Cisco ASA Series Cli Configuration Manual page 1265

Chapter 1 Configuring the TLS Proxy for Encrypted Voice Inspection
Command
Step 1
hostname(config)# tls-proxy proxy_name
Example:
hostname(config)# tls-proxy my_proxy
Step 2
hostname(config-tlsp)# server trust-point
proxy_trustpoint
Example:
hostname(config-tlsp)# server trust-point ccm_proxy
Step 3
hostname(config-tlsp)# client ldc issuer ca_tp_name
Example:
hostname(config-tlsp)# client ldc issuer ldc_server
Step 4
hostname(config-tlsp)# client ldc key-pair key_label
Example:
hostname(config-tlsp)# client ldc key-pair
phone_common
Step 5
hostname(config-tlsp)# client cipher-suite
cipher_suite
Example:
hostname(config-tlsp)# client cipher-suite
aes128-sha1 aes256-sha1
What to Do Next
Once you have created TLS proxy instance, enable the TLS proxy instance for Skinny and SIP
inspection. See
Enabling the TLS Proxy Instance for Skinny or SIP Inspection
Enable TLS proxy for the Cisco IP Phones and Cisco UCMs in Skinny or SIP inspection. The following
procedure shows how to enable the TLS proxy instance for Skinny inspection.
Enabling the TLS Proxy Instance for Skinny or SIP Inspection, page
Configuring the TLS Proxy for Encrypted Voice Inspection
Purpose
Creates the TLS proxy instance.
Specifies the proxy trustpoint certificate to present
during TLS handshake.
The server command configures the proxy
parameters for the original TLS server. In other
words, the parameters for the ASA to act as the
server during a TLS handshake, or facing the
original TLS client.
Sets the local dynamic certificate issuer. The local
CA to issue client dynamic certificates is defined by
the crypto ca trustpoint command and the
trustpoint must have proxy-ldc-issuer configured,
or the default local CA server
(LOCAL-CA-SERVER).
Where
ldc issuer ca_tp_name
CA trustpoint to issue client dynamic certificates.
Sets the keypair.
The keypair value must have been generated with the
crypto key generate command.
Sets the user-defined cipher suite.
For client proxy (the proxy acts as a TLS client to
the server), the user-defined cipher suite replaces the
default cipher suite, or the one defined by the ssl
encryption command. You can use this command to
achieve difference ciphers between the two TLS
sessions. You should use AES ciphers with the
CallManager server.
Cisco ASA Series CLI Configuration Guide
specifies the local
1-13.
1-13