Initial data

According to the technical specification, it is required to determine the hardware platform.

Example of drafting hardware requirements

After determining the requirements of the project, create a preliminary network map.

An example of components allocation in the address space for a single node:

Connecting to network

The topology of connecting the server to the network to ensure redundancy is recommended to be done using 2 switches.

Figure 1 — Network connection diagram

Option 1. Active-backup

The switches are connected in erps ring.

All 4 physical network interfaces are connected into 1 aggregated link (bond). Server port aggregation is configured in active-backup mode, i.e. there is always only 1 network interface in operation. Server network interfaces are connected in pairs in switches, on which port aggregation (port-channel) is also configured in active-backup mode.

For example, eth0 and eth1 are connected in the first switch, and eth2 and eth3 are connected in the second.

Option 2. LACP

The switches are connected in a stack. The stack must logically operate as a single switch, capable of providing port aggregation between different physical switches in LACP mode. MES-3124 with specialized firmware can be an example. 

All 4 physical network interfaces are connected into 1 aggregated link (bond). Server port aggregation is configured in 802.3ad mode. Network cards aggregated groups with same rate and duplex are created. With such a combination, the transmission uses all channels in active aggregation according to the IEEE 802.3ad standard. The choice on which interface to send a packet is determined by policy. By default, it is XOR policy, also xmit_hash policy can be used. For more information, see Netplan section. 

Requirements:

• Ethtool support in driver to obtain information about speed and duplex on each network interface;
• IEEE802.3ad standard support on switch. 

Server network interfaces are also included in pairs in switches, on which port aggregation (port-channel) is configured in LACP mode. For example, eth0 and eth1 are included to first switch (port-channel 1), and eth2 and eth3 — to the second (port-channel 2).

Installation of ECSS-10 on one server

Installation of ECSS-10 consists of two main parts:

1. Preparation: installation of Ubuntu 22.04, Ubuntu packets updating, OS "optimization", installation of additional software packages, preparation of network interfaces, /etc/hosts, ssh-keygen
2. Installation of ECSS-10 

Preparation

This section describes the operating system installation, as well as required and optional packages. ECSS-10 version 3.18 runs on Ubuntu 22.04.

Preliminary requirements:

• Installation media with the operating system distribution;
• A prepared server with an updated BIOS, ILP (if available), and a connected network for internet access;
• Setting the installation media (USB flash drive or CD/DVD) as the first boot priority in the BIOS;
• Sufficient disk space and memory as specified in the design.

OS installation

To install the OS, do the following:

• After booting from the installation media, select "Install Ubuntu Server"
• Select the system language and keyboard layout
• Configure the network interface to connect to the Internet
• Create disk partitions according to Table 1
• Configure server and user names
• Install OpenSSH server
• Reboot the successfully installed OS

Table1 — An option for storing information in a file system on physical media for servers

The system requires at least 256 GB of free space.

It is neccessary to configure "hostname" parameter on the system servers.

It is recommended to specify the same username (anything except ssw) on all servers in the system. The ECSS-10 license is linked to the eToken/ruToken key and the computer hostname. The system user ssw is created when installing the ecss-user package.

Configuring network

Install the software switch according to the parameters specified in the technical specification. In this example, it is assumed that the required operating system is already installed. 

It is recommended to split traffic used for different purposes. For example, management traffic and VoIP traffic. To do this, 2 or more VLANs are created. In the minimum case and with a small load, one VLAN can be enough. Hovewer, it will cause inconvenience in the future at traffic dump and its analysis. According to the technical specification, host IP adresses, gateways, DNS, routing and other parameters are configured on VLAN. 
According to the technical specification, the following addresses are used in a given example:

10.0.10.10/24 — for management, vlan 10;

10.0.20.10/24 — for VoIP.

There is an address structure inside the server platform and internal addresses are used for interaction between subsystems (nodes) in the cluster. For example, the internal address for a cluster on one server is 127.0.0.1, while the kernel (ecss-core) interacts with the multimedia data processing server (ecss-media-server). Their interaction takes place using the same address, but each software part has its own transport port: ecss-core — 5000, ecss-msr — 5040.

A single address for accessing the MySQL database is defined for all cluster nodes, for example, the ecss-mysql address 127.0.0.1. Thus, the uniformity condition is fulfilled, in which all cluster nodes have completely identical data about the current state of the dynamic components of the software switch (for example, call history).

Preparing system network interfaces

According to the technical specification, the system has 4 network interfaces. Information about their status can be viewed using the ifconfig or ip a command:

First, the network interfaces are configured. Ubuntu18 uses the netplan utility to configure.

This utility is meant for configuring the network and then uploading it to the system using the network manager networkd or NetworkManager.

sudo nano /etc/netplan/ecss_netplan.yaml

In the configurations for each host, first of all, declare the ethernets section, which describes existing in the system Ethernet interfaces that will be used in the future. It is important to disable the use of dynamic address allocation (DHCP) for each interface.

The next section describes aggregated channels — bonds. Depending on chosen network connection option, 1:1 (active - backup) or LACP (802.3ad) backup mode is configured.

Optionally, gateways for communication with the outside world and DNS server addresses are defined, as well as IP addresses for each interface.

Example of configuring ecss-netplan.yaml file for active-backup connection option:

# Netplan for the ecss1 host of the test software switch
# Pay attention to the mandatory presence of at least two spaces in each line and section (except for the network section line)

network:
  version: 2 # netplan version
  renderer: networkd # netplan configuration executor
  ethernets: # Ethernet interfaces description section
    eth0: # Interface name
      dhcp4: no # Disabling dynamic distribution of IP address on the interfaces
    eth1:
      dhcp4: no
    eth2:
      dhcp4: no
    eth3:
      dhcp4: no

  bonds: # Section describing bonding interfaces. The name cannot contain more than 15 characters!
    bond1: # Bonding interface name
      interfaces: # Section of determining bonding interfaces

                - eth0
		- eth1
		- eth2
		- eth3
      parameters: # Section of defining bonding interface parameters 
        mode: active-backup # Backup mode 1:1
        mii-monitor-interval: 100 # Section of interface monitoring (ms)
        primary: eth0 # Section of determining main interface
      optional: false

  vlans:

   network.10: # Management interface
      id: 10
        link: bond1
        addresses: [10.0.3.237/24]
        gateway4: 10.0.10.1 # Gateway address
        nameservers:
          addresses: [10.0.10.1, 8.8.8.8] # DNS servers addresses
   network.20: # interface for VoIP
      id: 20
      link: bond1
      addresses: [10.0.3.237/24]

Apply parameters with the command:

sudo netplan apply

Operating system software update

Add the ELTEX repository to install the ECSS-10 system:

sudo sh -c "echo 'deb [arch=amd64] http://archive.eltex.org/ssw/bionic/3.14 stable main extras external' > /etc/apt/sources.list.d/eltex-ecss10-stable.list"

sudo sh -c "echo 'deb [arch=amd64] http://archive.eltex.org/ssw/smolensk/3.14 stable main extras external' > /etc/apt/sources.list.d/eltex-ecss10-stable.list"
sudo sh -c "echo 'http://archive.eltex.org astra smolensk smolensk-extras' > /etc/apt/sources.list.d/eltex-ecss10-stable.list"

Next, import the key with the following command:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 33CB2B750F8BB6A5

Before starting the installation, update the OS:

sudo apt update
sudo apt upgrade

Software installation and configuration

Install all the proposed packages:

sudo apt install aptitude atop ethtool htop iotop mc minicom mtr-tiny nmap pptpd pv screen ssh tftpd vim sngrep tshark cpanminus gnuplot libgraph-easy-perl debconf-utils

Installing ecss-mysql package

The installation begins with the deployment of the MySQL server and the integration of the ecss-mysql database.

To install, run the command:

sudo apt install ecss-mysql

Configuring ecss-dns-env package

Before installing the ecss-mysql package, you will be prompted to configure environment variables for services in dnsmasq. Configuration manager will prompt to select the sections to configure, do not select anything.

Configuring ecss-mysql package

When installing the package, the following data will be requested:

Changing the default path — agree to change the configuration file to enter the path to the ecss-mysql databases by entering "Y".

MySQL databases used by the ECSS-10 system will be stored under the path /var/lib/ecss-mysql after installation. Check for files in the folder:

ls -l /var/lib/ecss-mysql/
total 36
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_address_book
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:37 ecss_audit
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_calls_db
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_dialer_db
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_meeting_db
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_statistics
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 ecss_subscribers
drwxr-xr-x 2 mysql mysql 4096 Sep 26 13:36 history_db
drwxr-xr-x 2 mysql mysql 4096 Sep 26 14:32 web_conf

Check that the server is running:

sudo systemctl status mysql

● mysql.service - MySQL Community Server
Loaded: loaded (/lib/systemd/system/mysql.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/mysql.service.d
          └─override.conf
Active: active (running) since Thu 2019-09-26 13:36:47 +07; 23h ago
Main PID: 11642 (mysqld)
CGroup: /system.slice/mysql.service
          └─11642 /usr/sbin/mysqld --daemonize --pid-file=/run/mysqld/mysqld.pid

Installing the ecss-node package

Installing the ecss-node package:

sudo apt install ecss-node

During the package installation ssw user is created, on whose behalf all ecss services are launched*. The necessary directories are being created, DNS is being configured, SSL certificates are being configured. During the installation, 8 questions necessary for the formation of configuration files will be asked.

To generate certificates, select manual method. All questions can be answered as suggested by default.

Installing ecss-media-server, ecss-media-resources, ecss-restf, ecss-web-conf packages

Next, ecss-media-server, ecss-media-resources, ecss-restf, ecss-web-conf and other packages are installed in any order:

ecss-media-server, ecss-media-resources

sudo apt install ecss-media-server ecss-media-resources

For the media server (ecss-media-server / MSR), initial configuration is possible with parameters recorded to the configuration file, it is required to perform the configuration without selecting any items:

After forming the default configurations, go to the directory where the configurations are located and check them:

cd /etc/ecss/ecss-media-server/
cat config.xml
cat conf.d/default.xml

There is a configuration for msr: config.xml, the conf.d directory contains the configuration default.xml. At its core, default.xml is an addition to config.xml, which defines the accounts section. This is done in order for this configuration to remain unchanged after package updates. 

Example of config.xml:

<?xml version="1.0" encoding="utf-8"?>
<config date="10:48:15 21.02.2022">
  <general log-level="3" log-rotate="yes" max-calls="8192" max-in-group="512" load-sensor="media" load-delta="10" calls-delta="100" spool-dir-size="100M" log-name="msr.log" log-path="/var/log/ecss/media-server" use-srtp="disabled" suspicious-mode="no"/>
  <transport bind-addr="192.168.2.21" port="5040" transport="udp+tcp"/>
  <!-- By default configured public TURN-server -->
  <turn-server use-turn="no" host="numb.viagenie.ca" user="webrtc@live.com" password="muazkh"/>
  <media mixer-clock-rate="8000" use-vad="no" cng-level="0" jb-size="60" rtcp-timeout="0" rtp-timeout="350" udp-src-check="no" cn-multiplier="3" port-start="12000" port-range="2048" tias-in-sdp="no" thread-cnt="2" silence-threshold="-30" dtmf-flash-disable="no" video-dscp="0" other-dscp="0" dummy-video-src="/usr/share/ecss-media-server/video/dummy_video.yuv" video-enc-width="1280" video-enc-height="720" finalsilence="1000" rtcp-stat-dump="yes"/>
  <codec pcma="1" pcmu="2" ilbc="0" gsm="0" g722="3" g729="0" speex="0" l16="0" g7221="0" opus="0" h264="1" h263-1998="2" t38="1" tel-event-pt="0"/>
  <accounts>
    <!-- <dynamic msr_name="msr.name"
            realm="sip:127.0.0.1:5000"
            dtmf_mode="rfc+inband+info"
            auth_name="user"
            auth_password="password" /> -->
  </accounts>
  <pbyte>
    <mcc bind-addr="192.168.2.21" port="5700"/>
  </pbyte>
  <conf_dir path="/etc/ecss/ecss-media-server/conf.d"/>
  <rtp>
    <auto addr-v4=""/>
  </rtp>
</config>

Example of accounts section (default.xml file):

<?xml version="1.0"?>
<config>
      <accounts>
            <dynamic msr_name="msr.ecss1" realm="sip:127.0.0.1:5000" dtmf_mode="rfc+inband+info" auth_name="user" auth_password="password"/>
      </accounts>
</config>

It contains current settings according to which the msr is registered on core.

The main parameters are: msr_name and realm.

msr_name is a parameter that defines the name of the msr. (it is recommended to set the name of the msr. and the host to which it belongs, for example, msr.ecss1);

realm — defines the address for registration on the core. Default entry point: port 5000, address: 127.0.0.1.

ecss-restfs

sudo apt install ecss-restfs

When installing, you will be prompted to set up the configuration:

ecss-web-conf

sudo apt install ecss-web-conf

When installing, you will be prompted to set up the configuration:

Configuring security. SSH

Configuring SSH server:

sudo nano /etc/ssh/sshd_config

In the configuration file specify the port and address where you can access the server:

Restart ssh:

sudo systemctl restart ssh.service

Initial configuration

Start the necessary services.

Run the ecss-mycelium and ecss-ds packages on the first host:

sudo systemctl start ecss-mycelium
sudo systemctl start ecss-ds

Go to the CLI:

ssh admin@localhost -p 8023
password: password

Check system status:

admin@mycelium1@ecss1$ system-status 
Checking...
┌─┬───────────────┬────────────────────────┬───────────────┬────────────┬──────┐
│ │     Node      │        Release         │ Erlang nodes  │Mnesia nodes│Uptime│
├─┼───────────────┼────────────────────────┼───────────────┼────────────┼──────┤
│ │ds1@ecss1      │ecss-ds-3.14.10.91      │ds1@ecss1      │ds1@ecss1   │8m 9s │
│ │mycelium1@ecss1│ecss-mycelium-3.14.10.91│mycelium1@ecss1│not running │8m 10s│
└─┴───────────────┴────────────────────────┴───────────────┴────────────┴──────┘

All services are started.

Next, install passport and licenses to the system:

admin@[mycelium1@ecss1]:/$ cluster/storage/ds1/licence/set-passport <passport>
admin@[mycelium1@ecss1]:/$ cluster/storage/ds1/licence/add <license>

Exit the CoCon, reboot the ecss-mycelium and ecss-ds subsystems, and then connect the remaining subsystems in the following order: ecss-core, ecss-pa-sip, ecss-media-server, ecss-restfs, ecss-mediator, ecss-web-conf.

sudo systemctl start ecss-core ecss-pa-sip ecss-mediator ecss-media-server ecss-restfs ecss-web-conf

Return to the CoCon.

After that, the MSR- and Core-subsystems are connected. To do this, use the following command:

admin@[mycelium1@ecss1]:/$ /system/media/resource/declare core1@ecss1 iface msr.ecss1 bond1_ecss1_pa default local true

To check, run system-status command and see the output:

admin@mycelium1@ecss1$ system-status                        
Checking...
┌─┬───────────────┬────────────────────────┬───────────────┬────────────┬──────┐
│ │     Node      │        Release         │ Erlang nodes  │Mnesia nodes│Uptime│
├─┼───────────────┼────────────────────────┼───────────────┼────────────┼──────┤
│ │core1@ecss1    │ecss-core-3.14.10.91    │core1@ecss1    │not running │1m 59s│
│ │ds1@ecss1      │ecss-ds-3.14.10.91      │ds1@ecss1      │ds1@ecss1   │4h    │
│ │md1@ecss1      │ecss-mediator-3.14.10.91│md1@ecss1      │md1@ecss1   │1m 59s│
│ │mycelium1@ecss1│ecss-mycelium-3.14.10.91│mycelium1@ecss1│not running │4h    │
│ │sip1@ecss1     │ecss-pa-sip-3.14.10.91  │sip1@ecss1     │sip1@ecss1  │1m 59s│
└─┴───────────────┴────────────────────────┴───────────────┴────────────┴──────┘

All services are started.

  Active media resource selected list specific:
┌─────────────┬───────────┬────────────┬───────────┬───────────┐
│    Node     │     MSR   │    MSR     │ Cc-status │ Cc-uptime │
│             │           │  version   │           │           │
├─────────────┼───────────┼────────────┼───────────┼───────────┤
│ core1@ecss1 │ msr.ecss1 │ 3.14.10.42 │ connected │ 00:01:31  │
└─────────────┴───────────┴────────────┴───────────┴───────────┘

Configure the SIP adapter according to the technical specification. Define a group of IP addresses (IP-set):

admin@[mycelium1@ecss1]:/$ /cluster/adapter/sip1/sip/network/set ip_set test_set node-ip node = sip1@ecss1 ip = 10.0.3.238 

          
Property "ip_set" successfully changed from:

          
to
test_set: no ports set
test_set: sip1@ecss1 10.0.3.238
test_set: dscp 0.

Next, create a domain and assign to it the created group (IP-set) of the SIP adapter settings:

admin@[mycelium1@ecss1]:/$ domain/declare test_domain --add-domain-admin-privileges --add-domain-user-privileges 
New domain test_domain is declared

          
domain/test_domain/sip/network/set ip_set [test_set] Property "ip_set" successfully changed from:

          
[] to ["test_set"].

After creating the domain, configure:

• routing;
• users;
• subscribers;
• trunks and bridges.