Configuring Default Zone Access Rules - Cisco TelePresence Administrator's Manual

Zones and neighbors

Configuring Default Zone access rules

The Default Zone access rules
external systems are allowed to connect over SIP TLS to the VCS via the Default Zone.
Each rule specifies a pattern type and string that is compared to the identities (Subject Common Name and
any Subject Alternative Names) contained within the certificate presented by the external system. You can
then allow or deny access to systems whose certificates match the specified pattern. Up to 10,000 rules can
be configured.
To use the rules, Use Default Zone access rules on the
access rules are enabled, then by default no systems will be allowed to connect over SIP TLS to the Default
Zone; you must set up the access rules for the systems you want to grant access. Note that the access rules
do not affect other connections to the Default Zone (H.323 and SIP UDP/TCP).
The configurable options are:
Field Description
Name The name assigned to the rule.
Description An optional free-form description of the rule.
Priority Determines the order in which the rules are applied if the
certificate names match multiple rules. The rules with the
highest priority (1, then 2, then 3 and so on) are applied first.
Multiple rules with the same priority are applied in
configuration order.
Pattern The way in which the Pattern string must match the Subject
type Common Name or any Subject Alternative Names contained
within the certificate.
Exact: the entire string must exactly match the name,
character for character.
Prefix: the string must appear at the beginning of the name.
Suffix: the string must appear at the end of the name.
Regex: treats the string as a
Pattern The pattern against which the name is compared.
string
Action The action to take if the certificate matches this access rule.
Allow: allows the external system to connect via the Default
Zone.
Deny: rejects any connection requests received from the
external system.
State Indicates if the rule is enabled or not.
Cisco VCS Administrator Guide (X8.1.1)
(Configuration > Zones > Default Zone access
regular expression.
Configuring Default Zone access rules
rules) control which
Default Zone page must be set to Yes. If the
Usage tips
You can test whether a pattern
matches a particular name by
using the
(Maintenance > Tools > Check
pattern).
Use this setting to test
configuration changes, or to
temporarily disable certain rules.
Any disabled rules still appear in
the rules list but are ignored.
Check pattern tool
Page 140 of 507