topic CAPF/CTL on IP Phones in Wireless

CAPF/CTL on IP Phones

kfarrington — Sun, 04 Jul 2021 00:57:02 GMT

Hi Guys,

Can you use the CAPF/CTL features to provision and update digital certificates on 7921/7925 phones?

Has anyone every used it for such purpose?

Many thx indeed,

Ken

Re: CAPF/CTL on IP Phones

migilles — Mon, 17 Aug 2009 19:31:42 GMT

Yes 7921/7925 supports CTL and can push a LSC to the phone via CAPF.

The 7921/7925 phones also come with a MIC as well.

See the 7921/7925 Deployment Guide for more info.

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7921g/6_0/english/deployment/guide/7921dply.pdf

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7925g/7_0/english/deployment/guide/7925dply.pdf

Re: CAPF/CTL on IP Phones

kfarrington — Tue, 18 Aug 2009 08:08:13 GMT

Hi mate,

This is excellent news.

Can I just ask as the deployment guide has excellent info and the CUCM security guide has some but not a great deal?

The initiall install of certs will always have to be via USB so the phone can auth onto the WLAN. Correct?

Can the CAPF function renew certs before they expire?

Many thx indeed,

Ken

Re: CAPF/CTL on IP Phones

migilles — Tue, 18 Aug 2009 18:50:31 GMT

Thanks for the compliments on the DG.

Yes for certificates to be used for WLAN authentication with PEAP or EAP-TLS, they must be installed via the phone webpage, which can be done via USB or over the air.

CAPF is not used for WLAN certificates currently.

Re: CAPF/CTL on IP Phones

kfarrington — Wed, 19 Aug 2009 11:17:13 GMT

Hi Michael, Can I just confirm the last statement.

Yes we will load the certs via USB etc etc on the phone, and then they will connect to the WLAN.

After that, CAPF can be used to renew certs on the wireless IP phones, correct?

Sorry if I am mis-understanding mate 🙂

Cheers

Ken

Re: CAPF/CTL on IP Phones

migilles — Wed, 19 Aug 2009 16:12:52 GMT

No can not renew WLAN certs via CAPF.

CAPF certs (LSC) are for media, signaling and tftp encryption.

Currently WLAN cert management is manual, so if planning to use EAP-TLS with user certs signed by your CA then want to ensure you set an adequate validity period.

You can also use the MIC in the phone for WLAN authentication.

That info is in the deployment guide.