Encryption in CM 4.1.3

[balukr]

I have CM 4.1.3 SR1 and we want to encrypt all the calls between IP phones.

I know for that we have to register the phones with encryption in "Device Security mode" .

I read couple of documents and setup CAPF,Ran CTL client,USB key with security tokens in CM.After some time I was able to register just two phones with encryption and works great.All other phones I tried giving an error "Registration Rejected" .I delete the certificate on Phone still no help.

I tried even new phones it gives the same error.

My question is if I want to add a phone with encryption what is the exact procedure I need to follow so I won't get any error and register the phones without any problem.

If I follow the Cisco document it is little confusing.

As always appreciate your help.

Thanks

Balu

[mciarfello]

I want to try out the encryption and/or authentication, but haven't gotten the USB token yet. Where did you get it from?

Thanks

[balukr]

From Cisco directly.It is separate part list so you have to order separately and you need minimum two keys.

[mciarfello]

Yea, I saw those. I guess I was hoping something different could be used. Actually, the last time I checked, Cisco didn't sell them directly. You needed to go third party.

Thanks for responding.

[pbarman]

Balu,

You have to install the LSC (Locally Significant Certificates) on the IP Phones first before you turn on Encryption for the 7940/7960 Phones.

7970 has MIC (Manufacture Installed Certificates), so depending on your CAPF settings, they may download the LSC successfully and register.

But the 7940 and 7960 phones do not have MIC and you have to install the LSC on those phones first and look at the CAPF status if the certificate install was successful. Once successful, you change the Device Security Mode on the Phone to Encrypted and Reset.

I have set the Enterprise Parameter for Device Security Mode to Non-Secure and changed the Device Security Mode on Phones instead to Encrypted.

Atleast thats the way I did it and got it to work successfully for one of our customers. No problems experienced, it's working like a charm.

Thanks,

Partha

[mwadam]

Partha,

I assume that when you state that you have to install the LSC on the 7940/60 first, that you are using the Security menu on the phone to enter the authentication string manually to install the LSC? This is the only way I have been able to get the 7940/60 to work. Have you found a way to get the LSC on the 7940/60 automatically? I have 500 phones I need to set this up on. Touching each phone individually will really be a slow process.

Thanks!!!

Adam

[jrsteele21]

Adam,

I am trying to find the same answer about installing the LSC automatically to multiple phones. Did you happen to get an answer on that?

thanks