Best Practices for UC Monitor

In a Cisco environment, you can connect the collector to a SPAN port on the switches that carry VoIP traffic on your network. The collector must be able to inspect call setup-related packets that pass between the call servers and endpoints in your system. Connect the collector at an appropriate network location, using a properly configured SPAN switch port.

If possible, SPAN only VoIP traffic and call server traffic

Add VLANs dedicated to voice traffic to the list of spanned ports.
Configure an ACL to discard non-VoIP traffic before it is sent out of the SPAN port. An ACL has significant overhead on some switches, so use your best judgment in selecting a method to separate traffic.
Use a VACL to filter for all traffic going to and from the IP addresses of the Cisco Unified Communication Managers.

Install UC Monitor collectors near monitored call servers or voice gateways

Calculations for server response times assume that the collector and the monitored server receive an inbound frame at approximately the same time. Similarly, traceroute investigations provide the most accurate path results when the collector is located close to the call server, and the collector and call server share a router. This configuration helps ensure that traceroute results reflect the path taken by packets sent to and from the call server.

Consider NIC usage

A distributed collector and a standalone server use one NIC for the collector service and one NIC for management.

When a network tap is used, one NIC is used for management and two NICs are used for the collector service. A tap splits the transmitting and receiving flows of a full-duplex link across two physical ports. The collector receives the separated traffic from both NICs.

The collector works better with SPAN ports than with network taps

Plug the monitor NIC on the collector into the SPAN port. Configure a network tap only when the SPAN port is in use. You can configure remote spanning of switch traffic to another switch and connect the collector to the SPAN port on the remote switch. Having a dedicated collector for each switch is the recommended configuration.

Forward the following VoIP protocols to the collector:

SIP. Session Initiation Protocol performs call setup and teardown, manages sessions, and determines user location, availability, and capabilities. Forward TCP and UDP traffic on port 5060 to the collector to get SIP flows. UC Monitor supports authenticated SIP flows, but it cannot interpret or report on calls from encrypted SIP flows.
Note: Collectors can monitor only one port per protocol. To monitor multiple SIP ports on a single SPAN, contact CA Technical Support.
H.323. This family of protocols supports real-time transfer of data over packet networks by enabling communications between H.323-enabled devices, such as VoIP gateways. Forward the following traffic to the collector:
- for H.225, TCP traffic on port 1720
- for H.245, TCP traffic on ports above 11000 (dynamically selected)
SCCP. The Skinny Call Control Protocol is a proprietary Cisco protocol used for messaging between skinny clients and a Cisco Unified Communications Manager. Forward TCP traffic on port 2000 to the collector to get SCCP flows. If SCCP signaling flows are encrypted, UC Monitor cannot interpret or report on calls.
MGCP. The Media Gateway Control Protocol enables call-control devices, such as media gateway controllers, to control VoIP calls. Performs similar functions to H.323. Forward UDP traffic on port 2427 to the collector to get MGCP flows.
Q.931. Call setup traffic is backhauled over a TCP connection to Cisco Unified Communications Manager to control the ISDN PRI for the voice gateway. The collector must see the Q.931 Setup and Alerting messages that are sent between the Unified Communications Manager and the gateway. Forward TCP traffic on port 2428 to the collector to get the PRI backhaul flows.

Verify that the SPAN port is not congested or misconfigured

Review the dropped packets statistics on the SPAN port where you want to connect the collector.

If you are running Application Delivery Analysis on the network, connect Application Delivery Analysis to a SPAN port on a different switch

In some situations, however, both systems must monitor the same switch. Therefore, you can use a network tap to separate the traffic intended for Application Delivery Analysis from the traffic intended for UC Monitor. The collector can be connected to a standard tap (copper or fiber) or an aggregating tap rather than a SPAN port. Application Delivery Analysis supports a dual-NIC collector, which a standard tap requires. UC Monitor does not support this type of collector. Purchase a tap that sends the request and the response traffic over the same connection on the tap.

Consider traffic from Publishers and Subscribers

Cisco Unified Communications Manager servers act in multiple roles to provide failover and load balancing capabilities. Therefore, configure the SPAN port so that VoIP-related traffic is associated with both Publishers and Subscribers.

Voice gateways can register with either the Publisher or Subscriber and are often configured to perform failover duties. Signaling between a voice gateway and a call server must reach the collector so that all call traffic on the network is monitored.

In a large Cisco deployment, each cluster typically includes as many as four servers: one Publisher, two Subscribers to handle call processing, and one TFTP server. The Publisher and TFTP server act as backups for failover situations. In such a configuration, SPAN the traffic that goes to two of the servers in the cluster and send it to one collector. Then, send the traffic for the other two servers to a second collector. If the phones are load-balanced among the servers in the cluster, each collector sees data from only half the phones, which is a manageable load.