Cisco TelePresence - Device Authentication

To Next Page

To Previous Page

Device authentication

This section provides information about the VCS's authentication policy and the pages that appear under the

Configuration > Authentication menu.

About device authentication 102

Authenticating with external systems 129

Cisco VCS Administrator Guide (X8.1.1) Page 101 of 507

Main Page

Table of Contents2
Introduction11
About the Cisco Telepresence Video Communication Server (VCS)12
- VCS Base Applications13
- Standard Features13
- Optional Features14
- Installation and Initial Configuration16
About this Guide17
- Related Documentation17
- Training17
- Glossary17
- Accessibility Notice17
- Using the Web Interface18
- Using the Command Line Interface (CLI)19
- Web Page Features and Layout20
What's New in this Version22
- X8.1.122
- X8.122
Network and System Settings28
Network Settings29
- Configuring IP Settings29
- Lan Configuration30
- Configuring Ethernet Settings31
- Configuring DNS Settings32
- Configuring Quality of Service Settings33
Intrusion Protection34
- Configuring Firewall Rules34
- Current Active Firewall Rules36
- Configuring Automated Intrusion Protection36
- Additional Information39
Network Services40
- Configuring System Name and Access Settings40
- Configuring SNMP Settings43
- Configuring Time Settings45
- Configuring the Login Page47
Configuring External Manager Settings48
Configuring TMS Provisioning Extension Services49
Firewall Traversal52
About Firewall Traversal53
- The Expressway Solution53
- How Does It Work53
- Endpoint Traversal Technology Requirements54
- H.323 Firewall Traversal Protocols54
- SIP Firewall Traversal Protocols54
- Media Demultiplexing54
- Firewall Traversal Configuration Overview55
- Vcs as a Firewall Traversal Server56
Configuring a Traversal Client and Server57
Configuring Ports for Firewall Traversal58
- Configuring the Firewall58
- Configuring Traversal Server Ports58
- Configuring Ports for Connections from Traversal Clients59
Firewall Traversal and Authentication61
- Authentication and NTP61
Configuring Expressway and Traversal Endpoint Communications62
About ICE and TURN Services63
- About ICE63
- About TURN63
- Configuring TURN Services64
Unified Communications66
Mobile and Remote Access67
- Jabber Client Connectivity Without VPN68
Configuring Mobile and Remote Access on VCS69
- Setting up the VCS Control69
- Setting up the VCS Expressway72
- Setting up VCS Security Certificates72
- Setting up Secure VCS Traversal Zones74
- Checking the Status of Unified Communications Services75
- Additional Configuration75
Protocols77
About H.32378
- Using the VCS as an H.323 Gatekeeper78
- H.323 Endpoint Registration78
Configuring H.32379
About SIP81
- VCS as a SIP Registrar81
- VCS as a SIP Proxy Server82
- Proxying Registration Requests83
- VCS as a SIP Presence Server83
Configuring SIP84
- SIP Functionality and SIP-Specific Transport Modes and Ports84
- Certificate Revocation Checking Modes84
- Registration Controls85
- Authentication Controls87
Configuring Domains88
- Configuring the Supported Services for Unified Communications (VCS Control Only)88
- Configuring Delegated Credential Checking (VCS Expressway Only)88
Configuring SIP and H.323 Interworking90
Registration Control92
About Registrations93
- Finding a VCS with Which to Register93
- Registrations on a VCS Expressway93
- MCU, Gateway and Content Server Registration94
- Configuring Registration Restriction Policy94
- Registering Aliases94
About Allow and Deny Lists97
- Configuring the Registration Allow List97
- Configuring the Registration Deny List98
Configuring Registration Policy to Use an External Service99
Device Authentication101
About Device Authentication102
- Configuring VCS Authentication Policy103
- Controlling System Behavior for Authenticated and Non-Authenticated Devices104
- Authentication Policy Configuration Options105
- SIP Authentication Trust108
- Configuring Delegated Credential Checking (SIP Only)109
- Device Provisioning and Authentication Policy112
- Presence and Authentication Policy114
- Hierarchical Dial Plans and Authentication Policy115
- Practical Configuration of Authentication Policy116
- Configuring VCS Authentication Methods116
- Authentication Mechanism117
- Configuring Authentication to Use the Local Database119
- Using an H.350 Directory Service Lookup Via LDAP120
- Using Active Directory Database (Direct)123
- Configuring the Connection to Active Directory Service (ADS)124
Authenticating with External Systems129
Zones and Neighbors130
About Your Video Communications Network131
Structuring Your Dial Plan132
- Flat Dial Plan132
- Structured Dial Plan132
- Hierarchical Dial Plan132
About Zones134
Configuring Media Encryption Policy135
- Configuring the B2BUA for Media Encryption136
Configuring ICE Messaging Support137
About the Local Zone and Subzones138
The Default Zone139
- Configuring the Default Zone139
Configuring Default Zone Access Rules140
Configuring Zones141
- Configuring Neighbor Zones141
- Configuring Traversal Client Zones144
- Configuring Traversal Server Zones146
- Configuring ENUM Zones149
- Configuring DNS Zones150
- Zone Configuration: Advanced Settings151
- Zone Configuration: Pre-Configured Profile Settings154
- TLS Certificate Verification of Neighbor Systems155
- Configuring a Zone for Incoming Calls Only156
Clustering and Peers157
About Clusters158
License Usage Within a Cluster160
Managing Clusters and Peers162
- Setting up a Cluster162
- Maintaining a Cluster163
- Specifying Peer-Specific Items in Clustered Systems164
- Sharing Registrations Across Peers166
- Sharing Bandwidth Across Peers166
- Cluster Upgrades, Backup and Restore167
- Clustering and Presence167
- Clustering and Cisco TMS167
- About the Cluster Subzone168
- Neighboring the Local VCS to Another VCS Cluster169
Troubleshooting Cluster Replication Problems170
Dial Plan and Call Processing171
Call Routing Process172
Configuring Hop Counts174
Configuring Dial Plan Settings175
- About the Fallback Alias175
About Transforms and Search Rules176
- About Pre-Search Transforms176
- Configuring Pre-Search Transforms177
- Search and Zone Transform Process178
- Configuring Search Rules179
Example Searches and Transforms182
- Filter Queries to a Zone Without Transforming182
- Always Query a Zone with Original Alias (no Transforms)183
- Query a Zone for a Transformed Alias183
- Query a Zone for Original and Transformed Alias184
- Query a Zone for Two or more Transformed Aliases185
- Stripping @Domain for Dialing to H.323 Numbers186
- Transforms for Alphanumeric H.323 ID Dial Strings188
- Allowing Calls to IP Addresses Only if They Come from Known Zones190
Configuring Search Rules to Use an External Service191
About Call Policy194
- Configuring Call Policy194
- Configuring Call Policy Rules Using the Web Interface195
- Configuring Call Policy Using a CPL Script195
- Configuring Call Policy to Use an External Service197
Supported Address Formats199
- Dialing by IP Address199
- Dialing by H.323 ID or E.164 Alias199
- Dialing by H.323 or SIP URI199
- Dialing by ENUM200
Dialing by IP Address201
About URI Dialing203
- URI Dialing Without DNS203
- URI Dialing Via DNS204
- URI Resolution Process Using DNS204
- URI Dialing Via DNS for Outgoing Calls205
- URI Dialing Via DNS for Incoming Calls207
- Configuring Sip Srv Records208
- URI Dialing and Firewall Traversal209
About ENUM Dialing211
- ENUM Dialing Process211
- Enabling ENUM Dialing211
- ENUM Dialing for Outgoing Calls212
- Configuring Zones and Search Rules for ENUM Dialing213
- ENUM Dialing for Incoming Calls215
Configuring DNS Servers for ENUM and URI Dialing217
Configuring Call Routing and Signaling218
Identifying Calls219
Disconnecting Calls220
Bandwidth Control221
About Bandwidth Control222
Configuring Bandwidth Controls223
- About Downspeeding223
About Subzones224
- About the Traversal Subzone224
- Configuring the Default Subzone225
- Configuring Subzones225
- Configuring Subzone Membership Rules226
- Applying Bandwidth Limitations to Subzones228
Links and Pipes230
- Configuring Links230
- Default Links230
- Configuring Pipes231
- Applying Pipes to Links232
Bandwidth Control Examples233
Applications235
Configuring Conference Factory236
Presence238
- Presence Server238
- Presence User Agent (PUA)239
- Configuring Presence240
B2BUA (Back-To-Back User Agent) Overview243
- Configuring B2BUA TURN Servers243
- Microsoft Lync B2BUA244
Findme251
- End-User Findme Account Configuration251
- How Are Devices Specified251
- Findme Process Overview252
- Recommendations When Deploying Findme252
- Configuring Findme252
Cisco TMS Provisioning255
- VCS Provisioning Server256
- Starter Pack Provisioning258
- Configuring Starter Pack Provisioning258
User Accounts259
About User Accounts260
- Account Authentication260
- Account Types260
Configuring Password Security262
Configuring Administrator Accounts263
- Viewing Active Administrator Sessions264
- Login History264
Configuring Remote Account Authentication Using LDAP265
- Checking the LDAP Server Connection Status267
- Configuring Administrator Groups268
- Configuring Findme Groups270
Configuring Findme Accounts271
- Configuring a Findme Account's Principal Devices273
- Active Findme Sessions273
Resetting Forgotten Passwords274
- Resetting Your Root or Admin Password Via a Serial Connection274
- Resetting Findme Account Passwords274
Using the Root Account275
- Changing the Root Account Password275
- Accessing the Root Account over SSH275
Maintenance276
Enabling Maintenance Mode277
About Upgrading Software Components278
- Upgrading VCS Software279
- Upgrading Using Secure Copy (SCP/PSCP)280
Configuring Logging281
- Event Log Levels281
- Remote Logging of Events281
Managing Option Keys283
About Security Certificates285
- Managing the Trusted CA Certificate List285
- Managing the Vcs's Server Certificate286
- Managing Certificate Revocation Lists (Crls)288
- Configuring Certificate-Based Authentication290
- Testing Client Certificates292
Advanced Security295
- Configuring Advanced Account Security Mode295
- Configuring FIPS140-2 Cryptographic Mode296
Configuring Language Settings299
- Changing the Language299
- Installing Language Packs299
- Removing Language Packs300
Backing up and Restoring VCS Data301
- When to Create a Backup301
- Content of the Backup File301
- Limitations301
- Creating a System Backup301
- Restoring a Previous Backup302
Diagnostics Tools303
- Configuring Diagnostic Logging303
- Creating a System Snapshot304
- Configuring Network Log Levels304
- Configuring Support Log Levels305
Incident Reporting306
- Incident Reporting Caution: Privacy-Protected Personal Data306
- Enabling Automatic Incident Reporting306
- Sending Incident Reports Manually307
- Viewing Incident Reports307
- Incident Report Details308
Checking the Effect of a Pattern309
Locating an Alias310
Port Usage311
- Local Inbound Ports311
- Local Outbound Ports311
- Remote Listening Ports312
Network Utilities313
- Ping313
- Traceroute313
- Tracepath314
- DNS Lookup314
Restarting, Rebooting and Shutting down317
Developer Resources319
- Debugging and System Administration Tools319
- Experimental Menu319
Overview and Status Information320
Status Overview321
System Information323
Ethernet Status324
IP Status325
Resource Usage326
Registration Status328
Call Status330
- Disconnecting Calls331
B2BUA Calls332
- Viewing B2BUA Call Media Details332
Search History333
Search Details334
Local Zone Status335
Zone Status336
Bandwidth337
- Link Status337
- Pipe Status337
Policy Server Status and Resiliency338
- Viewing Policy Server Status Via the VCS338
TURN Relays Status339
Unified Communications Status340
Presence341
- Presence Publishers341
- Presence Presentities341
- Presence Subscribers342
Lync B2BUA343
- Lync User Status343
- Lync B2BUA Status343
TMS Provisioning Extension Service Status344
- Provisioning Server Device Requests Status (Cisco TMSPE)344
- User Records Provided by Cisco TMSPE Services345
- Findme Records Provided by Cisco TMSPE Services346
- Phone Book Records Provided by Cisco TMSPE Services346
- Provisioned Devices347
- Checking Provisioned Data347
Starter Pack Provisioning Server Status348
Managing Alarms349
Logs350
- Event Log350
- Configuration Log351
- Network Log352
Hardware Status354
- VCS Unit Front Panel354
Reference Material355
Performance Capabilities356
About Event Log Levels357
- Event Log Format357
- Administrator and Findme User Events358
- Message Details Field358
- Events and Levels360
CPL Reference366
- CPL Address-Switch Node366
- Otherwise368
- Not-Present368
- Location368
- Rule-Switch369
- Proxy370
- Reject370
- Unsupported CPL Elements370
- CPL Examples371
LDAP Server Configuration for Device Authentication377
- Downloading the H.350 Schemas377
- Configuring a Microsoft Active Directory LDAP Server377
- Securing with Tls378
- Configuring an Openldap Server379
DNS Configuration Examples383
- Verifying the SRV Record383
- Microsoft DNS Server383
- Bind 8 & 9383
Changing the Default SSH Key385
Restoring Default Configuration (Factory Reset)386
- Prerequisite Files386
- Performing a Reset to Default Configuration386
- Resetting Via USB Stick386
Password Encryption388
Pattern Matching Variables389
Port Reference391
- Local VCS Inbound/Outbound Ports391
- Remote Listening Ports393
Unified Communications Port Reference395
Microsoft Lync B2BUA Port Reference397
Device Authentication Port Reference399
- H.350 Directory Service399
- Active Directory (Direct)399
Regular Expressions400
Supported Characters402
Call Types and Licensing403
- Call Types403
- What Are Traversal Calls403
Alarms405
Command Reference - Xconfiguration422
Command Reference - Xcommand469
Command Reference - Xstatus488
External Policy Overview490
- Using an External Policy Server490
- External Policy Request Parameters491
- Default CPL for Policy Services492
Flash Status Word Reference Table493
Supported Rfcs494
Software Version History496
- X7.2.1496
- X7.2496
- X7.1499
Related Documentation503
Legal Notices505
- Intellectual Property Rights505
- Copyright Notice505
- Patent Information506

Cisco TelePresence - Device Authentication

Table of Contents

Other manuals for Cisco TelePresence

Related product manuals