Before you start to configure NSC to connect with Lync Server, you need to know some information first:
a. Transport type to use for SIP signalling (TCP or TLS. Lync Mediation Server doesn't support UDP for SIP signalling);
b. Lync Server Mediation Server SIP listening port (By default, 5067 for TLS or 5068 for TCP);
c. NSC SIP listening port, e.g. I use port 5081 here for either TCP or TLS;
d. Lync Server Trunk Configuration "Encryption support level": Required, Optional or Not Supported
e. FQDN or IP address of Lync Server Mediation Server
Because Lync only supports G711 codecs (PCMU and PCMA), it is suggested that you create a media profile that only includes PCMU and PCMA.
For a call from Mediation Server to NSC, we call it an outbound call; what we need to do is to create NSC SIP Profile.
Don't forget to link this sip profile to the correct dial plan.
For a call from NSC to Mediation Server, we call it an inbound call; besides the sip profile we defined in section 3, we need to create a new sip trunk
To make NSC work with Lync Server Mediation Server through TLS, you need to have 2 certificates in hand: CA Root Certificate and Server Certificate.
Get CA Root Certificate from whoever can access your CA authority, rename the extension of the file to ".pem" and then you can upload it into NSC "CA Certificates".
For TLS Server Certificate, you need to prepare 2 files: one is your private key (never give file to others); the other is Certificate Request.
To generate a certificate request SSH into the SBC and run the command below. The FQDN being used here is "testsbc.sangoma.com".
/usr/local/nsc/bin/gentls_cert create_server_req -cn testsbc.sangoma.com -alt DNS:testsbc.sangoma.com -org sangoma.com
At this point your certificate request will be displayed on the SSH window. Copy and paste the text to your CA to generate the certificate.
NSC only supports BASE 64 format, we don't support DER format.
WINSCP into the SBC and copy the certificate file from your CA into /usr/local/nsc/conf/ssl/. Ensure this file is in the Base64 format. As well ensure the file is renamed to "certificate.pem". Once this is done run the commands below to create the agent.pem file. This will contain both the certificate and the private key.
cat certificate.pem myreq.key > agent.pem
At this point WINSCP the agent.pem to your local desktop and log into the SBC via the webUI and go to Configuration -> Security -> Certificates. Upload the agent.pem as a Server certificate.