Cisco Systems and the ASA Services Module Manual De Usuario
16-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 16 Configuring the Cisco Phone Proxy
Configuring the Phone Proxy
Prerequisites
Import the required certificates, which are stored on the Cisco UCM. See
.
What to Do Next
Once you have created the trustpoints and generated the certificates, create the CTL file for the phone
proxy. See
proxy. See
.
If you are configuring the phone proxy in a mixed-mode cluster, you can use an existing CTL file. See
Creating the CTL File
Create the CTL file that will be presented to the IP phones during the TFTP requests.
Command
Purpose
Step 1
hostname(config)# crypto key generate rsa label
key-pair-label modulus size
Example:
crypto key generate rsa label cucmtftp_kp modulus
1024
Creates a keypair that can be used for the trustpoints.
Step 2
hostname(config)# crypto ca trustpoint
trustpoint_name
Example:
crypto ca trustpoint cucm_tftp_server
Creates the trustpoints for each entity in the network
(primary Cisco UCM, secondary Cisco UCM, and
TFTP server).
(primary Cisco UCM, secondary Cisco UCM, and
TFTP server).
Note
You are only required to create a separate
trustpoint for the TFTP server when the
TFTP server resides on a different server
from the Cisco UCM. See
trustpoint for the TFTP server when the
TFTP server resides on a different server
from the Cisco UCM. See
for an example of this
configuration.
Step 3
hostname(config-ca-trustpoint)# enrollment self
Generates a self-signed certificate.
Step 4
hostname(config-ca-trustpoint)# keypair keyname
Example:
keypair cucmtftp_kp
Specifies the keypair whose public key is being
certified.
certified.
Step 5
hostname(config-ca-trustpoint)# exit
Exits from the Configure Trustpoint mode.
Step 6
hostname(config)# crypto ca enroll trustpoint
Example:
crypto ca enroll cucm_tftp_server
Requests the certificate from the CA server and
causes the ASA to generate the certificate.
causes the ASA to generate the certificate.
When prompted to include the device serial number
in the subject name, type Y to include the serial
number or type N to exclude it.
in the subject name, type Y to include the serial
number or type N to exclude it.
When prompted to generate the self-signed
certificate, type Y.
certificate, type Y.