Cisco Systems Creating the CTL File

17-15
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter17 Configuring the Cisco Phone Proxy
Configuring the Phone Proxy
Creating the CTL File
Create a Certificate Trust List (CTL) file that is required by the Phone Proxy. Specify the certificates
needed by creating a new CTL file or by specifying the path of an exiting CTL file to parse from Flash
memory.
Create trustpoints and generate certificates for each entity in the network (CUCM, CUCM and TFTP,
TFTP server, CAPF) that the IP phones must trust. The certificates are used in creating the CTL file. You
need to create trustpoints for each CUCM (primary and secondary if a secondary CUCM is used) and
TFTP server in the network. The trustpoints need to be in the CTL file for the phones to trust the CUCM.
Create the CTL File that will be presented to the IP phones during the TFTP. The address must be the
translated or global address of the TFTP server or CUCM if NAT is configured.
When the file is created, it creates an internal trustpoint used by the Phone Proxy to sign the TFTP files.
The trustpoint is named _internal_PP_ctl-instance_filename.
Note When a CTL file instance is assigned to the Phone Proxy, you cannot modify it in the CTL File pane and
the pane is disabled. To modify a CTL File that is assigned to the Phone Proxy, go to the Phone Proxy
pane (Configuration > Firewall > Unified Communications > Phone Proxy), and deselect the Use the
Certificate Trust List File generated by the CTL instance check box.
Use the Create a Certificate Trust List (CTL) File pane to create a CTL file for the Phone Proxy. This
pane creates the CTL file that is presented to the IP phones during the TFTP handshake with the ASA.
For a detailed overview of the CTL file used by the Phone Proxy, see the “Creating the CTL File” section
on page 17-15.
The Create a Certificate Trust List (CTL) File pane is used to configure the attributes for generating the
CTL file. The name of the CTL file instance is generated by the ASDM. When the user tries to edit the
CTL file instance configuration, the ASDM automatically generates the shutdown CLI command first
and the no shutdown CLI command as the last command.
This pane is available from the Configuration > Firewall > Unified Communications > CTL File pane.
Step1 Open the Configuration > Firewall > Unified Communications > CTL File pane.
Step2 Check the Enable Certificate Trust List File check box to enable the feature.
Step3 To specify the CTL file to use for the Phone Proxy, perform one of the following:
•If there is an existing CTL file available, download the CTL file to Flash memory by using the File
Management Tool in the ASDM Tools menu. Select the Use certificates present in the CTL stored
in flash radio button and specify the CTL file name and path in the text box.
Use an existing CTL file to install the trustpoints for each entity in the network (CUCM, CUCM and
TFTP, TFTP server, CAPF) that the IP phones must trust. If you have an existing CTL file that
contains the correct IP addresses of the entities (namely, the IP address that the IP phones use for
the CUCM or TFTP servers), you can be use it to create a new CTL file. Store a copy of the existing
CTL file to Flash memory and rename it something other than CTLFile.tlv
•If there is no existing CTL file available, select Create new CTL file radio button.
Add Record entries for each entity in the network such as CUCM, TFTP, and CUCM-TFTP option
by clicking Add. The Add Record Entry dialog box opens. See Adding or Editing a Record Entry
in a CTL File, page 17-16.
Step4 Specify the number SAST certificate tokens required. The default is 2. maximum allowed is 5.