Cisco ASA Series Cli Configuration Manual page 1250

Configuration Examples for the Phone Proxy
media-termination my_mediaterm
phone-proxy mypp
class-map sec_sccp
class-map sec_sip
policy-map pp_policy
service-policy pp_policy interface outside
Example 6: VLAN Transversal
Figure 1-7
to operate in authenticated mode when CIPC softphones are deployed in a voice and data VLAN
scenario. VLAN transversal is required between CIPC softphones on the data VLAN and hard phones
on the voice VLAN.
In this sample, the Cisco UCM cluster mode is nonsecure.
In this sample, you create an access list to allow the IP phones to contact the TFTP server and to allow
the IP phones to register in nonsecure mode by opening the nonsecure port for SIP and SCCP as well as
the CAPF port for LSC provisioning.
In this sample, you configure NAT for the CIPC by using PAT so that each CIPC is mapped to an IP
address space in the Voice VLAN.
Additionally, you create the CAPF trustpoint by copying and pasting the CAPF certificate from the Cisco
UCM Certificate Management software.
Note
Cisco IP Communicator supports authenticated mode only and does not support encrypted mode;
therefore, there is no encrypted voice traffic (SRTP) flowing from the CIPC softphones.
Cisco ASA Series CLI Configuration Guide
1-52
client ldc issuer ldc_server
client ldc keypair phone_common
client cipher-suite aes128-sha1 aes256-sha1
address 192.0.2.25 interface inside
address 10.10.0.25 interface outside
media-termination my_mediaterm
tftp-server address 192.0.2.101 interface inside
tls-proxy mytls
ctl-file myctl
cluster-mode mixed
match port tcp 2443
match port tcp eq 5061
class sec_sccp
inspect skinny phone-proxy mypp
class sec_sip
inspect sip phone-proxy mypp
shows an example of the configuration to force Cisco IP Communicator (CIPC) softphones
Chapter 1 Configuring the Cisco Phone Proxy