CUCM-CUBE TLS SIP Trunk

This is an old revision of the document!

What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s)

Reference: https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/212090-Configure-SIP-TLS-between-CUCM-CUBE-CUBE.html

Summary Steps

Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct.
Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License
Import CallManager Cert (note: not the Tomcat cert) for each CUCM Node into CUBE
- Note - you could get CallManager Certs signed by CA - meaning only the CA cert should need to be imported - but usually means you have to redo certs every 2 years. Self Signed Certs last 5 years. See this guide
Create a Cert for the CUBE and export, then import into CUCM - with a CN equal to the routers FQDN, e.g. cubeA.mydomain.com
CUCM - Create a Security Profile which has subject line of CUBE and assign to the SIP trunk - also set the IP address and port of the CUBE as 5061
Enable SIP Option Pings - with a SIP profile
Enable tcp tls on the sip-ua (so CUBE listens on 5061)
Create a SIP Options Profile with tls and assign to the Outbound Going CUCM dial-peer
Same Config Below!

Create Trustpoint for self signed CUBE certificate

CUBE-A(config)#crypto pki trustpoint CUBE-A.mydomain.com
CUBE-A(ca-trustpoint)# enrollment selfsigned
CUBE-A(ca-trustpoint)# serial-number none
CUBE-A(ca-trustpoint)# fqdn none
CUBE-A(ca-trustpoint)# ip-address none
CUBE-A(ca-trustpoint)# revocation-check none
CUBE-A(ca-trustpoint)# subject-name cn=CUBE-A.mydomain.com
CUBE-A(ca-trustpoint)# rsakeypair CUBE-A.mydomain.com

Create the certificate for the CUBE

CUBE-A(config)#crypto pki enroll CUBE-A.mydomain.com
% The fully-qualified domain name will not be included in the certificate
Generate Self Signed Router Certificate? [yes/no]: yes

Router Self Signed Certificate successfully created

CUBE-A(config)#

export the Self Signed Certificate

CUBE-A(config)#crypto pki export CUBE-A.mydomain.com pem terminal
% Self-signed CA certificate:
-----BEGIN CERTIFICATE-----
MIICNDCCAZ2gAwIBAgIBATANBgkqhkiG9w0BAQUFADAjMSEwHwYDVQQDExhDVUJF
LlhakjhmAgMBAAGjeDB2MA8GA1UdEwEB/MAgMBAAGjeDB2MA8GA1UdEwEB/xMDAw
MDAwWjAjMSEwHwYDVQQDExhDVUJFLUEudmhpaGVhbHRoY2FyZS5uZXQwgZ8wDQYJ
KoZIhvcNABaNanaQgY0AMIGJAoGBALF79FOfyGAHaJgRuhehzSFX6/Gop8/vwGuq
TOxWLySHaZ/5NpD4K67DoZJriDAfBC/j1KLkF6YK9LeFvEGkvgc0y/PjZx3/wMTj
k059THE0CNvvMCxZY66NXvsWlBajX1dhcd6LdevPSPe8UpR/hmdF0Iyuy3HTzKzk
r7qkdc3JAgMBAAGjeDB2MA8GA1UdEwEB/wQFMAMBAf8wIwYDVR0RBBwwGoIYQ1VC
RS1BLnZoaWhlYWx0aGNhcmUubmV0MB8GA1UdIwQYMBaAFJDTla2gcpXY2D0OQ7Tk
a2gcpXY2D0OQTANBgkqhkiG9w0Br7qkdc3JAgMBAAGjeDB2MA8GA1UdEwEBIyuJv
AQUFAAOBgQAgSpp2KdMoraJLhDPqMxJG+WJFMVeM4PXI8AcnjAPvvT72vXZu1hx7
G98QZjaCPCImJNnJAYJuQ2Ivp5IQ0EJv0AynGEwISX0cZ+8GBVe1qF7j2Dpsw8pb
izDlGeJ5yx2mxi2AyndVhnXfpU6b2GKMz46FmzZfSeqW3QUzTLNM7w==
-----END CERTIFICATE-----

% General Purpose Certificate:
-----BEGIN CERTIFICATE-----
MIICNDCCAZ2gAwIBAgIBATANBgkqhkiG9w0BAQUFADAjMSEwHwYDVQQDExhDVUJF
LlhakjhmAgMBAAGjeDB2MA8GA1UdEwEB/MAgMBAAGjeDB2MA8GA1UdEwEB/xMDAw
MDAwWjAjMSEwHwYDVQQDExhDVUJFLUEudmhpaGVhbHRoY2FyZS5uZXQwgZ8wDQYJ
KoZIhvcNABaNanaQgY0AMIGJAoGBALF79FOfyGAHaJgRuhehzSFX6/Gop8/vwGuq
TOxWLySHaZ/5NpD4K67DoZJriDAfBC/j1KLkF6YK9LeFvEGkvgc0y/PjZx3/wMTj
k059THE0CNvvMCxZY66NXvsWlBajX1dhcd6LdevPSPe8UpR/hmdF0Iyuy3HTzKzk
r7qkdc3JAgMBAAGjeDB2MA8GA1UdEwEB/wQFMAMBAf8wIwYDVR0RBBwwGoIYQ1VC
RS1BLnZoaWhlYWx0aGNhcmUubmV0MB8GA1UdIwQYMBaAFJDTla2gcpXY2D0OQ7Tk
a2gcpXY2D0OQTANBgkqhkiG9w0Br7qkdc3JAgMBAAGjeDB2MA8GA1UdEwEBIyuJv
AQUFAAOBgQAgSpp2KdMoraJLhDPqMxJG+WJFMVeM4PXI8AcnjAPvvT72vXZu1hx7
G98QZjaCPCImJNnJAYJuQ2Ivp5IQ0EJv0AynGEwISX0cZ+8GBVe1qF7j2Dpsw8pb
izDlGeJ5yx2mxi2AyndVhnXfpU6b2GKMz46FmzZfSeqW3QUzTLNM7w==
-----END CERTIFICATE-----

CUBE-A(config)#

=== Import all CallManager Nodes Certs onto the CUBE which will send or receive calls===
  * Download the **Callmanager** cert (not tomcat certs) from **each** CUCM node which you are sending / receiving calls from.
  * Note the expiry date of the certs (5 years from first created) - if necessary regenerate certs in advance so certs last for 5 years - note - this is service impacting as requires restarting of services - see above notes

Example below for one CUCM Node

  *Create trustpoint
<code>
Enter configuration commands, one per line.  End with CNTL/Z.
CUBE-A(config)#crypto pki trustpoint uc-cucm-sub-1a.mydomain.com
CUBE-A(ca-trustpoint)# enrollment terminal
CUBE-A(ca-trustpoint)# revocation-check none

Import Certificate

CUBE-A(config)#crypto pki authenticate uc-cucm-sub-1a.mydomain.com

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIID0TCCArmgAwIBAgIQWgh0k4uyHCX1X6MzuUVPJDANBgkqhkiG9w0BAQsFADB9
MQswCQYDVQQGEwJJRTEMMAoGA1UECgwDVkhJMREwDwYDVQQLDAhUZWxlY29tczEp
MCcGA1UEAwwgVUMtQ1VDTS1TVUItMUEudmhpaGVhbHRoY2FyZS5uZXQxETAPBgNV
BAgMCExlaW5zdGVyMQ8wDQYDVQQHDAZEdWJsaW4wHhcNMTYwODA4MTUxNDAzWhcN
MjEwODA3MTUxNDAyWjB9MQswCQYDVQQGEwJJRTEMMAoGA1UECgwDVkhJMREwDwYD
Vbott0mbAnNaBaNaNasB00PBo5sEAwwgVUMtQ1VDTS1TVUItMUEudmhpaGVhbHRo
Y2FyZS5uZXQxETAPBgNVBAgMCExlaW5zdGVyMQ8wDQYDVQQHDAZEdWJsaW4wggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzXdBYGES6JwDXXtlNPLh3TI8L
spH0+pA7Zc5GdjSTUNGqcLqNI+bOD8iynIo2wXyaK8D30qkP4H58uGHZqeWUUBTD
ZX/mei7fNKpXn0PfNUaj/ne8DhovIJnI1jrtBcV6zsxW7LRnew2yuXhZ13+LlpS5
se6hdnXcYSnh5hQcIuMRTU/E6B+OI2Xkd2W9SmeznJGwXvYYJwRT7yo8i5WYHb/b
mXzIzeW41gc23vkyU5dNeDwUNfets8vNAN9PwM6559jSCGQgX20WetnlQn5NHk25
SQh3XoAZdIy3ZQFFkEYIAE6DhNjkKeqATC6kuLVSWVm4mosu8pT6Mlp+L9XzAgMB
AAGjTTBLMAsGA1UdDwQEAwICtDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
AwIwHQYDVR0OBBYEFJm6E+cGQACVadgUvdqneg5n++3PMA0GCSqGSIb3DQEBCwUA
A4IBAQCzU/OjoZGYBOPULf4OkxW3bOmI5zhpbXm3BWCo20QeIfTPaM/v85n5eYN9
BBNlawztvottcR7YH4yhz5wMn5ICPWiqacEumIfoxnz9v7hQeSDpgJ0MoMHarFgB
ThPuDsPZQV5qK73KIm0DNNcbFO1G1OiEcXenKqEIhnSvPxRZD8KZOWlc2OhWhPLk
l6MOzMzEcQRDdMY5TpoWj4OBtrGIRFbJ1IfDb3AtMKyxkQF4lLvUy7K8skjymr8H
qL6hJqkwlsCPiVu6Oi4Q9Y85kl8m3MwA6f367rc2k+iIPAt3h7QwldgC2d5VJFJk
hawnxjo0viK5yXidux79c/fu++3r
-----END CERTIFICATE-----

Certificate has the following attributes:
       Fingerprint MD5: FFA5B2F6 7058E607 AAE0F1BC 8D1C1972
      Fingerprint SHA1: B7332EB9 1EB2BEDB 9F7B1963 7A219D1D BE5F4125

% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
% Certificate successfully imported

Enable Security License

Note: Make sure you are entitled to have a security license on the CUBE - if not purchase one. This command requires the CUBE to be reloaded to take effect.

CUBE-A(config)#license boot level securityk9
% use 'write' command to make license boot config take effect on next boot

CUBE-A(config)#
CUBE-A#wr

Enable Router to listen on TCP port 5061 & use its self signed Certificate

CUBE-A(config)#sip-ua
CUBE-A(config-sip-ua)#transport tcp tls
CUBE-A(config-sip-ua)#crypto signaling default trustpoint CUBE-A.mydomain.com

After regeneration of CallManager Certs

Restart Cisco Callmanager Service and other relevant services including Cisco CTI Manager for the regenerated certificates to become active.
When regenerating on TFTP Servers - see above Cisco link
- Stop TFTP A Service,
- Regenerate TFTP A Cert,
- Reset phones (so they use B side TFTP)
- Restart CUCM Services & CTI
- Restart TFTP A Service
- Repeat on B side