Introduction
This document covers the configuration procedure to implement endpoint hardening for securing Cisco Unified Communications Manager devices against various forms of attacks and vulnerabilities. Deploying a VoIP infrastructure introduces a new set of challenges and Securing Unified Communications allows the phones to communicate over the secure real time protocol and prevent access from allowing unsecured devices.
Implementing endpoint hardening on CUCM
Endpoint hardening can provide greater protection from various forms of attacks.
To harden an endpoint from various forms of attacks and vulnerabilities, perform the following:
1. Navigate to the endpoint to be hardened on the Cisco Unified Communications Administration page: Device --> Phone
2. Under the Product Specific Configuration Layout section, enable or disable the following fields as required:
Based on your requirement you can disable the fields which are not required. Those that are not required can be disabled as part of endpoint hardening.
This prevents the users from connecting a computer to the network by way of this port, useful for disabling the phones connected in lobby/reception area.
- Settings Access - Disabled
Disabling access to the settings menu prevents a user from gathering information about the networking, including relevant IP addresses and VLAN information
- Gratuitous ARP - Disabled
- PC Voice VLAN Access – Disabled
Disabling the PC Port VLAN access, prevent users connected to the phone from sniffing voice traffic. This feature can be useful for administrators when troubleshooting, but in general should be disabled and enabled on an as-needed basis.
- Video capabilities – Disable
- Auto Line select - Disabled
- Web Access - Disabled
3. Click --> Save.
4. Click --> Reset.
5. Repeat these steps for each endpoint that requires hardening.
By doing this we can increase the security of our setup and prevent our phones from attacks such as Gratuitous ARP poisoning.
Related Information
· Cisco Unified Communications Manager Administration Guide, Release 8.5(1)
