6.2 Mailbox Provisioning, User Templates & Class of Service

6.2 Mailbox Provisioning, User Templates & Class of Service

Scaling voicemail administration across large enterprise environments requires standardized provisioning workflows, granular role-based policy enforcement, and robust toll fraud prevention. Cisco Unity Connection (CUC) accomplishes this through a hierarchical configuration model based on User Templates, Class of Service (CoS) profiles, and Restriction Tables.

---

1. Mailbox Provisioning Architecture & User Templates

When a new employee joins an organization, manually configuring hundreds of individual voicemail parameters—such as notification schedules, password policies, transfer restrictions, and storage quotas—would be error-prone and unscalable. CUC solves this with User Templates.

+-----------------------------------------------------------------------------------+
|                         USER TEMPLATE INHERITANCE MODEL                           |
|                                                                                   |
|  USER TEMPLATE (e.g., 'Corporate-Employee-Template')                              |
|  +-----------------------------------------------------------------------------+  |
|  |  - Assigned Class of Service: 'Standard-Employee-CoS'                       |  |
|  |  - Language & Greeting Defaults: English (US), Standard Greeting Enabled   |  |
|  |  - Notification Devices: Mobile Phone (SMS), HTML Web Inbox                 |  |
|  |  - Password & PIN Policy: Corporate PIN Policy (Min 6 digits)               |  |
|  |  - Dialing Search Scope: Internal Search Space                              |  |
|  +-----------------------------------------------------------------------------+  |
|                                          |                                        |
|                   +----------------------+----------------------+                 |
|                   | (Applied during user creation)              |                 |
|                   v                                             v                 |
|       SUBSCRIBER 1 (Alice - Ext 2001)               SUBSCRIBER 2 (Bob - Ext 2002) |
|       - Inherits all template settings              - Inherits all template settings|
|       - Overrides: Name, Extension, Primary Email   - Overrides: Name, Extension  |
+-----------------------------------------------------------------------------------+

Template Attributes & Mechanics

A User Template is a baseline prototype for creating subscriber accounts with voice mailboxes. Attributes defined in a template include:

• Assigned Class of Service (CoS): Dictates subscriber feature permissions and mailbox storage boundaries.
• Message Actions: Defines whether incoming voice messages are stored in the user mailbox, accepted and relayed to an external SMTP server, or rejected.
• Notification Devices: Configures default external notification endpoints (e.g., SMS, SMTP email, phone callbacks) and delivery schedules.
• Default Greetings: Determines whether personal greetings, standard greetings, or system-generated name prompts play by default.
• Search Space: Dictates the directory partition visibility for addressing and directory searching.

---

2. User Ingestion Methods: LDAP, AXL, and BAT

CUC provides three primary automated mechanisms for importing user identities and telephone extensions into the messaging system:

1. LDAP Directory Synchronization

For enterprises using Microsoft Active Directory or OpenLDAP as their authoritative identity store, CUC connects directly to LDAP servers via LDAPv3:

• Attribute Mapping: Synchronizes standard schema fields such as sAMAccountName (User ID), givenName (First Name), sn (Last Name), telephoneNumber (Extension), and mail (Email Address).
• LDAP Search Filters: Allows granular import filtering (e.g., (&(objectCategory=person)(department=Finance))).
• Template Selection: When importing LDAP users, the administrator chooses which user template to apply, so filtering the import lets different groups receive different templates.
• Single Sign-On (SSO): When SAML 2.0 SSO is configured, LDAP-integrated users can reach the Cisco Personal Communications Assistant (PCA) and Web Inbox with their corporate credentials.

2. CUCM AXL Web Service Import

Administrative XML (AXL) is a SOAP-based application programming interface (API) running over HTTPS (TCP port 8443) on CUCM:

• CUC queries CUCM's AXL service to retrieve end users and their associated Directory Numbers (DNs).
• Administrators navigate to Users > Import Users, select the CUCM phone system, query for unprovisioned extensions, select the target User Template, and import the accounts with a single click.
• This guarantees that phone extensions in CUCM exactly match the mailbox primary extensions in CUC.

3. Bulk Administration Tool (BAT)

For large-scale non-LDAP environments or complex migrations, the CUC Bulk Administration Tool imports, updates, or deletes thousands of mailboxes via comma-separated values (CSV) flat files:

• Supports granular column headers (Alias, DtmfAccessId, FirstName, LastName, CosName, TemplateName).
• Generates comprehensive transaction error logs for audit compliance.

---

3. Class of Service (CoS) Architecture

A Class of Service (CoS) defines the operational entitlements and feature privileges granted to a user. Subscribers link to exactly one CoS at any given time.

+-----------------------------------------------------------------------------------+
|                         CLASS OF SERVICE (CoS) CONTROLS                           |
|                                                                                   |
|  1. RECORDING LIMITS                                                              |
|     - Max Message Length: 300 seconds (default)                                   |
|     - Mailbox size quotas are set outside CoS                                     |
|                                                                                   |
|  2. CALL TRANSFER PRIVILEGES                                                      |
|     - Transfer to Alternate Extensions                                            |
|     - Transfer to External Phone Numbers (Governed by Restriction Tables)         |
|                                                                                   |
|  3. FEATURE PERMISSIONS                                                           |
|     - Private & Urgent Message Sending                                            |
|     - Visual Voicemail Access                                                     |
|     - Private Distribution List Creation (Max: 50 lists)                          |
|     - Live Record & Live Reply Privileges                                         |
+-----------------------------------------------------------------------------------+

Mailbox Quotas (Set Outside CoS)

Mailbox size limits are not part of CoS. They are set system-wide under Message Storage > Mailbox Quotas and can be overridden per user or per user template. The defaults are:

1. Warning quota (12 MB): CUC warns the user that the mailbox is nearly full.
2. Send quota (13 MB): The user can still listen to and delete messages but cannot send new voice messages.
3. Send/Receive quota (14 MB): The mailbox stops accepting new messages, and outside callers are told the mailbox is full.

Message aging policies (Message Storage > Message Aging) can move or delete old messages automatically to keep users under their quotas.

Message Duration Limits

• Maximum Message Length: Sets the upper bound for any single recorded voice message. The system default is 300 seconds (5 minutes), but administrators can adjust this value from 1 to 3,600 seconds.
• Minimum Message Length: Discards accidental recordings or hang-ups shorter than a defined duration (default: 1 second).

---

4. Restriction Tables & Toll Fraud Prevention

Cisco Unity Connection features call transfer capabilities: automated attendants and subscriber personal greetings can offer callers the option to press a key to transfer to another internal extension, a mobile phone, or an external operator. Without security boundaries, malicious callers could dial into an automated attendant and trick the system into outdialing costly international or premium-rate numbers—an attack known as toll fraud.

CUC prevents toll fraud using Restriction Tables.

Restriction Table Evaluation Logic

A Restriction Table contains an ordered list of dialed digit patterns evaluated on a first-match basis. Each entry defines whether the pattern is Permitted or Restricted. Patterns support only two wildcards: * matches zero or more digits and ? matches exactly one digit. Each table also sets minimum and maximum dial-string lengths.

Incoming Transfer Request: Caller enters digits '9011442079460000'
                     |
                     v
+-----------------------------------------------------------------------------------+
|                    EVALUATE RESTRICTION TABLE PATTERNS (TOP-DOWN)                 |
|                                                                                   |
|  1. Pattern: 911        -> Permitted? YES -> Match? NO                            |
|  2. Pattern: 9011*      -> Permitted? NO  -> Match? YES! -> [ TRANSFER BLOCKED ]  |
|  3. Pattern: 9???????   -> Permitted? YES -> Not evaluated                        |
|  4. Pattern: *          -> Permitted? NO  -> Default Catch-All                    |
+-----------------------------------------------------------------------------------+

Default Restriction Tables

CUC provides predefined restriction tables linked to specific functional tasks:

• Default Outdial: Governs phone numbers dialed by CUC for message notification callbacks.
• Default System Transfer: Applied when an outside caller uses automated attendant prompts to transfer to a dialed number.
• Default Transfer: Applied through CoS to the numbers users can enter for call transfer and similar user-defined destinations.
• Default Fax: Restricts the numbers used for fax delivery.

By default these tables block long-distance and international patterns; administrators then permit what the organization needs.

Standard Pattern Syntax

---

5. Voice Mailbox Parameters & Credential Policies

Each subscriber mailbox maintains individual addressing, credential, and localization settings:

Primary vs. Alternate Extensions

• Primary Extension: The unique directory number representing the mailbox owner (e.g., 2001). Matches the SIP Diversion header during call forwarding.
• Alternate Extensions: Auxiliary phone numbers mapped to the same single mailbox. For example, an employee's mobile number (9195551212) or home office extension (3001) can be added as alternate extensions. When the employee calls CUC from their mobile phone, CUC identifies the calling party number (Caller ID), recognizes it as an alternate extension, and immediately prompts: "Welcome Alice Smith, please enter your PIN"—bypassing the need to manually enter the mailbox ID.

PIN Policies & Trivial PIN Rejection

Phone PINs govern TUI authentication. Under System Settings > Authentication Rules, administrators enforce robust credential requirements:

• Minimum PIN Length: Configurable (recommended minimum 6 digits).
• Expiration: Forces users to update their PIN periodically (e.g., every 90 days).
• Lockout Threshold: Locks the account after a specified number of consecutive failed attempts (for example, lock the account after 3 failed attempts for 30 minutes, or until an administrator unlocks it).
• Trivial PIN Restrictions: Prevents easily guessed PINs:
  • Prohibits repeating digits (e.g., 111111 or 555555).
  • Prohibits sequential ascending or descending digits (e.g., 123456 or 654321).
  • Prohibits using the user's own extension number or the reverse of the extension number.

---

6. Distribution Lists & Broadcast Messaging

CUC enables multi-recipient messaging through distribution lists:

System Distribution Lists vs. Private Distribution Lists

• System Distribution Lists: Centrally managed by administrators in CUC Administration. Available to all authorized subscribers to message entire teams or the entire organization (e.g., All-Employees@cuc.local or Engineering-Staff).
• Private Distribution Lists: Created and curated by individual subscribers using the Cisco Personal Communications Assistant (PCA) web portal. CoS limits determine the maximum number of private lists a user can create (e.g., up to 50 lists with up to 100 members each).

Broadcast Messaging

Broadcast Messaging is an administrative utility used to deliver urgent, mass communications to all subscribers across an entire CUC cluster or digital network:

• Broadcast messages bypass individual user mailbox storage quotas.
• When a subscriber logs into their mailbox via the TUI, the broadcast message plays immediately and unconditionally before the user can listen to personal messages or access menu options.
• Broadcast messages are delivered with priority over ordinary messages and are managed separately from the user's mailbox.