Filter
Top Products
17-10
Cisco Unified Communications Manager Security Guide
OL-24124-01
Chapter 17 Configuring Virtual Private Networks
Configuring ASA for VPN client on IP phone
• CallManager - Authenticating the Cisco UCM during TLS handshake (Only required for
mixed-mode clusters)
• Cisco_Manufacturing_CA - Authenticating IP phones with a Manufacturer Installed Certificate
(MIC).
• CAPF - Authenticating IP phones with an LSC.
To import these Cisco Unified Communications Manager certificates
a. From the Cisco Unified Communications Manager OS Administration web page.
b. Choose Security > Certificate Management. (Note: This location may change based on the UCM
version)
c. Find the certificates Cisco_Manufacturing_CA and CAPF. Download the .pem file and save as .txt
file
d. Create trustpoint on the IOS
Example:
hostname(config)# crypto pki trustpoint trustpoint_name
hostname(config-ca-trustpoint)# enrollment terminal
hostname(config)# crypto pki authenticate trustpoint
When prompted for base 64 encoded CA Certificate, copy-paste the text in the downloaded
.pem file along with the BEGIN and END lines. Repeat the procedure for the other certificates
e. You should generate the following IOS self-signed certificates and register them with Cisco Unified
Communications Manager, or replace with a certificate that you import from a CA.
• Generate a self-signed certificate.
Example:
Router> enable
Router# configure terminal
Router(config)# crypto key generate rsa general-keys label <name> <exportable
-optional>
Router(config)# crypto pki trustpoint <name>
Router(ca-trustpoint)# enrollment selfsigned
Router(ca-trustpoint)# rsakeypair <name> 1024 1024
Router(ca-trustpoint)#authorization username subjectname commonname
Router(ca-trustpoint)# crypto pki enroll <name>
Router(ca-trustpoint)# end
• Generate a self-signed certificate with Host-id check enabled on the VPN profile in Cisco Unified
Communications Manager.
Example:
Router> enable
Router# configure terminal
Router(config)# crypto key generate rsa general-keys label <name> <exportable
-optional>
Router(config)# crypto pki trustpoint <name>
Router(ca-trustpoint)# enrollment selfsigned
Router(config-ca-trustpoint)# fqdn <full domain name>
Router(config-ca-trustpoint)# subject-name CN=<full domain name>, CN=<IP>
Router(ca-trustpoint)#authorization username subjectname commonname
Router(ca-trustpoint)# crypto pki enroll <name>
Router(ca-trustpoint)# end
• Register the generated certificate with Cisco Unified Communications Manager.
Example:
Router(config)# crypto pki export <name> pem terminal