The Avaya Session Border Controller for Enterprise (ASBCE) certificate management is a feature that allows you to install, manage, and renew certificates for the ASBCE server. Certificates are used to authenticate and encrypt the communication between the ASBCE server and other entities, such as endpoints, servers, or service providers. The following statements about the ASBCE certificate management are true:

• It allows using a default server certificate for up to one year after the installation: The ASBCE server comes with a default self-signed server certificate that can be used for testing or demonstration purposes. The default server certificate is valid for one year from the date of installation. After one year, the default server certificate expires and needs to be replaced with a valid certificate from a trusted Certificate Authority (CA).
• It supports both the Root and Intermediate Certificate Authority (CA) certificates: The ASBCE server supports installing both the Root and Intermediate CA certificates, which are used to verify the identity and trustworthiness of other certificates. A Root CA certificate is a certificate that is issued by a trusted authority and is self-signed. An Intermediate CA certificate is a certificate that is issued by a Root CA or another Intermediate CA and is used to sign other certificates. The ASBCE server can store up to 10 Root CA certificates and up to 10 Intermediate CA certificates.

To integrate Avaya Aura® Communication Manager (CM) with Application Enablement Services (AES), and enable the TSAPI link, you need to perform two configuration steps on CM: Configure IP Services and Create a CTI link. These steps are necessary to establish a connection between CM and AES using ASAI protocol, which is a proprietary protocol that provides access to various CTI features of CM. A TSAPI link is a logical connection between CM and AES that allows TSAPI applications to use ASAI features through AES. To configure IP Services and Create a CTI link on CM, you need to use these screens:

• The “ip-services” screen: This is a screen that allows you to create and manage IP services on CM, such as ASAI-IP or C-LAN. You can access this screen using the System Access Terminal (SAT) interface of CM. On this screen, you need to specify a service type, node name, local node, local port, remote node, remote port, remote domain name, service state, and service link for each IP service. For integrating with AES, you need to create an ASAI-IP service that points to the node name of an AES server.
• The “cti-link” screen: This is a screen that allows you to create and manage CTI links on CM, which are logical connections between CM and CTI servers, such as AES. You can access this screen using the System Access Terminal (SAT) interface of CM. On this screen, you need to specify a name, number, type, and password for each CTI link. For integrating with AES, you need to create a CTI link of type ADJ-IP that matches the switch CTI link number on AES.

The output from the show mgc command (issued on a G430/G450 Gateway CLI) can indicate whether the G430/G450 is operating as an Internet Friendly (Edge) Gateway or an Enterprise Gateway. An Internet Friendly (Edge) Gateway is a device that provides secure and reliable connectivity between endpoints on different networks, such as the public internet and a private enterprise network. An Enterprise Gateway is a device that provides connectivity between endpoints on the same network, such as a LAN or a WAN. The show mgc command displays information about the Media Gateway Controller (MGC), which is the entity that controls the media gateway functions of the G430/G450, such as call processing, routing, and signaling. The MGC can be an Avaya Communication Manager (CM) server or an Avaya Session Border Controller for Enterprise (ASBCE) server. The output from the show mgc command includes these fields:

• Management Link Mode: This field indicates how the G430/G450 communicates with the MGC for management purposes, such as configuration, monitoring, and troubleshooting. The possible values are Direct or Tunnelled. Direct means that the G430/G450 communicates with the MGC using a direct IP connection over TCP port 5022. Tunnelled means that the G430/G450 communicates with the MGC using a tunnel over TCP port 2944 and secured using TLS. This mode is used when the G430/G450 operates as an Internet Friendly (Edge) Gateway and communicates with ASBCE as the MGC.
• H.248 Link Mode: This field indicates how the G430/G450 communicates with the MGC for media gateway control purposes, such as controlling media streams, allocating resources, and creating connections. The possible values areEGW or IFG. EGW means that the G430/G450 communicates with the MGC using H.248 protocol over UDP port 2944. This mode is used when the G430/G450 operates as an Enterprise Gateway and communicates with CM as the MGC. IFG means that the G430/G450 communicates with the MGC using H.248 protocol over TCP port 2944 and secured using TLS. This mode is used when the G430/G450 operates as an Internet Friendly (Edge) Gateway and communicates with ASBCE as the MGC.
• H.248 Link Status: This field indicates whether the H.248 link between the G430/G450 and the MGC is up or down, and whether it is encrypted or not. The possible values are UP/Encrypted, UP/Unencrypted, DOWN/Encrypted, or DOWN/Unencrypted. UP means that the H.248 link is established and functional. DOWN means that the H.248 link is not established or not functional. Encrypted means that the H.248 link is secured using TLS encryption. Unencrypted means that the H.248 link is not secured using TLS encryption.

Therefore, to determine whether the G430/G450 is operating as an Internet Friendly (Edge) Gateway or an Enterprise Gateway, you can look at these two fields in the output from the show mgc command:

• If the H.248 Link Mode displays IFG, it means that the G430/G450 is operating as an Internet Friendly (Edge) Gateway and communicating with ASBCE as the MGC using H.248 over TCP port 2944 and secured using TLS.
• If the H.248 Link Status displays UP/Encrypted, it means that the G430/G450 is operating as an Internet Friendly (Edge) Gateway and communicating with ASBCE as the MGC using a secure and functional H.248 link.

To connect the Avaya Breeze® platform that is hosting an Avaya Aura® Presence Services snap-in with the Avaya Aura® Session Manager (SM), you need to configure the following:

• One Entity Link from SM to Avaya Breeze®: This is a SIP trunk that connects the SM and the Avaya Breeze® server for SIP signaling and media. You need to create an Entity Link in System Manager, under Elements > Routing > Entity Links, and specify the IP address or FQDN of the SM and the Avaya Breeze® server Security Module (SM100). You also need to select TLS as the SIP Link Transport Type56
• TLS ports 5061 and TLS 5062: These are the ports used by the Entity Link for secure SIP signaling between SM and Avaya Breeze®. Port 5061 is used by SM to send SIP requests to Avaya Breeze®, while port 5062 is used by Avaya Breeze® to send SIP responses to SM. These ports require a valid certificate on both SM and Avaya Breeze® servers56
• UDP port 5060 and TLS port 5061: These are the ports used by the Presence Services snap-in for XMPP federation with other XMPP servers or clients. Port 5060 is used for unencrypted XMPP traffic over UDP, while port 5061 is used for encrypted XMPP traffic over TLS. These ports enable presence and instant messaging features across different domains or platforms34

To allow communications between the Avaya Aura® Device Services (AADS) and the Avaya Aura® Web Gateway (AAWG), you need to perform the following configuration steps:

• Configure the AAWG FQDN as a Trusted Host on the AADS: A Trusted Host is an entity that is allowed to communicate with the AADS server using HTTPS or REST APIs. You need to configure the Fully Qualified Domain Name (FQDN) of the AAWG server as a Trusted Host on the AADS server, using the System Manager web interface. This allows the AAWG server to access the AADS server for device management and configuration purposes3
• Configure the AADS FQDN as a Trusted Host on the AAWG: Similarly, you need to configure the FQDN of the AADS server as a Trusted Host on the AAWG server, using the app configure command line utility. This allows the AADS server to send dynamic configuration parameters and certificates to the AAWG server for WebRTC call signaling and media processing4
• Configure the AADS FQDN, Client interface port and Server-to-server interface port on the AAWG: You also need to configure the FQDN, Client interface port and Server-to-server interface port of the AADS server on the AAWG server, using the app configure command line utility. These parameters are used by the AAWG server to establish secure connections with the AADS server for device management and configuration purposes. The default Client interface port is 9443, while the default Server-to-server interface port is 84434

Avaya Breeze® is a development platform that enables rapid development for applications targeted to meet a customer’s communications needs. It is used by Avaya, Partner, and third-party developers to create and deploy snap-ins, which are modular software components that provide specific functionality or features. Avaya Breeze® allows application developers to quickly add new capabilities to their Avaya solutions, such as voice, video, messaging, presence, collaboration, and analytics.