Configuring Cisco Mobility Advantage
This chapter describes how to configure the adaptive security appliance for Cisco Unified Communications Mobility Advantage Proxy features.
This chapter includes the following sections:
•Information about the Cisco Mobility Advantage Proxy Feature
•Licensing for the Cisco Mobility Advantage Proxy Feature
•Configuring Cisco Mobility Advantage
•Feature History for Cisco Mobility Advantage
Information about the Cisco Mobility Advantage Proxy Feature
This section contains the following topics:
•Cisco Mobility Advantage Proxy Functionality
•Mobility Advantage Proxy Deployment Scenarios
•Trust Relationships for Cisco UMA Deployments
Cisco Mobility Advantage Proxy Functionality
To support Cisco UMA for the Cisco Mobility Advantage solution, the mobility advantage proxy (implemented as a TLS proxy) includes the following functionality:
•The ability to allow no client authentication during the handshake with clients.
•Allowing an imported PKCS-12 certificate to server as a proxy certificate.
The adaptive security appliance includes an inspection engine to validate the Cisco UMA Mobile Multiplexing Protocol (MMP).
MMP is a data transport protocol for transmitting data entities between Cisco UMA clients and servers. As shown in Figure 46-1, MMP must be run on top of a connection-oriented protocol (the underlying transport) and is intended to be run on top of a secure transport protocol such as TLS. The Orative Markup Language (OML) protocol is intended to be run on top of MMP for the purposes of data synchronization, as well as the HTTP protocol for uploading and downloading large files.
Figure 46-1 MMP Stack
The TCP/TLS default port is 5443. There are no embedded NAT or secondary connections.
Cisco UMA client and server communications can be proxied via TLS, which decrypts the data, passes it to the inspect MMP module, and re-encrypt the data before forwarding it to the endpoint. The inspect MMP module verifies the integrity of the MMP headers and passes the OML/HTTP to an appropriate handler. The adaptive security appliance takes the following actions on the MMP headers and data:
•Verifies that client MMP headers are well-formed. Upon detection of a malformed header, the TCP session is terminated.
•Verifies that client to server MMP header lengths are not exceeded. If an MMP header length is exceeded (4096), then the TCP session is terminated.
•Verifies that client to server MMP content lengths are not exceeded. If an entity content length is exceeded (4096), the TCP session is terminated.
Note 4096 is the value currently used in MMP implementations.
Because MMP headers and entities can be split across packets, the adaptive security appliance buffers data to ensure consistent inspection. The SAPI (stream API) handles data buffering for pending inspection opportunities. MMP header text is treated as case insensitive and a space is present between header text and values. Reclaiming of MMP state is performed by monitoring the state of the TCP connection.
Mobility Advantage Proxy Deployment Scenarios
Figure 46-2 and Figure 46-3 show the two deployment scenarios for the TLS proxy used by the Cisco Mobility Advantage solution. In scenario 1 (the recommended deployment architecture), the adaptive security appliance functions as both the firewall and TLS proxy. In scenario 2, the adaptive security appliance functions as the TLS proxy only and works with an existing firewall. In both scenarios, the clients connect from the Internet.
In the scenario 1 deployment, the adaptive security appliance is between a Cisco UMA client and a Cisco UMA server. The Cisco UMA client is an executable that is downloaded to each smartphone. The Cisco UMA client applications establishes a data connection, which is a TLS connection, to the corporate Cisco UMA server. The adaptive security appliance intercepts the connections and inspects the data that the client sends to the Cisco UMA server.
Figure 46-2 The TLS proxy for the Cisco Mobility Advantage solution does not support client authentication because the Cisco UMA client cannot present a certificate. Security Appliance as Firewall with Mobility Advantage Proxy and MMP Inspection
In Figure 46-2, the adaptive security appliance performs static NAT by translating the Cisco UMA server 10.1.1.2 IP address to 192.0.2.140.
Figure 46-3 shows deployment scenario 2, where the adaptive security appliance functions as the TLS proxy only and does not function as the corporate firewall. In this scenario, the adaptive security appliance and the corporate firewall are performing NAT. The corporate firewall will not be able to predict which client from the Internet needs to connect to the corporate Cisco UMA server. Therefore, to support this deployment, you can take the following actions:
•Set up a NAT rule for inbound traffic that translates the destination IP address 192.0.2.41 to 172.16.27.41.
•Set up an interface PAT rule for inbound traffic translating the source IP address of every packet so that the corporate firewall does not need to open up a wildcard pinhole. The Cisco UMA server receives packets with the source IP address 220.127.116.11.
See Chapter 27 "Configuring Network Object NAT (ASA 8.3 and Later)" and Chapter 28 "Configuring Twice NAT (ASA 8.3 and Later)" for information.
Note This interface PAT rule converges the Cisco UMA client IP addresses on the outside interface of the adaptive security appliance into a single IP address on the inside interface by using different source ports. Performing this action is often referred as "outside PAT". "Outside PAT" is not recommended when TLS proxy for Cisco Mobility Advantage is enabled on the same interface of the adaptive security appliance with phone proxy, Cisco Unified Presence, or any other features involving application inspection. "Outside PAT" is not supported completely by application inspection when embedded address translation is needed.
Figure 46-3 Cisco UMC/Cisco UMA Architecture - Scenario 2: Security Appliance as Mobility Advantage Proxy Only
Mobility Advantage Proxy Using NAT/PAT
In both scenarios (Figure 46-2 and Figure 46-3), NAT can be used to hide the private address of the Cisco UMA servers.
In scenario 2 (Figure 46-3), PAT can be used to converge all client traffic into one source IP, so that the firewall does not have to open up a wildcard pinhole for inbound traffic.
Trust Relationships for Cisco UMA Deployments
To establish a trust relationship between the Cisco UMC client and the adaptive security appliance, the adaptive security appliance uses the Cisco UMA server certificate and keypair or the adaptive security appliance obtains a certificate with the Cisco UMA server FQDN (certificate impersonation). Between the adaptive security appliance and the Cisco UMA server, the adaptive security appliance and Cisco UMA server use self-signed certificates or certificates issued by a local certificate authority.
Figure 46-4 shows how you can import the Cisco UMA server certificate onto the adaptive security appliance. When the Cisco UMA server has already enrolled with a third-party CA, you can import the certificate with the private key onto the adaptive security appliance. Then, the adaptive security appliance has the full credentials of the Cisco UMA server. When a Cisco UMA client connects to the Cisco UMA server, the adaptive security appliance intercepts the handshake and uses the Cisco UMA server certificate to perform the handshake with the client. The adaptive security appliance also performs a handshake with the server.
Figure 46-4 How the Security Appliance Represents Cisco UMA - Private Key Sharing
Figure 46-5 shows another way to establish the trust relationship. Figure 46-5 shows a green field deployment, because each component of the deployment has been newly installed. The adaptive security appliance enrolls with the third-party CA by using the Cisco UMA server FQDN as if the adaptive security appliance is the Cisco UMA server. When the Cisco UMA client connects to the adaptive security appliance, the adaptive security appliance presents the certificate that has the Cisco UMA server FQDN. The Cisco UMA client believes it is communicating to with the Cisco UMA server.
Figure 46-5 How the Security Appliance Represents Cisco UMA - Certificate Impersonation
A trusted relationship between the adaptive security appliance and the Cisco UMA server can be established with self-signed certificates. The adaptive security appliance's identity certificate is exported, and then uploaded on the Cisco UMA server truststore. The Cisco UMA server certificate is downloaded, and then uploaded on the adaptive security appliance truststore by creating a trustpoint and using the crypto ca authenticate command.
Licensing for the Cisco Mobility Advantage Proxy Feature
The Cisco Unified Communications proxy features (Cisco Phone Proxy, TLS proxy for encrypted voice inspection, and the Cisco Presence Federation Proxy) supported by the adaptive security appliance require a Unified Communications Proxy license. However, in Version 8.2(2) and later, the Mobility Advantage proxy no longer requires a Unified Communications Proxy license.
The following table shows the licensing requirements for the Mobility Advantage proxy:
For more information about licensing, see Chapter 4 "Managing Feature Licenses."
Configuring Cisco Mobility Advantage
This section includes the following topic:
•Task Flow for Configuring Cisco Mobility Advantage
Task Flow for Configuring Cisco Mobility Advantage
To configure for the adaptive security appliance to perform TLS proxy and MMP inspection as shown in Figure 46-2 and Figure 46-3, perform the following tasks.
It is assumed that self-signed certificates are used between the adaptive security appliance and the Cisco UMA server.
To configure the Cisco Mobility Advantage Proxy by using ASDM, choose Wizards > Unified Communications Wizard from the menu. The Unified Communications Wizard opens. From the first page, select the Cisco Mobility Advantage Proxy option under the Remote Access section.
The wizard automatically creates the necessary TLS proxy, then guides you through creating the Unified Presence Proxy instance, importing and installing the required certificates, and finally enables the MMP inspection for the Mobility Advantage traffic automatically.
The wizard guides you through four steps to create the Mobility Advantage Proxy:
Step 1 Select the Mobility Advantage Proxy option.
Step 2 Specify setting to define the proxy topology, such the IP address of the Mobility Advantage server.
Step 3 Configure the server-side certificate management, namely the certificates that are exchanged between the local Mobility Advantage server and the adaptive security appliance.
Step 4 Configure the client-side certificate management, namely the certificates that are exchanged between the Unified Mobile Communicator and the adaptive security appliance
The wizard completes by displaying a summary of the configuration created for Mobility Advantage Proxy. See Chapter 43 "Using the Cisco Unified Communication Wizard" for more information.
Feature History for Cisco Mobility Advantage
Table 46-1 lists the release history for this feature.
Table 46-1 Feature History for Cisco Phone Proxy
Cisco Mobility Advantage Proxy
The Cisco Mobility Advantage Proxy feature was introduced.
Cisco Mobility Advantage Proxy
The Unified Communications Wizard was added to ASDM. By using the wizard, you can configure the Cisco Mobility Advantage Proxy.