Cisco Systems ASA5515K9, ASA 5500 Using an Existing CTL File, Creating the TLS Proxy Instance for a Non-secure Cisco UCM Cluster

48-20
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter48 Configuring the Cisco Phone Proxy
Configuring the Phone Proxy
Using an Existing CTL File
Note Only when the phone proxy is running in mixed-mode clusters, you have the option to use an existing
CTL file to install trustpoints.
If you have an existing CTL file that contains the correct IP addresses of the entities (namely, the IP
address that the IP phones use for the Cisco UCM or TFTP servers), you can be use it to create a new
CTL file thereby using the existing CTL file to install the trustpoints for each entity in the network (Cisco
UCM, Cisco UCM and TFTP, TFTP server, CAPF) that the IP phones must trust.
Prerequisites
If a CTL file exists for the cluster, copy the CTL file to Flash memory. When you copy the CTL file to
Flash memory, rename the file and do not name the file CTLFile.tlv.
If you are using domain names for your Cisco UCM and TFTP server, you must configure DNS lookup
on the ASA. See the prerequisites for Creating the CTL File, page48-18.
What to Do Next
When using an existing CTL file to configure the phone proxy, you can add additional entries to the file
as necessary. See Creating the CTL File, page48-18.
Once you have configured the CTL file for the phone proxy, create the TLS proxy instance. See Creating
the TLS Proxy Instance for a Non-secure Cisco UCM Cluster, page 48-20 to add the TLS proxy when
configuring the phone proxy in a non-secure mode or see Creating the TLS Proxy for a Mixed-mode
Cisco UCM Cluster, page48-21 if the phone proxy is running in a mixed-mode cluster.
Creating the TLS Proxy Instance for a Non-secure Cisco UCM Cluster
Create the TLS proxy instance to handle the encrypted signaling.
Command Purpose
Step1 hostname(config)# ctl-file ctl_name
Example:
ctl-file myctl
Creates the CTL file instance.
Step2 hostname(config-ctl-file)# cluster-ctl-file
filename_path
Example:
hostname(config-ctl-file)# cluster-ctl-file
disk0:/old_ctlfile.tlv
Uses the trustpoints that are already in the existing
CTL file stored in Flash memory.
Where the existing CTL file was saved to Flash
memory with a filename other than CTLFile.tlv;
for example, old_ctlfile.tlv.
Command Purpose
Step1 hostname(config)# tls-proxy proxy_name
Example:
tls-proxy mytls
Creates the TLS proxy instance.
Step2 hostname(config-tlsp)# server trust-point
_internal_PP_ctl-instance_filename
Example:
server trust-point _internal_PP_myctl
Configures the server trustpoint and references the
internal trustpoint named
_internal_PP_ctl-instance_filename.