An administrator is enabling Mobile and Remote Access login for the Cisco UCM registration domain cisco.com. Phones are registered with a Cisco UCM phone security profile name of…

Question

Options

• ASecurephone.cisco.com on the CallManager certificate
• Bcisco.com on the Expressway-C certificate
• CSecurephone.cisco.com on the Expressway-E certificate
• Dcisco.com on the Expressway-E certificate
• ESecurephone.cisco.com on the Expressway-C certificate

• A
  6% (2)
• B
  15% (5)
• C
  9% (3)
• D
  71% (24)

Explanation

Two SANs are required for MRA to function correctly. First, 'cisco.com' must appear as a SAN on the Expressway-E certificate (Answer D) because Jabber clients discover the Expressway-E using the '_collab-edge._tls.cisco.com' SRV record and then validate the TLS certificate against the registration domain 'cisco.com'. Second, 'securephone.cisco.com' must appear as a SAN on the Expressway-C certificate (Answer E) because phones registering via MRA use the CUCM phone security profile name as the expected server identity when establishing a TLS connection through the Expressway-C. The Expressway-C proxies CUCM, so it must present a certificate matching the profile name. The Expressway-E does not need the phone security profile SAN, and the CallManager certificate does not need the profile name as a SAN for this specific MRA scenario.

No community discussion yet for this question.