Preventing Cisco IP Phone MAC Spoofing

[shinas]

Hi All,

In call manager is there a mechanism by default that ip phone added in call manager is authenticated to get its config file and only its config file? Or there is something needed to configure on ip phone to make it use only its config file, so any one is trying to spoof this ip phone's mac will be denied from getting that ip phone's config file?

Regards,

Shinas

[Jonathan Schulenberg]

For Cisco phones there isn’t really sensitive stuff in the config file. Your concern would be better phrased as “what prevents a malicious/spoofed device registration?”

For the moment, this is done with certificates-based TLS client authentication. This is a rather involved topic that is covered in the security guide. The phone gets an X.509 certificate from CAPF and uses that in the TLS handshake to prove its identity. Optionally, CUCM can also encrypt the phone’s config file using the public RSA key of that cert. CUCM 12.5 allows CAPF to relay the CSR from a phone to a Microsoft CA if a customer prefers to use that.

Seperately in 12.5 you will notice references to OAuth tokens as an alternative to CAPF and LSCs. This is a major improvement over CAPF. For the moment, this is only supported by Jabber and MRA-registered IP Phones though. I can’t speak to roadmap details but you can imagine this eventually being supported by on-premises endpoints too.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/12_5_1/cucm_b_security-guide-1251.html

[shinas]

---

Hi Jonathan,

I am having CUCM 11.5.

Does this feature works in non-secure mode or should I convert to Mixed Mode for certificates-based TLS client authentication.

Regards,

Shinas

[HARIS_HUSSAIN]

You can enable encryption of the Configuration files and only Phone with valid certificate will be able to decrypt them.

Below link will be helpful

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/8_5_1/secugd/sec-851-cm/secuencp.html


*** Please rate helpful post; Mark "Accept as a Solution" if applicable

Thanks,
Haris

[shinas]

Hi 

I am having CUCM 11.5.1.10000-6 and Phones are 8841 model IP Phone. Will this phone model supports Configuration File Encryption?

Regards,

Shinas

[shinas]

Hi Haris,

Suppose I have a phone with MAC AAAA.BBBB.CCCC. When I connect the phone to the network, it will request tftp server for ITL file and CUCM will provide ITL to the Phone. Next the phone will ask for configuraion file, and CUCM will give configuration with the signature. Next the phone verifies the configuration file has been received from valid CUCM by the public key obtained through ITL file. If the verification in successful, then the phone will get registered.

Then my question is if somebody connect another device to the network and  spoof the MAC AAAA.BBBB.CCCC, it will get the ITL file again from CUCM, and finally it will register to the CUCM after completing the same process. How can we protect this from happening?

Thanks in Advance

Shinas

[George Sotiropoulos]

You can encrypt the Phone' configuration files (digest password etc) by following the guidelines:

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/11_0_1/secugd/CUCM_BK_C1A78C1D_00_cucm-security-guide-1101/CUCM_BK_C1A78C1D_00_cucm-security-guide-1101_chapter_01011.html