Nortel SMC 2450, Implementation Manual

Page: 124 / 262

Page 124 of 260 Secure UNIStim deployment
553-3001-225 Standard 1.00 May 2006
By default, the SMC keeps all IP client in an insecure mode. This allows the
administrator to control the Secure Unistim roll-out so that licences are not
exceeded.
When the SMC is first installed, three standard policies are created:
• insecure: does not try to upgrade phones to Secure UNIStim or push the
key fingerprints to the IP phones.
• secure: tries to upgrade IP phones that are not configured for security to
Secure UNIStim and push the key fingerprint of the primary key to the
IP phone. Any IP phones that do not support security are allowed to
access the signaling server using normal UNIStim.
• maxsecure: this policy works the same as secure, except that IP phones
that cannot be upgraded to security are denied access to the signaling
server.
The default rule in the SMC maps a network called voip_users to a nonsecure
Policy. The Client Rules can be viewed in the Web UI at:
Multimedia
Security > UNIStim Security > Client > Rules.
Security policy example
In this example, the Finance Network requires a high level of security (the
secure policy), while Sales requires less security (the nonsecure policy).
IMPORTANT!
To add enhanced security for all IP phones protected by a given policy,
client security is required. UNIStim phones with firmware that does not
support security, such as the IP Softphone 2050 and the WLAN
handsets 2210 and 2211, needs a policy that does not require UNIStim
security. See “Security policy example” on
page 124 for an example of
how security policies work.
For these phones, set the policy to Required Security = false . These
unsupported IP phones are then allowed to pass through as unsecure,
even though the SMC tries to upgrade them. For more information about
unsupported IP phone firmware, see “IP client firmware management”
on
page 151 .