Cisco TelePresence Administrator's Manual page 116

Each VCS is configured with:
the directory VCS as a neighbor zone
n
a search rule with a Mode of Any alias and a Target of the directory VCS
n
There is no need to neighbor each VCSs with each other. Adding a new VCS now only requires changing
configuration on the new VCS and the directory VCS. However, note that it may be necessary to neighbor
your VCSs to each other if you are using device authentication — see below for more information.
Also, failure of the directory VCS in this situation could cause significant disruption to communications.
Consideration should be given to the use of
H.323 calls and optimal call routing
For H.323 calls, if Optimal
Source of Any. If the Source is configured to All zones, H.323 calls will fail to connect. This is because the
H.323 SETUP message, having followed the optimized route established by the original LRQ or ARQ, will
appear to the target VCS as coming from an unknown zone. SIP calls, however, are successfully routed if
the search rule Source is All zones (because in SIP the search and call setup is combined into one
message).
Hierarchical dial plan (directory VCS) deployments and device authentication
The design of your system must be considered when using device authentication in video networks which
have a hierarchical dial plan with a directory VCS. Authentication problems can occur, if:
any VCS in the network uses a different authentication database from any other VCS in the network, and
n
credential checking is enabled on the Default Zone of each node VCS (as is needed, for example, when
n
using TMS Provisioning Extension mode), and
the directory VCS or any other VCS in a signaling path can optimize itself out of the call routing path
n
In such deployments, each VCS must be configured with a neighbor zone between itself and every other
VCS in the network. Each zone must be configured with an Authentication policy of Do not check
credentials. (No search rules are required for these neighbor zones.)
This is required because, otherwise, some messages such as SIP RE-INVITES, which are sent directly
between VCSs (due to optimal call routing), will be categorized as coming from the Default Zone. The VCS
will then attempt to authenticate the message and this may fail as it may not have the necessary credentials
in its authentication database. This means that the message will be rejected and the call may be dropped.
However, if the node VCSs have a neighbor zone relationship then the message will be identified as coming
through that neighbor zone, the VCS will not perform any credential checking and the message will be
accepted.
Cisco VCS Administrator Guide (X7.1)
clustering
call routing is enabled you must ensure that all search rules are configured with a
for increased resilience.
Zones and neighbors
Page 116 of 479