Crestron Mercury CCS-UC-1 User manual

CCS-UC-1
Secure SIP Endpoint with Cisco®Unified
Communications Manager 11.0
Configuration Guide
Crestron Electronics, Inc.

Crestron product development software is licensed to Crestron dealers and Crestron Service Providers (CSPs) under a limited non-exclusive,
non-transferable Software Development Tools License Agreement. Crestron product operating system software is licensed to Crestron
dealers, CSPs, and end-users under a separate End-User License Agreement. Both of these Agreements can be found on the Crestron
website at www.crestron.com/legal/software_license_agreement.
The product warranty can be found at www.crestron.com/warranty.
The specific patents that cover Crestron products are listed at patents.crestron.com.
Certain Crestron products contain open source software. For specific information, please visit www.crestron.com/opensource.
Crestron, the Crestron logo, AirMedia, Crestron Mercury, and Crestron Toolbox are either trademarks or registered trademarks of Crestron
Electronics, Inc. in the United States and/or other countries. Bugzilla is either a trademark or registered trademark of the Mozilla Foundation in
the United States and/or other countries. Cisco is either a trademark or registered trademark of Cisco Systems, Inc. in the United States
and/or other countries. Microsoft is either a trademark or registered trademark of Microsoft Corporation in the United States and/or other
countries. Other trademarks, registered trademarks, and trade names may be used in this document to refer to either the entities claiming the
marks and names or their products. Crestron disclaims any proprietary interest in the marks and names of others. Crestron is not responsible
for errors in typography or photography.
This document was written by the Technical Publications department at Crestron.
©2017 Crestron Electronics, Inc.

Configuration Guide – DOC. 7991A Contents
•
i
Contents
Introduction 1
Audience................................................................................................................. 1
Topology................................................................................................................. 1
Software Requirements........................................................................................... 2
Hardware Requirements ......................................................................................... 2
Product Description ................................................................................................ 2
Summary ................................................................................................................ 2
Features Supported ................................................................................... 2
Features Not Supported............................................................................. 3
Known Issues and Limitations................................................................................. 3
Crestron Mercury Configuration 4
Setup ...................................................................................................................... 4
Configuring the device ............................................................................................ 4
Configuring the TLS SIP Parameters ....................................................................... 7
Add Certificates ...................................................................................................... 7
Add Root Certificate................................................................................... 8
Generate Device Certificate Request and Download Device Certificate from
CA ........................................................................................................... 10
Add SIP Certificate................................................................................... 14
Cisco UCM Configuration 15
Configure the End User......................................................................................... 16
Configure a Secure SIP Trunk Security Profile ....................................................... 18
Configure a Secure SIP Profile for Trunk ............................................................... 19
Configure a Secure SIP Profile for Phones ............................................................ 23
Configure Phone Security Profile ........................................................................... 27
Configure the Crestron device as a Third-party SIP Device ................................... 31
Configure Media Resource Group and Media Resource Group List ...................... 37
Cisco UBE configuration for MRG resources............................................ 37
Cisco UCM Media Termination Point Configuration.................................. 42
Cisco UCM Conference Bridge Configuration .......................................... 43
Cisco UCM MRG Configuration ............................................................... 44
Configure Region for G729 ................................................................................... 48
Modify Device Pool Configuration.......................................................................... 49
Configure Trunk .................................................................................................... 50
Configure Route Patterns...................................................................................... 54

ii
•
Contents Configuration Guide – DOC. 7991A

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
1
CCS-UC-1: Secure SIP Endpoint with
Cisco Unified Communications
Manager 11.0
Introduction
This configuration guide describes the necessary procedure to configure a Crestron
Mercury™ device, in a secure mode, to register to the Cisco®Unified Communications
Manager as a basic AS SIP endpoint.
Audience
This document is intended for users attempting to configure and use the Crestron Mercury
devices as secure SIP endpoints registering to the Cisco Unified Communications Manager
(Cisco UCM).
Topology
The network topology for the Crestron Mercury endpoint to interop with the Cisco UCM is
shown below.
Secure SIP Endpoint Integration with Cisco UCM - Reference Network

2
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
The lab network consists of the following components:
•Cisco UCM cluster for voice features
•Cisco SIP phones
•Crestron Mercury as the secure SIP endpoints
•Cisco UBE (CUBE) to ensure secure signaling and media within the enterprise for
PSTN calls
Software Requirements
•Cisco Unified Communications Manager v 11.0.1.20000-2
•Cisco UBE v 15.6
•Crestron Mercury devices v 1.3291.00019.001 or 1.3318.0002 (for G729 testing)
Hardware Requirements
•Cisco UCS-C240-M3S VMWare Host running ESXi 5.5
•Cisco 3845 as PSTN Gateway
•Cisco UBE as an SBC
•Cisco phone models: 8961 (SIP) and 8945 (SIP)
•Crestron Mercury devices (2)
Product Description
The Crestron Mercury device is a complete solution for conference rooms. It acts as an
all-in-one touch screen, speakerphone and AirMedia®product for conference rooms
that integrate microphones and speakers into the user interface at the table.
Crestron Toolbox™ is used to discover and control all Crestron devices on the network.
The Crestron Mercury web interface is used to control the Crestron Mercury devices on
the network.
Summary
The Crestron Mercury devices, in secure mode, are configured on the Cisco UCM as
Assured Service (AS) SIP endpoints. The devices successfully register to the Cisco UCM
with digest authentication.
The sections below describe supported and unsupported features on a Crestron Mercury
device.
Features Supported
•Secure Mode: establishes a secure SIP and RTP session with the Cisco UCM
•Registration with digest authentication
•Basic calls with G729, G722, G711u, and G711a codecs
•Caller ID (limited to only calling number)

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
3
•DTMF support
•Early media support
•Retrieval of a parked call
•Transferee in a call transfer
•Conference participant
•Member of hunt group
Features Not Supported
•Caller ID presentation with name and number display
•Call hold and resume
•Call forwarding on the device (Forwarding can be configured on the PBX for the DN
assigned to the endpoint.)
•Call waiting
•Conference
•Initiating attended call transfer
•Initiating semi-attended call transfer
•Initiating blind call transfer
•Configuration of shared line on device
•Initiating call park
•Do Not Disturb (DND)
Known Issues and Limitations
•Caller ID is not supported on the device. Currently only the calling party number is
displayed as the caller ID. This issue is tracked via Crestron’s Bugzilla™ software,
Defect: 119006.
•The active call timer on the device does not reflect the correct call duration. The
active call duration includes the time for which the unit was being alerted also. This
issue is tracked via Crestron’s Bugzilla software Defect: 124001.
•The first ringback heard on the device is stuttered – resembles a mix of local and
remote ringback. This issue is tracked via Crestron’s Bugzilla software Defect:
122421.
•On the Crestron Mercury web user interface, there is currently no notification
provided to the user when certain mandatory configurations are missing. This issue
is tracked via Crestron’s Bugzilla software Defect: 125193.
•On the Crestron Mercury web user interface, a configuration of DHCP OFF on the
Network configuration page mandates configuration of both the adapters. The user
is unable to save changes unless both the adapters are configured and is notified of
an invalid IP against the default of 0.0.0.0 for an unused adapter. This issue is
tracked via Crestron’s Bugzilla software Defect: 126236.

4
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
•On the Crestron Mercury web user interface, there is currently no check to validate
whether a certificate that is being deleted is in use, i.e., whether it is on the trusted
list or not. This issue is tracked via Crestron’s Bugzilla software Defect: 126232.
•On the Crestron Mercury device, for certain called numbers that cannot be reached
or are invalid, the user only hears a reorder tone and does not have the option to
disconnect the call except by pressing the call button again. This issue is tracked
via Crestron’s Bugzilla software Defect: 122633.
Crestron Mercury Configuration
Setup
The LAN port of the Crestron Mercury device needs to be connected to one PoE+ port to
power it up and network connectivity with the Cisco UCM. The PoE+ switch that is used
should have the LLDP functionality enabled for the device to power up and be completely
functional. By default, the “poeplus” configuration is set to Off on the device.
Configuring the device
To configure this device, follow this procedure:
1. Access the web GUI for the device by using an http session with the device’s IP
address. The device IP address 10.80.25.50 was used in this example. The initial
page that displays is shown below.
Crestron Mercury: Login to Web GUI

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
5
2. Click
Sign In
and log in to the device. For information on device administration,
refer to the CCS-UC-1 Supplemental Guide (Doc. 7844) at
www.crestron.com/manuals.
The Status screen that appears displays basic information on the device.
Crestron Mercury: Status
The device can be configured from the
Network
page.
3. On the web GUI, navigate to
Network
.

6
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
Crestron Mercury: Network Setting: DHCP Off: Static IP Configured
4. Enter the following parameters in the
Adapter 1
section to configure the Crestron
Mercury device.
•
Domain Name
: skypelabsj.local was used in this test
•
DHCP
: Choose either of the following:
oObtain an IP address automatically
oUse the following IP address
For the test, a static IP was configured.

IP address
: 10.80.25.50 was used in this example

Subnet Mask
: 255.255.255.0 was used in this example

Default Gateway
: 10.80.25.1 was used in this example

DNS Servers
: 10.64.4.10 was used in this example
5. Click
Save Changes
.

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
7
Configuring the TLS SIP Parameters
To configure the TLS SIP parameters, follow this procedure:
1. On the web GUI, navigate to
Device
>
SIP Calling
.
Crestron Mercury: Device Configuration: SIP Parameters
2. Enable the check box for
Enable SIP
.
3. Configure the
Server IP Address
: Enter the FQDN of the primary Cisco UCM node.
clus35pub.skypelabsj.local was used in this example.
4. Configure the
Port
: 5061, used in this example.
5. Configure the
Server Username
: Enter the end user configured on Cisco UCM for
this device. Crestron Mercury_2600 was used in this example.
6. Configure the
Server Password
: Enter the password as configured on Cisco UCM
for this end user.
7. Configure the
Local Extension
: Enter the directory number that was configured for
this device on Cisco UCM. 2600 was used in this example.
8. Leave all other fields at their default values.
9. Click
Save Changes
.
Once the device successfully registers with the Cisco UCM, the
SIP Server Status
updates
its status to show Online.
Add Certificates
For a successful TLS handshake between the Crestron Mercury device and the Cisco UCM,
the following certificates need to be added to the Crestron Mercury:

8
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
•RootCA certificate (root_cer). This is the certificate that is downloaded from the
certificate authority that serves the Cisco UCM (the DNS IP configured on the
CUCM and Crestron Mercury device). This certificate is required by the Crestron
Mercury device to allow it to validate the Cisco UCM when Enable Server Validation
is enabled in the
SIP Calling
configuration screen.
•SIP certificate (sip-cert.pfx). This is a specific device certificate that is downloaded
from the same certificate authority that serves the Cisco UCM. This certificate
contains information on the CA that the Cisco UCM identifies/recognizes and
enables a successful TLS handshake. This certificate is a signed certificate from the
CA with the signing request generated on the same CA using a specific device
certificate request with server and client authentication.
Add Root Certificate
To upload certificates to the device, follow this procedure:
1. On the web GUI, navigate to
Device
>
SIP Calling
.
2. Click
Manage Certificates
.
Crestron Mercury Configuration: Manage Certificates: Add Root Certificate
3. Click
Add Root Certificate
.

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
9
Crestron Mercury Configuration: Manage Certificates: Add Certificate: Browse
4. In the
Add Certificate
window, click
Browse
.
5. Select the root_cer.cer file that needs to be uploaded, and click
OK
.
6. On the screen that follows, click
Load
. The device indicates that the certificate was
added successfully.
Crestron Mercury Configuration: Manage Certificates: Add Certificate: Add Complete
7. Click
OK
and close the
Manage Certificates
window.
The certificate authority from where this root-cer certificate was downloaded
appears in the list of trusted certificate authorities.
8. On the main
SIP Calling
screen, navigate to
Select Trusted Certificate
Authorities
.

10
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
Crestron Mercury Configuration: SIP Calling: Select Trusted Certificate Authorities
9. From the list of certificate authorities, select the certificate authority (from where the
root_cer.cer certificate was downloaded).
Generate Device Certificate Request and Download Device Certificate
from CA
On the CA, open a browser and access the Certificate Services. For this example, a
Microsoft®Active Directory was used to generate a specific device certificate request.
Certificate Authority: Request a Certificate

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
11
To generate and download a device certificate, follow this procedure:
1. Click
Request a certificate
.
Certificate Authority: advanced certificate request
2. Click
advanced certificate request
.
3. On the screen that follows, click
Create and Submit a request to this CA
.

12
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
Certificate Authority: Submit Device-Specific Certificate Request
4. Select a
Certificate Template
that does client and server authentication. Copy of
Web Server was used in this example.
5. Configure
Identifying Information for Offline Template
:
Name
: Assign the device
IP to be the common name. The IP address used in this example is 10.80.25.50.

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
13
6. In the
Additional Options
section, configure the
Request Format
. PKCS10 was
used in this example.
7. Click
Submit
.
Certificate Authority: Install certificate
8. Click
Install this Certificate
.
9. Export this certificate from the certificate store
Certificate Authority: Export Device Certificate
The certificate should be exported as a
sip_cert.pfx
with the following parameters.
•The option to export the private key.
•The certificate should have a .PFX extension.
•A password. Enter this same password when importing this SIP certificate
on the Crestron Mercury device.

14
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
Add SIP Certificate
To add a SIP certificate, follow this procedure:
1. On the web GUI, navigate to
Device
>
SIP Calling
.
2. Click
Manage Certificates
.
Crestron Mercury Configuration: Manage Certificates
3. Click the
SIP
tab.
Crestron Mercury Configuration: Manage Certificates: Add SIP Certificate
4. Click
Add SIP Certificate
.
5. In the
Add Certificate
window, click
Browse
.
6. Select the sip_cert file that needs to be uploaded, and click
OK
.
7. Enter the password that was used when exporting this certificate on the CA.

Configuration Guide – DOC. 7991A CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0
•
15
The SIP certificate is now listed under the SIP tab. The name of the certificate is the
common name provided when generating the device specific certificate request on
the CA.
A typical TLS handshake consists of the following steps:
1. The Crestron Mercury device sends a Client Hello to the Cisco UCM server.
2. The Cisco UCM server sends a Server Hello.
3. The Cisco UCM server sends its certificate and a certificate request from the
Crestron Mercury device.
4. The Crestron Mercury device sends its certificate.
5. The Crestron Mercury device verifies the server certificate.
6. The Cisco UCM Server changes the cipher spec and sends an encrypted
handshake message.
7. Application data is exchanged between the the Cisco UCM and the Crestron
Mercury device.
NOTE:
The Crestron Mercury device supports TLS v1.0.
NOTE:
The device itself uses SIP port 5060 (instead of 5061) to communicate to the Cisco
UCM, even in a secure mode.
Cisco UCM Configuration
This section describes the Cisco UCM configuration necessary to integrate the Crestron
Mercury device as a secure SIP endpoint.
NOTE:
It is assumed that the general installation and basic Cisco UCM configuration have
already been administered.

16
•
CCS-UC-1: Secure SIP Endpoint with Cisco UCM 11.0 Configuration Guide – DOC. 7991A
Configure the End User
To configure the end user, follow this procedure:
1. Navigate to
User Management
>
End User
.
2. Click
Add New
. The End User configuration window appears.
Cisco UCM: End User Configuration
3. Configure
User ID
: Enter a unique end user identification name. Two users were
configured for this example for the Crestron Mercury devices: Crestron
Mercury_2600 and Crestron Mercury_2602.