Cisco ASA 5505 - Page 982

44-10
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 44 Configuring the TLS Proxy for Encrypted Voice Inspection
CTL Provider
When you are configuring the TLS Proxy for the Phone Proxy, click Install TLS Server’s Certificate
and install the Cisco Unified Call Manager (CUCM) certificate so that the proxy can authenticate the IP
phones on behalf of the CUCM server.
Step 4 To require the adaptive security appliance to present a certificate and authenticate the TLS client during
TLS handshake, check the Enable client authentication during TLS Proxy handshake check box.
When adding a TLS Proxy Instance for Mobile Advantage (the CUMC client and CUMA server), disable
the check box when the client is incapable of sending a client certificate.
Step 5 Click Next.
The Add TLS Proxy Instance Wizard – Client Configuration dialog box opens. In this step of the wizard,
configure the client proxy parameters for original TLS Client—the CUMC client for Mobile Advantage,
CUP or MS LCS/OCS client for Presence Federation, or the IP phone for the Phone Proxy. See the “Add
TLS Proxy Instance Wizard – Client Configuration” section on page 44-10.
After configuring the client proxy parameters, the wizard provides instructions on the steps to complete
outside the ASDM to make the TLS Proxy fully functional (see the “Add TLS Proxy Instance Wizard –
Other Steps” section on page 44-12).
Add TLS Proxy Instance Wizard – Client Configuration
Note This feature is not supported for the Adaptive Security Appliance version 8.1.2.
Use the Add TLS Proxy Instance Wizard to add a TLS Proxy to enable inspection of SSL encrypted VoIP
signaling, namely Skinny and SIP, interacting with Cisco Call Manager and to support the Cisco Unified
Communications features on the adaptive security appliance.
This wizard is available from the Configuration > Firewall > Unified Communications > TLS Proxy
pane.
Step 1 Complete the first two steps of the Add TLS Proxy Instance Wizard. See the “Adding a TLS Proxy
Instance” section on page 44-8 and “Add TLS Proxy Instance Wizard – Client Configuration” section on
page 44-10.
The Add TLS Proxy Instance Wizard – Client Configuration dialog box opens.
Step 2 To specify a client proxy certificate to use for the TLS Proxy, perform the following. Select this option
when the client proxy certificate is being used between two servers; for example, when configuring the
TLS Proxy for Presence Federation, which uses the Cisco Unified Presence Server (CUPS), both the TLS
client and TLS server are both servers.
a. Check the Specify the proxy certificate for the TLS Client... check box.
b. Select a certificate from the drop-down list.
Or
To create a new client proxy certificate, click Manage. The Manage Identify Certificates dialog box
opens. See the “Configuring Identity Certificates Authentication” section on page 35-14.