line:84% Provision the Expressway Core, Expressway Edge, 00:00:39.030 --> 00:00:43.110 align:middle line:84% the HQ call manager, and the HQ-IM_P with a signed 00:00:43.110 --> 00:00:47.100 align:middle line:84% certificate from the internal CA server whose IP address is 00:00:47.100 --> 00:00:50.430 align:middle line:90% 11.100.64.9. 00:00:50.430 --> 00:00:54.240 align:middle line:84% Expressway should serve as the domain ine.com. 00:00:54.240 --> 00:00:55.840 align:middle line:90% Now this is what is required. 00:00:55.840 --> 00:01:00.060 align:middle line:84% Now looking at this question, I gauge an information 00:01:00.060 --> 00:01:03.510 align:middle line:84% that the connection between the Expressway Core 00:01:03.510 --> 00:01:07.590 align:middle line:84% and the call manager and the IM&P is going to be using TLS. 00:01:07.590 --> 00:01:09.060 align:middle line:84% Because the reason they're asking 00:01:09.060 --> 00:01:11.850 align:middle line:84% you to do a sign certificate it basically 00:01:11.850 --> 00:01:15.960 align:middle line:84% means that they are going to be verifying each other using TLS. 00:01:15.960 --> 00:01:19.120 align:middle line:90% So let's quickly go and do this. 00:01:19.120 --> 00:01:21.390 align:middle line:84% So the first thing that I'm going to do 00:01:21.390 --> 00:01:26.550 align:middle line:84% is I am going to access my call manager, 00:01:26.550 --> 00:01:30.240 align:middle line:84% and I will download the root CA certificate. 00:01:30.240 --> 00:01:32.760 align:middle line:84% So we need to install the root CA certificate 00:01:32.760 --> 00:01:36.090 align:middle line:84% on the Expressway Core, on the Expressway Edge, 00:01:36.090 --> 00:01:39.870 align:middle line:84% on the call manager, and on IM&P. For call manager, 00:01:39.870 --> 00:01:41.760 align:middle line:84% it's going to be for tomcat-trust. 00:01:41.760 --> 00:01:45.570 align:middle line:84% For IM&P, it's going to be tomcat-trust and 00:01:45.570 --> 00:01:48.040 align:middle line:90% cup-xmpp-trust. 00:01:48.040 --> 00:01:49.680 align:middle line:84% So let's quickly go and build that. 00:01:49.680 --> 00:01:56.160 align:middle line:90% 00:01:56.160 --> 00:02:00.065 align:middle line:90% So let's access the browser. 00:02:00.065 --> 00:02:04.430 align:middle line:90% 00:02:04.430 --> 00:02:07.150 align:middle line:90% Let's go to our Expressway Core. 00:02:07.150 --> 00:02:09.490 align:middle line:84% Let's do the Expressway Core and the Edge first. 00:02:09.490 --> 00:02:15.040 align:middle line:90% 00:02:15.040 --> 00:02:16.980 align:middle line:84% Now, one thing which is very extremely 00:02:16.980 --> 00:02:21.180 align:middle line:84% important for getting your certificate signed is your NTP. 00:02:21.180 --> 00:02:24.150 align:middle line:90% Your time should sync correctly. 00:02:24.150 --> 00:02:29.520 align:middle line:84% If you look at the Expressway C and the Expressway Core, 00:02:29.520 --> 00:02:33.870 align:middle line:84% the time is shown at the bottom of the screen 00:02:33.870 --> 00:02:35.850 align:middle line:84% where once you log in, you would see 00:02:35.850 --> 00:02:38.580 align:middle line:84% the time that what time zone you are in 00:02:38.580 --> 00:02:40.600 align:middle line:90% and what is the current time. 00:02:40.600 --> 00:02:43.380 align:middle line:84% So let's go next with the Expressway Core. 00:02:43.380 --> 00:02:47.040 align:middle line:90% Let's also access Expressway C-- 00:02:47.040 --> 00:02:52.380 align:middle line:84% oh, Expressway E. And let's also open up our internal server 00:02:52.380 --> 00:02:55.350 align:middle line:84% and internal CA server, which is right here. 00:02:55.350 --> 00:03:02.170 align:middle line:90% 00:03:02.170 --> 00:03:04.980 align:middle line:90% Let's sign in. 00:03:04.980 --> 00:03:06.720 align:middle line:90% Sign in to our Expressway Edge. 00:03:06.720 --> 00:03:10.100 align:middle line:90% 00:03:10.100 --> 00:03:12.380 align:middle line:84% Now, if you see here at the bottom, 00:03:12.380 --> 00:03:19.810 align:middle line:84% you see that the current time is 4:00 PM, 4:02 PM PST, which is 00:03:19.810 --> 00:03:22.400 align:middle line:90% the time on your NTP as well. 00:03:22.400 --> 00:03:26.170 align:middle line:84% I believe the NTP server is switch 1, which 00:03:26.170 --> 00:03:27.310 align:middle line:90% is preconfigured. 00:03:27.310 --> 00:03:29.980 align:middle line:84% So switch 1's is NTP server, my CA server 00:03:29.980 --> 00:03:31.630 align:middle line:90% is taking time from switch 1. 00:03:31.630 --> 00:03:36.460 align:middle line:84% My Expressway C, Expressway Core, and Expressway Edge they 00:03:36.460 --> 00:03:39.750 align:middle line:84% all are taking time from switch 1 who is the NTP server. 00:03:39.750 --> 00:03:41.170 align:middle line:90% So my time is synced. 00:03:41.170 --> 00:03:43.930 align:middle line:84% But let's say in the lab exam, if your NTP is not 00:03:43.930 --> 00:03:45.700 align:middle line:84% synced, your CA server certificate, 00:03:45.700 --> 00:03:47.560 align:middle line:84% sign certificate is going to fail, 00:03:47.560 --> 00:03:49.520 align:middle line:84% you would not be able to install that. 00:03:49.520 --> 00:03:50.830 align:middle line:90% So be careful with that. 00:03:50.830 --> 00:03:53.590 align:middle line:84% Make sure your NTP is synced before you actually 00:03:53.590 --> 00:03:55.475 align:middle line:90% get your certificate signed. 00:03:55.475 --> 00:03:57.100 align:middle line:84% So the first thing what I'm going to do 00:03:57.100 --> 00:04:01.960 align:middle line:84% is go to Expressway Core, go to Configuration. 00:04:01.960 --> 00:04:08.480 align:middle line:84% And I would go to Unified Communication, Configuration, 00:04:08.480 --> 00:04:10.790 align:middle line:90% and enable MRA. 00:04:10.790 --> 00:04:11.840 align:middle line:90% Let's enable that. 00:04:11.840 --> 00:04:14.590 align:middle line:90% 00:04:14.590 --> 00:04:18.029 align:middle line:84% So let's do mobile and remote access. 00:04:18.029 --> 00:04:24.900 align:middle line:84% And here, I would basically turn authorize by OAuth, 00:04:24.900 --> 00:04:27.750 align:middle line:84% turn that off, because we are going to authenticate 00:04:27.750 --> 00:04:30.840 align:middle line:90% using user credentials. 00:04:30.840 --> 00:04:35.220 align:middle line:84% Turn this off, and make sure you turn the user credentials on. 00:04:35.220 --> 00:04:37.290 align:middle line:90% That's the first thing we do. 00:04:37.290 --> 00:04:38.235 align:middle line:90% Let's Save this. 00:04:38.235 --> 00:04:42.710 align:middle line:90% 00:04:42.710 --> 00:04:46.790 align:middle line:84% The next thing that I'm going to do is go to Maintenance, 00:04:46.790 --> 00:04:52.160 align:middle line:84% go to Security, Trusted CA Certificate, 00:04:52.160 --> 00:04:55.370 align:middle line:84% and upload the root CA certificate. 00:04:55.370 --> 00:04:57.380 align:middle line:84% The root CA certificate is going-- to we 00:04:57.380 --> 00:04:59.030 align:middle line:84% have to get that from the CA server. 00:04:59.030 --> 00:05:04.460 align:middle line:84% So click on the CA Server, go to Download a CA Certificate. 00:05:04.460 --> 00:05:05.135 align:middle line:90% Click on that. 00:05:05.135 --> 00:05:10.330 align:middle line:90% 00:05:10.330 --> 00:05:13.358 align:middle line:84% They should download the root CA certificate locally 00:05:13.358 --> 00:05:14.025 align:middle line:90% on your machine. 00:05:14.025 --> 00:05:18.970 align:middle line:90% 00:05:18.970 --> 00:05:20.620 align:middle line:90% And click on Base 64. 00:05:20.620 --> 00:05:23.560 align:middle line:84% See, the basic difference between DER and Base 64 00:05:23.560 --> 00:05:26.090 align:middle line:84% is that the Base 64 is unencrypted. 00:05:26.090 --> 00:05:28.700 align:middle line:84% So it's easy to read when you open it. 00:05:28.700 --> 00:05:33.910 align:middle line:84% So let's choose Base 64 and download CA certificate. 00:05:33.910 --> 00:05:47.200 align:middle line:90% 00:05:47.200 --> 00:05:50.830 align:middle line:84% Once we have this downloaded, let's go and open this 00:05:50.830 --> 00:05:53.870 align:middle line:90% in the folder. 00:05:53.870 --> 00:05:56.270 align:middle line:84% Let's rename this file, and let's name 00:05:56.270 --> 00:05:58.890 align:middle line:90% this as root certificate. 00:05:58.890 --> 00:06:05.950 align:middle line:84% So let's just rename this file as root. 00:06:05.950 --> 00:06:08.320 align:middle line:84% And now we will go and upload this certificate 00:06:08.320 --> 00:06:13.450 align:middle line:84% on our Expressway C. So go and Browse. 00:06:13.450 --> 00:06:22.070 align:middle line:90% 00:06:22.070 --> 00:06:24.110 align:middle line:84% And let's append the CA certificate. 00:06:24.110 --> 00:06:28.460 align:middle line:84% So this should have this, the root CA certificate installed 00:06:28.460 --> 00:06:32.420 align:middle line:84% on your Expressway C, which you can see here 00:06:32.420 --> 00:06:37.520 align:middle line:84% that the validity is up to June 21, 2027. 00:06:37.520 --> 00:06:39.710 align:middle line:90% It's approximately five years. 00:06:39.710 --> 00:06:44.120 align:middle line:84% And the same thing we would do on Expressway Edge. 00:06:44.120 --> 00:06:49.280 align:middle line:84% So go to Configuration and enable unified communication. 00:06:49.280 --> 00:06:52.670 align:middle line:84% See, the main reason why we want to enable unified communication 00:06:52.670 --> 00:06:55.130 align:middle line:84% on the Expressway C and Expressway E 00:06:55.130 --> 00:06:57.530 align:middle line:84% is because we want the domain name 00:06:57.530 --> 00:06:59.990 align:middle line:90% to be included in the certs. 00:06:59.990 --> 00:07:06.710 align:middle line:84% So if I go back to Maintenance and go to Security 00:07:06.710 --> 00:07:09.170 align:middle line:84% and go to Server Certificate, you 00:07:09.170 --> 00:07:12.170 align:middle line:84% would see that when I click on Generate CSR, 00:07:12.170 --> 00:07:15.090 align:middle line:84% I don't have the option of domain name. 00:07:15.090 --> 00:07:18.440 align:middle line:84% So if you see here, let's say if I click on Generate CSR, 00:07:18.440 --> 00:07:21.450 align:middle line:84% you will see I don't get the option of including the domain 00:07:21.450 --> 00:07:21.950 align:middle line:90% name. 00:07:21.950 --> 00:07:23.658 align:middle line:84% If you look at the question, the question 00:07:23.658 --> 00:07:27.740 align:middle line:84% says that the Expressway should serve as the domain ine.com. 00:07:27.740 --> 00:07:30.200 align:middle line:84% So I don't get the option of specifying 00:07:30.200 --> 00:07:33.710 align:middle line:84% the domain name, which needs to be included in the certificate. 00:07:33.710 --> 00:07:36.800 align:middle line:84% Because for our traversal zone between the Expressway C 00:07:36.800 --> 00:07:40.550 align:middle line:84% and Expressway Edge, we require the domain name 00:07:40.550 --> 00:07:43.080 align:middle line:90% to be there in the certificate. 00:07:43.080 --> 00:07:44.550 align:middle line:90% So it does not really show up. 00:07:44.550 --> 00:07:46.430 align:middle line:84% So we need to go back to Configuration, 00:07:46.430 --> 00:07:49.820 align:middle line:84% Unified Communication, Configuration 00:07:49.820 --> 00:07:52.550 align:middle line:84% and enable the mobile and remote access. 00:07:52.550 --> 00:07:54.590 align:middle line:84% Once you enable this, there's no settings 00:07:54.590 --> 00:07:56.990 align:middle line:84% that we need to change here on Expressway Edge. 00:07:56.990 --> 00:08:01.580 align:middle line:84% On Expressway Core, we had to change that to use local user 00:08:01.580 --> 00:08:03.530 align:middle line:90% credentials inside of OAuth. 00:08:03.530 --> 00:08:05.232 align:middle line:84% But for Expressway Edge, we don't really 00:08:05.232 --> 00:08:06.065 align:middle line:90% have to do anything. 00:08:06.065 --> 00:08:09.080 align:middle line:90% 00:08:09.080 --> 00:08:11.570 align:middle line:90% Let's Save this. 00:08:11.570 --> 00:08:12.350 align:middle line:90% Excuse me. 00:08:12.350 --> 00:08:15.580 align:middle line:90% 00:08:15.580 --> 00:08:18.040 align:middle line:84% Now that we've saved this, let's go and upload 00:08:18.040 --> 00:08:20.860 align:middle line:84% the certificate of the CA server. 00:08:20.860 --> 00:08:26.920 align:middle line:84% So let's go to Trusted CA and browse with the root CA 00:08:26.920 --> 00:08:31.040 align:middle line:90% certificate and append. 00:08:31.040 --> 00:08:34.020 align:middle line:84% So now both Expressway C and Expressway Edge, 00:08:34.020 --> 00:08:36.980 align:middle line:84% they both have the root CA certificate. 00:08:36.980 --> 00:08:40.280 align:middle line:84% Now we need to get our certificate signed. 00:08:40.280 --> 00:08:43.940 align:middle line:84% To get that signed, the first thing we would do 00:08:43.940 --> 00:08:46.700 align:middle line:84% is go to Maintenance, go to Security, 00:08:46.700 --> 00:08:48.770 align:middle line:90% go to Server Certificate. 00:08:48.770 --> 00:08:52.790 align:middle line:84% So we are on the Expressway Edge right now. 00:08:52.790 --> 00:08:57.230 align:middle line:84% And we would click on Generate CSR. 00:08:57.230 --> 00:09:02.960 align:middle line:84% Here, I would put the FQDN, the internal FQDN. 00:09:02.960 --> 00:09:04.670 align:middle line:84% So one thing that you need to know 00:09:04.670 --> 00:09:08.570 align:middle line:84% is for the Expressway E or the Expressway Edge, 00:09:08.570 --> 00:09:13.550 align:middle line:84% we need the external FQDN that resolves the WAN IP address. 00:09:13.550 --> 00:09:16.370 align:middle line:84% Let's say, if you were using the dual link, 00:09:16.370 --> 00:09:20.700 align:middle line:84% dual link deployment, on our Expressway, we have two links. 00:09:20.700 --> 00:09:23.120 align:middle line:84% One is the LAN side interface and one is the WAN side 00:09:23.120 --> 00:09:23.940 align:middle line:90% interface. 00:09:23.940 --> 00:09:26.390 align:middle line:84% So in your signed certificate, we 00:09:26.390 --> 00:09:31.490 align:middle line:84% need the FQDN which resolves to the WAN IP address. 00:09:31.490 --> 00:09:35.000 align:middle line:84% We also need the FQDN that results to the LAN IP address, 00:09:35.000 --> 00:09:36.720 align:middle line:90% and we need the domain name. 00:09:36.720 --> 00:09:39.590 align:middle line:84% So right now if I go back to System 00:09:39.590 --> 00:09:43.700 align:middle line:84% and look at my FQDN of this machine, 00:09:43.700 --> 00:09:45.290 align:middle line:84% of this Expressway Edge, you will 00:09:45.290 --> 00:09:48.830 align:middle line:84% see that the name is coedge.ine.com. 00:09:48.830 --> 00:09:52.440 align:middle line:84% Coedge.ine.com results to the WAN IP address. 00:09:52.440 --> 00:09:55.820 align:middle line:84% That's why if you go back to Maintenance, Security, 00:09:55.820 --> 00:09:58.670 align:middle line:84% and Server Certificate, you would 00:09:58.670 --> 00:10:01.370 align:middle line:84% see when I click on Generate CSR, 00:10:01.370 --> 00:10:04.220 align:middle line:90% it shows the coedge.ine.com. 00:10:04.220 --> 00:10:07.550 align:middle line:84% So this is going to be included in your signed cert. 00:10:07.550 --> 00:10:11.490 align:middle line:84% Now, we also want the LAN side IP address. 00:10:11.490 --> 00:10:13.310 align:middle line:84% So that's going to be hq-expwe.ine.com. 00:10:13.310 --> 00:10:17.810 align:middle line:90% 00:10:17.810 --> 00:10:19.790 align:middle line:90% Now, how do I know this FQDN? 00:10:19.790 --> 00:10:22.670 align:middle line:84% If you go back to your DNS machine, 00:10:22.670 --> 00:10:26.990 align:middle line:84% the internal DNS whose IP is 11.100.64.9, 00:10:26.990 --> 00:10:29.190 align:middle line:84% if you go back to this machine here, 00:10:29.190 --> 00:10:32.190 align:middle line:84% which is the internal DNS, and let's access that, 00:10:32.190 --> 00:10:39.410 align:middle line:84% and if you look at the A record, the FQDN is hq-expwe.ine.com. 00:10:39.410 --> 00:10:40.880 align:middle line:90% Let's go and verify that. 00:10:40.880 --> 00:10:48.430 align:middle line:90% 00:10:48.430 --> 00:10:51.830 align:middle line:84% So let's go to Forward Lookup Zones, ine.com. 00:10:51.830 --> 00:10:57.015 align:middle line:84% And if you see here, the name is hq-expwe, 00:10:57.015 --> 00:11:00.390 align:middle line:84% and the domain is ine.com, which you can see here 00:11:00.390 --> 00:11:03.150 align:middle line:90% hq-expwe.ine.com. 00:11:03.150 --> 00:11:08.190 align:middle line:84% And that is the directory that points to the internal IP 00:11:08.190 --> 00:11:10.200 align:middle line:90% address of Expressway E. 00:11:10.200 --> 00:11:13.680 align:middle line:84% See, the traversal zone between the Expressway C and Expressway 00:11:13.680 --> 00:11:17.310 align:middle line:84% E is going to use the internal IP address or the LAN side IP 00:11:17.310 --> 00:11:18.100 align:middle line:90% address. 00:11:18.100 --> 00:11:23.830 align:middle line:84% That's why we need to include the LAN side FQDN in the certs. 00:11:23.830 --> 00:11:27.150 align:middle line:84% So this is going to be at hq-expwe.ine.com. 00:11:27.150 --> 00:11:29.850 align:middle line:84% And if you see this option here, the domain, 00:11:29.850 --> 00:11:33.330 align:middle line:84% we got this option because we turned on MRA. 00:11:33.330 --> 00:11:35.380 align:middle line:90% So now we have this option. 00:11:35.380 --> 00:11:38.100 align:middle line:84% Let's specify the domain, ine.com. 00:11:38.100 --> 00:11:44.560 align:middle line:84% Let's scroll down and specify the country. 00:11:44.560 --> 00:11:48.850 align:middle line:84% Country is going to be US, California. 00:11:48.850 --> 00:11:50.230 align:middle line:90% Let's choose San Diego. 00:11:50.230 --> 00:11:57.700 align:middle line:90% 00:11:57.700 --> 00:12:04.730 align:middle line:84% And what happened to my certificate? 00:12:04.730 --> 00:12:07.832 align:middle line:90% 00:12:07.832 --> 00:12:09.470 align:middle line:90% Let's discard the CSR. 00:12:09.470 --> 00:12:14.540 align:middle line:90% 00:12:14.540 --> 00:12:39.390 align:middle line:84% Go back to Generate and specify hq-expwe.ine.com and US, 00:12:39.390 --> 00:12:45.940 align:middle line:90% California, San Diego. 00:12:45.940 --> 00:12:53.400 align:middle line:84% The company name would be INE LLC, and organization, 00:12:53.400 --> 00:12:57.460 align:middle line:90% let's say collaboration. 00:12:57.460 --> 00:13:00.040 align:middle line:90% And let's generate the CSR. 00:13:00.040 --> 00:13:04.870 align:middle line:84% Now, once we generate the CSR, we will look at show PEM. 00:13:04.870 --> 00:13:07.720 align:middle line:90% We get the CSR file. 00:13:07.720 --> 00:13:08.520 align:middle line:90% Let's copy this. 00:13:08.520 --> 00:13:14.480 align:middle line:90% 00:13:14.480 --> 00:13:32.750 align:middle line:84% Go back to my CA server, which is here, 00:13:32.750 --> 00:13:34.160 align:middle line:90% and let's go back to home. 00:13:34.160 --> 00:13:48.820 align:middle line:90% 00:13:48.820 --> 00:13:52.460 align:middle line:90% And let's request a certificate. 00:13:52.460 --> 00:13:57.145 align:middle line:84% Go to Advance Certificate Request, paste your CSR. 00:13:57.145 --> 00:14:00.400 align:middle line:90% 00:14:00.400 --> 00:14:02.380 align:middle line:84% And the client server certificate 00:14:02.380 --> 00:14:05.000 align:middle line:84% is going to be client server authentication. 00:14:05.000 --> 00:14:08.140 align:middle line:84% So your certificate template is client server authentication. 00:14:08.140 --> 00:14:10.060 align:middle line:84% The reason we need this, if you do not 00:14:10.060 --> 00:14:13.210 align:middle line:84% select lines of authentication, the Expressway C and Expressway 00:14:13.210 --> 00:14:16.480 align:middle line:84% E would give an error saying that client 00:14:16.480 --> 00:14:18.758 align:middle line:84% certificate-- the client server certificate required. 00:14:18.758 --> 00:14:20.300 align:middle line:84% So if you choose some other template, 00:14:20.300 --> 00:14:21.600 align:middle line:90% it's not going to work. 00:14:21.600 --> 00:14:24.190 align:middle line:84% So select Client Server Authentication 00:14:24.190 --> 00:14:25.585 align:middle line:90% and click on Submit. 00:14:25.585 --> 00:14:36.570 align:middle line:90% 00:14:36.570 --> 00:14:38.730 align:middle line:84% Now once you click on Submit, you 00:14:38.730 --> 00:14:40.260 align:middle line:90% should get your signed cert. 00:14:40.260 --> 00:14:41.160 align:middle line:90% Let's download that. 00:14:41.160 --> 00:14:44.970 align:middle line:84% Again, select Base 64 and click on Download Certificate. 00:14:44.970 --> 00:14:48.450 align:middle line:84% So now your certificate is downloaded on this machine. 00:14:48.450 --> 00:14:53.130 align:middle line:84% Let's go and open that up, and let's rename this 00:14:53.130 --> 00:15:06.600 align:middle line:90% to Expressway E. Expressway E. 00:15:06.600 --> 00:15:11.520 align:middle line:84% And let's upload this signed cert to our Expressway Core 00:15:11.520 --> 00:15:12.960 align:middle line:90% or Expressway Edge. 00:15:12.960 --> 00:15:19.350 align:middle line:84% So let's go back down to Browse and upload 00:15:19.350 --> 00:15:24.180 align:middle line:84% the signed cert, which is expwe.cer, 00:15:24.180 --> 00:15:26.190 align:middle line:90% and click on Upload Certificate. 00:15:26.190 --> 00:15:28.290 align:middle line:84% It should ask me to reboot this machine. 00:15:28.290 --> 00:15:31.400 align:middle line:90% 00:15:31.400 --> 00:15:36.730 align:middle line:84% Let's accept this, Advance, scroll down, Accept. 00:15:36.730 --> 00:15:39.532 align:middle line:84% And it should ask me to restart this box. 00:15:39.532 --> 00:15:40.615 align:middle line:90% So let's click on Restart. 00:15:40.615 --> 00:15:47.220 align:middle line:90% 00:15:47.220 --> 00:15:49.420 align:middle line:90% And Expressway Edge is done. 00:15:49.420 --> 00:15:52.140 align:middle line:84% Let's do the same thing for Expressway Core. 00:15:52.140 --> 00:15:56.070 align:middle line:84% So on Expressway Core, I would go to Maintenance, 00:15:56.070 --> 00:15:59.280 align:middle line:84% again, Security, Server Certificate. 00:15:59.280 --> 00:16:02.530 align:middle line:84% On Expressway Core, we only have one NIC. 00:16:02.530 --> 00:16:07.860 align:middle line:84% So the only thing we need is the FQDN 00:16:07.860 --> 00:16:11.230 align:middle line:84% that resolves to the one NIC that we have, 00:16:11.230 --> 00:16:12.930 align:middle line:90% which is already here. 00:16:12.930 --> 00:16:15.120 align:middle line:84% This is generated based on the system hostname. 00:16:15.120 --> 00:16:19.350 align:middle line:84% So my system hostname is hq-expwe.ine.com. 00:16:19.350 --> 00:16:20.340 align:middle line:90% That's all we need. 00:16:20.340 --> 00:16:22.830 align:middle line:84% We don't need to specify anything here. 00:16:22.830 --> 00:16:26.970 align:middle line:84% And let's scroll down, click on US 00:16:26.970 --> 00:16:34.620 align:middle line:84% as the country, California, San Diego, company name as INE, 00:16:34.620 --> 00:16:40.200 align:middle line:84% and organization as collaboration. 00:16:40.200 --> 00:16:47.490 align:middle line:84% Let's go and generate the CSR, and let's do a show PEM. 00:16:47.490 --> 00:16:48.915 align:middle line:90% Copy the CSR contents. 00:16:48.915 --> 00:16:56.630 align:middle line:90% 00:16:56.630 --> 00:17:05.180 align:middle line:84% And let's go back to our CA server. 00:17:05.180 --> 00:17:05.764 align:middle line:90% Go to Home. 00:17:05.764 --> 00:17:14.700 align:middle line:90% 00:17:14.700 --> 00:17:19.319 align:middle line:84% And again, we would request to get the certificate signed. 00:17:19.319 --> 00:17:23.580 align:middle line:84% So Request Certificate, Advance Certificate Request. 00:17:23.580 --> 00:17:26.099 align:middle line:90% 00:17:26.099 --> 00:17:31.600 align:middle line:84% Now let's paste the contents, select Client Server 00:17:31.600 --> 00:17:34.365 align:middle line:90% Authentication, and Submit. 00:17:34.365 --> 00:17:37.180 align:middle line:90% 00:17:37.180 --> 00:17:42.480 align:middle line:84% It says that your request was invalid. 00:17:42.480 --> 00:17:46.050 align:middle line:90% Certificate contained bad data. 00:17:46.050 --> 00:17:50.620 align:middle line:90% Let's go back to my-- 00:17:50.620 --> 00:18:02.000 align:middle line:90% 00:18:02.000 --> 00:18:03.020 align:middle line:90% let's go back here. 00:18:03.020 --> 00:18:20.330 align:middle line:90% 00:18:20.330 --> 00:18:22.030 align:middle line:90% I believe it is in Downloads. 00:18:22.030 --> 00:18:25.710 align:middle line:90% 00:18:25.710 --> 00:18:28.515 align:middle line:84% I want to go back here and just do a show PEM. 00:18:28.515 --> 00:18:31.410 align:middle line:90% 00:18:31.410 --> 00:18:33.450 align:middle line:90% Maybe I didn't copy it right. 00:18:33.450 --> 00:18:35.340 align:middle line:84% We have to copy the whole thing all the way 00:18:35.340 --> 00:18:40.915 align:middle line:84% from the begin certificate request to the end certificate 00:18:40.915 --> 00:18:41.415 align:middle line:90% request. 00:18:41.415 --> 00:18:48.140 align:middle line:90% 00:18:48.140 --> 00:18:48.730 align:middle line:90% Let's copy. 00:18:48.730 --> 00:18:52.740 align:middle line:90% 00:18:52.740 --> 00:18:56.475 align:middle line:90% Let's go back to our CA server. 00:18:56.475 --> 00:19:13.120 align:middle line:90% 00:19:13.120 --> 00:19:29.930 align:middle line:84% Let's go back to home, Request Certificate, 00:19:29.930 --> 00:19:32.430 align:middle line:90% Advance Certificate Request. 00:19:32.430 --> 00:19:39.130 align:middle line:84% Let's paste, Client Server Authentication, and Submit. 00:19:39.130 --> 00:19:51.270 align:middle line:90% 00:19:51.270 --> 00:19:55.750 align:middle line:84% All right, let's download the certificate, Base 64. 00:19:55.750 --> 00:20:02.750 align:middle line:90% 00:20:02.750 --> 00:20:22.000 align:middle line:84% Let's rename this file to Expressway C, Expressway C, 00:20:22.000 --> 00:20:23.965 align:middle line:84% and let's upload this signed cert. 00:20:23.965 --> 00:20:32.088 align:middle line:90% 00:20:32.088 --> 00:20:45.270 align:middle line:84% Let's scroll down, Browse, Expressway C, and then 00:20:45.270 --> 00:20:49.220 align:middle line:90% Upload Server Signed Cert. 00:20:49.220 --> 00:20:52.190 align:middle line:84% Now, again, once we do this, it should 00:20:52.190 --> 00:20:56.000 align:middle line:90% ask me to restart this box. 00:20:56.000 --> 00:20:59.780 align:middle line:90% Let's scroll down, Accept. 00:20:59.780 --> 00:21:01.280 align:middle line:84% And now it's asking me to restart. 00:21:01.280 --> 00:21:04.290 align:middle line:84% So Expressway C and Expressway Edge, 00:21:04.290 --> 00:21:07.250 align:middle line:84% they both are done with a signed cert, which 00:21:07.250 --> 00:21:10.250 align:middle line:84% means now Expressway C and Expressway E 00:21:10.250 --> 00:21:14.210 align:middle line:84% would trust each other using TLS. 00:21:14.210 --> 00:21:17.000 align:middle line:84% The same thing has to be done for the call manager 00:21:17.000 --> 00:21:20.420 align:middle line:84% and the IM&P. So let's now do the call manager. 00:21:20.420 --> 00:21:26.490 align:middle line:90% So let me open up IM&P here. 00:21:26.490 --> 00:21:29.540 align:middle line:84% And let's open up the call manager here. 00:21:29.540 --> 00:21:33.450 align:middle line:90% 00:21:33.450 --> 00:21:35.880 align:middle line:84% Now for the call manager, it's going to be the Tomcat. 00:21:35.880 --> 00:21:37.080 align:middle line:90% So let's go to-- 00:21:37.080 --> 00:21:38.610 align:middle line:90% let's log in first. 00:21:38.610 --> 00:21:40.560 align:middle line:90% Go to OS Administration. 00:21:40.560 --> 00:21:54.060 align:middle line:90% 00:21:54.060 --> 00:21:54.705 align:middle line:90% Log in. 00:21:54.705 --> 00:21:57.820 align:middle line:90% 00:21:57.820 --> 00:22:07.270 align:middle line:84% Same thing for IM&P. We would go to OS Administration. 00:22:07.270 --> 00:22:12.380 align:middle line:90% 00:22:12.380 --> 00:22:13.040 align:middle line:90% Log in. 00:22:13.040 --> 00:22:18.200 align:middle line:90% 00:22:18.200 --> 00:22:21.080 align:middle line:84% Again, you need to be really careful about the NTP. 00:22:21.080 --> 00:22:24.170 align:middle line:84% Make sure your call manager has the correct time. 00:22:24.170 --> 00:22:25.790 align:middle line:84% Otherwise, uploading your certificate, 00:22:25.790 --> 00:22:29.850 align:middle line:84% your signed certificate is going to fail. 00:22:29.850 --> 00:22:32.400 align:middle line:84% I already have NTP preconfigured. 00:22:32.400 --> 00:22:34.980 align:middle line:84% So you when you do the lab, you should 00:22:34.980 --> 00:22:37.090 align:middle line:84% see that the time is synced correctly, 00:22:37.090 --> 00:22:40.290 align:middle line:84% so you would not have a problem with uploading 00:22:40.290 --> 00:22:41.880 align:middle line:90% your signed certificate. 00:22:41.880 --> 00:22:46.690 align:middle line:90% 00:22:46.690 --> 00:22:48.330 align:middle line:84% So firstly what I'm going to do is 00:22:48.330 --> 00:22:51.450 align:middle line:84% I will start off with the IM&P. So I'll 00:22:51.450 --> 00:22:56.870 align:middle line:84% go to Security, Certificate Management, 00:22:56.870 --> 00:23:00.230 align:middle line:84% and upload the root CA certificate. 00:23:00.230 --> 00:23:02.220 align:middle line:84% We already have that in our Downloads file. 00:23:02.220 --> 00:23:08.870 align:middle line:84% So click on Tomcat-Trust and upload the root CA certificate. 00:23:08.870 --> 00:23:20.060 align:middle line:90% 00:23:20.060 --> 00:23:21.470 align:middle line:90% OK, let's upload this. 00:23:21.470 --> 00:23:25.280 align:middle line:90% 00:23:25.280 --> 00:23:26.900 align:middle line:84% Once I upload this, it should tell me 00:23:26.900 --> 00:23:29.630 align:middle line:84% that I need to restart my Tomcats, Tomcat service. 00:23:29.630 --> 00:23:31.860 align:middle line:90% But we can do that later on. 00:23:31.860 --> 00:23:34.820 align:middle line:84% So once you upload the root CA certificate to tomcat-trust, 00:23:34.820 --> 00:23:38.600 align:middle line:84% also upload this to cup-xmpp-trust. 00:23:38.600 --> 00:23:42.410 align:middle line:84% So scroll down to cup-xmpp-trust and upload the root CA 00:23:42.410 --> 00:23:43.595 align:middle line:90% certificate there as well. 00:23:43.595 --> 00:23:52.760 align:middle line:90% 00:23:52.760 --> 00:23:56.260 align:middle line:84% So on IM&P, we need the root CA certificate 00:23:56.260 --> 00:24:00.940 align:middle line:84% on two places, tomcat-trust and cup-xmpp-trust. 00:24:00.940 --> 00:24:01.825 align:middle line:90% Let's upload this. 00:24:01.825 --> 00:24:06.700 align:middle line:90% 00:24:06.700 --> 00:24:07.220 align:middle line:90% Done. 00:24:07.220 --> 00:24:10.630 align:middle line:84% Now, the next thing we need is to generate a CSR for Tomcat 00:24:10.630 --> 00:24:15.280 align:middle line:84% and one more CSR for cup-xmpp to get it signed. 00:24:15.280 --> 00:24:23.280 align:middle line:84% So let's go to Generate CSR and select Tomcat, just Tomcat, 00:24:23.280 --> 00:24:24.660 align:middle line:90% and Generate. 00:24:24.660 --> 00:24:31.660 align:middle line:90% 00:24:31.660 --> 00:24:33.920 align:middle line:90% Let's close this. 00:24:33.920 --> 00:24:37.480 align:middle line:90% Now click on Download CSR. 00:24:37.480 --> 00:24:40.190 align:middle line:84% You will see Tomcat inside this dropdown list 00:24:40.190 --> 00:24:44.300 align:middle line:84% because we just generated the CSR, and click on Download. 00:24:44.300 --> 00:24:49.160 align:middle line:90% 00:24:49.160 --> 00:24:51.410 align:middle line:84% Let's go back to our downloaded file. 00:24:51.410 --> 00:25:10.250 align:middle line:90% 00:25:10.250 --> 00:25:15.710 align:middle line:84% In the meanwhile, let's go back to my Active Directory machine 00:25:15.710 --> 00:25:19.630 align:middle line:90% and go to home. 00:25:19.630 --> 00:25:20.980 align:middle line:90% And let's go back here. 00:25:20.980 --> 00:25:24.270 align:middle line:90% 00:25:24.270 --> 00:25:28.640 align:middle line:90% Click on this Tomcat CSR. 00:25:28.640 --> 00:25:34.900 align:middle line:84% Let's go to the folder, and let's open this in a Notepad. 00:25:34.900 --> 00:25:45.220 align:middle line:90% 00:25:45.220 --> 00:25:46.150 align:middle line:90% Copy the contents. 00:25:46.150 --> 00:26:08.880 align:middle line:90% 00:26:08.880 --> 00:26:11.880 align:middle line:84% And let's go back to our CA server. 00:26:11.880 --> 00:26:17.360 align:middle line:84% Click on Request Certificate, Advanced. 00:26:17.360 --> 00:26:24.440 align:middle line:84% Paste the contents, Client Server Authentication, 00:26:24.440 --> 00:26:27.810 align:middle line:90% and Submit. 00:26:27.810 --> 00:26:29.160 align:middle line:90% Let's download the certificate. 00:26:29.160 --> 00:26:35.010 align:middle line:84% This is my IM&P's Tomcat signed certificate. 00:26:35.010 --> 00:26:59.160 align:middle line:84% Let's rename this file to IM&P, IM&P. 00:26:59.160 --> 00:27:02.250 align:middle line:84% And let's upload this certificate. 00:27:02.250 --> 00:27:07.690 align:middle line:84% So go back to certificate list on IM&P, upload certificate, 00:27:07.690 --> 00:27:09.970 align:middle line:90% and upload this to Tomcat. 00:27:09.970 --> 00:27:10.960 align:middle line:90% So let's browse. 00:27:10.960 --> 00:27:14.760 align:middle line:90% 00:27:14.760 --> 00:27:20.680 align:middle line:90% IM&P and upload. 00:27:20.680 --> 00:27:23.530 align:middle line:84% Next thing we would do is we would regenerate the CSR 00:27:23.530 --> 00:27:26.440 align:middle line:90% but this time for cup-xmpp. 00:27:26.440 --> 00:27:27.325 align:middle line:90% Let's close this. 00:27:27.325 --> 00:27:36.420 align:middle line:90% 00:27:36.420 --> 00:27:38.765 align:middle line:84% And now we would click on Generate CSR again. 00:27:38.765 --> 00:27:42.170 align:middle line:90% 00:27:42.170 --> 00:27:48.400 align:middle line:84% Select cup-xmpp and say Generate. 00:27:48.400 --> 00:27:55.360 align:middle line:90% 00:27:55.360 --> 00:28:00.550 align:middle line:84% Let's close this, go to Download CSR. 00:28:00.550 --> 00:28:03.730 align:middle line:84% And this time we select cup-xmpp. 00:28:03.730 --> 00:28:12.870 align:middle line:84% Download CSR, go back to your Downloads file. 00:28:12.870 --> 00:28:25.705 align:middle line:84% Let's open this up in Notepad, and let's copy this. 00:28:25.705 --> 00:28:40.420 align:middle line:90% 00:28:40.420 --> 00:28:43.045 align:middle line:84% Go back to your CA server and get it signed. 00:28:43.045 --> 00:28:50.160 align:middle line:90% 00:28:50.160 --> 00:28:56.260 align:middle line:84% Let's go to home, Request Certificate, 00:28:56.260 --> 00:28:59.880 align:middle line:90% Advance Certificate. 00:28:59.880 --> 00:29:04.830 align:middle line:84% Paste the contents, Clients Server Authentication, 00:29:04.830 --> 00:29:07.890 align:middle line:90% and Submit. 00:29:07.890 --> 00:29:09.770 align:middle line:90% Let's download the signed cert. 00:29:09.770 --> 00:29:14.230 align:middle line:90% 00:29:14.230 --> 00:29:22.340 align:middle line:84% Let's rename this file to cup-xmpp. 00:29:22.340 --> 00:29:24.530 align:middle line:84% Again, this file name could be really anything. 00:29:24.530 --> 00:29:31.430 align:middle line:90% 00:29:31.430 --> 00:29:36.010 align:middle line:84% So let's rename this to cup-xmpp, 00:29:36.010 --> 00:29:38.530 align:middle line:84% and let's upload that certificate. 00:29:38.530 --> 00:29:42.770 align:middle line:90% 00:29:42.770 --> 00:30:03.630 align:middle line:84% Select cup-xmpp, and let's Browse and Upload. 00:30:03.630 --> 00:30:04.680 align:middle line:90% IM&P is done. 00:30:04.680 --> 00:30:09.000 align:middle line:84% The only thing we need to do is restart Tomcat service 00:30:09.000 --> 00:30:13.090 align:middle line:90% and also restart XCP router. 00:30:13.090 --> 00:30:14.490 align:middle line:90% So that's what it says here. 00:30:14.490 --> 00:30:17.880 align:middle line:84% The Cisco XCP router service must be restarted in order 00:30:17.880 --> 00:30:19.240 align:middle line:90% to take effect. 00:30:19.240 --> 00:30:19.840 align:middle line:90% So that's it. 00:30:19.840 --> 00:30:21.750 align:middle line:90% That's all we need on IM&P. 00:30:21.750 --> 00:30:27.030 align:middle line:84% Let's go to call manager now and go to Security, Certificate 00:30:27.030 --> 00:30:28.050 align:middle line:90% Management. 00:30:28.050 --> 00:30:32.010 align:middle line:84% First thing we would do is upload the root CA certificate 00:30:32.010 --> 00:30:34.300 align:middle line:90% in the tomcat-trust. 00:30:34.300 --> 00:30:35.280 align:middle line:90% So let's upload that. 00:30:35.280 --> 00:30:39.770 align:middle line:90% 00:30:39.770 --> 00:31:03.379 align:middle line:84% Select Tomcat-Trust and upload the root CA certificate. 00:31:03.379 --> 00:31:11.050 align:middle line:90% 00:31:11.050 --> 00:31:13.300 align:middle line:84% So root CA certificate has been uploaded. 00:31:13.300 --> 00:31:17.386 align:middle line:90% 00:31:17.386 --> 00:31:21.390 align:middle line:84% The next thing we would generate a CSR. 00:31:21.390 --> 00:31:27.905 align:middle line:84% So click on Generate CSR, select Tomcat. 00:31:27.905 --> 00:31:35.560 align:middle line:90% 00:31:35.560 --> 00:31:36.580 align:middle line:90% Let's close this. 00:31:36.580 --> 00:31:41.820 align:middle line:90% 00:31:41.820 --> 00:31:43.560 align:middle line:90% Click on Download CSR. 00:31:43.560 --> 00:31:50.640 align:middle line:90% 00:31:50.640 --> 00:31:52.440 align:middle line:84% You would see Tomcat as a service 00:31:52.440 --> 00:31:55.710 align:middle line:84% because we generated the CSR for Tomcat. 00:31:55.710 --> 00:31:56.670 align:middle line:90% Let's download that. 00:31:56.670 --> 00:32:00.990 align:middle line:90% 00:32:00.990 --> 00:32:07.130 align:middle line:84% Go back to your Downloads folder, 00:32:07.130 --> 00:32:29.685 align:middle line:84% and let's open this file and copy the contents. 00:32:29.685 --> 00:32:42.380 align:middle line:90% 00:32:42.380 --> 00:32:49.720 align:middle line:84% Let's go to a CA server, go back to home, Request Certificate, 00:32:49.720 --> 00:32:58.950 align:middle line:84% Advanced, paste, and again, Client Server Authentication. 00:32:58.950 --> 00:32:59.505 align:middle line:90% Let's Submit. 00:32:59.505 --> 00:33:12.810 align:middle line:90% 00:33:12.810 --> 00:33:18.110 align:middle line:84% Let's download Base 64 certificate. 00:33:18.110 --> 00:33:20.525 align:middle line:84% Let's rename this to call manager. 00:33:20.525 --> 00:33:39.230 align:middle line:90% 00:33:39.230 --> 00:33:46.710 align:middle line:84% Let's name this as CUCM and then go back to your call manager. 00:33:46.710 --> 00:33:58.070 align:middle line:84% Upload the signed cert to Tomcat, and that's it. 00:33:58.070 --> 00:33:59.510 align:middle line:90% That's where we are done. 00:33:59.510 --> 00:34:02.240 align:middle line:84% The only thing we need to do is restart Tomcat. 00:34:02.240 --> 00:34:03.320 align:middle line:90% So let's do that now. 00:34:03.320 --> 00:34:10.139 align:middle line:90% 00:34:10.139 --> 00:34:11.870 align:middle line:84% So I would go back to my EVE Topology, 00:34:11.870 --> 00:34:20.159 align:middle line:84% double click on my call manager and also on my IM&P. 00:34:20.159 --> 00:34:21.210 align:middle line:90% Let's log in. 00:34:21.210 --> 00:34:23.920 align:middle line:90% 00:34:23.920 --> 00:34:25.960 align:middle line:90% Username is administrator. 00:34:25.960 --> 00:34:29.155 align:middle line:90% Password is C1sc0123! 00:34:29.155 --> 00:34:31.900 align:middle line:90% where C is uppercase. 00:34:31.900 --> 00:34:43.510 align:middle line:84% Let's do the same thing on IM&P. Administrator, C1sc0123! 00:34:43.510 --> 00:34:46.030 align:middle line:84% And then we would give the command utils 00:34:46.030 --> 00:34:48.505 align:middle line:90% service restart Cisco Tomcat. 00:34:48.505 --> 00:34:52.409 align:middle line:90% 00:34:52.409 --> 00:34:55.230 align:middle line:84% It should take about a few minutes, maybe about two 00:34:55.230 --> 00:34:57.660 align:middle line:84% minutes for it to restart, and then you 00:34:57.660 --> 00:35:00.550 align:middle line:84% should be able to access your call manager again. 00:35:00.550 --> 00:35:06.590 align:middle line:84% So let's give the command utils service restart Cisco Tomcat. 00:35:06.590 --> 00:35:12.770 align:middle line:90% 00:35:12.770 --> 00:35:16.070 align:middle line:84% Same thing we would do for IM&P, utils 00:35:16.070 --> 00:35:19.535 align:middle line:90% servers restart Cisco Tomcat. 00:35:19.535 --> 00:35:24.700 align:middle line:90% 00:35:24.700 --> 00:35:26.620 align:middle line:84% Now while our service is restarting, 00:35:26.620 --> 00:35:30.550 align:middle line:84% the only thing left is call manager is done. 00:35:30.550 --> 00:35:32.020 align:middle line:90% Expressway Core is done. 00:35:32.020 --> 00:35:33.790 align:middle line:90% Expressway E is done. 00:35:33.790 --> 00:35:38.260 align:middle line:84% The only thing left is we need to restart Cisco XCP 00:35:38.260 --> 00:35:41.090 align:middle line:90% router on IM&P. That's it. 00:35:41.090 --> 00:35:45.300 align:middle line:84% That's all we need to complete this task. 00:35:45.300 --> 00:35:48.150 align:middle line:84% The key point to remember is that NTP 00:35:48.150 --> 00:35:51.640 align:middle line:84% needs to be in sync for your certificate to be valid. 00:35:51.640 --> 00:35:53.820 align:middle line:84% So be extremely careful about that. 00:35:53.820 --> 00:35:56.950 align:middle line:84% In my lab, NTP has been preconfigured for you. 00:35:56.950 --> 00:36:00.630 align:middle line:84% In the actual lab exam, it may be configured or it may not. 00:36:00.630 --> 00:36:04.860 align:middle line:84% Just make sure that your NTP is synced. 00:36:04.860 --> 00:36:06.070 align:middle line:90% Let's go back. 00:36:06.070 --> 00:36:07.095 align:middle line:90% Let's close this. 00:36:07.095 --> 00:36:10.740 align:middle line:90% 00:36:10.740 --> 00:36:14.700 align:middle line:84% Let's go back here and try and access our IM&P. 00:36:14.700 --> 00:36:17.430 align:middle line:84% I believe we should not be able to access at this point of time 00:36:17.430 --> 00:36:21.930 align:middle line:84% because Tomcat service is restarting. 00:36:21.930 --> 00:36:23.860 align:middle line:90% Yeah, it's not available. 00:36:23.860 --> 00:36:25.787 align:middle line:84% Let's accept the new certificate. 00:36:25.787 --> 00:36:31.760 align:middle line:90% 00:36:31.760 --> 00:36:34.895 align:middle line:84% So Tomcat is still restarting, which you can see here. 00:36:34.895 --> 00:36:37.740 align:middle line:90% 00:36:37.740 --> 00:36:41.760 align:middle line:84% So on my IM&P, it has already restarted. 00:36:41.760 --> 00:36:43.550 align:middle line:90% Let's close this. 00:36:43.550 --> 00:36:48.070 align:middle line:90% And on my publisher-- 00:36:48.070 --> 00:36:50.210 align:middle line:84% now in my lab, I only have a publisher. 00:36:50.210 --> 00:36:51.640 align:middle line:90% I don't have a subscriber. 00:36:51.640 --> 00:36:54.310 align:middle line:84% In the lab exam, if you have a subscriber also, 00:36:54.310 --> 00:36:58.640 align:middle line:84% you have to do exactly the same steps for a subscriber also. 00:36:58.640 --> 00:37:01.360 align:middle line:84% So upload your certificates there as well. 00:37:01.360 --> 00:37:05.720 align:middle line:84% Get it signed and restart Cisco Tomcat. 00:37:05.720 --> 00:37:11.870 align:middle line:84% Let's go back here and go to Administration. 00:37:11.870 --> 00:37:14.420 align:middle line:90% 00:37:14.420 --> 00:37:16.160 align:middle line:90% Accept your new signed certs. 00:37:16.160 --> 00:37:21.710 align:middle line:90% 00:37:21.710 --> 00:37:23.070 align:middle line:90% Tomcat is still restarting. 00:37:23.070 --> 00:37:24.440 align:middle line:90% So give it a few minutes. 00:37:24.440 --> 00:37:25.520 align:middle line:90% It should restart. 00:37:25.520 --> 00:37:37.610 align:middle line:90% 00:37:37.610 --> 00:37:39.570 align:middle line:90% So IM&P is up and running. 00:37:39.570 --> 00:38:09.670 align:middle line:84% Let's log into serviceability and go to Tools, Control Center 00:38:09.670 --> 00:38:18.230 align:middle line:84% Network Services, and select your IM&P. Let's click Go. 00:38:18.230 --> 00:38:23.300 align:middle line:90% 00:38:23.300 --> 00:38:25.380 align:middle line:90% Scroll down. 00:38:25.380 --> 00:38:28.055 align:middle line:90% You should see Cisco XCP router. 00:38:28.055 --> 00:38:34.250 align:middle line:90% 00:38:34.250 --> 00:38:39.780 align:middle line:84% So we have our Cisco XCP router here. 00:38:39.780 --> 00:38:47.020 align:middle line:84% So select that, and restart the service. 00:38:47.020 --> 00:38:50.630 align:middle line:90% 00:38:50.630 --> 00:38:51.390 align:middle line:90% That's it. 00:38:51.390 --> 00:38:57.200 align:middle line:84% We are done with the request for getting our certificate signs, 00:38:57.200 --> 00:39:00.200 align:middle line:84% and so task 5.1 is complete, where 00:39:00.200 --> 00:39:04.670 align:middle line:84% we installed root CA certificate on Expressway C, Expressway 00:39:04.670 --> 00:39:09.020 align:middle line:84% Edge, on call manager, for tomcat-trust, and for IM&P 00:39:09.020 --> 00:39:11.660 align:middle line:84% for tomcat-trust and cup-xmpp-trust. 00:39:11.660 --> 00:39:13.520 align:middle line:84% Then we got the certificate signed 00:39:13.520 --> 00:39:17.030 align:middle line:84% for Expressway C, Expressway Edge, and for Tomcat 00:39:17.030 --> 00:39:21.440 align:middle line:84% on publisher and Tomcat and cup-xmpp for IM&P, 00:39:21.440 --> 00:39:23.840 align:middle line:84% and then we restarted the service. 00:39:23.840 --> 00:39:26.870 align:middle line:84% With this, we've completed our task requirement. 00:39:26.870 --> 00:39:28.830 align:middle line:84% I hope this video was informative for you, 00:39:28.830 --> 00:39:31.420 align:middle line:90% and thank you for watching. 00:39:31.420 --> 00:39:32.000 align:middle line:90%