How to Enable Data Push to Cisco IP Phones with Application Gateway

Summary

This article describes how to configure the Application Gateway to push voice data to Cisco IP phones.

Requirements

The following configuration is required for the Application Gateway to communicate with Cisco IP phones:

To enable audio to be pushed from the Application Gateway to the phones, port 32674 must be open between the Application Gateway and the phones.
The CallManager Web Access option must be enabled for each phone. Go to Device > Phone to locate this option, which enables the Web server on a phone. The Application Gateway must connect to a phone’s Web server in order to obtain its Directory Number (DN) and MAC address.
The Web server on a Cisco IP phone requires that the source of pushed data is authenticated to access the phone. Thus, for the Application Gateway to push voice data to Cisco IP phones, you must have a user in CallManager that has push access to all IP phones. In addition, you must specify the credentials for that user in the Application Gateway Administration Tool. If CallManager is configured to use Active Directory, you must also add the user to Active Directory.
During a page or alert push to a large number of IP phones, authentication requests can overwhelm CallManager. You can offload the authentication requests to the Application Gateway, as described below in the To have the Application Gateway handle IP phone authentication requests section.

Procedure

To add a new user to CallManager:

Note: If you are using Active Directory, skip this procedure and continue with the next procedure (To add a new user to Active Directory and CallManager).

In the Cisco CallManager Administration interface, go to User > Add a New User.
Enter the required information, including a user ID of agpush (Citrix recommends the name agpush because it indicates the purpose of the user).
Select the Enable CTI Application Use check box. You enable the Computer Telephony Interface so that the agpush user can run applications.
Save the new user and then click Device Association.
Use the filter at the top of the page to find the device or devices that you want to associate with agpush.
When the device list appears, select the check boxes next to each device that you want to associate, or select the Check All on Page check box to select all the devices.
Click the Update button to save your changes.

To add a new user to Active Directory and CallManager:

Add an agpush user to Active Directory (refer to your Active Directory documentation for help).
In the Cisco CallManager Administration interface, select User > Global Directory and search for the user agpush.
Select the agpush user from the results list and select Device Association for that user.
When the device list appears, select the check boxes next to each device that you want to associate, or select the Check All on Page check box to select all the devices.
Click the Update button to save your changes.

To specify the “agpush” user credentials in the Application Gateway

Administration Tool:

In the Application Gateway Administration Tool, go to the Operation > Voice Office > IP Phone page.
Enter agpush for the user name and enter the password that you specified in CallManager > Active Directory.
Click Submit.

More Information

To have the Application Gateway handle IP phone authentication requests:

When the Application Gateway sends a page or alert, the CallManager must authenticate each IP phone to receive the pushed message. For pages and alerts sent to too many IP phones at once, the burst of authentication traffic degrades CallManager performance. You must configure the Application Gateway to handle the Voice Office authentication requests from IP phones, sparing CallManager from the additional traffic.

Open the Citrix Application Gateway Administration Tool. From a Web browser, enter the following URL:
https://AG_ipAddress:AG_adminPort
Go to the Operation > Voice Office > IP Phone page.
Specify the CallManager authentication URL. The following URL is typically used:
http://CallManager_ipAddress/CCMCIP/authenticate.asp
In CallManager, set the phones' authentication URL to:
http://AppGw_ipAddress/cisco_auth/authenticate.html

When the Application Gateway pushes to a phone with the credentials supplied in the IP Phone page, the phone makes an authentication request to the Application Gateway, which then checks the incoming credentials against its stored ones. If the push originated from the Application Gateway, this check passes. If the credentials do not match, the Application Gateway redirects the phone to the CallManager Authentication URL and processes other requests from that phone as usual.