Cisco Cisco TelePresence Video Communication Server Expressway 관리 매뉴얼
Zones and neighbors
Cisco VCS Administrator Guide (X7.2)
Page 147 of 498
TLS certificate verification of neighbor systems
When a SIP TLS connection is established between a VCS and a neighbor system, the VCS can be
configured to check the X.509 certificate of the neighbor system to verify its identity. You do this by
configuring the zone’s TLS verify mode setting.
configured to check the X.509 certificate of the neighbor system to verify its identity. You do this by
configuring the zone’s TLS verify mode setting.
If TLS verification is enabled, the neighbor system's FQDN or IP address, as specified in the Peer address
field of the zone’s configuration, is used to verify against the certificate holder’s name contained within the
X.509 certificate presented by that system. (The name has to be contained in either the Subject Common
Name or the Subject Alternative Name attributes of the certificate.) The certificate itself must also be valid
and signed by a trusted certificate authority.
field of the zone’s configuration, is used to verify against the certificate holder’s name contained within the
X.509 certificate presented by that system. (The name has to be contained in either the Subject Common
Name or the Subject Alternative Name attributes of the certificate.) The certificate itself must also be valid
and signed by a trusted certificate authority.
Note that for traversal server and DNS zones, the FQDN or IP address of the connecting traversal client is
not configured, so the required certificate holder’s name is specified separately.
not configured, so the required certificate holder’s name is specified separately.
If the neighbor system is another VCS, or it is a traversal client / traversal server relationship, the two
systems can be configured to authenticate each other’s certificates. This is known as mutual authentication
and in this case each VCS acts both as a client and as a server and therefore you must ensure that each
VCS’s certificate is valid both as a client and as a server.
systems can be configured to authenticate each other’s certificates. This is known as mutual authentication
and in this case each VCS acts both as a client and as a server and therefore you must ensure that each
VCS’s certificate is valid both as a client and as a server.
See
for more information about certificate verification and for instructions on
uploading the VCS’s server certificate and uploading a list of trusted certificate authorities.
Configuring a zone for incoming calls only
To configure a zone so that it is never sent an alias search request (for example if you only want to receive
incoming calls from this zone), do not define any search rules that have that zone as its target.
incoming calls from this zone), do not define any search rules that have that zone as its target.
In this scenario, when viewing the zone, you can ignore the warning indicating that search rules have not
been configured.
been configured.