Pass the Avaya ACIS-7130 71301X Questions and answers with ValidTests

The statement that is true about the Application Enablement Services (AES) certificate management is that AES is shipped with a default certificate which is valid for one year, and a customer-provided server identity certificate must be installed before the default certificate expires. A server identity certificate is a file that contains information about the identity and public key of a server, such as AES. A server identity certificate is used to authenticate the server to other entities that communicate with it using HTTPS or SIP over TLS. A server identity certificate is signed by a Certificate Authority (CA), which is an entity that issues and verifies certificates. AES uses certificates for various purposes, such as securing web access, enabling HTTPS-based APIs, encrypting SIP signaling, and supporting mutual authentication with endpoints or servers. AES comes with a default self-signed certificate that can be used for testing or demonstration purposes. The default certificate is valid for one year from the date of installation. After one year, the default certificate expires and needs to be replaced with a valid customer-provided certificate from a trusted CA. To install a customer-provided certificate on AES, you need to use tools such as OpenSSL or Keytool to generate a Certificate Signing Request (CSR), submit it to a CA, obtain a signed certificate from the CA, and upload it to AES using the web interface or CLI.

To connect to the Application Enablement Services (AES) web interface, you need to use the correct URL and the default login ID. The AES web interface is a web-based application that allows you to configure and manage the AES server and its features. You can access the AES web interface using any web browser that supports HTTPS. The URL for connecting to the AES web interface is https:// :8443, where is the IP address of the AES server that you want to connect to. The port number 8443 is the default port for HTTPS communication with the AES server. After entering the URL in the web browser, you will see a login screen where you need to enter the login ID and password for accessing the AES web interface. The default login ID for the AES web interface is craft, which is a system administrator account that has full access to all features and functions of the AES server. The default password for the craft account is craft. You can change the password or create other user accounts with different access levels using the Security Database feature of the AES web interface.

An H.248 signaling link connects the Internet Friendly (Edge) Gateway to Avaya Communication Manager (CM) by tunneling H.248 messages using TCP port 2944 and securing them using TLS. H.248 is a protocol that defines how media gateway controllers control media gateways for supporting multimedia streams across different networks, such as IP networks and PSTN networks. An H.248 signaling link is a logical connection between an H.248 controller and an H.248 gateway that allows exchanging H.248 messages for controlling media streams. In an Internet Friendly (Edge) Gateway scenario, CM acts as an H.248 controller and ASBCE DBE acts as an H.248 gateway. To connect an H.248 signaling link between CM and ASBCE DBE, these steps are performed:

CM initiates a TCP connection to ASBCE DBE using port 2944, which is reserved for H.248 over TLS.

CM and ASBCE DBE negotiate TLS parameters and exchange certificates for mutual authentication and encryption.

CM and ASBCE DBE establish a secure TLS session over TCP port 2944.

CM and ASBCE DBE exchange H.248 messages over TLS session for controlling media streams.

The Avaya Aura® Web Gateway (AAWG) requires a license file to operate and provide WebRTC services for endpoints such as Avaya Workplace clients or Avaya Spaces Calling extension users. The license file can be installed on either of these two options:

The WebLM server embedded in System Manager (SMGR): This is a web-based licensing application that is integrated with SMGR and can manage licenses formultiple Avaya products, such as Communication Manager, Session Manager, Presence Services, or Breeze Platform. You can install an AAWG license file on this WebLM server using SMGR web interface, under Elements > Licensing > Licenses5

A standalone WebLM server: This is a web-based licensing application that runs on a separate Linux or Windows server and can manage licenses for multiple Avaya products, such as Communication Manager, Session Manager, Presence Services, or Breeze Platform. You can install an AAWG license file on this WebLM server using its web interface, under Licenses > Add License File6

When integrating the Application Enablement Services (AES) with the Avaya Aura® Communication Manager (CM), you need to configure a Switch Password in two places: on the “cti-link” screen in CM, and in “Switch Connections” on AES. TheSwitch Password is a password that is used to authenticate the communication between CM and AES. CM and AES use a protocol called Adjunct Switch Application Interface (ASAI) to exchange information and commands related to Computer Telephony Integration (CTI) applications. ASAI requires a Switch Password to establish a secure connection between CM and AES. To configure the Switch Password, you need to use these two screens:

The “cti-link” screen in CM: This is a screen that allows you to create and manage CTI links, which are logical connections between CM and CTI servers, such as AES. You can access this screen using the System Access Terminal (SAT) interface of CM. On this screen, you need to specify a name, number, type, and password for each CTI link. The password is the Switch Password that will be used by CM to authenticate AES.

The “Switch Connections” screen on AES: This is a screen that allows you to create and manage switch connections, which are logical connections between AES and switches, such as CM. You can access this screen using the web interface of AES. On this screen, you need to specify a name, IP address, port, type, and password for each switch connection. The password is the Switch Password that will be used by AES to authenticate CM.

If the Avaya Session Border Controller for Enterprise (ASBCE) does not trust the Certificate Authority (CA) that signed the WebLM server identity certificate, you can use the sbceconfigurator.py fix-weblm-cert command issued from the EMS CLI to fix the trust issue. The WebLM server is a web-based licensing application that manages licenses for various Avaya products, such as Communication Manager, Session Manager, Presence Services, or Breeze Platform. The WebLM server uses an identity certificate to authenticate itself to other entities that communicate with it using HTTPS or REST APIs. The identity certificate is signed by a CA, which is an entity that issues and verifies certificates. The ASBCE server needs to trust the CA that signed the WebLM server identity certificate in order to communicate with it securely and obtain licenses from it. If the ASBCE server does not trust the CA, you can use the sbceconfigurator.py fix-weblm-cert command to install the CA certificate on the ASBCE server and establish trust with it. The sbceconfigurator.py tool is a Python script that runs on the EMS component of the ASBCE server and performs various configuration tasks. The EMS component is responsible for managing and monitoring the ASBCE server. You can access the EMS CLI using SSH or Telnet and run the sbceconfigurator.py tool from there.

The Avaya Session Border Controller for Enterprise (ASBCE) requires licenses to support different types of services, such as SIP Trunking or Remote Worker. The ASBCE licenses are based on the number of concurrent sessions that are handled by the ASBCE server. There are two types of licenses: standard services licenses and advanced services licenses. A standard services license is required for each SIP Trunking session, which is a session between the ASBCE server and a SIP service provider. An advanced services license is required for each Remote Worker session, which is a session between the ASBCE server and a remote endpoint, such as an IP phone or a softphone. Therefore, if the customer plans to have 50 SIP Trunks and100 Remote Workers supported by the ASBCE, they will need 50 standard services licenses and 100 advanced services licenses.

In some deployments, you can enable a feature called “Stream Users Over Transport Link” in the Signaling Interface used for the Avaya Aura® Session Manager (SM) on the Avaya Session Border Controller for Enterprise (ASBCB). This feature allows reusing the same TCP connection to SM for all SIP messages related to Remote Workers registered with SM through ASBCB. A Signaling Interface is a configuration object that defines how ASBCB handles SIP signaling with other entities, such as endpoints or servers. A Signaling Interface can include parameters such as source and destination IP addresses, ports, protocols, encryption modes, authentication modes, and timers. The “Stream Users Over Transport Link” parameter is an option that can be enabled or disabled in the Advanced tab of the Signaling Interface configuration screen. When this option is enabled, ASBCB will use the same TCP connection to SM for all SIP messages related to the same Remote Worker. This can reduce the number of TCP connections and improve the performance and scalability of ASBCB and SM.

The output from the show mgc command (issued on a G430/G450 Gateway CLI) can indicate whether the G430/G450 is operating as an Internet Friendly (Edge) Gateway or an Enterprise Gateway. An Internet Friendly (Edge) Gateway is a device that provides secure and reliable connectivity between endpoints on different networks, such as the public internet and a private enterprise network. An Enterprise Gateway is a device that provides connectivity between endpoints on the same network, such as a LAN or a WAN. The show mgc command displays information about the Media Gateway Controller (MGC), which is the entity that controls the media gateway functions of the G430/G450, such as call processing, routing, and signaling. The MGC can be an Avaya Communication Manager (CM) server or an Avaya Session Border Controller for Enterprise (ASBCE) server. The output from the show mgc command includes these fields:

Management Link Mode: This field indicates how the G430/G450 communicates with the MGC for management purposes, such as configuration, monitoring, and troubleshooting. The possible values are Direct or Tunnelled. Direct means that the G430/G450 communicates with the MGC using a direct IP connection over TCP port 5022. Tunnelled means that the G430/G450 communicates with the MGC using a tunnel over TCP port 2944 and secured using TLS. This mode is used when the G430/G450 operates as an Internet Friendly (Edge) Gateway and communicates with ASBCE as the MGC.

H.248 Link Mode: This field indicates how the G430/G450 communicates with the MGC for media gateway control purposes, such as controlling media streams, allocating resources, and creating connections. The possible values areEGW or IFG. EGW means that the G430/G450 communicates with the MGC using H.248 protocol over UDP port 2944. This mode is used when the G430/G450 operates as an Enterprise Gateway and communicates with CM as the MGC. IFG means that the G430/G450 communicates with the MGC using H.248 protocol over TCP port 2944 and secured using TLS. This mode is used when the G430/G450 operates as an Internet Friendly (Edge) Gateway and communicates with ASBCE as the MGC.

H.248 Link Status: This field indicates whether the H.248 link between the G430/G450 and the MGC is up or down, and whether it is encrypted or not. The possible values are UP/Encrypted, UP/Unencrypted, DOWN/Encrypted, or DOWN/Unencrypted. UP means that the H.248 link is established and functional. DOWN means that the H.248 link is not established or not functional. Encrypted means that the H.248 link is secured using TLS encryption. Unencrypted means that the H.248 link is not secured using TLS encryption.

Therefore, to determine whether the G430/G450 is operating as an Internet Friendly (Edge) Gateway or an Enterprise Gateway, you can look at these two fields in the output from the show mgc command:

If the H.248 Link Mode displays IFG, it means that the G430/G450 is operating as an Internet Friendly (Edge) Gateway and communicating with ASBCE as the MGC using H.248 over TCP port 2944 and secured using TLS.

If the H.248 Link Status displays UP/Encrypted, it means that the G430/G450 is operating as an Internet Friendly (Edge) Gateway and communicating with ASBCE as the MGC using a secure and functional H.248 link.

The Avaya Session Border Controller for Enterprise (ASBCE) certificate management is a feature that allows you to install, manage, and renew certificates for the ASBCE server. Certificates are used to authenticate and encrypt the communication between the ASBCE server and other entities, such as endpoints, servers, or service providers. The following statements about the ASBCE certificate management are true:

It allows using a default server certificate for up to one year after the installation: The ASBCE server comes with a default self-signed server certificate that can be used for testing or demonstration purposes. The default server certificate is valid for one year from the date of installation. After one year, the default server certificate expires and needs to be replaced with a valid certificate from a trusted Certificate Authority (CA).

It supports both the Root and Intermediate Certificate Authority (CA) certificates: The ASBCE server supports installing both the Root and Intermediate CA certificates, which are used to verify the identity and trustworthiness of other certificates. A Root CA certificate is a certificate that is issued by a trusted authority and is self-signed. An Intermediate CA certificate is a certificate that is issued by a Root CA or another Intermediate CA and is used to sign other certificates. The ASBCE server can store up to 10 Root CA certificates and up to 10 Intermediate CA certificates.