CUCM VPN Profile

[MrButton]

Question for those running a VPN for teleworkers. 

How are you doing your Client authentication method and authorization setup?

Are you doing certificate base only?  Do you have ISE doing authorization? 

I tested the certificate method which works great, but I want to make sure I am following a best practice for security.

The VPN profile on the firepower is certificate base to allow the phone vpn profile to connect over the internet to CUCM only publishing the collaboration networks in the split tunnel.

I appreciate any information and documentation.

[Roger Kallberg]

With the introduction of Mobile Remote Access many years ago I think that there aren’t that many still using phone VPN. Are there any specific reason for why you want to use phone VPN instead of the more common and a lot easier to use MRA?

[MrButton]

I did MRA at a previous place before with a contractor.  At that time I felt MRA had more overhead with maintenance and additional resources for a server (vmware).  I would always run into issues with MRA whether it was QoS or just one way communication.  It had very low usage at the place I was at, so I did not spend too much time troubleshooting the MRA platform. 

Where I am now there are a lot more teleworkers that require an IP hard phone for home.  I suggested we do Jabber over VPN but infosec dept denied it.  I see VPN with less overhead, because I already have the Firepower FMC and ISE in place.  If I were to go MRA I'd need to allocate VMware resources and still have ISE authorizing the IP Phone.

In my sandbox UCS, Firepower, VPN environment I tested VPN on the phone profile.  It works great certificate base authentication.  I just need to add the layer of security with ISE.  

I was able to catch up with some CVDs.  I found one that discusses 802.1x for IP telephony.  Good stuff.  This looks like the route I need to take using the LSC similar to how I labbed the sandbox VPN.  I bet I just have a few steps to implement between UCS and ISE having the Firepower VPN profile do the authorization through ISE. 

Did folks move towards MRA because of the AnyConnect licensing? 

[Roger Kallberg]

With MRA there is no correlation with ISE. The authentication is done by CM. The most user friendly UX is where a registration code, created in device configuration in CM, is used.

[Wilson Samuel]

In the long run, MRA turns out to be much cheaper and easier to manage and maintain (once the FW rules are in place you are good to go).

I have had few deployments with MRA and they all work without any issues. You will need atleast 1 Public CA signed certificates, and access to Public DNS entries (for your org).  You could test your MRA config on the Collaboration Solutions Analyzer page to verify most of the configuration issues.

URL for CSA https://cway.cisco.com/csa-new/#/home

HTH

Wilson Samuel

[MrButton]

So once it reaches MRA and pass the network how does the security work besides SSL?  May be I am over thinking this proposed topology.  I just don't want to introduce vulnerabilities.  There have been and will continue to have too many sponsored attacks.