Cisco TelePresence Administrator's Manual page 111

Device authentication
3. For the Authentication realm, choose from the set of configured SIP domains to determine the traversal
zone through which credential checking is delegated.
Additional information
The system clocks on the VCS Control and the VCS Expressway must be within 100 seconds of each
n
other. We recommend that all VCSs are configured to use a common NTP server.
The VCS Expressway can still perform "local" non-delegated authentication for specific domains. If this is
n
required, ensure that:
Those domains have Traversal zone for delegated credential checking set to Do not delegate.
l
The relevant authentication mechanisms are configured on the VCS Expressway.
l
The VCS Control can still perform authentication in the normal manner, as well as providing a delegated
n
credential checking service for the VCS Expressway. Note that:
The NTLM protocol challenges setting on the VCS Control only applies if the VCS Control itself is
l
making an authentication challenge.
The authentication policy configuration on the traversal client on the VCS Control has no effect on the
l
delegated credential checking requests received by the VCS Control.
Enabling delegated credential checking does not affect any other message routing; there is no need to
amend any existing transforms, search rules and so on.
Cisco VCS Administrator Guide (X8.1.1)
About device authentication
Page 111 of 507