Cisco TelePresence Administrator's Manual page 106

The Default Zone and any traversal client zone's authentication policy must be set to either Check
l
credentials or Treat as authenticated, otherwise provisioning requests will fail.
The authentication of subsequent messages, including registration requests, phone book requests and call
n
signaling messages is controlled by the authentication policy setting on the Default Subzone (or relevant
alternative subzone) if the endpoint is registered (which is the usual case), or by the authentication policy
setting on the Default Zone if the endpoint is not registered.
The relevant authentication policy must be set to either Check credentials or Treat as authenticated,
l
otherwise phone book requests will fail.
In each case, the VCS performs its authentication checking against the appropriate credential store,
according to whichever authentication methods are configured. Note that if the VCS is using the local
database, this will include all credentials supplied by TMS.
For more information about provisioning configuration in general, see TMS Provisioning Extension
Deployment Guide.
Legacy TMS Agent mode
The Provisioning Server will only service authenticated provisioning requests, but it can perform its own
authentication challenge:
If the VCS has already authenticated the device (at the zone or subzone entry point), then the Provisioning
n
Server accepts the VCS's authentication check and does not perform any additional authentication
challenge.
If the VCS has not authenticated the device, then the Provisioning Server will authenticate the request (i.e.
n
challenge for and check credentials) before providing provisioning data.
The Provisioning Server checks device account credentials against the TMS Agent database only. It
l
does not check against any other credential store.
The following diagram shows the flow of provisioning messages from an endpoint to the Provisioning Server,
together with the credential checking processes:
Cisco VCS Administrator Guide (X7.2)
Device authentication
Page 106 of 498