Trust relationships for cisco uma deployments – Cisco ASA 5505 User Manual

Page 1059

Advertising
background image

50-5

Cisco ASA 5500 Series Configuration Guide using the CLI

Chapter 50 Configuring Cisco Mobility Advantage

Information about the Cisco Mobility Advantage Proxy Feature

In scenario 2 (

Figure 50-3

), PAT can be used to converge all client traffic into one source IP, so that the

firewall does not have to open up a wildcard pinhole for inbound traffic.

hostname(config)# access-list cumc extended permit tcp any host 172.16.27.41 eq 5443

versus

hostname(config)# access-list cumc extended permit tcp host 192.0.2.183 host 172.16.27.41

eq 5443

Trust Relationships for Cisco UMA Deployments

To establish a trust relationship between the Cisco UMC client and the ASA, the ASA uses the Cisco
UMA server certificate and keypair or the ASA obtains a certificate with the Cisco UMA server FQDN
(certificate impersonation). Between the ASA and the Cisco UMA server, the ASA and Cisco UMA
server use self-signed certificates or certificates issued by a local certificate authority.

Figure 50-4

shows how you can import the Cisco UMA server certificate onto the ASA. When the Cisco

UMA server has already enrolled with a third-party CA, you can import the certificate with the private
key onto the ASA. Then, the ASA has the full credentials of the Cisco UMA server. When a Cisco UMA
client connects to the Cisco UMA server, the ASA intercepts the handshake and uses the Cisco UMA
server certificate to perform the handshake with the client. The ASA also performs a handshake with the
server.

Figure 50-4

How the Security Appliance Represents Cisco UMA – Private Key Sharing

Figure 50-5

shows another way to establish the trust relationship.

Figure 50-5

shows a green field

deployment, because each component of the deployment has been newly installed. The ASA enrolls with
the third-party CA by using the Cisco UMA server FQDN as if the ASA is the Cisco UMA server. When
the Cisco UMA client connects to the ASA, the ASA presents the certificate that has the Cisco UMA
server FQDN. The Cisco UMA client believes it is communicating to with the Cisco UMA server.

271643

Internet

Inspected and

Modified

(if needed)

Certificate

Authority

Certificate

Certificate with

Private Key

ASA

Enroll with FQDN

of Cisco UMA

Key 1

Key 2

TLS (Self-signed,
or from local CA)

TLS (Cisco UMA Certificate)

3rd Party CA

Cisco UMA

Cisco UMC Client

Advertising