I wrote a TCL script to completely automate the secure CME configuration. The configuration of secure CME is quite complex, requiring around 60 lines of configuration. This should alleviate the current pain points with the secure CME configuration.
Purpose
The configuration of secure CME is quite intensive, and there are several commands which require configuration in a specific sequence. Some of which won't even show up in the final configuration. The purpose of this script is to alleviate the burden for customers to configure secure CME by completely automating the entire secure CME configuration procedure.
Requirements
- A CME device with phones registered to it.
- CME running a feature set that supports secure CME.
- CME currently has no secure CME configuration present before running script (no IOS CA, and no trust points named ca, cme, or sast2).
- Phones do not currently have a CTL or LSC loaded before running script.
- Script has not been previously run on this box. Partial/existing configuration of trustpoints/CA will likely cause issues.
Caveats
Some firmware versions have issues pulling LSCs. See the README for more information, but I'd be interested if you come across non-working firmware versions so that I can document accordingly.
The script does very limited error checking. Ensure that you read the documentation before running so that you understand correct operation before executing.
Procedure
1. Copy securecme.tcl to router.
2. Configure the following parameters:
conf t
event manager directory user policy "flash:/"
event manager policy securecme.tcl
event manager environment password <password key for CA/certs>
event manager session cli username <aaa-username>
======> Password key must be 8+ characters and meet password requirements of IOS CA.
======> The last line is only necessary if AAA is running. Specific a user with rights
to run show commands. A password does not need to be specified for the user.
Sample Configuration:
event manager directory user policy "flash:/"
event manager policy securecme.tcl
event manager environment password cisco123
event manager session cli username sholl
3. Ensure that time is correct on the router and phones:
- Router clock is set properly before executing script; verify with 'sh clock'
- Router clock timezone is set properly before executing script; verify with 'sh run | i timezone'
- CME Time-zone is set properly before executing script; verify with 'sh telephony-s | i time'
4. Ensure that ip domain-name has been defined.
5. Ensure that phones do not have a CTL or LSC already installed. If so, factory reset those phones before running script.
6. Ensure that phone is running recent firmware and has the the 'type' defined under the ephone. Some firmware has issues with LSC provisioning. See the README for more information on this.
7. Save configuration before running script. If script's secure CME provisioning is unsuccessful, simply reload the router (and delete the CTL files off each phone, if applicable).
8. Type 'securecme' in exec mode to run the script.
89 Observe 'sh log | i ---' to observe output. System wide messages will print at start and finish of script.
10. If provisioning is not successful and script needs to be re-run, reload router before re-running to clear out partially provisioning security settings. Clear CTL/LSC from phones (if applicable).
Assumptions Made
- CME is already configured, and phones are registered unencrypted. Ensure phones are configured with the 'type' command under each ephone.
- Router is running a featureset which supports Secure CME (securityk9+uck9 or advipservicesk9 or adventerprisek9)
- Router may need to have a UC and security feature license activated:
- Router clock is set properly before executing script; verify with 'sh clock'
- Router clock timezone is set properly before executing script; verify with 'sh run | i timezone'
- CME Time-zone is set properly before executing script; verify with 'sh telephony-s | i time'
- 'password' is defined in the EEM configuration as a 8+ character password and meets the specifications of IOS CA requirements.
- Script has not been previously run on this device (previous partial configuration of CA, trustpoints, CTL, etc. will probably create conflicts.)
- The device is currently not configured with IOS CA, nor with a self-signed certificate. (i.e. Run this on a clean normal non-secure CME configuration).
- Phones do not currently have a CTL or LSC on them before running the script. Factory reset the phone if you are unsure of the presence of such. (Hold #, plug in cable, wait for lights to blink, hit 123456789*0#).
- Phones are running recent firmware. Testing of script was successful on 15.2(2)T with multiple phone models, running 9.1.1SR1 (newer phones) and 8.1.2 (7960).
Downloading the script
See the securecmeTCL.zip file attached to the bottom of this post.
The current version is v1.4 - 1/13/2011.
Troubleshooting
Please read the README and the TCL header before running the script to avoid incorrect operation.
One can observe the logging buffer output for current status of script. Run 'debug event manager all' during script operation for details on what the script is doing.
If you run into issues with the script for which you would like me to take a look at, I will require the following information:
- Output of the following information before running script:
- sh run
- sh ephone ph
- sh clock
- 'debug event manager all' enabled before running script, with 'logging buffered 10000000 7' set.
- Output of the following after script is run:
- sh log
- sh run
- sh capf-server sum
- sh ctl-client
- sh telephony-service tftp
- sh ephone reg
