簡介
本檔案介紹安全加密的組態 VG224類比網關上的信令連線控制部分(SCCP)。
必要條件
需求
思科建議您瞭解以下主題：
- SCCP
- VG224
- 思科整合通訊管理員(CUCM)
採用元件
本檔案中的資訊是根據以下軟體版本：
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
設定
步驟1.將callmanager.pem證書複製到VG224（在下面的配置中稱為SECURE信任點）
步驟2.在VG224上建立一個自簽名證書，其MAC地址為FastEthernet0/0（繫結介面），主題名稱僅使用最後10位數字。
步驟3.將vg-cert作為呼叫管理器信任複製到CUCM並重新啟動CUCM。
提供配置VG224所需的證書的資訊。
Router(config)#crypto key generate rsa general-keys label vg modulus 1024
Router(config)#crypto pki trustpoint vg
Router(ca-trustpoint)#enrollment selfsigned
serial-number none
fqdn none
ip-address none
subject-name cn=1A:E2:85:7B:E2 <----- Last 10 DIGITS ONLY of the SCCP bind interface. Formatting EXACTLY as shown with colons.
rsakeypair vg
crypto pki enroll vg
Router(config)#crypto pki export vg_cert pem terminal
提示：命令參考指南
附註：由於CSCti08882警告，在從安全VG224模擬電話呼叫安全IP電話時，看不到鎖定圖示
驗證
此資訊用於驗證VG224成功註冊
Router#show sccp
SCCP Admin State: UP
Gateway Local Interface: FastEthernet0/0
IPv4 Address: 14.1.97.95
Port Number: 2000
IP Precedence: 5
User Masked Codec list: None
Call Manager: 172.18.172.204, Port Number: 2000
Priority: N/A, Version: 7.0, Identifier: 1
Trustpoint: N/A
Call Manager: 172.18.172.205, Port Number: 2000
Priority: N/A, Version: 7.0, Identifier: 2
Trustpoint: N/A
Call Manager: 172.18.172.206, Port Number: 2000
Priority: N/A, Version: 7.0, Identifier: 3
Trustpoint: N/A
AutoCfg_Virtual_Endpoint Oper State: ACTIVE - Cause Code: NONE
Active Call Manager: 172.18.172.204, Port Number: 2000
TCP Link Status: CONNECTED, Device Name: AN1AE2857BE2FFF
Reported Max Streams: 0, Reported Max OOS Streams: 0
Supported Codec: g711ulaw, Maximum Packetization Period: 20
Alg_Phone Oper State: ACTIVE - Cause Code: NONE
Active Call Manager: 172.18.172.204, Port Number: 2443
TCP Link Status: CONNECTED, Device Name: AN1AE2857BE2400
Security
Signaling Security: ENCRYPTED TLS
Media Security: SRTP
Supported crypto suites :AES_CM_128_HMAC_SHA1_32
Reported Max Streams: 1, Reported Max OOS Streams: 0
Supported Codec: rfc2833 dtmf, Maximum Packetization Period: 30
Supported Codec: g711ulaw, Maximum Packetization Period: 20
Supported Codec: g711alaw, Maximum Packetization Period: 20
Supported Codec: g729r8, Maximum Packetization Period: 220
Supported Codec: g729ar8, Maximum Packetization Period: 220
Supported Codec: g729br8, Maximum Packetization Period: 220
Supported Codec: g729r8, Maximum Packetization Period: 220
Supported Codec: ilbc, Maximum Packetization Period: 120
TLS : ENABLED
這顯示使用SCCP IOS配置的安全VG224。
Building configuration...
Current configuration : 5258 bytes
!
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot system slot0:vg224-i6k9s-mz.151-4.M3
boot-end-marker
!
!
enable secret 5 $1$f99B$PWPClPrUNzgsUZEO8aBYG.
!
no aaa new-model
crypto pki token default removal timeout 0
!
crypto pki trustpoint SECURE
enrollment terminal
revocation-check crl
!
crypto pki trustpoint vg
enrollment selfsigned
serial-number none
fqdn none
ip-address none
subject-name cn=1A:E2:85:7B:E24 ( instead of this command, we can use hiddle command "mac-address Fast Ethernet0/0 as well )
revocation-check crl
rsakeypair AN1AE2857BE2400
!
!
crypto pki certificate chain SECURE
certificate ca 588C9B7C2D4B37F03930E8C926D02A18
<truncated>
crypto pki certificate chain vg
certificate self-signed 03
<truncated>
ip source-route
!
ip cef
ip name-server 172.18.108.43
ip name-server 172.18.108.34
!
!
no ipv6 cef
!
stcapp ccm-group 1
stcapp security trustpoint vg
stcapp security mode encrypted
stcapp
!
stcapp feature access-code
!
stcapp feature speed-dial
!
!
!
stcapp supplementary-services
port 2/0
fallback-dn 862224
!
!
!
!
!
!
!
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 14.1.97.1 254
ip route 0.0.0.0 0.0.0.0 14.1.97.1 254
!
!
!
control-plane
!
!
voice-port 2/0
timeouts initial 60
timeouts interdigit 60
timeouts ringing infinity
!
voice-port 2/1
!
<truncated>
!
voice-port 2/23
!
ccm-manager config server 172.18.172.204
ccm-manager config
ccm-manager sccp local FastEthernet0/0
ccm-manager sccp
!
!
mgcp profile default
!
sccp local FastEthernet0/0
sccp ccm 172.18.172.204 identifier 1 version 7.0
sccp ccm 172.18.172.205 identifier 2 version 7.0
sccp ccm 172.18.172.206 identifier 3 version 7.0
sccp
!
sccp ccm group 1
associate ccm 1 priority 1
associate ccm 2 priority 2
associate ccm 3 priority 3
!
dial-peer voice 999200 pots
service stcapp
securiy mode encrypted =====> Required command
port 2/0
!
dial-peer voice 99920 pots
! service stcapp
securiy mode encrypted =====> Required command
port 2/1
!
!(configure all ports in same secure mode)
!
line con 0
line aux 0
line vty 0 4
password ww
login
transport input all
!
ntp server 172.18.108.15
end
意見