Cisco Cisco TelePresence Video Communication Server Expressway 관리 매뉴얼
Zones and neighbors
Cisco VCS Administrator Guide (X7.0)
Page 135 of 488
TLS certificate verification of neighbor systems
When a SIP TLS connection is established between a VCS and a neighbor system, the VCS can be
configured to check the X.509 certificate of the neighbor system to verify its identity. You do this by
configuring the zone’s TLS verify mode setting.
configured to check the X.509 certificate of the neighbor system to verify its identity. You do this by
configuring the zone’s TLS verify mode setting.
If TLS verification is enabled, the neighbor system's FQDN or IP address, as specified in the Peer
address field of the zone’s configuration, is used to verify against the certificate holder’s name contained
within the X.509 certificate presented by that system. (The name has to be contained in either the
Subject Common Name or the Subject Alternative Name attributes of the certificate.) The certificate
itself must also be valid and signed by a trusted certificate authority.
address field of the zone’s configuration, is used to verify against the certificate holder’s name contained
within the X.509 certificate presented by that system. (The name has to be contained in either the
Subject Common Name or the Subject Alternative Name attributes of the certificate.) The certificate
itself must also be valid and signed by a trusted certificate authority.
Note that for traversal server zones, the FQDN or IP address of the connecting traversal client is not
configured, so the required certificate holder’s name is specified separately.
configured, so the required certificate holder’s name is specified separately.
If the neighbor system is another VCS, or it is a traversal client / traversal server relationship, the two
systems can be configured to authenticate each other’s certificates. This is known as mutual
authentication and in this case each VCS acts both as a client and as a server and therefore you must
ensure that each VCS’s certificate is valid both as a client and as a server.
systems can be configured to authenticate each other’s certificates. This is known as mutual
authentication and in this case each VCS acts both as a client and as a server and therefore you must
ensure that each VCS’s certificate is valid both as a client and as a server.
See the
section for more information about certificate verification and for
instructions on uploading the VCS’s server certificate and uploading a list of trusted certificate
authorities.
authorities.
Configuring a zone for incoming calls only
To configure a zone so that it is never sent an alias search request (for example if you only want to
receive incoming calls from this zone), do not define any search rules that have that zone as its target.
receive incoming calls from this zone), do not define any search rules that have that zone as its target.
In this scenario, when viewing the zone, you can ignore the warning indicating that search rules have not
been configured.
been configured.