CHAPTE R
17-1
Cisco ASA Series Firewall CLI Configuration Guide
17
Configuring the TLS Proxy for Encrypted Voice

Inspection

This chapter describes how to configure the ASA for the TLS Proxy for Encrypted Voice Inspection
feature.
This chapter includes the following sections:
•Information about the TLS Proxy for Encrypted Voice Inspection, page17-1
•Licensing for the TLS Proxy, page17-5
•Prerequisites for the TLS Proxy for Encrypted Voice Inspection, page17-7
•Configuring the TLS Proxy for Encrypted Voice Inspection, page17-7
•Monitoring the TLS Proxy, page17-15
•Feature History for the TLS Proxy for Encrypted Voice Inspection, page17-17

Information about the TLS Proxy for Encrypted Voice Inspection

End-to-end encryption often leaves network security appliances “blind” to media and signaling traffic,
which can compromise access control and threat prevention security functions. This lack of visibility can
result in a lack of interoperability between the firewall functions and the encrypted voice, leaving
businesses unable to satisfy both of their key security requirements.
The ASA is able to intercept and decrypt encrypted signaling from Cisco encrypted endpoints to the
Cisco Unified Communications Manager (Cisco UCM), and apply the required threat protection and
access control. It can also ensure confidentiality by re-encrypting the traffic onto the Cisco UCM servers.
Typically, the ASA TLS Proxy functionality is deployed in campus unified communications network.
This solution is ideal for deployments that utilize end to end encryption and firewalls to protect Unified
Communications Manager servers.

Decryption and Inspection of Unified Communications Encrypted Signaling

With encrypted voice inspection, the security appliance decrypts, inspects and modifies (as needed, for
example, performing NAT fixup), and re-encrypts voice signaling traffic while all of the existing VoIP
inspection functions for Skinny and SIP protocols are preserved. Once voice signaling is decrypted, the
plaintext signaling message is passed to the existing inspection engines.