Subzone-Level Authentication Policy - Cisco TelePresence Administrator's Manual

Subzone-level Authentication Policy

The VCS's Authentication Policy at the subzone level controls how the VCS authenticates incoming
messages (including registration requests) from that subzone.
To configure a subzone's Authentication policy, go to the
Local Zone > Subzones, then click
Default Subzone's Authentication policy. The policy is set to Do not check credentials by default.
The behavior varies for H.323 and SIP messages as shown in the tables below:
H.323
Authentication Behavior
policy
Check Messages are classified as either authenticated or unauthenticated depending on whether any
credentials credentials in the message can be verified against the authentication database. Messages that
pass authentication are classified as authenticated.
If no credentials are supplied, the message is always classified as unauthenticated.
Note that unauthenticated registration requests are rejected.
Do not check Message credentials are not checked and all messages are classified as unauthenticated.
credentials
Treat as Message credentials are not checked and all messages are classified as authenticated.
authenticated
SIP
The behavior for SIP messages depends upon whether the message was received from a local domain (a
domain for which the VCS is authoritative) or a non-local domain.
Authentication In local domain
policy
Check Messages are challenged for
credentials authentication and those that pass
are classified as authenticated.
Messages (including registration
requests) that fail authentication are
rejected.
Do not check Messages are not challenged for
credentials authentication.
All messages are classified as
unauthenticated.
Treat as Messages are not challenged for
authenticated authentication.
All messages are classified as
authenticated.
Cisco VCS Administrator Guide (X7.1)
Edit subzone
View/Edit or the name of the subzone). You can also configure the
Outside local domain
SIP messages received from non-local domains are all
treated in the same manner, regardless of the
subzone's Authentication policy setting:
Messages are not challenged for authentication.
All messages are classified as unauthenticated.
Device authentication
page (VCS configuration >
Page 101 of 479