48-10
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter48 Configuring the Cisco Phone Proxy
Prerequisites for the Phone Proxy
Note You can configure LSC provisioning for additional end-user authentication. See the Cisco
Unified Communications Manager configuration guide for information.
•The CAPF certificate must be imported onto the ASA.
•The CTL file created on the ASA must be created with a CAPF record-entry.
•The phone must be configured to use only the SCCP protocol because the SIP protocol does not
support encryption on these IP phones.
•If LSC provisioning is done via the phone proxy, you must add an ACL to allow the IP phones to
register with the Cisco UCM on the nonsecure port 2000.
Cisco IP Communicator Prerequisites
To configure Cisco IP Communicator (CIPC) with the phone proxy, you must meet the following
prerequisites:
•Include the cipc security-mode authenticated command under the phone-proxy command when
configuring the phone proxy instance.
•Create an ACL to allow CIPC to register with the Cisco UCM in nonsecure mode.
•Configure null-sha1 as one of the SSL encryption ciphers.
Current versions of Cisco IP Communicator (CIPC) support authenticated mode and perform TLS
signaling but not voice encryption. Therefore, you must include the following command when
configuring the phone proxy instance:
cipc security-mode authenticated
Because CIPC requires an LSC to perform the TLS handshake, CIPC needs to register with the Cisco
UCM in nonsecure mode using cleartext signaling. To allow the CIPC to register, create an ACL that
allows the CIPC to connect to the Cisco UCM on the nonsecure SIP/SCCP signalling ports (5060/2000).
Note You can configure LSC provisioning for additional end-user authentication. See the Cisco Unified
Communications Manager configuration guide for information.
CIPC uses a different cipher when doing the TLS handshake and requires the null-sha1 cipher and SSL
encryption be configured. To add the null-shal cipher, use the show run all ssl command to see the output
for the ssl encryption command and add null-shal to the end of the SSL encryption list.
Note When used with CIPC, the phone proxy does not support end-users resetting their device name in CIPC
(Preferences > Network tab > Use this Device Name field) or Administrators resetting the device name
in Cisco Unified CM Administration console (Device menu > Phone Configuration > Device Name
field). To function with the phone proxy, the CIPC configuration file must be in the format:
SEP<mac_address>.cnf.xml. If the device name does not follow this format (SEP<mac_address>), CIPC
cannot retrieve its configuration file from Cisco UMC via the phone proxy and CIPC will not function.