Cisco ASA 5505 Configuration Manual page 925

Chapter 41 Information About Cisco Unified Communications Proxy Features
There are three components to a Cisco Intercompany Media Engine deployment within an enterprise: a
Cisco Intercompany Media Engine server, a call agent (the Cisco Unified Communications Manager)
and an adaptive security appliance running the Cisco Intercompany Media Engine Proxy.
The adaptive security appliance provides perimeter security by encrypting signaling connections
between enterprises and preventing unathorized calls. An adaptive security appliance running the Cisco
Intercompany Media Engine Proxy can either be deployed as an Internet firewall or be designated as a
Cisco Intercompany Media Engine Proxy and placed in the DMZ, off the path of the regular Internet
traffic.
TLS Proxy Applications in Cisco Unified Communications
Table 41-1
adaptive security appliance.
Table 41-1
Application
Phone Proxy
and TLS Proxy
Mobility Proxy Cisco UMC
Presence
Federation
Proxy
The adaptive security appliance supports TLS proxy for various voice applications. For the phone proxy,
the TLS proxy running on the adaptive security appliance has the following key features:
•
•
OL-20339-01
shows the Cisco Unified Communications applications that utilize the TLS proxy on the
TLS Proxy Applications and the Security Appliance
TLS Client
IP phone
Cisco UP or
MS LCS/OCS
The adaptive security appliance forces remote IP phones connecting to the phone proxy through the
Internet to be in secured mode even when the Cisco UCM cluster is in non-secure mode.
The TLS proxy is implemented on the adaptive security appliance to intercept the TLS signaling
from IP phones.
TLS Proxy Applications in Cisco Unified Communications
Client
TLS Server Authentication
Cisco UCM Yes
Cisco UMA No
Cisco UP or Yes
MS LCS/OCS
Cisco ASA 5500 Series Configuration Guide using ASDM
Security Security
Appliance Appliance
Server Role Client Role
Proxy Local dynamic
certificate, certificate
self-signed or signed by the
by internal CA adaptive
security
appliance CA
(might not need
certificate for
phone proxy
application)
Using the Any static
Cisco UMA configured
private key or certificate
certificate
impersonation
Proxy Using the
certificate, Cisco UP
self-signed or private key or
by internal CA certificate
impersonation
41-3