Cisco ASA Series Cli Configuration Manual page 1237

Chapter 1 Configuring the Cisco Phone Proxy
b.
Verify that the list of installed certificates contains all required certificates for the phone proxy.
See
information.
c.
Import any missing certificates onto the ASA. See also
page
Step 4
If the steps above fail to resolve the issue, perform the following actions to obtain additional
troubleshooting information for Cisco Support.
a.
Enter the following commands to capture additional debugging information for the phone proxy:
hostname# debug inspect tls-proxy error
hostname# show running-config ssl
hostname(config) show tls-proxy tls_name session host host_addr detail
b.
Enable the capture command on the inside and outside interfaces (IP phones and Cisco UCM) to
enable packet capture capabilities for packet sniffing and network fault isolation. See the command
reference for information.
Problem
Solution
•
Check to see if SIP and Skinny signaling is successful by using the following commands:
–
–
•
If the TLS handshake is failing and you receive the following syslog, the SSL encryption method
might not be set correctly:
%ASA-6-725001: Starting SSL handshake with client dmz:171.169.0.2/53097 for TLSv1
session.
%ASA-7-725010: Device supports the following 1 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-SHA
%ASA-7-725008: SSL client dmz:171.169.0.2/53097 proposes the following 2 cipher(s).
%ASA-7-725011: Cipher[1] : AES256-SHA
%ASA-7-725011: Cipher[2] : AES128-SHA
%ASA-7-725014: SSL lib error. Function: SSL3_GET_CLIENT_HELLO Reason: no shared cipher
%ASA-6-725006: Device failed SSL handshake with dmz client:171.169.0.2/53097
Set the correct ciphers by completing the following procedure:
Step 1
To see the ciphers being used by the phone proxy, enter the following command:
hostname# show run all ssl
Step 2
To add the required ciphers, enter the following command:
hostname(config)# ssl encryption
The default is to have all algorithms available in the following order:
[3des-sha1] [des-sha1] [rc4-md5] [possibly others]
See the command reference for more information about setting ciphers with the ssl encryption
command.
Table 1-2, Certificates Required by the Security Appliance for the Phone
1-15.
The TLS handshake succeeds, but signaling connections are failing.
Perform the following actions:
debug sip
debug skinny
Troubleshooting the Phone Proxy
Importing Certificates from the Cisco UCM,
Cisco ASA Series CLI Configuration Guide
Proxy, for
1-39