Cisco CallManager Security Guide, Release 4.1(2)
Downloads: This chapterpdf (PDF - 198.0 KB) The complete bookPDF (PDF - 3.46 MB) | Feedback


Table Of Contents





Related Documentation


Obtaining Documentation

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco Technical Support Website

Submitting a Service Request

Definitions of Service Request Severity

Obtaining Additional Publications and Information


This preface describes the purpose, audience, organization, and conventions of this guide and provides information on how to obtain related documentation.

The preface covers these topics:




Related Documentation


Obtaining Documentation


Cisco CallManager Security Guide helps system and phone administrators perform the following tasks:

Configure authentication.

Configure encryption.

Install server authentication certificate that is associated with HTTPS.

Configure Certificate Authority Proxy Function (CAPF) to install, upgrade, or delete locally significant certificates on supported Cisco IP Phone models.

Configure phone hardening.

Configure Survivable Remote Site Telephony (SRST) references for security.

Troubleshoot issues.


This guide provides a reference and procedural guide for system and phone administrators who plan to configure the security features.


Table 1 lists the major sections of this guide:

Table 1 Guide Overview 


Chapter 1 "Security Overview"

Provides an overview of security terminology, system requirements, interactions and restrictions, installation requirements, and a configuration checklist; describes the different types of authentication and encryption.

Chapter 2 "Using Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS)"

Provides an overview of HTTPS and describes how to install the server authentication certificate in the trusted folder.

Chapter 3 "Configuring the Cisco CTL Client"

Describes how to configure authentication by installing and configuring the Cisco CTL client.

Chapter 4 "Using the Certificate Authority Proxy Function"

Provides an overview of Certificate Authority Proxy Function and describes how to install, upgrade, delete, or troubleshoot locally significant certificates on supported phones.

Chapter 5 "Configuring the Phones for Security"

Describes how to configure the Device Security Mode for supported phones; describes how to disable some phone settings in Cisco CallManager Administration to tighten security.

Chapter 6 "Configuring a Secure Survivable Remote Site Telephony (SRST) Reference"

Describes how to configure the SRST reference for security in Cisco CallManager Administration.

Chapter 7 "Troubleshooting"

Describes how to resolve some issues that are associated with security.

Related Documentation

Refer to the following documents for further information about related Cisco IP telephony applications and products:

Cisco IP Phone Administration Guide for Cisco CallManager, Cisco IP Phone Models 7960G and 7940G

Cisco IP Phone Administration Guide for Cisco CallManager, Cisco IP Phone Model 7970G

Cisco IP Phone Administrator Guide for Cisco CallManager Models 7902G, 7905G, and 7912G

The firmware release notes that support your phone model

Cisco IP Telephony Solution Reference Network Design Guide

Security application notes for topics, such as toll fraud, operating system hardening, TCP/UDP ports, and so on

Cisco Security Agent documentation that is compatible with the version of Cisco CallManager 4.1 that is installed in the cluster

Readme documentation for Cisco-provided operating system upgrades and service releases that post to

Cisco CallManager Administration documentation for Cisco MultiLevel Administration, toll fraud prevention, and SSL usage for directory applications

Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways

Configuring IPSEC from Cisco CallManager to MGCP Gateways

Cisco Survivable Remote Site Telephony (SRST) administration documentation that supports the SRST-enabled gateway


Notes use the following conventions:

Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the publication.

Tips use the following conventions:

Tip Means the following are useful tips.

Cautions use the following conventions:

Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Obtaining Documentation

Cisco documentation and additional literature are available on Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

You can access the most current Cisco documentation at this URL:

You can access the Cisco website at this URL:

You can access international Cisco websites at this URL:

Ordering Documentation

You can find instructions for ordering documentation at this URL:

You can order Cisco documentation in these ways:

Registered users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:

Nonregistered users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

You can send comments about technical documentation to

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems, Inc.
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.

Cisco Technical Support Website

The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year at this URL:

Access to all tools on the Cisco Technical Support Website requires a user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:

Submitting a Service Request

Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool automatically provides recommended solutions. If your issue is not resolved using the recommended resources, your service request will be assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:

For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.

To open a service request by telephone, use one of the following numbers:

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553 2447

For a complete list of Cisco TAC contacts, go to this URL:

Definitions of Service Request Severity

To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.

Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:

The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:

Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:

iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

World-class networking training is available from Cisco. You can view current offerings at this URL: