Cisco Asdm 7 User Guide

							 
16-9
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Phone Proxy by using the Unified Communication Wizard
See also the Cisco Unified Communications Manager Security Guide for information on Using the 
Certificate Authority Proxy Function (CAPF) to install a locally significant certificate (LSC).
If your network includes Cisco IP Communicators (CIPC) or you have LSC enabled IP phones, you must 
import the CAPF certificate from the Cisco UCM. The certificate will be used to generate the LSC on 
the IP phones.
If the Cisco UCM has more than one CAPF certificate, you must import all of them to the ASA. However, 
the wizard supports configuring only one CAPF certificate, which is the default. To import more than 
one CAPF certificate, go to Configuration > Device Management > Certificate Management > Identity 
Certificates.
You can configure LSC provisioning for additional end-user authentication. See the Cisco Unified 
Communications Manager configuration guide for information. 
Step 1Check the Enable Certificate Authority Proxy Function check box. The remaining fields in the page 
become available. 
Step 2Enter the private IP address of the LSC provider. 
Step 3In the Public Address field, specify whether to use the IP address of the ASA public interface or enter 
an IP address. 
Specifying the private and public IP addresses for the LSC provider, creates an access list entry that 
allows the IP phones to contact the Cisco UCM by opening the CAPF port for LSC provisioning. 
Step 4In the Translation Type field, select the Address only or Address and ports radio button. 
The IP phones must contact the CAPF service on the Cisco UCM. The address translation type (Address 
only versus Address and ports) you select for CAPF must match the address translation type of the Cisco 
UCM on which the CAPF service is running. You set the address translation type for that Cisco UCM 
server in the previous step of this wizard (see Configuring Servers for the Phone Proxy, page 16-6),
By default, the CAPF Service uses port 3804. Modify this default value only when it is modified on the 
Cisco UCM.
Step 5If you selected the Address and ports radio button, enter the private and public ports for the CAPF 
service. 
Step 6Click the Install CAPF Certificate button. The Install Certificate dialog box appears. See Installing a 
Certificate, page 16-23. 
Step 7Click Next.
Configuring the Public IP Phone Network
The values that you specify in this page generate the address translation rules used for the IP phones and 
configure how the ASA handles IP phone settings. 
Step 1From the Interface drop-down list, choose the interface on which the ASA listens for connections from 
IP phones.
Step 2To preserve Call Manager configuration on the IP phones, check the Preserve the Unified CM’s 
configuration on the phone’s service check box. When this check box is uncheck, the following service 
settings are disabled on the IP phones: 
Web Access 
						

							 
16-10
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Phone Proxy by using the Unified Communication Wizard
PC Port
Voice VLAN access
Gratuitous ARP
Span to PC Port
Step 3To configure address translation for IP phones, check the Enable address translation for IP phones check 
box. Select whether to use the IP address of the ASA private interface (which you selected in step 2 of 
the wizard) or enter an IP address. 
Configuring address translation for IP phone configures the address used by the IP phones. All traffic 
from the outside network converges into one source IP address so that, if there is another corporate 
firewall in the network, a pinhole needs to be opened only for that IP address rather than for all traffic. 
Step 4To configure an HTTP proxy for the Phone Proxy feature that is written into the IP phones configuration 
file under the  tag, do the following:
a.Check the Configure an HTTP proxy to redirect phone URLs... check box.
b.In the IP Address field, type the IP address of the HTTP proxy 
c.In the Port field, enter the listening port of the HTTP proxy. 
The IP address you enter should be the global IP address based on where the IP phone and HTTP 
proxy server is located. You can enter a hostname in the IP Address field when that hostname can 
be resolved to an IP address by the adaptive security appliance (for example, DNS lookup is 
configured) because the adaptive security appliance will resolve the hostname to an IP address. If a 
port is not specified, the default will be 8080. 
d.In the Interface field, select the interface on which the HTTP proxy resides on the adaptive security 
appliance.
Setting the proxy server configuration option for the Phone Proxy allows for an HTTP proxy on the 
DMZ or external network in which all the IP phone URLs are directed to the proxy server for 
services on the phones. This setting accommodates nonsecure HTTP traffic, which is not allowed 
back into the corporate network. 
Step 5Click Next.
Configuring the Media Termination Address for Unified Communication 
Proxies
The data from this step generates the MTA instance to be added to the Phone Proxy and the UC-IME 
proxy. 
The phone proxy and the UC-IME proxy use the media termination address for Secure RTP (SRTP) and 
RTP traffic. SRTP traffic sent from external IP phones to the internal network IP phone via the ASA is 
converted to RTP traffic. The traffic is terminated on the adaptive security appliance. SRTP provides 
message authentication and replay protection to Internet media traffic such as audio and video. RTP 
defines a standardized packet format for delivering audio and video over the Internet.
For the UC-IME proxy and the Phone Proxy to be fully functional, you must ensure that the public IP 
address for the media termination address (MTA) is accessible from the Internet. The summary page of 
the Unified Communication Wizard reminds you of this requirement.
The MTA IP addresses that you specify must meet specific requirements. See Media Termination 
Instance Prerequisites, page 17-6 for information.  
						

							 
16-11
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Mobility Advantage by using the Unified Communication Wizard
Step 1In the field for the private IP address, enter the IP address on which private media traffic terminates. The 
IP address must be within the same subnet as the private interface IP address. The correct subnet range 
is provided to the right of the field for the private IP address. 
Step 2In the field for the public IP address, enter the IP address on which public media traffic terminates. The 
IP address must be within the same subnet as the public interface IP address. The correct subnet range 
is provided to the right of the field for the public IP address. 
Step 3Specify the minimum and maximum values for the RTP port range for the media termination instance. 
Port values must be within the range of 1024 to 65535.
Step 4Click Next. 
The wizard completes by displaying a summary of the configuration created for proxy. 
Configuring the Mobility Advantage by using the Unified 
Communication Wizard
NoteThe Unified Communication Wizard is supported for the ASA version 8.3(1) and later.
The Unified Communication wizard guides you through the steps to configure the Mobility Advantage 
proxy. Choose Wizards > Unified Communication Wizard from the menu. The Unified 
Communication Wizard opens. Click the Cisco Mobility Advantage Proxy radio button under the 
Remote Access section. 
When using the wizard to create the Mobility Advantage proxy, ASDM automatically creates the 
necessary TLS proxies, enables MMP inspection for the Mobility Advantage traffic, generates address 
translation (NAT) statements, and creates the access rules that are necessary to allow traffic between the 
Cisco Mobility Advantage server and the mobility clients.
The following steps provide the high-level overview for configuring the Mobility Advantage proxy:
Step 1Specify settings to define the private and public network topology, such the public and private network 
interfaces, and the IP addresses of the Cisco Mobility Advantage server. See Configuring the Topology 
for the Cisco Mobility Advantage Proxy, page 16-12.
Step 2Configure the certificates that are exchanged between the Cisco Mobility Advantage server and the ASA. 
See Configuring the Server-Side Certificates for the Cisco Mobility Advantage Proxy, page 16-12. 
Step 3Configure the client-side certificate management, namely the certificates that are exchanged between the 
Unified Mobile Communicator clients and the ASA. See Configuring the Client-Side Certificates for the 
Cisco Mobility Advantage Proxy, page 16-13. 
The wizard completes by displaying a summary of the configuration created for Mobility Advantage 
Proxy.  
						

							 
16-12
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Mobility Advantage by using the Unified Communication Wizard
Configuring the Topology for the Cisco Mobility Advantage Proxy
When configuring the Mobility Advantage Proxy, you specify settings to define the private and public 
network topology, such the private and public network interfaces, and the private and public IP addresses 
of the Cisco Mobility Advantage server.
The values that you specify in this page generate the following configuration settings for the Mobility 
Advantage Proxy: 
Static PAT for the Cisco Mobility Advantage server
Static NAT for Cisco Unified Mobile Communicator clients if the Enable address translation for 
Mobility clients check box is checked. 
ACLs to allow Cisco Unified Mobile Communicator clients to access the Cisco Mobility Advantage 
server
Step 1In the Private Network area, choose the interface from the drop-down list. 
Step 2In the Unified MA Server area, enter the private and public IP address for the Cisco Mobility Advantage 
server. Entering ports for these IP addresses is optional. By default port number 5443 is entered, which 
is the default TCP port for MMP inspection. 
Step 3In the FQDN field, enter the domain name for the Cisco Mobility Advantage server. This domain name 
is included in the certificate signing request that you generate later in this wizard. 
Step 4In the Public Network area, choose an interface from the drop-down list. 
The proxy uses this interface for configuring static PAT for the Cisco Mobility Advantage server and the 
ACLs to allow Cisco Unified Mobile Communicator clients to access the Cisco Mobility Advantage 
server. 
Step 5To configure whether address translation (NAT) is used by Cisco Unified Mobile Communicator 
clients, check the Enable address translation for Mobility clients check box and choose whether to 
use the IP address of the public interface or whether to enter an IP address. 
Step 6Click Next.
Configuring the Server-Side Certificates for the Cisco Mobility Advantage 
Proxy
A trusted relationship between the ASA and the Cisco UMA server can be established with self-signed 
certificates. The ASAs identity certificate is exported, and then uploaded on the Cisco UMA server 
truststore. The Cisco UMA server certificate is downloaded, and then uploaded on the ASA truststore.
The supports using self-signed certificates only at this step.
Step 1In the ASA’s Identity Certificate area, click Generate and Export ASA’s Identity Certificate. 
An information dialog boxes appear indicating that the enrollment seceded. In the Enrollment Status 
dialog box, click OK. The Export certificate dialog box appears. 
Note If an identity certificate for the ASA has already been created, the button in this area appears as 
Export ASA’s Identity Certificate and the Export certificate dialog box immediately appears.  
						

							 
16-13
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Mobility Advantage by using the Unified Communication Wizard
When using the wizard to configure the Cisco Mobility Advantage proxy, the wizard only supports 
installing self-signed certificates.
Step 2Export the identity certificate generated by the wizard for the ASA. See Exporting an Identity 
Certificate, page 16-23. 
Step 3In the Unified MA Server’s Certificate area, click Install Unified MA Server’s Certificate. The Install 
Certificate dialog appears.
Step 4Locate the file containing the Cisco Mobility Advantage server certificate or paste the certificate details 
in the dialog box. See Installing a Certificate, page 16-23. 
Step 5Click Next. 
NoteSee the Cisco Mobility Advantage server documentation for information on how to export the certificate 
for this server. 
Configuring the Client-Side Certificates for the Cisco Mobility Advantage Proxy
To establish a trust relationship between the Cisco Unified Mobile Communicator (UMC) clients and the 
ASA, the ASA uses a CA-signed certificate that is configured with the Cisco Mobility Advantage 
server’s FQDN (also referred to as certificate impersonation). 
In the Client-Side Certificate Management page, you enter both the intermediate CA certificate (if 
applicable, as in the cases of Verisign) and the signed ASA identity certificate. 
NoteIf the ASA already has a signed identity certificate, you can skip Step 1 in this procedure and proceed 
directly to Step 2.
Step 1In the ASA’s Identity Certificate area, click Generate CSR. The CSR parameters dialog box appears.
For information about specifying additional parameters for the certificate signing request (CSR), see 
Generating a Certificate Signing Request (CSR) for a Unified Communications Proxy, page 16-24. 
Information dialog boxes appear indicating that the wizard is delivering the settings to the ASA and 
retrieving the certificate key pair information. The Identity Certificate Request dialog box appears. 
For information about saving the CSR that was generated and submitting it to a CA, see Saving the 
Identity Certificate Request, page 16-25. 
Step 2Click Install ASA’s Identity Certificate. Install the certificate. See Installing the ASA Identity 
Certificate on the Mobility Advantage Server, page 16-26. 
Step 3Click Install Root CA’s Certificate. The Install Certificate dialog box appears. Install the certificate. 
See Installing a Certificate, page 16-23.
Step 4Click Next. 
The wizard completes by displaying a summary of the configuration created for Mobility Advantage 
Proxy.  
						

							 
16-14
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Presence Federation Proxy by using the Unified Communication Wizard
Configuring the Presence Federation Proxy by using the Unified 
Communication Wizard 
NoteThe Unified Communication Wizard is supported for the ASA version 8.3(1) and later.
To configure the Cisco Unified Presence proxy by using ASDM, choose Wizards > Unified 
Communication Wizard from the menu. The Unified Communication Wizard opens. From the first 
page, select the Cisco Unified Presence Proxy option under the Business-to-Business section. 
When using the wizard to create the Cisco Presence Federation proxy, ASDM automatically creates the 
necessary TLS proxies, enables SIP inspection for the Presence Federation traffic, generates address 
translation (static PAT) statements for the local Cisco Unified Presence server, and creates ACLs to allow 
traffic between the local Cisco Unified Presence server and remote servers.
The following steps provide the high-level overview for configuring the Presence Federation Proxy:
Step 1Specify settings to define the private and public network topology, such the private and public IP address 
of the Presence Federation server. See Configuring the Topology for the Cisco Presence Federation 
Proxy, page 16-14. 
Step 2Configure the local-side certificate management, namely the certificates that are exchanged between the 
local Unified Presence Federation server and the ASA. See Configuring the Local-Side Certificates for 
the Cisco Presence Federation Proxy, page 16-15. 
Step 3Configure the remote-side certificate management, namely the certificates that are exchanged between 
the remote server and the ASA. See Configuring the Remote-Side Certificates for the Cisco Presence 
Federation Proxy, page 16-15. 
The wizard completes by displaying a summary of the configuration created for the Presence Federation 
proxy. 
Configuring the Topology for the Cisco Presence Federation Proxy
When configuring the Presence Federation Proxy, you specify settings to define the private and public 
network topology, such the private and public network interfaces, and the private and public IP addresses 
of the Cisco Unified Presence server.
The values that you specify in this page generate the following configuration settings for the Presence 
Federation Proxy: 
Static PAT for the local Cisco Unified Presence server
ACLs for traffic between the local Cisco Unified Presence server and remote servers
Step 1In the Private Network area, choose the interface from the drop-down list. 
Step 2In the Unified Presence Server area, enter the private and public IP address for the Unified Presence 
server. Entering ports for these IP addresses is optional. By default port number 5061 is entered, which 
is the default TCP port for SIP inspection.  
						

							 
16-15
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the Presence Federation Proxy by using the Unified Communication Wizard
Step 3In the FQDN field, enter the domain name for the Unified Presence server. This domain name is included 
in the certificate signing request that you generate later in this wizard. 
Step 4In the Public Network area, choose the interface of the public network from the drop-down list. The 
proxy uses this interface for configuring static PAT for the local Cisco Unified Presence server and for 
configuring ACLs to allow remote servers to access the Cisco Unified Presence server. 
Step 5Click Next.
Configuring the Local-Side Certificates for the Cisco Presence Federation 
Proxy
Within an enterprise, setting up a trust relationship is achievable by using self-signed certificates. The 
supports using self-signed certificates only at this step.
Step 1In the ASA’s Identity Certificate area, click Generate and Export ASA’s Identity Certificate. 
An information dialog box appears indicating that enrollment succeeded. In the Enrollment Status dialog 
box, click OK. The Export certificate dialog box appears. 
Note If an identity certificate for the ASA has already been created, the button in this area appears as 
Export ASA’s Identity Certificate and the Export certificate dialog box immediately appears. 
When using the wizard to configure the Cisco Presence Federation proxy, the wizard only supports 
installing self-signed certificates.
Step 2Export the identity certificate generated by the wizard for the ASA. See Exporting an Identity 
Certificate, page 16-23. 
Step 3Local Unified Presence Server’s Certificate area, click Install Server’s Certificate. The Install 
Certificate dialog appears.
Step 4Locate the file containing the Cisco Unified Presence server certificate or paste the certificate details in 
the dialog box. See Installing a Certificate, page 16-23. 
Step 5Click Next.
NoteSee the Cisco Unified Presence server documentation for information on how to export the certificate 
for this server. 
Configuring the Remote-Side Certificates for the Cisco Presence Federation 
Proxy
Establishing a trust relationship across enterprises or across administrative domains is key for federation. 
Across enterprises you must use a trusted third-party CA (such as, VeriSign). The security appliance 
obtains a certificate with the FQDN of the Cisco Unified Presence server (certificate impersonation).  
						

							 
16-16
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the UC-IME by using the Unified Communication Wizard
For the TLS handshake, the two entities, namely the local entity and a remote entity, could validate the 
peer certificate via a certificate chain to trusted third-party certificate authorities. The local entity and 
the remote entity enroll with the CAs. The ASA as the TLS proxy must be trusted by both the local and 
remote entities. The security appliance is always associated with one of the enterprises. Within that 
enterprise, the entity and the security appliance authenticate each other by using a self-signed certificate. 
To establish a trusted relationship between the security appliance and the remote entity, the security 
appliance can enroll with the CA on behalf of the Cisco Unified Presence server for the local entity. In 
the enrollment request, the local entity identity (domain name) is used. 
To establish the trust relationship, the security appliance enrolls with the third party CA by using the 
Cisco Unified Presence server FQDN as if the security appliance is the Cisco Unified Presence server. 
NoteIf the ASA already has a signed identity certificate, you can skip Step 1 in this procedure and proceed 
directly to Step 2.
Step 1In the ASA’s Identity Certificate area, click Generate CSR. The CSR parameters dialog box appears. 
For information about specifying additional parameters for the certificate signing request (CSR), see 
Generating a Certificate Signing Request (CSR) for a Unified Communications Proxy, page 16-24. 
Information dialog boxes appear indicating that the wizard is delivering the settings to the ASA and 
retrieving the certificate key pair information. The Identity Certificate Request dialog box appears. 
For information about saving the CSR that was generated and submitting it to a CA, see Saving the 
Identity Certificate Request, page 16-25. 
Step 2Click Install ASA’s Identity Certificate. See Installing the ASA Identity Certificate on the Presence 
Federation and Cisco Intercompany Media Engine Servers, page 16-26.
Step 3Click Remote Server’s CA’s Certificate. The Install Certificate dialog box appears. Install the 
certificate. See Installing a Certificate, page 16-23. 
NoteYou must install a root CA certificate for each remote entity that communicates with the ASA 
because different organizations might be using different CAs.
Step 4Click Next. 
The wizard completes by displaying a summary of the configuration created for the Presence Federation 
proxy. 
Configuring the UC-IME by using the Unified Communication 
Wizard
NoteThe Unified Communication Wizard is supported for the ASA version 8.3(1) and later. 
						

							 
16-17
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the UC-IME by using the Unified Communication Wizard
To configure the Cisco Intercompany Media Engine Proxy by using ASDM, choose Wizards > Unified 
Communication Wizard from the menu. The Unified Communication Wizard opens. From the first 
page, select the Cisco Intercompany Media Engine Proxy option under the Business-to-Business section 
and click Next. 
NoteThe Cisco Intercompany Media Engine Proxy does not appear as an option in the Unified 
Communication Wizard unless the license required for this proxy is installed on the ASA.
When using the wizard to create the Cisco Intercompany Media Engine Proxy, ASDM automatically 
creates the necessary TLS proxies, enables SIP inspection for Cisco Intercompany Media Engine traffic, 
generates address translation (static PAT) statements for local Cisco Unified Communications Manager 
servers, and creates ACLs to allow traffic between the local Cisco Unified Communications Manager 
servers and the remote servers.
The following steps provide the high-level overview for configuring the Cisco Intercompany Media 
Engine Proxy:
Step 1Select the topology of the Cisco Intercompany Media Engine Proxy, namely whether the security 
appliance is an edge firewall with all Internet traffic flowing through it or whether the security appliance 
is off the path of the main Internet traffic (referred to as an off-path deployment). See Configuring the 
Topology for the Cisco Intercompany Media Engine Proxy, page 16-17. 
Step 2Specify private network settings such as the Cisco UCM IP addresses and the ticket settings. See 
Configuring the Private Network Settings for the Cisco Intercompany Media Engine Proxy, page 16-18.
Step 3Specify the public network settings. See Configuring the Public Network Settings for the Cisco 
Intercompany Media Engine Proxy, page 16-20. 
Step 4Specify the media termination address settings of the Cisco UMC. See Configuring the Media 
Termination Address for Unified Communication Proxies, page 16-10. 
Step 5Configure the local-side certificate management, namely the certificates that are exchanged between the 
local Cisco Unified Communications Manager servers and the security appliance. See Configuring the 
Local-Side Certificates for the Cisco Intercompany Media Engine Proxy, page 16-21.
Step 6Configure the remote-side certificate management, namely the certificates that are exchanged between 
the remote server and the ASA. This certificate is presented to remote servers so that they can 
authenticate the ASA as a trusted server. See Configuring the Remote-Side Certificates for the Cisco 
Intercompany Media Engine Proxy, page 16-22.
The wizard completes by displaying a summary of the configuration created for the Cisco Intercompany 
Media Engine. 
Configuring the Topology for the Cisco Intercompany Media Engine Proxy
Step 1Select the topology of your ICME deployment by clicking one of the following options:
All Internet traffic flows through the ASA radio button. This option is also referred to as a basic 
deployment. 
This ASA is off the path of the regular Internet traffic. This option is also referred to as an off-path 
deployment.  
						

							 
16-18
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 16      Using the Cisco Unified Communication Wizard
  Configuring the UC-IME by using the Unified Communication Wizard
Step 2Click Next. 
Basic Deployment
In a basic deployment, the Cisco Intercompany Media Engine Proxy sits in-line with the Internet firewall 
such that all Internet traffic traverses the ASA. In this deployment, a single Cisco UCM or a Cisco UCM 
cluster is centrally deployed within the enterprise, along with a Cisco Intercompany Media Engine server 
(and perhaps a backup). A single Internet connection traverses the ASA, which is enabled with the Cisco 
Intercompany Media Engine Proxy.
The ASA sits on the edge of the enterprise and inspects SIP signaling by creating dynamic SIP trunks 
between enterprises.
Off-path Deployment
In an off path deployment, inbound and outbound Cisco Intercompany Media Engine calls pass through 
an ASA enabled with the Cisco Intercompany Media Engine Proxy. The ASA is located in the DMZ and 
configured to support primarily Cisco Intercompany Media Engine. Normal Internet facing traffic does 
not flow through this ASA. 
For all inbound calls, the signaling is directed to the ASA because destined Cisco UCMs are configured 
with the global IP address on the ASA. For outbound calls, the called party could be any IP address on 
the Internet; therefore, the ASA is configured with a mapping service that dynamically provides an 
internal IP address on the ASA for each global IP address of the called party on the Internet. 
Cisco UCM sends all outbound calls directly to the mapped internal IP address on the ASA instead of 
the global IP address of the called party on the Internet. The ASA then forwards the calls to the global 
IP address of the called party. 
NoteWhen you configure the Cisco Intercompany Media Engine for an off-path deployment, you must ensure 
that the public IP addresses and ports of the Cisco Unified Communications Manager servers and the 
public IP address for the media termination address are accessible from the Internet. The summary page 
of the Unified Communication Wizard reminds you of the requirements.
Configuring the Private Network Settings for the Cisco Intercompany Media 
Engine Proxy
When configuring the Cisco Intercompany Media Engine Proxy, you specify settings to define the 
private network topology, such the private network interface, the IP addresses of the Cisco Unified 
Communications servers, and ticket verification. Additionally, when the Cisco Unified Communications 
servers are operating in secure mode, you specify the X.509 subject name for the Cisco Intercompany 
Media Engine Proxy, 
The values that you specify in this page generate the following configuration settings for the Cisco 
Intercompany Media Engine Proxy: 
The list of Cisco Unified Communications servers
The ticket epoch and password used by the Cisco Intercompany Media Engine Proxy
For an off-path deployment only, the mapping service on the same interface as the Cisco Unified 
Communications server