Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| vendors:cisco:uc:cube:tls [2021/04/01 14:06] – created gerardorourke | vendors:cisco:uc:cube:tls [2026/05/19 17:50] (current) – [Generating CSR] gerardorourke | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== CUCM-CUBE TLS SIP Trunk ====== | + | ====== CUBE - TLS ====== |
| + | ===== Generating CSR ===== | ||
| + | |||
| + | We need to create a CSR which will be signed by a CA (and likely also an intermediate CA). | ||
| + | Steps: | ||
| + | *Create trustpoint ' | ||
| + | * < | ||
| + | crypto pki trustpoint CUBETLS2 | ||
| + | enrollment terminal pem | ||
| + | serial-number none | ||
| + | ip-address none | ||
| + | subject-name cn=ROUTER1.mydomain.com | ||
| + | subject-alt-name ROUTER1.mydomain.com | ||
| + | revocation-check none | ||
| + | resakeypair CUBETLS2 | ||
| + | hash sha512 | ||
| + | </ | ||
| + | *Request the CSR | ||
| + | * < | ||
| + | ! This displays the Certificate Signing Request (CSR) to the terminal | ||
| + | configure terminal | ||
| + | crypto pki enroll CUBETLS2 | ||
| + | ! | ||
| + | </ | ||
| + | |||
| + | Then once you have the PEM file returned - which should contain the signed cert, as well as the inter and root CAs) | ||
| + | you need to import the intermediate and CA certs (in that order and both together) | ||
| + | |||
| + | * < | ||
| + | conf terminal | ||
| + | crypto pki authenticate CUBETLS2 | ||
| + | </ | ||
| + | *Paste the 2 certs into above. Each Cert will start and end with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- | ||
| + | *You will paste both the inter and CA cert (in that order) and then after pasting in each leave a line space to complete the import. | ||
| + | |||
| + | Finally import the actual certificate for that router. | ||
| + | *< | ||
| + | crypt pki import CUBETLS2 certificate | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ===== CUCM-CUBE TLS SIP Trunk ===== | ||
| What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s) | What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s) | ||
| Line 5: | Line 50: | ||
| Reference: https:// | Reference: https:// | ||
| - | ===== Summary Steps ===== | + | ==== Summary Steps ==== |
| * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct. | * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct. | ||
| * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License | * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License | ||
| - | * Import CallManager Cert (note: **not** the Tomcat cert) for each CUCM Node into CUBE | + | * Import CallManager Cert (note: **not** the Tomcat cert) for each CUCM Node you are sending / receiving calls from the CUBE |
| * Note - you could get CallManager Certs signed by CA - meaning only the CA cert should need to be imported - but usually means you have to redo certs every 2 years. Self Signed Certs last 5 years. See this [[https:// | * Note - you could get CallManager Certs signed by CA - meaning only the CA cert should need to be imported - but usually means you have to redo certs every 2 years. Self Signed Certs last 5 years. See this [[https:// | ||
| - | * Create a Cert for the CUBE and export, then import into CUCM - with a CN equal to the routers FQDN, e.g. cubeA.mydomain.com | + | * Create a Cert for the CUBE and export, then import into CUCM as a **CallManager-Trust** Certificate |
| - | * CUCM - Create a Security Profile | + | * CUCM - Create a ' |
| * Enable SIP Option Pings - with a SIP profile | * Enable SIP Option Pings - with a SIP profile | ||
| - | * Enable tcp tls on the sip-ua (so CUBE listens on 5061) | ||
| * Create a SIP Options Profile with tls and assign to the Outbound Going CUCM dial-peer | * Create a SIP Options Profile with tls and assign to the Outbound Going CUCM dial-peer | ||
| - | * Same Config Below! | + | |
| + | | ||
| - | ===== Detailed Steps ===== | + | ==== Detailed Steps ==== |
| - | ==== CUBE Config | + | === CUBE Config ==== |
| ==Create Trustpoint for self signed CUBE certificate== | ==Create Trustpoint for self signed CUBE certificate== | ||
| < | < | ||
| Line 42: | Line 87: | ||
| </ | </ | ||
| - | ===export | + | ===Export |
| + | |||
| + | *Copy the output between the -----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- into a text file and save as a .cer file. | ||
| < | < | ||
| CUBE-A(config)# | CUBE-A(config)# | ||
| Line 78: | Line 125: | ||
| CUBE-A(config)# | CUBE-A(config)# | ||
| + | </ | ||
| === Import all CallManager Nodes Certs onto the CUBE which will send or receive calls=== | === Import all CallManager Nodes Certs onto the CUBE which will send or receive calls=== | ||
| Line 133: | Line 181: | ||
| </ | </ | ||
| - | == Enable Security License == | + | === Enable Security License |
| Note: Make sure you are entitled to have a security license on the CUBE - if not purchase one. | Note: Make sure you are entitled to have a security license on the CUBE - if not purchase one. | ||
| This command requires the CUBE to be reloaded to take effect. | This command requires the CUBE to be reloaded to take effect. | ||
| Line 145: | Line 193: | ||
| </ | </ | ||
| + | === Configure SIP to use the Trustpoint Self Signed Certificate=== | ||
| + | < | ||
| + | CUBE-A(config)# | ||
| + | CUBE-A(config-sip-ua)# | ||
| + | </ | ||
| + | === Configure a TLS SIP Options Profile === | ||
| + | |||
| + | < | ||
| + | ! | ||
| + | voice class sip-options-keepalive 3 | ||
| + | | ||
| + | | ||
| + | | ||
| + | retry 3 | ||
| + | | ||
| + | ! | ||
| + | </ | ||
| + | |||
| + | === Update Dial-peers to/from CUCM === | ||
| + | |||
| + | * to use TLS (the ' | ||
| + | * to use the new SIP options over TLS profile ' | ||
| + | |||
| + | < | ||
| + | dial-peer voice 2500 voip | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | no vad | ||
| + | ! | ||
| + | dial-peer voice 9500 voip | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | no vad | ||
| + | </ | ||
| + | |||
| + | ==== CUCM Config ==== | ||
| + | |||
| + | === Upload CUBE Self Signed Cert to CUCM === | ||
| + | |||
| + | Make sure to upload as a **CallManager-Trust** Certificate - as per below screenshot.\\ | ||
| + | |||
| + | {{: | ||
| + | |||
| + | **The GUI informs you to restart the CUCM Service after uploading this certificate, | ||
| + | |||
| + | === Create SIP Security Profile for each CUBE === | ||
| + | |||
| + | *The Subject on the certificate must match what is detailed here. | ||
| + | |||
| + | {{: | ||
| + | |||
| + | === Update CUCM SIP Trunk=== | ||
| + | |||
| + | * Edit the SIP trunk to make the destination Port 5061 (instead of 5060). | ||
| + | * Assign the Dedicated CUBE Security profile configured in previous step | ||
| + | * Recommend you configure a SIP Profile which includes SIP options PINGs (I would recommend for all SIP Trunks). | ||
| + | * Reset the SIP Trunk (and I found I had to reset the Security Profile). | ||
| + | |||
| + | |||
| + | ===== Troubleshooting Commands ===== | ||
| + | < | ||
| + | debug crypto pki api | ||
| + | debug crypto pki callbacks | ||
| + | debug crypto pki messages | ||
| + | debug crypto pki transactions | ||
| + | debug ssl openssl errors | ||
| + | debug ssl openssl msg | ||
| + | debug ssl openssl states | ||
| + | debug ip tcp transactions | ||
| + | debug ccsip verbose | ||
| + | </ | ||
| ===== Regeneration of Certs ===== | ===== Regeneration of Certs ===== | ||