Cisco ASA Series Cli Configuration Manual page 1195

Chapter 1 Information About Cisco Unified Communications Proxy Features
There are three components to a Cisco Intercompany Media Engine deployment within an enterprise: a
Cisco Intercompany Media Engine server, a call agent (the Cisco Unified Communications Manager)
and an ASA running the Cisco Intercompany Media Engine Proxy.
The ASA provides perimeter security by encrypting signaling connections between enterprises and
preventing unathorized calls. An ASA running the Cisco Intercompany Media Engine Proxy can either
be deployed as an Internet firewall or be designated as a Cisco Intercompany Media Engine Proxy and
placed in the DMZ, off the path of the regular Internet traffic.
TLS Proxy Applications in Cisco Unified Communications
Table 1-1
Table 1-1
Application
Phone Proxy
and TLS Proxy
Mobility Proxy Cisco UMC
Presence
Federation
Proxy
The ASA supports TLS proxy for various voice applications. For the phone proxy, the TLS proxy
running on the ASA has the following key features:
•
•
•
•
•
shows the Cisco Unified Communications applications that utilize the TLS proxy on the ASA.
TLS Proxy Applications and the Security Appliance
TLS Client
IP phone
Cisco UP or
MS LCS/OCS
The ASA forces remote IP phones connecting to the phone proxy through the Internet to be in
secured mode even when the Cisco UCM cluster is in non-secure mode.
The TLS proxy is implemented on the ASA to intercept the TLS signaling from IP phones.
The TLS proxy decrypts the packets, sends packets to the inspection engine for NAT rewrite and
protocol conformance, optionally encrypts packets, and sends them to Cisco UCM or sends them in
clear text if the IP phone is configured to be in nonsecure mode on the Cisco UCM.
The ASA acts as a media terminator as needed and translates between SRTP and RTP media streams.
The TLS proxy is a transparent proxy that works based on establishing trusted relationship between
the TLS client, the proxy (the ASA), and the TLS server.
TLS Proxy Applications in Cisco Unified Communications
Client
Authenticatio
TLS Server n
Cisco UCM Yes
Cisco UMA No
Cisco UP or Yes
MS LCS/OCS
Cisco ASA Series CLI Configuration Guide
Security Security
Appliance Appliance
Server Role Client Role
Proxy Local dynamic
certificate, certificate
self-signed or signed by the
by internal CA ASA CA
(might not need
certificate for
phone proxy
application)
Using the Any static
Cisco UMA configured
private key or certificate
certificate
impersonation
Proxy Using the
certificate, Cisco UP
self-signed or private key or
by internal CA certificate
impersonation
1-3