Putting Voicemail on Exchange 2010

A major driver for our upgrade to Exchange 2010 is to migrate voice-mail off of our Nortel CS1000 system that currently uses Callpilot to having voice-mail handled by Exchange's Unified Messaging features.

The push for this was the continued expanse of upgrading the Call Pilot voicemail system while receiving no new functionality. By moving voicemail to be handled by exchange we ended up spending a little less than 1/3 of the call pilot cost while receiving several new features.

For this upgrade we received assistance from the Via Group. The designed the upgrade process and handled the work on the Audiocodes device, as well as providing UM and Exchange Assistance as required.

The basic concept for getting Voicemail to to exchange was the following:
-*Prereq. - Have Exchange installed with a server that has the UM role.

Voicemail in Exchange instead of Nortel - Basic Configuration

1. Purchase an AudioCodes Gateway device that essentially acts as a go between for the Analog Nortel Switch and the Exchange UM server.
2. We previously had 4 ISDN Line's as our PRIs from the PTSN. This allowed a maximum of 92 concurrent Incoming or Outgoing calls.
3. We moved one of these PRI's to connect to the AudioCodes Device as a QSIG Trunk, provided a capacity of 23 concurrent connections to the new voicemail server, that leaves 69 concurrent calls allowed in or out of campus.
4. Create the Dial Plans and Policy inside of Exchange Unified Messaging. If you are looking for a good walk-through on this refer to here.
5. Concerning Certificates, we have an enterprise CA that we used to sign the certificate on both the AudioCodes Device and for the UM role in Exchange.
   - Note: Both these devices will need to use the FQDN of the UM server and the DNS address you create for audiocodes gateway. This allows them to do TLS encryption between devices. If you follow this route you will also need to install the root certificates on the AudioCodes Devices
6. Assign Mailboxes to phone numbers in Exchange
7. Ensure Receive Connectors on 2010 CAS are able to accept messages from the UM. (More on this below)

With these steps completed you should be able to receive Voicemail messages in Exchange. Below are a couple of the errors and troubleshooting steps we needed to take.

1. Voicemails not being received in Exchange from "Unauthenticated Callers" ( An unauthenticated caller is anyone whose phone is not in the UM. This means numbers outside the organization and anyone on the legacy Nortel system.)

• Error Messages included the voicemails collecting in InstallDrive:\\Program Files\Microsoft\Exchange Server\V14\UnifiedMessaging\voicemail.
• In the windows application log we were also seeing the following:  
  The Unified Messaging server encountered an error while trying to process the message with header file "C:\Program Files\Microsoft\Exchange Server\V14\UnifiedMessaging\voicemail\53fd3299-40b3-42d2-bf02-02b09edacf1f.txt". Error details: "Microsoft.Exchange.UM.UMCore.SmtpSubmissionException: Submission to the Hub Transport server failed. The operation will be retried. ---> Microsoft.Exchange.Net.ExSmtpClient.UnexpectedSmtpServerResponseException: Unexpected SMTP server response. Expected: 220, actual: 500, whole response: 500 5.3.3 Unrecognized command
  
     at Microsoft.Exchange.Net.ExSmtpClient.SmtpTalk.CheckResponse(ServerResponseInfo response, Int32 expectedCode)
     at Microsoft.Exchange.Net.ExSmtpClient.SmtpTalk.Command(SmtpChunk[] chunks, SmtpCommandType command, Int32 expectedCode)
     at Microsoft.Exchange.Net.ExSmtpClient.SmtpTalk.StartTls()
     at Microsoft.Exchange.Net.ExSmtpClient.SmtpClient.Submit(Boolean disableDelayedAck)
     at Microsoft.Exchange.UM.UMCore.SmtpSubmissionHelper.SubmitMessage(MessageItem message, String senderAddress, String recipientAddress, OutboundConversionOptions submissionConversionOptions, InternalExchangeServer smtpServer)
     at Microsoft.Exchange.UM.UMCore.SmtpSubmissionHelper.SubmitMessage(MessageItem message, String senderAddress, String recipientAddress, OutboundConversionOptions submissionConversionOptions, String requestId)
     --- End of inner exception stack trace ---
  
  Server stack trace:
     at Microsoft.Exchange.UM.UMCore.SmtpSubmissionHelper.HandleTransientSmtpFailure(Exception e, InternalExchangeServer smtpServer, String recipientAddress)
     at Microsoft.Exchange.UM.UMCore.SmtpSubmissionHelper.SubmitMessage(MessageItem message, String senderAddress, String recipientAddress, OutboundConversionOptions submissionConversionOptions, String requestId)
     at Microsoft.Exchange.UM.UMCore.SmtpSubmitStage.InternalDoSynchronousWork()
     at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
     at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)
  
  Exception rethrown at [0]:
     at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)
     at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData)
     at Microsoft.Exchange.UM.UMCore.SynchronousPipelineStageBase.SynchronousWorkDelegate.EndInvoke(IAsyncResult result)
     at Microsoft.Exchange.UM.UMCore.SynchronousPipelineStageBase.EndSynchronousWork(IAsyncResult r)"
• The solution for this was to create a custom receive connector on the 2010 Hub transport role because the Default one had to be modified to excluded other addresses to properly receive from internet. The settings we have are General Tab > FQDN = internal FQDN(must have a certificate); Network tab > Receive mail from remote servers includes: Addresses of 2010 UM server, CAS server and 2007 CAS; Authentication Tab > Check TLS, Mutual Auth TLS, Exchange Server Authentication; Permission Groups Tab > Check all users.

Best of Luck in your setup.

Exchange 2007 and Exchange 2010 Upgrade issues

This post will highlight some of the errors and solutions we ran into in our upgrade process.

The first error we ran into after the installation and change of DNS addresses was the backup of the mail queues on the 2010 server because it was unable to send mail to the 2007 exchange HUB server to be delivered to mailboxes.  The Queue was a next hop domain of hub version 8, Delivery type of SMTP Relay in Active Directory Site, the last error was 451 4.4.0 DNS query failed. The last error was:SMTPSEND.DNS.NonExisentDomain; nonexistent domain.

We ran the Mailflow Trouble shooting tool and it gave a couple of warnings regarding no pointer records that had not propagated yet.

The solution ended up being related to the receive connectors. The basic concept is to ensure you have a receive connector on each exchange server that is configured to only include the other exchange server. DO NOT have any other of your receive connectors able to receive from an IP address scope that contains within it the other Exchange server AND has Anonymous Users not selected. An example of our receive connector on the Exchange 2007 server can be seen below.

The second major issue we had was with ActiveSync and our mobile phones. Both Iphone and Android phones experienced errors of Invalid Usernames and passwords. We were also receiving Error:MisconfiguredDevice_Mbx in the IIS logs. This appears to be a common issue according to http://www.stevieg.org/2010/01/solving-iphone-and-exchange-20102007-coexistance-issues/.

 The resolution is to run the command

Get-ActiveSyncVirtualDirectory -Server E2007CA | Set-ActiveSyncVirtualDirectory -ExternalURL:$null

Figure 5

This essentially sets up a proxy for the Activesync clients to the 2007 server. The URL folder from Server Configuration > Client Access > Server > ActiveSync will look like the figure 5. 

- Authentication was set to Ignore Client Certificates and not allow Basic Authentication from the settings of the Client 

- In the IIS folder settings we have Integrated Windows authentication enabled.

- We did temporarily enabled Basic authentication to set a default domain and disabled it; however I am not sure if this had any effect on the final solution.

One final note is that in the process of this some mobile clients updated server settings to legacy.domain.edu. On those few clients they might need to manual change their servers to webmail.domain.edu.

Exchange 2007 to Exchange 2010 Upgrade/Migration

The past couple of days we have spent preparing and doing and upgrade/migration from Exchange 2007 On-Premise to Exchange 2010 On-Premise. All of this is in preparation to migrate voice-mail off of Call-Pilot and our Nortel PBX to Exchange Unified Messaging. That does was made largely because of the every increasing cost of maintenance and replacement wiring for the legacy phone switch. This post will work through the steps, errors and troubleshooting we went through to get Exchange 2010 up and working.

Figure 1. Starting Network Design

Our starting point is the configuration in figure 1. where all Exchange servers are running SP3 Rollup 6.  In addition, all steps until Step # should be able to be completed during normal hours without downtime. This was importance for us because we don't have the redundant hardware or storage to create a replica of the exchange environment. We installed the new servers in a virtual environment.

1. Provision a server in VMware
2. Run the Exchange setup /prepareSchema on the Domain Controller that is SchemaMaster
3. Run the Exchange setup /prepareAD against all domains in your environment. (We have 2, an empty upper root and another full one.)
   
   Note: You will need to move the schema Master to the domain where the exchange server will be installed. Not doing so may result in the following error messages: Hat tip to here for the help
   
   Error: Setup needs to contact the Active Directory schema master but this computer is not in the same Active Directory domain as the schema master (DC=muc,DC=prv). Click here for help... http://go.microsoft.com/fwlink/?linkid=30939&l=en&v=ExBPA.14&id=2376fec1-b9ce-44db-beb6-cb9ac4788988
   
   Error: Setup encountered a problem while validating the state of Active Directory: Exchange organization-level objects have not been created, and setup cannot create them because the local computer is not in the same domain and site as the schema master.  Run setup with the /prepareAD parameter on a computer in the domain muc and site Default-First-Site-Name, and wait for replication to complete. Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.141).aspx?v=14.1.218.11&e=ms.exch.err.Ex28883C&l=0&cl=cp 
    
4.  Run PS cmd- Add-WindowsFeature Web-WMI,Web-Asp-Net,Web-ISAPI-Filter,Web-Client-Auth,Web-Dir-Browsing,Web-Http-Errors,Web-Http-Logging,Web-Http-Redirect,Web-Http-Tracing,Web-Request-Monitor,Web-Static-Content on the exchange server
5.  Our original desire was to only install the CAS role. Due to the certificates we needed to request, we also needed to install the Hub Transport and UM roles while we were going through the setup. So total roles installed = CAS,HUB,UM
6. Perform any Updates
7. Request a UC SAN Certificate for the 2010 server: Do not include Federation service in your request. Use this article as a good example of how to do this in 2010.
   
   - Note: We use Entrust for our certificates and I highly recommend their services. After authorization, we had access to a Certificate Management Service from which we can create, revoke and reuse certificates after they are purchased. With this we don't have to wait on authorization for every single certificate. Their support is great and they are cheaper than the major certificate vendor.
   
   - Certificate Name of the UC SAN (Subject Alternate Name) certificate
   - Common Name = webmail.domain.edu or mail.domain.edu whatever you have currently set your 2007 CAS to
   - SAN = legacy.domain.edu (for redirection of 2007 mailboxes to 2007 CAS)
   - SAN = autodiscover.mountunion.edu
   - SAN = 2010ExchangeName.domain.domain.local
   - SAN = domain.edu
   - SAN = UM.domain.edu ( For UM roles when required)
8. Install the certificate by replying to the request in the GUI.
9. Add the DNS entries for legacy.domain.edu to the DNS servers and have them mapped to the 2007 CAS server.
10. Change firewall rules to allow access to the 2010 CAS server and allow the 2 Cas servers to talked to each other.
    
    Everything up to this point should be able to be completed with no downtime
11. Change the DNS of the primary mail server and autodiscover to point to the new 2010 CAS server.
12. Replace the current UC SAN certificate that is on the 2007 CAS.
    - Common Name = legacy.domain.edu
    - SAN = autodiscover.domain.edu
    - SAN = 2007ServerName.domain.domain.local (This is critically to avoiding errors from Outlook Clients
    - SAN = webmail.domain.edu
    
    - The error received is if you don't have the proper private name is " Security Alert : Information you exchange with this site cannot be viewd or changed by others. However, there is a problem with this site's security certificate. The name on the security certificate is invalid or does not match the name of the site.
    
13. This will need to be generated by Powershell in 2007. The easiest way I found is to use a site like https://www.digicert.com/easy-csr/exchange2007.htm to generate the powershell to paste into the powershell command line.
14. Take that CSR and submit it to your CA to get a certificate.
15. Install the certificate with Import-ExchangeCertificate -Path C:\filename.cer
16. Run a Get-ExchangeCertificate and copy the thumbprint you just installed.
17. Do an Enable-ExchangeCertificate -Services "SMTP,IIS,POP,IMAP" and respond with the thumbprint.
18. If you are looking for full information on the certificates you can run a Get-ExchangeCertificate | fl to see expiration dates and all SANs
19. Make sure to change any spam filter rules to make 2010 the new primary place that mail passes through

Your mail configuration should now be up and Exchange should be passing mail through the 2010 CAS server.   I will do a follow up post that covers a couple of the problems we ran into along the way. Finally, here is an image of the environment after setup.

Here are a couple links to other useful resources when performing this upgrade.

http://blogs.catapultsystems.com/IT/archive/2010/02/17/preparing-for-the-transition-from-exchange-2007-to-exchange-2010-part-1-of-4.aspx


 http://technet.microsoft.com/en-us/library/bb124350.aspx


http://www.simple-talk.com/sysadmin/exchange/upgrade-from-exchange-2007-to-exchange-2010---part-1/ 


http://blogs.technet.com/b/exchange/archive/2006/11/17/3397307.aspx