Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 First Published: 2017-08-18 Last Modified: 2019-09-24 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version. Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) © 2020 Cisco Systems, Inc. All rights reserved. CONTENTS PREFACE Preface xvi Purpose xvi Audience xvii Organization xvii Related Documentation xix Conventions xix Obtain Documentation, Support, and Security Guidelines xx Cisco Product Security Overview xx PART I Security Basics 21 CHAPTER 1 Security Overview 1 Terms and Acronyms 1 System Requirements 6 Features List 6 Security Icons 7 Interactions and Restrictions 8 Interactions 9 Restrictions 9 Authentication and Encryption 10 Barge and Encryption 10 Wideband Codecs and Encryption 10 Media Resources and Encryption 11 Phone Support and Encryption 11 Phone Support and Encrypted Setup Files 11 Security Icons and Encryption 11 Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 iii Contents Cluster and Device Security Modes 12 Digest Authentication and Encryption 12 Packet Capturing and Encryption 13 Best Practices 13 Device Resets, Server and Cluster Reboots, and Service Restarts 13 Reset Devices, Servers, Clusters, and Services 14 Media Encryption with Barge Setup 14 CTL Client, SSL, CAPF, and Security Token Installation 15 TLS and IPSec 15 Certificates 16 Phone Certificate Types 16 Server Certificate Types 18 Support for Certificates from External CAs 19 Authentication, Integrity, and Authorization 20 Image Authentication 20 Device Authentication 20 File Authentication 21 Signaling Authentication 21 Digest Authentication 21 Authorization 23 Encryption 24 Signaling Encryption 24 Media Encryption 24 AES 256 Encryption Support for TLS and SIP SRTP 26 AES 256 and SHA-2 Support in TLS 26 AES 256 Support in SRTP SIP Call Signaling 27 Cisco Unified Communications Manager Requirements 28 Interactions and Restrictions 28 Configuration File Encryption 28 NMAP Scan Operation 29 Set Up Authentication and Encryption 29 Where to Find More Information 32 CHAPTER 2 Hypertext Transfer Protocol Over Secure Sockets Layer (HTTPS) 33 Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 iv Contents HTTPS 33 HTTPS for Cisco Unified IP Phone Services 35 Cisco Unified IP Phones that Support HTTPS 35 Features That Support HTTPS 35 Cisco Unified IP Phone Services Settings 36 Enterprise Parameter Settings for HTTPS Support 38 Save Certificate to Trusted Folder Using Internet Explorer 8 38 Copy Internet Explorer 8 Certificate to File 39 First-Time Authentication for Firefox with HTTPS 40 Save Certificate to Trusted Folder Using Firefox 3.x 40 Copy Firefox 3.x Certificate to File 41 First-Time Authentication for Safari with HTTPS 42 Save Certificate to Trusted Folder Using Safari 4.x 42 Copy Safari 4.x Certificate to File 43 Where to Find More Information About HTTPS Setup 44 CHAPTER 3 Default Security Setup 45 Default Security Features 45 Trust Verification Service 46 TVS Description 46 Initial Trust List 46 Initial Trust List Files 47 ITL File Contents 47 ITL and CTL File Interaction 48 Certificate Management Changes for ITLRecovery Certificate 48 Interactions and Restrictions 49 Update ITL File for Cisco Unified IP Phones 49 Autoregistration 49 Get Endpoint Support for Security by Default 49 ECDSA Support for Common Criteria for Certified Solutions 50 Certificate Manager ECDSA Support 50 SIP ECDSA Support 50 CAPF ECDSA Support 51 Entropy 52 Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 v Contents HTTPS Support for Configuration Download 52 CTI Manager Support 52 Certificate Regeneration 53 Regenerate CAPF Certificate 53 Regenerate TVS Certificate 53 Regenerate TFTP Certificate 54 Tomcat Certificate Regeneration 54 System Back-Up Procedure After TFTP Certificate Regeneration 55 Refresh Upgrade From Cisco Unified Communications Manager Release 7.x to Release 8.6 Or Later 55 Roll Back Cluster to a Pre-8.0 Release 56 Switch Back to Release 8.6 or Later After Revert 57 Migrate IP Phones Between Clusters with Cisco Unified Communications Manager and ITL Files 58 Bulk Certificate Export 59 Generate Self-Signed Certificate 60 Self-signed Certificate Fields 60 Generate Certificate Signing Request 62 Certificate Signing Request Fields 63 Interactions and Restrictions 64 Perform Bulk Reset of ITL File 65 Reset CTL Localkey 65 View the Validity Period of ITLRecovery Certificate 66 Contact Search Authentication Task Flow 66 Confirm Phone Support for Contact Search Authentication 67 Enable Contact Search Authentication 67 Configure Secure Directory Server for Contact Search 68 CHAPTER 4 Cisco CTL Client Setup 69 About Cisco CTL Setup 69 Addition of Second SAST Role in the CTL File for Recovery 70 Activate Cisco CTL Provider Service 71 Cisco CAPF Service Activation 71 Set up Secure Ports 72 Set Up Cisco CTL Client 73 Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 vi Contents SAST Roles of CTL File 74 Migrate Phones from One Cluster to Another Cluster 75 Migration from eToken-based CTL File to Tokenless CTL File 76 Update CTL File 76 Update Cisco Unified Communications Manager Security Mode 77 Cisco CTL File Details 78 Verify Cisco Unified Communications Manager Security Mode 79 Set Up Smart Card Service to Started or Automatic 79 Verify or Uninstall Cisco CTL Client 80 CHAPTER 5 Certificate Setup 81 About Certificate Setup 81 Find Certificate 81 Upload Certificate or Certificate Chain 82 Certificate Settings 82 PART II Security for Cisco IP Phone and Cisco Voice-Messaging Ports 85 CHAPTER 6 Phone Security 87 Phone Security Overview 87 Trusted Devices 88 Cisco Unified Communications Manager Administration 88 Device Called Trust Determination Criteria 89 Phone Model Support 89 Preferred Vendor SIP Phone Security Set Up 89 Set Up Preferred Vendor SIP Phone Security Profile Per-Device Certificates 90 Set Up Preferred Vendor SIP Phone Security Profile Shared Certificates 90 View Phone Security Settings 91 Set Up Phone Security 91 Phone Security Interactions and Restrictions 92 Where to Find More Information About Phone Security 92 CHAPTER 7 Phone Security Profile Setup 93 Phone Security Profile Overview 93 Security Guide for Cisco Unified Communications Manager, Release 11.5(1)SU3 vii Contents Phone Security Profile Setup Prerequisites 93 Find Phone Security Profile 94 Set Up Phone Security Profile 95 Phone Security Profile Settings 95 Apply Security Profiles to Phone 104 Synchronize Phone Security Profile with Phones 105 Delete Phone Security Profile 105 Find Phones with Phone Security Profiles 106 CHAPTER 8 Secure and Nonsecure Indication Tone Setup 107 Secure and Non-Secure Indication Tone Overview 107 Protected