Cisco ASA 5505 Configuration Manual page 995

Chapter 45 Configuring Cisco Mobility Advantage
Trust Relationships for Cisco UMA Deployments
To establish a trust relationship between the Cisco UMC client and the adaptive security appliance, the
adaptive security appliance uses the Cisco UMA server certificate and keypair or the adaptive security
appliance obtains a certificate with the Cisco UMA server FQDN (certificate impersonation). Between
the adaptive security appliance and the Cisco UMA server, the adaptive security appliance and Cisco
UMA server use self-signed certificates or certificates issued by a local certificate authority.
Figure 45-4
appliance. When the Cisco UMA server has already enrolled with a third-party CA, you can import the
certificate with the private key onto the adaptive security appliance. Then, the adaptive security
appliance has the full credentials of the Cisco UMA server. When a Cisco UMA client connects to the
Cisco UMA server, the adaptive security appliance intercepts the handshake and uses the Cisco UMA
server certificate to perform the handshake with the client. The adaptive security appliance also performs
a handshake with the server.
Figure 45-4
Cisco UMC Client
Figure 45-5
deployment, because each component of the deployment has been newly installed. The adaptive security
appliance enrolls with the third-party CA by using the Cisco UMA server FQDN as if the adaptive
security appliance is the Cisco UMA server. When the Cisco UMA client connects to the adaptive
security appliance, the adaptive security appliance presents the certificate that has the Cisco UMA server
FQDN. The Cisco UMA client believes it is communicating to with the Cisco UMA server.
OL-20339-01
shows how you can import the Cisco UMA server certificate onto the adaptive security
How the Security Appliance Represents Cisco UMA – Private Key Sharing
Internet
TLS (Cisco UMA Certificate)
Key 1
shows another way to establish the trust relationship.
Information about the Cisco Mobility Advantage Proxy Feature
3rd Party CA
Certificate
Authority
Certificate
ASA
TLS (Self-signed,
Inspected and
or from local CA)
Modified
Key 2
(if needed)
Figure 45-5
Cisco ASA 5500 Series Configuration Guide using ASDM
Enroll with FQDN
of Cisco UMA
Cisco UMA
Certificate with
Private Key
shows a green field
45-5