Cisco Systems ASA 5585-X Manual De Usuario
17-11
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 17 Configuring the TLS Proxy for Encrypted Voice Inspection
Configuring the TLS Proxy for Encrypted Voice Inspection
What to Do Next
Once you have created the internal CA, create the CTL provider instance. See
Creating a CTL Provider Instance
Create a CTL Provider instance in preparation for a connection from the CTL Client.
The default port number listened by the CTL Provider is TCP 2444, which is the default CTL port on
the Cisco UCM. Use the service port command to change the port number if a different port is used by
the Cisco UCM cluster.
the Cisco UCM. Use the service port command to change the port number if a different port is used by
the Cisco UCM cluster.
Step 3
ciscoasa(config-ca-trustpoint)# proxy-ldc-issuer
Issues TLS proxy local dynamic certificates. The
proxy-ldc-issuer command grants a crypto
trustpoint the role as local CA to issue the LDC and
can be accessed from crypto ca trustpoint
configuration mode.
proxy-ldc-issuer command grants a crypto
trustpoint the role as local CA to issue the LDC and
can be accessed from crypto ca trustpoint
configuration mode.
The proxy-ldc-issuer command defines the local
CA role for the trustpoint to issue dynamic
certificates for TLS proxy. This command can only
be configured under a trustpoint with "enrollment
self."
CA role for the trustpoint to issue dynamic
certificates for TLS proxy. This command can only
be configured under a trustpoint with "enrollment
self."
Step 4
ciscoasa(config-ca-trustpoint)# fqdn fqdn
Example:
ciscoasa(config-ca-trustpoint)# fqdn
my-ldc-ca.exmaple.com
Includes the indicated FQDN in the Subject
Alternative Name extension of the certificate during
enrollment.
Alternative Name extension of the certificate during
enrollment.
Step 5
ciscoasa(config-ca-trustpoint)# subject-name
X.500_name
Example:
ciscoasa(config-ca-trustpoint)# subject-name
cn=FW_LDC_SIGNER_172_23_45_200
Includes the indicated subject DN in the certificate
during enrollment
during enrollment
Step 6
hostname(config-ca-trustpoint)# keypair keyname
Example:
ciscoasa(config-ca-trustpoint)# keypair
ldc_signer_key
Specifies the key pair whose public key is to be
certified.
certified.
Step 7
ciscoasa(config-ca-trustpoint)# exit
Exits from the CA Trustpoint configuration mode.
Step 8
hostname(config)# crypto ca enroll trustpoint
Example:
ciscoasa(config)# crypto ca enroll ldc_server
Starts the enrollment process with the CA and
specifies the name of the trustpoint to enroll with.
specifies the name of the trustpoint to enroll with.
Command
Purpose