Cisco Cisco TelePresence Video Communication Server Expressway
Configuring VCS authentication methods
VCS Deployment Guide: Device authentication on Cisco VCS (VCS X7.2)
Page 18 of 50
Using Active Directory database (direct)
Active Directory database (direct) authentication uses NTLM protocol challenges and authenticates
credentials via direct access to an Active Directory server using a Kerberos connection.
credentials via direct access to an Active Directory server using a Kerberos connection.
Active Directory database (direct) authentication can be enabled at the same time as local
database and H.350 directory service authentication:
•
database and H.350 directory service authentication:
•
This is because NTLM authentication is only supported by certain endpoints.
•
In such circumstances you could, for example, use the Active Directory (direct) server
method for Movi / Jabber Video, and the local database or H.350 directory service
authentication for the other devices that do not support NTLM.
method for Movi / Jabber Video, and the local database or H.350 directory service
authentication for the other devices that do not support NTLM.
NTLM authentication is only supported (at the time of writing) by Movi / Jabber Video version 4.2
or later
or later
If Active Directory (direct) authentication has been configured and NTLM protocol challenges is set
to Auto, then NTLM authentication challenges are offered to those devices that support NTLM.
to Auto, then NTLM authentication challenges are offered to those devices that support NTLM.
NTLM challenges are offered in addition to the standard Digest challenge.
Endpoints that support NTLM will respond to the NTLM challenge in preference to the Digest
challenge, and the VCS will attempt to authenticate that NTLM response.
challenge, and the VCS will attempt to authenticate that NTLM response.
Configuration prerequisites
Active Directory
A username and password of an AD user account with either “account operator” or “administrator”
access rights must be available for the Cisco VCS to use for joining and leaving the domain.
access rights must be available for the Cisco VCS to use for joining and leaving the domain.
Entries must exist in the Active Directory server for all devices that are to be authenticated
through this method. Each entry must have an associated password.
through this method. Each entry must have an associated password.
The device entries (in all domains) must be accessible by the user account that is used by VCS to
join the domain. If the VCS is in a domain that is part of a forest, and there is trust between
domains in the forest, the VCS can authenticate device entries from different domains providing
the user account has appropriate rights to authenticate devices against the other domains.
join the domain. If the VCS is in a domain that is part of a forest, and there is trust between
domains in the forest, the VCS can authenticate device entries from different domains providing
the user account has appropriate rights to authenticate devices against the other domains.
Kerberos Key Distribution Center
The KDC (Kerberos Key Distribution Center) server must be synchronized to a time server.
DNS server
If a DNS name or DNS SRV name is used to identify the AD servers, a DNS server must be
configured with the relevant details. (Note that the VCS must be configured to use a DNS server
even if you are not using DNS / DNS SRV to specify the AD servers.)
configured with the relevant details. (Note that the VCS must be configured to use a DNS server
even if you are not using DNS / DNS SRV to specify the AD servers.)
Cisco VCS
The VCS must be configured to use a DNS server (
System > DNS
).
•
The VCS’s Local host name (
System > DNS
) must be 15 or fewer characters long.
(Microsoft NetBIOS names are capped at 15 characters.)
•
When part of a cluster, ensure that each Cisco VCS peer has a unique Local host name.
Ensure that an NTP server (
System > Time
) has been configured and is active.
Ensure that the VCS is configured to challenge for authentication on the relevant zones and
subzones:
•
subzones:
•
The Default Zone (
VCS configuration > Zones > Zones
, then select Default Zone) must be
configured with an Authentication policy of Check credentials. This ensures that
provisioning requests (and any call requests from non-registered devices) are challenged.
provisioning requests (and any call requests from non-registered devices) are challenged.
•
The Default Subzone (
VCS configuration > Local Zone > Default Subzone
) – or the
relevant subzones - must be configured with an Authentication policy of Check credentials.