Cisco SPA901-UK Provisioning Guide - Page 17

Using HTTPS, Provisioning Cisco Small Business VoIP Devices, HTTPS

Get Cisco SPA901-UK - Small Business Pro PDF manuals and user guides
UPC - 745883570751
View all Cisco SPA901-UK manuals
Add to My Manuals
Save this manual to your list of manuals

Page 17 highlights

Provisioning Cisco Small Business VoIP Devices Using HTTPS 1 Flow Step SEC-PRV-1 Secure Provisioning-Initial Configuration SEC-PRV-2 Secure Provisioning-Full Configuration Step Description The initial device-unique CFG file is targeted to each IP Telephony device by compiling the CFG file with the spc -target option. This provides an initial level of encryption that does not require the exchange of keys. The initial device-unique CFG file reconfigures the profile parameters to enable stronger encryption by programming a 256-bit encryption key and pointing to a randomly-generated TFTP directory. For example, the CFG file might contain: Profile_Rule [--key $A] tftp.callme.com/profile/$B/ spa962.cfg; GPP_A 8e4ca259...; # 256 bit key GPP_B Gp3sqLn...; # random CFG file path directory Subsequent profile resync operations retrieve 256-bit encrypted CFG files that maintain the IP Telephony device in a state synchronized to the provisioning server. All remaining parameters are configured and maintained through this strongly encrypted profile. The encryption key and random directory location can be changed periodically for extra security. Using HTTPS The IP Telephony device provides a reliable and secure provisioning strategy based on HTTPS requests from the device to the provisioning server. Both a server certificate and a client certificate are used to authenticate the IP Telephony device to the server and the server to the IP Telephony device. To use HTTPS, you must generate a Certificate Signing Request (CSR) and submit it to Cisco. Cisco generates a certificate for installation on the provisioning server. The IP Telephony device accepts the certificate when it seeks to establish an HTTPS connection with the provisioning server. This procedure is described in the "HTTPS" section on page 26. Cisco Small Business IP Telephony Devices Provisioning Guide 16

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
Provisioning Cisco Small Business VoIP Devices
Using HTTPS
Cisco Small Business IP Telephony Devices Provisioning Guide
16
1
Using HTTPS
The IP Telephony device provides a reliable and secure provisioning strategy
based on HTTPS requests from the device to the provisioning server. Both a
server certificate and a client certificate are used to authenticate the IP Telephony
device to the server and the server to the IP Telephony device.
To use HTTPS, you must generate a Certificate Signing Request (CSR) and submit
it to Cisco. Cisco generates a certificate for installation on the provisioning server.
The IP Telephony device accepts the certificate when it seeks to establish an
HTTPS connection with the provisioning server. This procedure is described in the
“HTTPS” section on page 26
.
SEC-PRV-1
Secure
Provisioning—Initial
Configuration
The initial device-unique CFG file is targeted to each IP
Telephony device by compiling the CFG file with the
spc --
target
option. This provides an initial level of encryption that
does not require the exchange of keys.
The initial device-unique CFG file reconfigures the profile
parameters to enable stronger encryption by programming a
256-bit encryption key and pointing to a randomly-generated
TFTP directory. For example, the CFG file might contain:
Profile_Rule [--key $A] tftp.callme.com/profile/$B/
spa962.cfg;
GPP_A 8e4ca259…;
# 256 bit key
GPP_B Gp3sqLn…;
# random CFG file path directory
SEC-PRV-2
Secure
Provisioning—Full
Configuration
Subsequent profile resync operations retrieve 256-bit
encrypted CFG files that maintain the IP Telephony device in a
state synchronized to the provisioning server.
All remaining parameters are configured and maintained
through this strongly encrypted profile. The encryption key and
random directory location can be changed periodically for extra
security.
Flow Step
Step Description