Differences

This shows you the differences between two versions of the page.

--- vendors:cisco:uc:cube:tls [2021/04/01 14:59] – [CUBE Config] gerardorourke
+++ vendors:cisco:uc:cube:tls [2026/05/19 17:50] (current) – [Generating CSR] gerardorourke
@@ Line 1: / Line 1: @@
-====== CUCM-CUBE TLS SIP Trunk ======
+====== CUBE - TLS ======
+===== Generating CSR =====
+We need to create a CSR which will be signed by a CA (and likely also an intermediate CA).
+Steps:
+  *Create trustpoint 'CUBETLS2' (we could call it anything) as per below config
+    * <code>
+crypto pki trustpoint CUBETLS2
+  enrollment terminal pem
+  serial-number none
+  ip-address none
+  subject-name cn=ROUTER1.mydomain.com
+  subject-alt-name ROUTER1.mydomain.com
+  revocation-check none
+  resakeypair CUBETLS2
+  hash sha512
+</code>
+  *Request the CSR
+    * <code>
+! This displays the Certificate Signing Request (CSR) to the terminal
+configure terminal
+  crypto pki enroll CUBETLS2
+!
+</code>
+Then once you have the PEM file returned - which should contain the signed cert, as well as the inter and root CAs)
+you need to import the intermediate and CA certs (in that order and both together)
+  * <code>
+conf terminal
+  crypto pki authenticate CUBETLS2
+</code>
+  *Paste the 2 certs into above. Each Cert will start and end with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
+  *You will paste both the inter and CA cert (in that order) and then after pasting in each leave a line space to complete the import.
+Finally import the actual certificate for that router.
+  *<code>
+crypt pki import CUBETLS2 certificate
+</code>
+===== CUCM-CUBE TLS SIP Trunk =====
 What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s)
@@ Line 5: / Line 50: @@
 Reference: https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/212090-Configure-SIP-TLS-between-CUCM-CUBE-CUBE.html
-===== Summary Steps =====
+==== Summary Steps ====
   * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct.
   * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License
-  * Import CallManager Cert (note: **not** the Tomcat cert) for each CUCM Node into CUBE
+  * Import CallManager Cert (note: **not** the Tomcat cert) for each CUCM Node you are sending / receiving calls from the CUBE
       * Note - you could get CallManager Certs signed by CA - meaning only the CA cert should need to be imported - but usually means you  have to redo certs every 2 years. Self Signed Certs last 5 years. See this [[https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200199-CUCM-Certificate-Regeneration-Renewal-Pr.html|guide]]
-  * Create a Cert for the CUBE and export, then import into CUCM - with a CN equal to the routers FQDN, e.g. cubeA.mydomain.com
+  * Create a Cert for the CUBE and export, then import into CUCM as a **CallManager-Trust** Certificate - with a Subject and a CN equal to the routers FQDN, e.g. cubeA.mydomain.com
-  * CUCM - Create a Security Profile which has subject line of CUBE and assign to the SIP trunk - also set the IP address and port of the CUBE as 5061
+  * CUCM - Create a 'encrypted' Security Profile (see example) for each CUBE for and set the subject line in it to be the FQDN of the CUBE and assign to the SIP trunk. Set the SIP Trunk Destination IP address of the CUBE and set the port as 5061
   * Enable SIP Option Pings - with a SIP profile
-  * Enable tcp tls on the sip-ua (so CUBE listens on 5061)
   * Create a SIP Options Profile with tls and assign to the Outbound Going CUCM dial-peer
-  * Same Config Below!
+  * Set the incoming and outgoing CUCM Dial-peers with **session transport tcp tls**
+  * Same Details Steps and example config extracts below
-===== Detailed Steps =====
+==== Detailed Steps ====
-==== CUBE Config =====
+=== CUBE Config ====
 ==Create Trustpoint for self signed CUBE certificate==
 <code>
@@ Line 42: / Line 87: @@
 </code>
- ===export the Self Signed Certificate===
+===Export the Self Signed Certificate===
+  *Copy the output between the -----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- into a text file and save as a .cer file.
 <code>
 CUBE-A(config)#crypto pki export CUBE-A.mydomain.com pem terminal
@@ Line 78: / Line 125: @@
 CUBE-A(config)#
+</code>
 === Import all CallManager Nodes Certs onto the CUBE which will send or receive calls===
@@ Line 145: / Line 193: @@
 </code>
-=== Enable Router to listen on TCP port 5061 & use its self signed Certificate===
+=== Configure SIP to use the Trustpoint Self Signed Certificate===
 <code>
 CUBE-A(config)#sip-ua
-CUBE-A(config-sip-ua)#transport tcp tls
 CUBE-A(config-sip-ua)#crypto signaling default trustpoint CUBE-A.mydomain.com
 </code>
+=== Configure a TLS SIP Options Profile ===
+<code>
+!
+voice class sip-options-keepalive 3
+ description ### TLS SIP options PING ###
+ down-interval 10
+ up-interval 10
+ retry 3
+ transport tcp tls
+!
+</code>
+=== Update Dial-peers to/from CUCM ===
+  * to use TLS (the 'session transport' command)
+  * to use the new SIP options over TLS profile '3' - configured above
+<code>
+dial-peer voice 2500 voip
+ description ### to CUCM ###
+ translation-profile outgoing CUCM
+ huntstop
+ destination-pattern +3530000000000
+ session protocol sipv2
+ session transport tcp tls
+ session server-group 2000
+ voice-class codec 1
+ voice-class sip options-keepalive profile 3
+ voice-class sip bind control source-interface GigabitEthernet0/0/2
+ voice-class sip bind media source-interface GigabitEthernet0/0/2
+ dtmf-relay rtp-nte
+ no vad
+!
+dial-peer voice 9500 voip
+ description ### from CUCM ###
+ session protocol sipv2
+ session transport tcp tls
+ destination dpg 9000
+ incoming uri via CUCM
+ voice-class codec 1
+ voice-class sip early-offer forced
+ voice-class sip bind control source-interface GigabitEthernet0/0/2
+ voice-class sip bind media source-interface GigabitEthernet0/0/2
+ dtmf-relay rtp-nte
+ no vad
+</code>
+==== CUCM Config ====
+=== Upload CUBE Self Signed Cert to CUCM ===
+Make sure to upload as a **CallManager-Trust** Certificate - as per below screenshot.\\
+{{:vendors:cisco:uc:cube:cube-a.png?400|}}
+**The GUI informs you to restart the CUCM Service after uploading this certificate, but you do not need in this case**
+=== Create SIP Security Profile for each CUBE ===
+  *The Subject on the certificate must match what is detailed here.
+{{:vendors:cisco:uc:cube:sip-trunk-securityprofile.png?400|}}
+=== Update CUCM SIP Trunk===
+  * Edit the SIP trunk to make the destination Port 5061 (instead of 5060).
+  * Assign the Dedicated CUBE Security profile configured in previous step
+  * Recommend you configure a SIP Profile which includes SIP options PINGs (I would recommend for all SIP Trunks).
+  * Reset the SIP Trunk (and I found I had to reset the Security Profile).
+===== Troubleshooting Commands =====
+<code>
+debug crypto pki api
+debug crypto pki callbacks
+debug crypto pki messages
+debug crypto pki transactions
+debug ssl openssl errors
+debug ssl openssl msg
+debug ssl openssl states
+debug ip tcp transactions
+debug ccsip verbose
+</code>
 ===== Regeneration of Certs =====