Cisco 7921G Administration Guide - Page 89

Chapter 4 Using the Cisco Unified Wireless IP Phone 7921G Web Pages Configuring Network Profiles Related Topics • Configuring IP Network Settings, page 4-25 • Configuring the Alternate TFTP Server, page 4-26 • Configuring Advanced Network Profile Settings, page 4-27 Installing Authentication Certificates for EAP-TLS Authentication EAP-TLS is a certificate based authentication that requires a trust relationship between two or more entities. Each entity has a certificate proving its identity and is signed by a trusted authority. These certificates are exchanged and verified during EAP-TLS authentication. Note The EAP-TLS certificate based authentication requires that the internal clock on the Cisco Unified Wireless IP Phone 7921G be set correctly. Use the phone web page to set the clock on the phone before using EAP-TLS authentication. To use EAP-TLS, both the Cisco Unified Wireless IP Phone 7921G and the Cisco Secure Access Control Server (ACS) must have certificates installed and configured properly. If your wireless network uses EAP-TLS for authentication, you can use the Manufacturing Installed Certificate (MIC) or a user installed certificate for authentication on the phone. Manufacturing Installed Certificate Cisco has included a Manufacturing Installed Certificate (MIC) in the phone at the factory. During EAP-TLS authentication the ACS server needs to verify the trust of the phone and the phone needs to verify the trust of the ACS server. To verify the MIC, the Manufacturing Root Certificate and Manufacturing Certificate Authority (CA) Certificate must be exported from a Cisco Unified Wireless IP Phone 7921G and installed on the Cisco ACS server. These two certificates are part of the trusted certificate chain used to verify the MIC by the Cisco ACS server. To verify the Cisco ACS certificate, a trusted subordinate certificate (if any) and root certificate (created from a CA) on the Cisco ACS server must be exported and installed on the phone. These certificate(s) are part of the trusted certificate chain used to verify the trust of the certificate from the ACS server. User Installed Certificate To use a user installed certificate, a Certificate Signing Request (CSR) must be generated on the phone, sent to the CA for approval, and the approved certificate installed on the Cisco Unified Wireless IP Phone 7921G. During EAP-TLS authentication, the ACS server needs to verify the trust of the phone and the phone needs to verify the trust of the ACS server. To verify the authenticity of the user installed certificate, a trusted subordinate certificate (if any) and root certificate from the CA that approved the user certificate must be installed on the Cisco ACS server. These certificate(s) are part of the trusted certificate chain used to verify the trust of the user installed certificate. To verify the Cisco ACS certificate, a trusted subordinate certificate (if any) and root certificate (created from a CA) on the Cisco ACS server must be exported and installed on the phone. These certificate(s) are part of the trusted certificate chain used to verify the trust of the certificate from the ACS server. OL-15985-01 Cisco Unified Wireless IP Phone 7921G Administration Guide for Cisco Unified Communications Manager Release 7.0 4-19