Step 1

From Cisco Unified CM Administration, choose System > Security > SIP Trunk Security Profile.

Step 2

Click Add New.

Step 3

To enable SIP signaling encryption with TLS, perform the following:

1. From the Device Security Mode drop-down list, select Encrypted.

2. From the Incoming Transport Type and Outgoing Transport Type drop-down lists, choose TLS.

3. For device authentication, in the X.509 Subject Name field, enter the subject name of the X.509 certificate.

4. In the Incoming Port field, enter the port on which you want to receive TLS requests. The default for TLS is 5061.

Step 4

To enable digest authentication, do the following

1. Check the Enable Digest Authentication check box

2. Enter a Nonce Validity Timer value to indicate the number of seconds that must pass before the system generates a new nonce. The default is 600 (10 minutes).

3. To enable digest authentication for applications, check the Enable Application Level Authorization check box.

Step 5

Complete the additional fields in the SIP Trunk Security Profile Configuration window.For more information on the fields and their configuration options, see Online Help.

Step 6

Click Save.

Step 1

From Cisco Unified CM Administration, choose Device > Device Settings > Common Device Configuration.

Step 2

Click Add New.

Step 3

For SIP trunks, SIP Phones or SCCP phones, choose a value for the IP Addressing Mode drop-down list:

• IPv4 Only—The device uses only an IPv4 address for media and signaling.
• IPv6 Only—The device uses only an IPv6 address for media and signaling.
• IPv4 and IPv6 (Default)—The device is a dual-stack device and uses whichever IP address type is available. If both IP address types are configured on the device, for signaling the device uses the IP Addressing Mode Preference for Signaling setting and for media the device uses the IP Addressing Mode Preference for Media enterprise parameter setting.

Step 4

If you configure IPv6 in your previous step, then configure an IP addressing preference for the IP Addressing Mode for Signaling drop-down list:

• IPv4—The dual stack device prefers IPv4 address for signaling.
• IPv6—The dual stack device prefers IPv6 address for signaling.
• Use System Default—The device uses the setting for the IP Addressing Mode Preference for Signaling enterprise parameter.

Step 5

Configure the remaining fields in the Common Device Configuration window. For more information on the fields and their configuration options, see the system Online Help.

Step 6

Click Save.

Step 1

From Cisco Unified CM Administration, choose Device > Trunk.

Step 2

Click Add New.

Step 3

From the Trunk Type drop-down list, choose SIP Trunk.

Step 4

From the Protocol Type drop-down list, choose the type of SIP trunk that matches your deployment and click Next:

• None (Default)
• Call Control Discovery
• Extension Mobility Cross Cluster
• Cisco Intercompany Media Engine
• IP Multimedia System Service Control

Step 5

(Optional) If you want to apply a Common Device Configuration to this trunk, select the configuration from the drop-down list.

Step 6

Check the SRTP Allowed check box if you want to allow encypted media over the trunk.

Step 7

Check the Run on All Active Unified CM Nodes check box if you want to enable the trunk for all cluster nodes.

Step 8

Configure the destination address for the SIP trunk:

1. In the Destination Address text box, enter an IPv4 address, fully qualified domain name, or DNS SRV record for the server or endpoint that you want to connect to the trunk.

2. If the trunk is a dual stack trunk, in the Destination Address IPv6 text box, enter an IPv6 address, fully qualified domain name, or DNS SRV record for the server or endpoint that you want to connect to the trunk.

3. If the destination is a DNS SRV record, check the Destination Address is an SRV check box.

4. To add additional destinations, click the (+).

Step 9

From the SIP Trunk Security Profile drop-down, assign a security profile. If you don't select this option, a nonsecure profile will be assigned.

Step 10

From the SIP Profile drop-down list, assign a SIP profile.

Step 11

(Optional) If you want to assign a normalization script to this SIP trunk, from the Normalization Script drop-down list, select the script that you want to assign.

Step 12

Configure any additional fields in the Trunk Configuration window. For more information on the fields and their configuration options, see Online Help.

Step 13

Click Save.