Codian:

MCU 4200 Series

MCU 4500 Series
MSE 8420 Media blade
MSE 8510 Media2 blade
Software Release Notes
Software version 4.0(1.49)

February 2010
D145803
TANDBERG
Philip Pedersens vei 20
1366 Lysaker
Norway
Telephone: +49 67 125 125
Fax: +49 67 125 234
Email: tandberg@tandberg.com
www.tandberg.com
 Introduction

Introduction
Software version 4.0 is a new feature release for the TANDBERG Codian MCU 4200 Series, MCU 4500
Series, and MSE Media blades (generically referred to as ‘the MCU’ in this document). This document
lists and describes the new features supported in this release.

Software version 4.0(1.49) is a maintenance release that fixes a number of bugs, as described in
Resolved issues later in this document.

Notes:
f Due to the improved logging introduced in release 4.0, the upgrade might take up to 25 minutes
to complete; this is because the MCU must reconfigure the compact flash card

f MCU software version 4.0 is only compatible with version 1.2(1.2) and later of TANDBERG
Codian Director

Important: Back up the configuration before upgrading

You must back up your configuration before upgrading to software version 4.0. Certain features of this
release change the format of the configuration file in a way that is not compatible with previous software
versions. If you do not keep an appropriate configuration file and you attempt to downgrade to a previous
software version without using this configuration file, you will no longer be able to log in to your MCU. See
Downgrading software later in this document for more information.

You must also remember the administrator user name and password for the backup configuration. You
will need these if you ever need to make use of this backup file.

Release 4.0 introduces the ability to back up via the web interface. However, before upgrading you must
back up via FTP.

To back up an MSE 8510, log into the Supervisor blade and create a master backup of the MSE 8510.
You can retrieve this master<n>.xml file using FTP (where n is the MSE chassis slot number of the
MSE 8510). For more information refer to the online help accessible from the web interface of the
MSE 8510. Do not use the configuration.xml file from the MSE 8510 blade, because larger
configuration files may be truncated.

To back up an MCU 4200, MCU 4500, or MSE 8420:

1. Ensure that the FTP service is enabled on the Network > Services page.
2. Connect to the MCU using an FTP client. Log in as an administrator. You will see a file called
configuration.xml. This contains the complete configuration of your unit.
3. Copy this file and store it somewhere safe.
The backup process is now complete.

TANDBERG MCU 4.0(1.49) software release notes Page 3 of 17

 Important note: Upgrading MSE 8510 Media2 blades

Important: Save Call Details Records before upgrading

If you are using Call Detail Records (CDR) for billing, auditing or any other purpose, before you upgrade
to this release, you must download and save your current CDR data because the MCU will delete some
recent CDRs to make space for the new audit logging feature, if necessary. If you downgrade from
release 4.0 to any older version, the MCU will delete all existing CDRs.

Important note: Upgrading MSE 8510 Media2 blades

The Media2 blade must be running boot loader version 1.0(0.2) to ensure compatibility with software
versions later than 2.4. To see what version of application and boot loader you are running, go to
Settings > Upgrade.

If your Media2 blade is not already running boot loader version 1.0(0.2), you must install it—but you must
upgrade the application software to 4.0(1.49) BEFORE you upload this boot loader to your 8510 blade.
Follow this procedure:

1. Download the boot loader image from

ftp://ftp.tandberg.com/pub/software/mse_8000/media_blade_8510/boot_loader/bootldr_8510_1.0(0.2)
.img
2. Upgrade the application software (see Upgrading software later in these release notes for
instructions).
3. After your Media2 blade has rebooted, go to the web interface of your Media2 blade. Go to
Status. The Software version field will now show 4.0(1.49).
4. Go to Settings > Upgrade.
5. Under Loader software, click Browse… and locate the bootldr_8510_1.0(0.2).img file
extracted in Step 1. Click Upload software image.
6. Restart the Media2 blade.
7. Go to Settings > Upgrade. The boot loader version will show 1.0(0.2) as the current version.

TANDBERG MCU 4.0(1.49) software release notes Page 4 of 17

 New features and functionalityAdvanced account security mode

New features and functionality

The following features are now supported.

X Advanced account security mode

X Web sessions

X Redirect HTTP requests

X Welcome messages

X Secure serial console

X Security status

X Audit logs

X Back up and restore of configuration files

X 80 port complex audio

X Automatic content handover

X URI dialing using DNS SRV

X API enhancements

The following sections provide further details about these features.

New feature descriptions

Advanced account security mode
Note: Advanced account security mode causes passwords to be hashed in an enhanced way. This
hashing of passwords is an irreversible process that is not compatible with previous releases.

The MCU will prompt you to save the configuration when you enable Advanced account security mode. If
you do not keep an appropriate configuration file and you attempt to downgrade to a previous software
version without using this configuration file, you will no longer be able to log in to your MCU.

See Downgrading software later in this document for more information.

Release 4.0 introduces the option for Advanced account security mode enabling the following features:

X The MCU will demand that passwords fulfill certain criteria, using a mixture of alphanumeric and
non-alphanumeric (special) characters explained in Password format below

X The MCU will hash passwords before storing them in the configuration.xml file. This is an
irreversible process

X Passwords will expire after 60 days

TANDBERG MCU 4.0(1.49) software release notes Page 5 of 17

 Advanced account security mode

X A new password for an account must be different from the last ten passwords used with that
account

X The MCU will disable a user's account if that user incorrectly enters a password three times
consecutively. If this is an admin account, it is disabled for 30 minutes; for any other account, it is
disabled until the administrator re-enables the account from the Users page

X Non-administrator account holders are not allowed to change their password more than once
during any 24 hour period

X Administrators can change any user account’s password and force any account to change its
password by selecting Force user to change password on next login on the Users page.
Administrators can prevent any non-administrator account from changing its password by
selecting Lock password on the Users page

X The MCU will disable any non-administrator account after a 30 day period of account inactivity.
To re-enable the account, you must edit that account's settings on the Users page

To enable Advanced account security mode, go to Settings > Security.

Administrator accounts in Advanced account security mode

When using Advanced account security mode, it is a good idea to rename the default administrator
account. This is especially true where the MCU is connected to the public internet because security
attacks will often use “admin” when attempting to access a device with a public IP address. Even on a
secure network, if the default administrator account is “admin”, it is not inconceivable that innocent
attempts to log into the MCU will cause you to be locked out for 30 minutes.

It is recommended that you create several accounts with administrator privileges. This will mean that you
will have an account through which you can access the MCU even if one administrator account has been
locked out.

If there are applications accessing the MCU, for example TMS, Conference Director, or any other API
application, it is recommended that you create dedicated administrator accounts for each application.

Password format
In Advanced account security mode, passwords must have:

X at least fifteen characters

X at least two uppercase alphabetic characters
X at least two lowercase alphabetic characters
X at least two numeric characters
X at least two non-alphanumeric (special) characters
X not more than two consecutive repeating characters. (That is, two repeating characters are
allowed, three are not)
In Advanced account security mode, a new password must be different to the previous 10 passwords that
have been used with that account.

TANDBERG MCU 4.0(1.49) software release notes Page 6 of 17

 Web sessions

Enhanced encryption and hashing algorithms

This release has enhanced encryption ciphers for HTTPS and for SIP calls using Transport Layer
Security (TLS). This may restrict the use of HTTPS with early versions of web browsers.

The password hashing algorithm has also been enhanced. This new method of hashing passwords is an
irreversible process that is not compatible with previous releases. See Downgrading software later in this
document for more information. To use the new password hashing algorithm, you must enable Advanced
account security mode.

Expiring passwords
In Advanced account security mode, if a user logs in with a correct but expired password the MCU asks
that user to change the password. If the user chooses not to change it, that user is allowed two more
logins. If a user without admin privileges attempts to login a fourth time the MCU will disable that user's
account indefinitely. A user with admin privileges will have their account disabled for 30 minutes on their
fourth attempt, after which they may log in and change their password.

Web sessions
Release 4.0 introduces the use of sessions to the MCU for user verification. The MCU no longer uses
digest authentication and therefore is less secure if you are using HTTP. This may cause some third-party
tools to stop working. It is recommended that you use HTTPS to protect user names and passwords.

Note: You must have the ‘Encryption’ feature key to use HTTPS.

Redirect HTTP requests

Release 4.0 introduces the option to have HTTP web requests to the MCU automatically redirected to
HTTPS. This option is unavailable if either HTTP (Web) or HTTPS (Secure web) access is disabled on
the Network > Services page.
This feature is enabled by default. To disable this feature, go to Settings > Security and select Redirect
HTTP requests to HTTPS.

Note: You must have the ‘Encryption’ feature key to use HTTPS.

Welcome messages
Release 4.0 introduces welcome messages. This means you can configure a login message to appear on
the Login page of the MCU. You can also configure a home page message to appear on the Home page.
You can configure a separate title (maximum: 100 characters) and text (maximum: 1500 characters) for
each message.
To configure the welcome messages, go to Settings > User interface. In the Welcome messages
section, under Login message enter the text you require for the messages in the Title and Text fields.
Under the Home page message section, enter the text you require for the messages in the Title and Text
fields.

TANDBERG MCU 4.0(1.49) software release notes Page 7 of 17

 Secure serial console

Secure serial console

Release 4.0 introduces additional security settings for the serial console. The serial console now has the
following features:
X Require administrator login – If this is not enabled, anyone with physical access to the MCU (or
with access to your terminal server) can potentially enter commands on the serial console. If
enabled, a user must login with administrator privileges to access the serial console. Enabling this
feature also allows you to configure a timeout for a session on the serial console. To enable this
feature, go to Settings > Security and select Require administrator login. If the audit log is
enabled, any failed login attempts are logged
X Advanced account security mode – When running in Advanced account security mode and with
Require administrator login enabled, all the features of Advanced account security mode will
apply, including the disabling of accounts – see Advanced account security mode for more
information
X Hiding log messages on the serial console – Log messages on the serial console can be hidden
by enabling Hide log messages on console on the Settings > Security page
X Reset password – Passwords can no longer be reset through the serial console
X Welcome messages on the serial console – The Login Welcome messages (discussed above)
also appear when logging in to the serial console. Note that Require administrator login must be
enabled. See above for details
X Disable the serial input during startup – The features above do not protect the serial console
during system startup, therefore an option has been added to disable the serial input during
startup. To disable access, go to Settings > Security and select Disable serial input during
startup

Security status
Release 4.0 introduces the Security status page. The Security status page displays a list of active
security warnings for the MCU. To access this information, go to Status > Security.
Security warnings identify potential weaknesses in the security of the MCU's configuration. To
acknowledge a security warning, select that warning and click Acknowledge selected. Acknowledged
warnings will not appear on the MCU's Home page. If the MCU reboots, the warnings are reset and
previously acknowledged warnings will need re-acknowledging.
To fix a security issue, click on the Action link for the warning message relating to the issue. When you
fix a security issue, the security warning disappears from this list (on the Status > Security page), but it
will be logged in the Audit log. See below for more information about the audit log.

Audit logs
The audit log records any user action on the MCU which might compromise the security of the unit, of its
functions, or of the network.
By enabling auditing, all network settings, security settings, creation/deletion of conferences, and any
changes to the audit log itself are logged on the MCU.

TANDBERG MCU 4.0(1.49) software release notes Page 8 of 17

 Back up and restore of configuration files

All relevant actions on the MCU are logged, including those made through the serial console, a supervisor
blade (for MSE blades), the API, FTP, and the web interface. The module that has caused a log is listed
within the details of that log and will be one of:
X Web: For configuration changes made through the web interface
X Serial: For configuration changes made through the serial interface
X API: For configuration changes made through the API
X Supervisor: For configuration changes made through the Supervisor Blade (only applies to MSE
blades)
X System: For audit messages internal to the MCU
X FTP: For configuration changes made through the FTP interface
Each log also has a severity associated with it (Error, Severe Warning, Warning, Info, or Status Warning).
You must enable the audit log for it to record these actions.
To enable and view the audit log, go to Logs and select the Audit log tab.

Back up and restore of configuration files

Release 4.0 introduces the ability to back up and restore the configuration files using the MCU web
interface.
The Backup and restore section of the Settings > Upgrade page allows you to back up and restore the
configuration of the MCU. This enables you to either go back to a previous configuration after making
changes or to effectively "clone" one unit as another by copying its configuration.
To back up the configuration, click Save backup file and save the resulting "configuration.xml" file to a
secure location.
To restore a "configuration.xml" file, type in, or browse to the backup file to be restored and click Restore
backup file. When restoring a new configuration file to an MCU you can control which parts of the
configuration are overwritten:
X If you check the Network settings box, the network configuration will be overwritten with the
network settings in the supplied file. Typically you would only check this box if you were restoring
from a file backed up from the same MCU or if you were intending to replace an out of service
MCU. If you copy the network settings from a different, active, MCU and there is a clash (for
instance, both are now configured to use the same fixed IP address) one or both boxes may
become unreachable via IP.
X If you check the User settings box, the current user accounts and passwords will be overwritten
with those in the supplied file. If you overwrite the user settings and there is no user account in
the restored file corresponding to your current login, you will need to log in again after the file has
been uploaded.
By default, the overwrite controls are unchecked, and so the existing network settings and user accounts
will be preserved.

Note: You can also back up and restore the configuration of the MCU using FTP. For more information,
see the Online Help.

TANDBERG MCU 4.0(1.49) software release notes Page 9 of 17

 80 port complex audio

80 port complex audio

Release 4.0 introduces support for up to 80 complex audio ports on the MSE 8510 Media2 blade when
running in SD mode.

Automatic content handover

Release 4.0 introduces automatic content handover. This feature allows for rapid swapping between
content from different participants in a video conference. In a conference where a participant is sending
content, this feature allows another endpoint to start sending content without having to wait for the original
content provider to stop sending content from his computer.

To enable this feature, go to Settings > Content. For Automatic content handover, select Enabled.

Note: The MCU applies this feature unit-wide. Therefore when it is enabled, all conferences on the MCU
will allow automatic content handover.

URI dialing using DNS SRV

This release supports the use of H.323 and SIP URI dialing using DNS SRV requiring neither an H.323
gatekeeper nor a SIP registrar. URI dialing uses the format: example.person@tandberg.com

API enhancements
Release 4.0 provides a number of new API features. For more information, refer to the latest version of
the API document.

TANDBERG MCU 4.0(1.49) software release notes Page 10 of 17

 Using a web browser

Upgrading software
Before upgrading the software, you must back up your configuration and save Call Details Records as
described in the Introduction.

Note: Due to the improved logging introduced in release 4.0, the upgrade might take up to 25 minutes to
complete; this is because the MCU must reconfigure the compact flash card.

Using a web browser

1. Unzip the image file.

2. Browse to the IP address of the MCU using a web browser.

3. Log in as an administrator.

4. Go to the Settings > Upgrade page.

5. In the Main software image section, type in, or browse to the location of the software image file.

6. Click Upload software image.

A progress bar is displayed in a separate pop-up widow while the web browser uploads the file to
the MCU or MSE media blade. This takes some time – dependent on your network connection.
Do not move your web browser away from the Upgrade software page or refresh this page during
the upload process; otherwise, it will abort.

After a number of minutes, the web browser refreshes automatically and displays “Main image
upload completed successfully”.

7. Click Close Status window.

8. In the changed Upgrade page, click Shut down MCU.

9. Click Confirm MCU shutdown.

10. When shutdown has completed, click Restart MCU and upgrade.

11. When prompted, confirm the restart. The unit will reboot and upgrade itself – this may take up to
25 minutes to complete.

Note: If you have been logged out due to inactivity, log in again as admin and click Restart MCU and
upgrade on the Shutdown page.

TANDBERG MCU 4.0(1.49) software release notes Page 11 of 17

 Downgrading software

Using FTP
1. Use an FTP client to connect to the MCU – e.g. ftp <MCU IP Address> from the command
prompt.

2. Log in as an administrator.

3. Upload the upgrade file from the command prompt. For example:

put codian_mcu_4.0(1.49)

4. When the upload has completed, go to the Upgrade page within the web interface.

5. Click Shut down MCU and upgrade.

6. Click Confirm MCU shutdown.

7. When shutdown has completed, click Restart MCU and upgrade.

8. When prompted, confirm the restart. The unit will reboot and upgrade itself – this may take up to
25 minutes.

Note: If you have been logged out due to inactivity, log in again as admin and click Restart MCU and
upgrade on the Shutdown page.

Notes
X The progress of the upgrade can be monitored through the serial port

X Before upgrading, make sure that the MCU is not in use. Anyone using the MCU at the time of
the upgrade may experience poor performance and loss of connectivity

Downgrading software
Note: Before downgrading to an older software version you must save Call Details Records. If you
downgrade from release 4.0 to any older version, the MCU will delete all existing CDRs.

To downgrade from release 4.0:

1. Go to Settings > Upgrade.

2. Locate a "configuration.xml" file that is compatible with the release to which you want to
downgrade and click Restore backup file. (Note: this must be a configuration file saved before
Advanced account security mode was enabled.)

3. Select User settings. If required, select Network settings.

When the configuration has been restored, follow the instructions as detailed in Upgrading software
above.

TANDBERG MCU 4.0(1.49) software release notes Page 12 of 17

 Checking for updates and getting help

Checking for updates and getting help

If you experience any difficulties or unexpected results when using this version of the MCU software,
consult the online help documentation for information on using the device.

It is a good idea to regularly check for software updates on the TANDBERG web site.

If the documentation does not answer your question or you have a problem with one of our products, refer
to the Troubleshooter and Knowledge Base sections of the web site which are kept up to date with the
latest information from TANDBERG customer support (www.tandberg.com > Support).

If the information on the web site does not help you to solve your problem, contact your reseller. Make
sure you have the following information ready:
X The serial number and product model number (for example, MCU 4510) of the unit
X The software build number (to find this, in the web interface, go to Status)
X Your contact email address or telephone number

TANDBERG MCU 4.0(1.49) software release notes Page 13 of 17

 Resolved issues

Resolved issues
The following issues have been found in previous releases and are resolved in this release.

Resolved since version 4.0(1.44), January 2010

Bug ID Summary

6744 Random corruption of messages transmitted between the host and DSPs could lead to the
MCU unexpectedly restarting.

7042 In certain situations the transmitted video sent from the MCU would contain one of more
panes that appeared to be shaking. This has been improved in this release.

9067 In previous releases, the MCU would send low frame rate 720p to MXP endpoints at a
lower bandwidth than can be successfully decoded (typically 384 Kbps). This would result
in video corruption. This is fixed in release 4.0(1.49)

In the previous 4.0 release, under some network conditions, the MCU 4200 Series and
9630
8420 blade could lose audio from TANDBERG MXP and C-series codecs. This is fixed in
the 4.0(1.49)

9674 In the previous 4.0 release, after a reboot, Unicode characters in the configuration file of
the MSE 8510 Media2 blade would be replaced with blank space. This is fixed in 4.0(1.49)

Resolved since version 3.1(2.13), August 2009

Bug ID Summary

8585 Release 4.0 improves memory allocation for audio DSPs.

8764 Release 4.0 improves video quality for Polycom HDX systems.

8808 In previous releases, uploading a customization package on an MSE Media 2 blade could
lead to a corruption in the audio files. This is fixed in release 4.0.

8814 In previous releases, adding a SIP participant to a conference with Use SIP registrar
usage unchecked (on the ‘Add participant’ page or in the endpoint’s configuration in the
MCU’s address book) could cause stability issues when a DNS server replied with a large
number of A records. This is fixed in release 4.0.

8860 In previous releases, the Maximum transmitted video packet size setting (on the Settings
> Conferences page) only applied to the main video channel. In release 4.0 this also
applies to the content channel.

8892 Release 4.0 introduces support for content sent from Movi 3.0.

TANDBERG MCU 4.0(1.49) software release notes Page 14 of 17

 Resolved issues

Bug ID Summary

9217 In previous releases, certain corrupted encryption streams could overload the DSPs with
messages causing stability issues. This is fixed in release 4.0.

9250 Release 4.0 introduces the ability to download large configuration files (over 32,000 bytes)
over FTP from MSE Media 2 blades.

TANDBERG MCU 4.0(1.49) software release notes Page 15 of 17

 Outstanding bugs

Outstanding bugs
Bug ID Summary

9208 If an MCU is registered to an OCS server, (for example, MCU@domainOne) and

attempts to place a call to a device in another domain (for example, domainTwo), the
MCU will substitute its own domain name (domainOne) for the required domain
(domainTwo). For example, trying to call user@domainTwo would result in the MCU
trying to call user@domainOne which causes a “404 not found reply” error message.

Known limitations
TMS CCC limitation
MCU software version 4.0 cannot deliver the “Snapshot” for a conference to TMS versions 12.5 or earlier
due to the changes in web authentication. This will be fixed in future versions of TMS.

Issues when removing the CompactFlash™ during operation

Removing the CompactFlash card while the MCU is in operation has been known to cause a restart.

Windows Media Player

Streaming a conference with Windows Media Player in multiple windows or tabs on the same browser will
crash the browser. This is a known issue with Windows Media Player. If you need to stream more than
one conference simultaneously, use a different player such as QuickTime or Real Player.

In addition, Windows Media Player 11 (WMP11) can display streams incorrectly when used as an
embedded player with browsers other than Internet Explorer. This is a known incompatibility. In some
cases, setting the video size of the main streaming video window (the Video size field in the Streaming
page) to Large will correct the problem. To work around this issue, you can use QuickTime or RealPlayer
instead of WMP, or use Internet Explorer instead of your normal browser.

Streaming to QuickTime7 causes problems with some browsers

Streaming to an embedded QuickTime player using the QuickTime 7.0 plus later option for the Player
format on the MCU can cause certain browsers to crash or remain in the 'negotiating' state indefinitely.
Affected browsers include: IE6; Firefox 1.5 (Mac and PC); Safari 2.0.3 and earlier, and Camino. IE7 and
Safari 2.0.4 do not appear to be affected by this. Using the QuickTime 6.5 plus later option for the Player
format on the MCU will allow streaming to QuickTime using any browser that supports a QuickTime
plugin.

Network Port B is not supported on the MSE 8510 Media2 blade series
Port B is currently not supported on the MSE 8510 Media2 blade. Do not enable Port B.

MCU uses DNS to try to resolve non-DNS addresses

Sometimes, if the MCU cannot resolve an E.164 number using the gatekeeper (for example, if for
whatever reason the gatekeeper does not respond to the MCU), the MCU will then repeatedly attempt to
use DNS to find the address. This causes the MCU to report failed name resolutions in the event log.

TANDBERG MCU 4.0(1.49) software release notes Page 16 of 17

 Known limitations

Disclaimers and notices

The objective of this documentation is to provide the reader with assistance in using and configuring the product. The
capabilities of TANDBERG products and other manufacturers' products change over time and so the required
configuration may be different from that indicated here. If you have any suggestions for changes to this document,
please feed them back to TANDBERG through your TANDBERG Authorized Service Representative.

If you need technical support, please contact your TANDBERG Authorized Service Representative.
The specifications for the product and the information in this Guide are subject to change at any time, without notice,
by TANDBERG. Every effort has been made to supply complete and accurate information in this Guide; however,
TANDBERG assumes no responsibility or liability for any errors or inaccuracies that may appear in this document.

TANDBERG® is a registered trademark belonging to Tandberg ASA. Other trademarks used in this document are the
property of their respective holders.

This Guide may be reproduced in its entirety, including all copyright and intellectual property notices, in
limited quantities in connection with the use of this product. Except for the limited exception set forth in the
previous sentence, no part of this Guide may be reproduced, stored in a retrieval system, or transmitted, in
any form, or by any means, electronically, mechanically, by photocopying, or otherwise, without the prior
written permission of TANDBERG.

www.tandberg.com

© 2010 TANDBERG

TANDBERG MCU 4.0(1.49) software release notes Page 17 of 17