Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1296 / 2164

1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Cisco Unified Presence
Configuring Cisco Unified Presence Proxy for SIP Federation
What to Do Next
Once you have created the trustpoints and installed the certificates for the local and remote entities on
the ASA, create the TLS proxy instance. See
Creating the TLS Proxy Instance, page 1-12 .
Creating the TLS Proxy Instance
Because either server can initiate the TLS handshake (unlike IP Telephony or Cisco Unified Mobility,
where only the clients initiate the TLS handshake), you must configure by-directional TLS proxy rules.
Each enterprise can have an ASA as the TLS proxy.
Create TLS proxy instances for the local and remote entity initiated connections respectively. The entity
that initiates the TLS connection is in the role of “TLS client”. Because the TLS proxy has a strict
definition of “client” and “server” proxy, two TLS proxy instances must be defined if either of the
entities could initiate the connection.
Step 8
hostname(config-ca-trustpoint)# exit
Exits from the CA Trustpoint configuration mode.
Step 9
hostname(config)# crypto ca authenticate trustpoint
Example:
hostname(config)# crypto ca authenticate ent_y_ca
Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line
by itself
MIIgAwIBAgIQKVcqP/KW74JbRTANBgkqhkiG
9w0BAQUFADCB
[ certificate data omitted ]
/7QEM8izy0EOTSErKu7Nd76jwf5e4qttkQ==
Installs and authenticates the CA certificates
associated with a trustpoint created for the local
entity.
The ASA prompts you to paste the base-64
formatted CA certificate onto the terminal.
Command Purpose
Command Purpose
Step 1
! Local entity to remote entity
hostname(config)# tls-proxy proxy_name
Example:
hostname(config)# tls-proxy ent_x_to_y
Creates the TLS proxy instance.
Step 2
hostname(config-tlsp)# server trust-point proxy_name
Example:
hostname(config-tlsp)# server trust-point
ent_y_proxy
Specifies the proxy trustpoint certificate presented
during TLS handshake.
The certificate must be owned by the ASA (identity
certificate).
Where the proxy_name for the server trust-point
command is the remote entity proxy name.
Step 3
hostname(config-tlsp)# client trust-point
proxy_trustpoint
Example:
hostname(config-tlsp)# client trust-point ent_x_cert
Specifies the trustpoint and associated certificate
that the ASA uses in the TLS handshake when the
ASA assumes the role of the TLS client.
The certificate must be owned by the ASA (identity
certificate).
Where the proxy_trustpoint for the client
trust-point command is the local entity proxy.