타사 인증서를 사용하여 Cisco Unified CME 보안 설정 예

소개

많은 네트워크 관리자가 보안과 함께 Cisco CME(Unified Communications Manager Express)를 구현하기로 선택했습니다.네트워크 관리자는 내장형 IOS-CA(IOS Certificate Authority) 대신 Secure CME를 기존 PKI(Public-Key Infrastructure) 인프라에 통합할 수 있습니다.이 문서에서는 서드파티 인증서를 통해 보안 신호 및 미디어를 사용하여 작동하도록 Secure CME를 구성하는 방법에 대해 설명합니다.

사전 요구 사항

요구 사항

이 문서에서는 사용자 환경의 Cisco CME(Unified Communications Manager Express)가 실행 중이고 완벽하게 작동하고 있다고 가정합니다. Secure Cisco Unified CME에서 작동해야 하는 모든 전화기는 먼저 성공적으로 CME에 등록할 수 있어야 합니다. CME 구성 방법에 대한 자세한 내용은 Cisco Unified Communications Manager Express System 관리자 설명서를 참조하십시오.

이 문서에서는 음성 및 보안 기능이 모두 활성화된 것으로 가정합니다.

사용되는 구성 요소

이 문서의 정보는 Cisco CME(Unified Communications Manager Express)를 기반으로 합니다.

이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다.이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다.현재 네트워크가 작동 중인 경우, 모든 명령어의 잠재적인 영향을 미리 숙지하시기 바랍니다. 

표기 규칙

문서 규칙에 대한 자세한 내용은 Cisco 기술 팁 규칙을 참조하십시오. 

구성

참고: 이 섹션에 사용된 명령에 대한 자세한 내용을 보려면 명령 조회 도구(등록된 고객만 해당)를 사용하십시오.  

요약 구성 단계

1. IOS-CA 인스턴스를 생성합니다.
2. 서드파티 CA 인증서를 보유할 신뢰 지점을 생성합니다.
3. 신뢰 지점에서 CSR(Certificate Signing Requests)을 생성합니다.
4. 서버 인증 사용으로 CSR에 서명하고 CA 인증을 받습니다.
5. CA 인증서로 신뢰 지점을 인증하고 각 ID 인증서를 가져옵니다.
6. 서드파티 인증서 신뢰 지점을 검증합니다.
7. IOS CA CME 신뢰 지점을 생성합니다.
8. CTL(Certificate Trust List) 클라이언트를 구성합니다.
9. CAPF(Certificate Authority Proxy Function) 서버를 구성합니다.
10. 텔레포니 서비스를 구성합니다.
11. 테스트 전화기를 구성합니다.
12. 확인.

자세한 구성 예

1. IOS-CA 인스턴스를 생성합니다.IOS-CA 인스턴스는 전화기의 LSC(Locally Significant Certificate)에 서명하는 데 사용되는 자체 서명 인증서를 생성합니다.
   

   crypto key gen rsa label ios-ca mod 2048
   The name for the keys will be: ios-ca
   % The key modulus size is 2048 bits
   % Generating 2048 bit RSA keys, keys will be non-exportable...
   [OK] (elapsed time was 17 seconds)
    
   crypto pki server ios-ca
   database level complete
   grant auto
   lifetime cert 7305
   exit
   ip http server 
   crypto pki trust ios-ca
   enrollment url http://10.2.3.4:80
   revo none
   rsakey ios-ca
   exit
   crypto pki server ios-ca
   no shut
   %Some server settings cannot be changed after CA certificate generation.
   % Please enter a passphrase to protect the private key
   % or type Return to exit
   Password: Cisco123
   Re-enter password: Cisco123
   % Certificate Server enabled.
   exit

2. 서드파티 서명에 대한 CSR을 생성할 신뢰 지점을 생성합니다. 이러한 신뢰 지점은 결국 CSR의 결과인 서드파티 CA 인증서와 ID 인증서를 보유합니다.
   
   

   crypto key generate rsa label tac-sast mod 2048
   The name for the keys will be: tac-sast
   % The key modulus size is 2048 bits
   % Generating 2048 bit RSA keys, keys will be non-exportable...
   [OK] (elapsed time was 52 seconds)
    
   crypto pki trust tac-sast
   enroll term
   serial-number none
   fqdn none
   ip-address none
   subject-name CN=tac-sast
   revo none
   rsakeypair tac-sast
   exit

3. 신뢰 지점에서 CSR을 생성합니다.crypto pki enroll 명령은 서드파티 CA에 서명에 제공된 CSR을 생성합니다. 
   
   예 1:
   

   crypto pki enroll tac-sast
   % Start certificate enrollment ..
   % The subject name in the certificate will include: CN=tac-sast
   % The fully-qualified domain name will not be included in the certificate
   Display Certificate Request to terminal? [yes/no]: yes
   Certificate Request follows:
   MIICfjCCAWYCAQAwGDEWMBQGA1UEAxMNam9jYXNhbGUtc2FzdDCCASIwDQYJKoZI
   hvcNAQEBBQADggEPADCCAQoCggEBALLIyM0k5DmgWy1jILHy+eaoJTU+OioaTfFO
   V7SdNOfjoXCRpqCZwFavR82/Wukoho9HUXB7/oEQV6D2UoyHRhl1mzHv5AxuJuE1
   0Qk9YHpBzLAcNEvRWvnyVnMaBSc6Fy9j7oabAUuOoWveK8NrsoR38WH2gIY3kUaM
   8swgaomqlAj8LbmYE/PQdtfxOEneIF1FHHXj4R72dqkCaiBz7fcO9sdxfRqi8jEf
   UbndH9yZit912wX14nxC2Wa2S3O/p6vXEwKfQMGZe4nO7SJPtJ/vNHx/HNCkJxHV
   H1V0JH7Afffffffffffffffffffffffffffffffffffffffffffffffffffff
   fffffffffffffffffffffffffffffffffEAAaAhMB8G
   CSqGSIb3DQEJDjESMBAwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEBBAUAA4IB
   AQB++utK7EpeGYYyPfNALsXkPcbu+2kwi/TI+B2kT3ol/dxyX6hNh0jp3eOTQtSl
   H7jRey4ew9GZVTeqq7cxwz1f7d6ZP4BRqzp1f0HVvu7HC+bAR0jB2FNvVaN27zYu
   XSP/GIaUiQDTbaEyDgGr8s5PlFSS2Ap4FvxsskjD/30geszhRs+N3cYfQVpnWjnq
   TwbMF4998BXmlPIQigJBInACY2SUszqcDih7Nc1Y6viYaSiN0ZCuzEyKI2tjbwUU
   EU/o0fcWMXsnBc44WQBAEpTBSLYFVb4kGl9AgAyOW7q9ACiBTpmul1kwuDyTPg5X
   fCIWUjVfTWoHizqxKSbLQ2nL
   ---End - This line not part of the certificate request---
   Redisplay enrollment request? [yes/no]: no

   예 2:

   crypto pki enroll tac-sast
   % Start certificate enrollment ..
   % The subject name in the certificate will include: CN=tac-sast
   % The fully-qualified domain name will not be included in the certificate
   Display Certificate Request to terminal? [yes/no]: yes
   Certificate Request follows:
   MIICfjCCAWYCAQAwGDEWMBQGA1UEAxMNam9jYXNhbGUtc2FzdDCCASIwDQYJKoZI
   hvcNAQEBBQADggEPADCCAQoCggEBALLIyM0k5DmgWy1jILHy+eaoJTU+OioaTfFO
   V7SdNOfjoXCRpqCZwFavR82/Wukoho9HUXB7/oEQV6D2UoyHRhl1mzHv5AxuJuE1
   0Qk9YHpBzLAcNEvRWvnyVnMaBSc6Fy9j7oabAUuOoWveK8NrsoR38WH2gIY3kUaM
   8swgaomqlAj8LbmYE/PQdtfxOEneIF1FHHXj4R72dqkCaiBz7fcO9sdxfRqi8jEf
   UbndH9ffffffffffffffffffffffffffffffffffffffffffffffffffffffff
   fffffffffffffffffffffffffffffffffHNCkJxHV
   H1V0JH7AwWLdnUgEWGoSFOL5j/lwIHmemUDpSuL9IY+9EP622E0CAwEAAaAhMB8G
   CSqGSIb3DQEJDjESMBAwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEBBAUAA4IB
   AQB++utK7EpeGYYyPfNALsXkPcbu+2kwi/TI+B2kT3ol/dxyX6hNh0jp3eOTQtSl
   H7jRey4ew9GZVTeqq7cxwz1f7d6ZP4BRqzp1f0HVvu7HC+bAR0jB2FNvVaN27zYu
   XSP/GIaUiQDTbaEyDgGr8s5PlFSS2Ap4FvxsskjD/30geszhRs+N3cYfQVpnWjnq
   TwbMF4998BXmlPIQigJBInACY2SUszqcDih7Nc1Y6viYaSiN0ZCuzEyKI2tjbwUU
   EU/o0fcWMXsnBc44WQBAEpTBSLYFVb4kGl9AgAyOW7q9ACiBTpmul1kwuDyTPg5X
   fCIWUjVfTWoHizqxKSbLQ2nL
   ---End - This line not part of the certificate request---
   Redisplay enrollment request? [yes/no]: no

4. 서버 인증 권한이 있는 인증서를 생성하려면 두 CSR을 사용합니다.
   참고:
   • CA에서 두 인증서 중 하나에 대해 전체 인증서 체인을 가져오는 것이 중요합니다. 인증서 체인은 서명 CA에서 CA 및 ID 인증서를 모두 제공합니다.
   • 인증서가 기본 64 형식으로 다운로드되었는지 확인합니다.
   • 각 신뢰 지점에 대한 인증에 CA 인증서를 사용하고 ID 인증서를 해당 순서대로 각 신뢰 지점으로 가져와야 합니다.
5. CA 인증서로 신뢰 지점을 인증하고 SAST ID 인증서를 가져옵니다.
   
   예 1:
   

   crypto pki auth tac-sast
   Enter the base 64 encoded CA certificate.
   End with a blank line or the word "quit" on a line by itself
   -----BEGIN CERTIFICATE-----
   MIIFQTCCBCmgAwIBAgIQUt2XjpaAwaJIEkcOebj7AjANBgkqhkiG9w0BAQUFADBs
   MRMwEQYKCZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xIjAg
   BgoJkiaJk/IsZAEZFhJqeW91bmd0YS1sYWJkb21haW4xGjAYBgNVBAMTEWp5b3Vu
   Z3RhLWNhc2VydmVyMB4XDTEyMDgxMzE1NTczM1oXDTE3MDgxNDE2MDY0M1owbDET
   MBEGCgmSJomT8ixkARkWA2NvbTEVMBMGCgmSJomT8ixkARkWBWNpc2NvMSIwIAYK
   CZImiZPyLGQBGRYSanlvdW5ndGEtbGFiZG9tYWluMRowGAYDVQQDExFqeW91bmd0
   YS1jYXNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ2Cxwm6
   uX3/t3Ip9A5OnbKS1IL4MaTCVzev7tlZbusWLQcfJwOhjFNxJJpgY2yE8CjBsL4H
   eryNvcvUFeA90kXbEncl1uoI7t1JEf5ifQBopqGO54E0t1YUHrcT5LgXdBU839yp
   lNm9VtFfffffffffffffffffffffffffffffffffffffffffffffffffffffffff
   ffffffffffffffffffffffffo45wsFTRpp8
   DC7nGuW0erm2/ISnfoNs/mUmfWbmoAbJjIrU+RHaQ7RrcXPWB3mEqC40eQtYJFZl
   tRE7DNwPriVBTpWCV+wo94DkHtn8/nc3FOWD0RIjU7Y66jG+umWSeqJh0xdZBak2
   +L9A6ZwCxyeuzg0CAwEAAaOCAd0wggHZMBMGCSsGAQQBgjcUAgQGHgQAQwBBMAsG
   A1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSy5dc14lYuF1hq
   yYnbrQAHPsISWzCCAUoGA1UdHwSCAUEwggE9MIIBOaCCATWgggExhoHWbGRhcDov
   Ly9DTj1qeW91bmd0YS1jYXNlcnZlcixDTj1qeW91bmd0YS1jYXNlcnZlcixDTj1D
   RFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u
   ZmlndXJhdGlvbixEQz1qeW91bmd0YS1sYWJkb21haW4sREM9Y2lzY28sREM9Y29t
   P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxE
   aXN0cmlifffffffffffffffffffffffffffffffffffffffffffffffffffffff
   fffffffffffffffffffffffffffffffyLmp5b3Vu
   Z3RhLWxhYmRvbWFpbi5jaXNjby5jb20vQ2VydEVucm9sbC9qeW91bmd0YS1jYXNl
   cnZlci5jcmwwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUWjZQ
   /W2X5GoSeibbuvAKHH8/97MwDQYJKoZIhvcNAQEFBQADggEBAI8nivQcicltdXnt
   X30+QO+FKK0Cu6WWFIozqKE0eeSJ0C3fPv88jjkae4+YjF/gK2wPt/mezWeQm0MO
   S4m0LHnMMZGU7ezAHTd+yh5oWI2Q2iBFnslvSIUboJZazNkDEFm7Dl8gDKajEvE/
   JUNtebgOJPJUXvV/v0Rpry1Nckxrn3tsiCF62acgAZke1hSrscoeqzkygk8vIr1K
   lv9W2Vy2TPa6i8ZWG8at36jAsNAk5HJUEl7mFyirMIJcc+diZ12WPoRqrQ+CE7ZL
   Mw+ydSS5x0XvFqily0VE649TsvtKCOMkJjbLLX8wZp9SU2AgXutHr3CdlrVlaElC
   ZW4J3cQ=
   -----END CERTIFICATE-----
   quit
   Certificate has the following attributes:
   Fingerprint MD5: C198A185 83575520 EBE6E03D 33BA9B2C 
   Fingerprint SHA1: B0A9668D 42D36311 E82B0A33 480127B5 BEB02B60
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.
   % Certificate successfully imported
    
    
   crypto pki import tac-sast cert
   % The fully-qualified domain name will not be included in the certificate
   Enter the base 64 encoded certificate.
   End with a blank line or the word "quit" on a line by itself
   -----BEGIN CERTIFICATE-----
   MIIGpzCCBY+gAwIBAgIKGdhyPgABAAABpDANBgkqhkiG9w0BAQUFADBsMRMwEQYK
   CZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xIjAgBgoJkiaJ
   k/IsZAEZFhJqeW91bmd0YS1sYWJkb21haW4xGjAYBgNVBAMTEWp5b3VuZ3RhLWNh
   c2VydmVyMB4XDTEyMDgyOTEzMzIyOVoXDTE0MDgyOTEzMzIyOVowGDEWMBQGA1UE
   AxMNam9jYXNhbGUtc2FzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
   ALLIyM0k5DmgWy1jILHy+eaoJTU+OioaTfFOV7SdNOfjoXCRpqCZwFavR82/Wuko
   ho9HUXB7/oEQV6D2UoyHRhl1mzHv5AxuJuE10Qk9YHpBzLAcNEvRWvnyVnMaBSc6
   Fy9j7oabAUuOoWveK8NrsoR38WH2gIY3kUaM8swgaomqlAj8LbmYE/PQdtfxOEne
   IF1FHHXj4fffffffffffffffffffffffffffffffffffffffffffffffffffffff
   fffffffffffffffffffffffffWa2S3O/
   p6vXEwKfQMGZe4nO7SJPtJ/vNHx/HNCkJxHVH1V0JH7AwWLdnUgEWGoSFOL5j/lw
   IHmemUDpSuL9IY+9EP622E0CAwEAAaOCA50wggOZMA4GA1UdDwEB/wQEAwIFoDAd
   BgNVHQ4EFgQUtP6NbC/kpe3uSa2oeZy9rTDGMHAwHwYDVR0jBBgwFoAUsuXXNeJW
   LhdYasmJ260ABz7CElswggGYBgNVHR8EggGPMIIBizCCAYegggGDoIIBf4aB2Wxk
   YXA6Ly8vQ049anlvdW5ndGEtY2FzZXJ2ZXIoMSksQ049anlvdW5ndGEtY2FzZXJ2
   ZXIsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2Vz
   LENOPUNvbmZpZ3VyYXRpb24sREM9anlvdW5ndGEtbGFiZG9tYWluLERDPWNpc2Nv
   LERDPWNvbT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xh
   c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGWWh0dHA6Ly9qeW91bmd0YS1jYXNlcnZl
   ci5qeW91bmd0YS1sYWJkb21haW4uY2lzY28uY29tL0NlcnRFbnJvbGwvanlvdW5n
   dGEtY2FzZXJ2ZXIoMSkuY3JshkZodHRwOi8vanlvdW5ndGEtY2FzZXJ2ZXIuY2lz
   Y28uY29tL0NlcnRFbnJvbGwvanlvdW5ndGEtY2FzZXJ2ZXIoMSkuY3JsMIIBcQYI
   KwYBBQUHAQEEggFjMIIBXzCBxAYIKwYBBQUHMAKGgbdsZGFwOi8vL0NOPWp5b3Vu
   Z3RhLWNhc2VydmVyLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxD
   Tj1TZXJ2aWffffffffffffffffffffffffffffffffffffffffffffffffffffff
   ffffffffffffffffffffffffLWxhYmRvbWFp
   bixEQz1jaXNjbyxEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNz
   PWNlcnRpZmljYXRpb25BdXRob3JpdHkwgZUGCCsGAQUFBzAChoGIaHR0cDovL2p5
   b3VuZ3RhLWNhc2VydmVyLmp5b3VuZ3RhLWxhYmRvbWFpbi5jaXNjby5jb20vQ2Vy
   dEVucm9sbC9qeW91bmd0YS1jYXNlcnZlci5qeW91bmd0YS1sYWJkb21haW4uY2lz
   Y28uY29tX2p5b3VuZ3RhLWNhc2VydmVyKDEpLmNydDAhBgkrBgEEAYI3FAIEFB4S
   AFcAZQBiAFMAZQByAHYAZQByMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3
   DQEBBQUAA4IBAQCayeYa7pauRGAgGPHmAHQt6iiqBsS+uVwArgO1u0HEjs4EkPm8
   xQZNexVBOmGyzTwlwjpD8jTDIO1AEWP67b/gB2xViktVqvaVfKfMR+3cxODoTUNJ
   DbMKR7tOyLrfv+7hNVcsKlAo+XpohVKdP4XOPXeEquYrTmzInsB55PtMxJ7qnYU6
   29kJUZdVQZUjZSy4dVhtVYVO9Gmj5XIkzUneS4QC7N/3CXGZQilH11PzulUvAAFh
   h2o6c7QgKtHGxOwrkXuPl6+GN4mV+uFXh1B5DTEXG7/yJNNE2yNN+Flb05yLcyEA
   Y0p/cksKkNhpRDh+YNT1uHa0AjY8fa1AJqpp
   -----END CERTIFICATE-----
   quit
   % Router Certificate successfully imported

   
   예 2:

   crypto pki auth tac-cme
   Enter the base 64 encoded CA certificate.
   End with a blank line or the word "quit" on a line by itself
   -----BEGIN CERTIFICATE-----
   MIIFQTCCBCmgAwIBAgIQUt2XjpaAwaJIEkcOebj7AjANBgkqhkiG9w0BAQUFADBs
   MRMwEQYKCZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xIjAg
   BgoJkiaJk/IsZAEZFhJqeW91bmd0YS1sYWJkb21haW4xGjAYBgNVBAMTEWp5b3Vu
   Z3RhLWNhc2VydmVyMB4XDTEyMDgxMzE1NTczM1oXDTE3MDgxNDE2MDY0M1owbDET
   MBEGCgmSJomT8ixkARkWA2NvbTEVMBMGCgmSJomT8ixkARkWBWNpc2NvMSIwIAYK
   CZImiZPyLGQBGRYSanlvdW5ndGEtbGFiZG9tYWluMRowGAYDVQQDExFqeW91bmd0
   YS1jYXNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ2Cxwm6
   uX3/t3Ip9A5OnbKS1IL4MaTCVzev7tlZbusWLQcfJwOhjFNxJJpgY2yE8CjBsL4H
   eryNvcvUFfffffffffffffffffffffffffffffffffffffffffffffffffffffff
   ffffffffffffffffffffffffffU839yp
   lNm9VtF+MXC0L7dIpu1XRT7/lJgLDAI5alZg5wW6zC9xrgNS88cR1o45wsFTRpp8
   DC7nGuW0erm2/ISnfoNs/mUmfWbmoAbJjIrU+RHaQ7RrcXPWB3mEqC40eQtYJFZl
   tRE7DNwPriVBTpWCV+wo94DkHtn8/nc3FOWD0RIjU7Y66jG+umWSeqJh0xdZBak2
   +L9A6ZwCxyeuzg0CAwEAAaOCAd0wggHZMBMGCSsGAQQBgjcUAgQGHgQAQwBBMAsG
   A1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSy5dc14lYuF1hq
   yYnbrQAHPsISWzCCAUoGA1UdHwSCAUEwggE9MIIBOaCCATWgggExhoHWbGRhcDov
   Ly9DTj1qeW91bmd0YS1jYXNlcnZlcixDTj1qeW91bmd0YS1jYXNlcnZlcixDTj1D
   RFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u
   ZmlndXJhdGlvbixEQz1qeW91bmd0YS1sYWJkb21haW4sREM9Y2lzY28sREM9Y29t
   P2NlcnRpZmffffffffffffffffffffffffffffffffffffffffffffffffffffff
   ffffffffffffffffffffffffffffffffjUkxE
   aXN0cmlidXRpb25Qb2ludIZWaHR0cDovL2p5b3VuZ3RhLWNhc2VydmVyLmp5b3Vu
   Z3RhLWxhYmRvbWFpbi5jaXNjby5jb20vQ2VydEVucm9sbC9qeW91bmd0YS1jYXNl
   cnZlci5jcmwwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUWjZQ
   /W2X5GoSeibbuvAKHH8/97MwDQYJKoZIhvcNAQEFBQADggEBAI8nivQcicltdXnt
   X30+QO+FKK0Cu6WWFIozqKE0eeSJ0C3fPv88jjkae4+YjF/gK2wPt/mezWeQm0MO
   S4m0LHnMMZGU7ezAHTd+yh5oWI2Q2iBFnslvSIUboJZazNkDEFm7Dl8gDKajEvE/
   JUNtebgOJPJUXvV/v0Rpry1Nckxrn3tsiCF62acgAZke1hSrscoeqzkygk8vIr1K
   lv9W2Vy2TPa6i8ZWG8at36jAsNAk5HJUEl7mFyirMIJcc+diZ12WPoRqrQ+CE7ZL
   Mw+ydSS5x0XvFqily0VE649TsvtKCOMkJjbLLX8wZp9SU2AgXutHr3CdlrVlaElC
   ZW4J3cQ=
   -----END CERTIFICATE-----
   quit
   Certificate has the following attributes:
   Fingerprint MD5: C198A185 83575520 EBE6E03D 33BA9B2C 
   Fingerprint SHA1: B0A9668D 42D36311 E82B0A33 480127B5 BEB02B60
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.
   % Certificate successfully imported
    
   crypto pki import tac-cme cert
   % The fully-qualified domain name will not be included in the certificate
   Enter the base 64 encoded certificate.
   End with a blank line or the word "quit" on a line by itself
   -----BEGIN CERTIFICATE-----
   MIIGpjCCBY6gAwIBAgIKGdmLjgABAAABpTANBgkqhkiG9w0BAQUFADBsMRMwEQYK
   CZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFY2lzY28xIjAgBgoJkiaJ
   k/IsZAEZFhJqeW91bmd0YS1sYWJkb21haW4xGjAYBgNVBAMTEWp5b3VuZ3RhLWNh
   c2VydmVyMB4XDTEyMDgyOTEzMzM0MVoXDTE0MDgyOTEzMzM0MVowFzEVMBMGA1UE
   AxMMam9jYXNhbGUtY21lMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
   uVz/50eRaTmlnvOKRFp9ZcZuqw3We6DVqsBMuTpQg0Bg/VQTgCa9NFD8LW2UXGO8
   YFANV8ABVn9q/1TET6Fg5YbcTePsd5/lNlL1zpSHiAtBuwfGzKKiMgZJ1XFYeb9p
   heqpTj2d22CoghFQnKbRUOPpjfPcElFq07/z5m7blEkAmsAQh2y+bIH5T7UNdgtf
   smLqWZMqIsMEvNEi3gbkPUTatmZlgFac1TXvxyIIv95rIeqs07WZXn0GsgkNsO3i
   CjcFY1UXxxYV5Wg/uPQlFnbRpTefd5Ms253Dm9Ey2E8v+E3HsOfn0JvpY4vIkKz2
   KDesetXsIOw747tf1wXHmQIDAQABo4IDnTCCA5kwDgYDVR0PAQH/BAQDAgWgMB0G
   A1UdDgQWBBR8xG8ZaDVcquSU+0n40KSH+7SmSDAfBgNVHSMEGDAWgBSy5dc14lYu
   F1hqyYnbrQAHPsISWzCCAZgGA1UdHwSCAY8wggGLMIIBh6CCAYOgggF/hoHZbGRh
   cDovLy9DTj1qeW91bmd0YS1jYXNlcnZlcigxKSxDTj1qeW91bmd0YS1jYXNlcnZl
   cixDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMs
   Q049Q29uZmlndXJhdGlvbixEQz1qeW91bmd0YS1sYWJkb21haW4sREM9Y2lzY28s
   REM9Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFz
   cz1jUkffffffffffffffffffffffffffffffffffffffffffffffffffffcDovL2
   p5b3VuZ3RhLWNhc2VydmVy
   Lmp5b3VuZ3RhLWxhYmRvbWFpbi5jaXNjby5jb20vQ2VydEVucm9sbC9qeW91bmd0
   YS1jYXNlcnZlcigxKS5jcmyGRmh0dHA6Ly9qeW91bmd0YS1jYXNlcnZlci5jaXNj
   by5jb20vQ2VydEVucm9sbC9qeW91bmd0YS1jYXNlcnZlcigxKS5jcmwwggFxBggr
   BgEFBQcBAQSCAWMwggFfMIHEBggrBgEFBQcwAoaBt2xkYXA6Ly8vQ049anlvdW5n
   dGEtY2FzZXJ2ZXIsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENO
   PVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9anlvdW5ndGEtbGFiZG9tYWlu
   LERDPWNpc2NvLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
   Y2VydGlmaWNhdGlvbkF1dGhvcml0eTCBlQYIKwYBBQUHMAKGgYhodHRwOi8vanlv
   dW5ndGEtY2FzZXJ2ZXIuanlvdW5ndGEtbGFiZG9tYWluLmNpc2NvLmNvbS9DZXJ0
   RW5yb2xsL2p5b3VuZ3RhLWNhcfffffffffffffffffffffffffffffffffffffff
   ffffffffffffffffffFpbi5jaXNj
   by5jb21fanlvdW5ndGEtY2FzZXJ2ZXIoMSkuY3J0MCEGCSsGAQQBgjcUAgQUHhIA
   VwBlAGIAUwBlAHIAdgBlAHIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcN
   AQEFBQADggEBAHNVNEMcys1z4sXGiI2jZzT5Nt/q8dLl4LCJ2iZkmS3F8tG14UEf
   C/e28VWavV4piIXK4FuZKB1iltOo9MZAGH9PvVEO+yG8zpeIcwOgDq951qJejeBA
   +N+ryCFy5TEbiMF3pw1XjdbBAProJ1s1Q0QcjoigPNtPyqRfehdlhMUo4NgC/svX
   5VZSfxpagaBhdpUNVYo2s0ujXujuI/aTRpbDan2h7n27tMMBtDcocpQgPv6txDoR
   b+Qb8CPZt3IvuEXAru4cRv1O1jYUWlY59ta5uELSnA+2WA36PiMxIyLu67W1RI05
   1rFcBOmIQ8vTpqyNp8/TFOpOSnQMO30w9Fs=
   -----END CERTIFICATE-----
   quit
   % Router Certificate successfully imported

6. CA와 ID 인증서가 모두 각 신뢰 지점에 로드되면 각 신뢰 지점에 대한 인증서 체인을 검증합니다.이 단계를 수행하면 이전 단계가 성공적으로 완료됩니다.
   
   

   crypto pki cert validate tac-cme
   Chain has 2 certificates
   Certificate chain for tac-cme is valid
    
   crypto pki cert validate tac-sast
   Chain has 2 certificates
   Certificate chain for tac-sast is valid

7. IOS CA CME 신뢰 지점을 생성합니다. 
   
   IOS-CA 신뢰 지점은 전화와의 클라이언트 인증(TLS(Transport Level Security) 연결에 사용할 수 없으므로 다른 신뢰 지점을 만들고 IOS-CA 인증서를 여기에 넣어야 합니다.
   
   이 신뢰 지점은 TLS 연결에 대한 IP 전화의 요청을 인증하는 데만 사용됩니다(올바르게 등록할 수 있음).
   
   

   crypto pki trust ios-ca-cme
   enroll url http://10.2.3.4:80
   revo none
   rsakey ios-ca
   exit
   
   crypto pki auth ios-ca-cme
   Certificate has the following attributes:
   Fingerprint MD5: 0120A3AB 44155DF9 091F31BF C3E26B80 
   Fingerprint SHA1: 90F9DDDE 20A792B5 3693A065 8BDAD50E 588E011C
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.

8. CTL 클라이언트를 구성합니다. 
   
   

   ctl-client
   server capf 10.2.3.4 trust tac-cme
   server cme-tftp 10.2.3.4 trust tac-cme
   sast1 trust tac1-cme
   sast2 trust tac-sast
   regenerate

   참고:CTL 파일이 성공적으로 작성되었는지 확인합니다.

   do sh flash | iCTL
   58 8642 Aug 29 2012 13:57:22 +00:00 CTLFile.tlv

9. CAPF 서버를 구성합니다.
   
   

   capf-server
   auth-mode null-string
   cert-enroll-trust ios-ca pass 0 null
   trustpoint-label tac-cme
   source-addr 10.2.3.4
   end

10. 텔레포니 서비스를 구성합니다.
    
    

    confi t
    Enter configuration commands, one per line. End with CNTL/Z.
    telephony-service
    secure-signaling trust tac-cme
    tftp-server-credentials trust tac-cme
    server-security-mode secure
    cnf-file perphone
    device-security-mode encrypted
    exit

11. 인증서를 업그레이드하고 암호화 모드를 사용하려면 테스트 폰(ephone)을 구성합니다.

    ephone 1
    capf-ip-in-cnf
    cert-oper upgrade auth-mode null
    device-security-mode encrypted
    telephony-service
    cre cnf
    Creating CNF files
    CNF-FILES: Clock is not set or synchronized, retaining old versionStamps
    end

    컨피그레이션이 완료되면 전화기를 재설정한 다음 등록될 때까지 기다립니다.
    
    참고:전화기를 재설정하기 전에 보안 컨피그레이션이 없는지 확인합니다.보안 컨피그레이션이 있는 경우 Secure Cisco Unified CME로 등록하기 전에 테스트 전화기를 수동으로 제거하거나 공장 재설정을 완료해야 합니다.
    
    전화기를 재설정하려면 다음 명령을 실행합니다.

    confi t
    ephone 1
    reset
    end

    전화기가 업데이트된 LSC를 수신하면 cert-oper upgrade auth-mode null-string 명령이 제거됩니다.

    do sh run | sec ephone
    ephone 1
    device-security-mode encrypted
    mac-address ABCD.ABCD.ABCD
    type 7960
    capf-ip-in-cnf
    button 1:1
    sh ephone

12. 전화기가 인증 및 암호화에 모두 등록되었는지 확인합니다.
    
    

    sh ephone
    ephone-1[0] Mac:ABCD.ABCD.ABCD TCP 
    socket:[2] activeLine:0 whisperLine:0 
    REGISTERED in SCCP ver 11/9 
    max_streams=0 + Authentication + Encryption with TLS connection
    mediaActive:0 whisper_mediaActive:0 
    startMedia:0 offhook:0 ringing:0 reset:0 
    reset_sent:0 paging 0 debug:0 caps:8 
    IP:10.2.3.10 * 51685 Telecaster 7960 
    keepalive 4 max_line 6 available_line 6
    button 1: cw:1 ccw:(0 0) 
    dn 1 number 2090 CH1 IDLE CH2 IDLE 
    Preferred Codec: g711ulaw 
    Lpcor Type: none

보안 Cisco Unified CME는 타사 인증서로 완벽하게 작동해야 합니다.

관련 정보

• Cisco Unified Communications Manager Express 시스템 관리자 가이드

• Secure Voice on Cisco TAC Wiki

• 기술 지원 및 문서 − Cisco Systems