Cisco Jabber for Windows Common Criteria Configuration Guide Version 1.0 EDCS - 1502604 11 November 2015 2015, Cisco Systems, Inc. All rights reserved. This document can be reproduced in full without any modifications.
Table of Contents 1 Introduction... 8 1.1 Audience... 8 1.2 Purpose... 8 1.3 Document References... 9 1.4 Supported Hardware and Software... 9 1.5 Operational Environment... 11 1.5.1 Supported non-toe Hardware/ Software/ Firmware... 11 1.6 Excluded Functionality... 11 2 Secure Acceptance of the TOE... 12 3 Secure Installation and Configuration... 14 3.1 Installation and Initial Setup of Jabber... 14 3.1.1 Enabling FIPS Mode... 14 3.1.2 Configuration and Certificates... 15 3.2 Network Protocols and Cryptographic Settings... 16 3.2.1 SIP Connections and Protocols... 17 4 Secure Management... 18 4.1 SIP Servers... 18 4.2 Client Credentials and SIP Authentication... 18 4.3 Product Updates... 18 4.4 Jabber Features and Calls... 20 4.4.1 Contacts... 21 4.4.2 Calls... 21 5 Modes of Operation... 23 6 Security Measures for the Operational Environment... 24 7 Related Documentation... 25 7.1 Documentation Feedback... 25 7.2 Obtaining Technical Assistance... 25 Page 2 of 26
List of Tables Table 1: Acronyms... 4 Table 2 Terminology... 6 Table 3 Cisco Documentation... 9 Table 4 Jabber for Windows Requirements... 10 Table 5: Operational Environment Components... 11 Table 6 Excluded Functionality... 11 Table 7 Evaluated Software Images... 12 Table 8 Operational Environment Security Measures... 24 Page 3 of 26
List of Acronyms The following acronyms and abbreviations may be used in this document: Table 1: Acronyms Acronyms / Definition Abbreviations AAA Administration, Authorization, and Accounting ACL Access Control Lists AES Advanced Encryption Standard BRI Basic Rate Interface CC Common Criteria for Information Technology Security Evaluation CEM Common Evaluation Methodology for Information Technology Security CM Configuration Management CSU Channel Service Unit CUCM Cisco Unified Communications Manager DHCP Dynamic Host Configuration Protocol DSU Data Service Unit EAL Evaluation Assurance Level EHWIC Ethernet High-Speed WIC ESP Encapsulating Security Payload GE Gigabit Ethernet port HTTP Hyper-Text Transport Protocol HTTPS Hyper-Text Transport Protocol Secure ICMP Internet Control Message Protocol ISDN Integrated Services Digital Network IT Information Technology NDPP Network Device Protection Profile OS Operating System PBKDF2 Password-Based Key Derivation Function version 2 PoE Power over Ethernet POP3 Post Office Protocol PP Protection Profile SA Security Association SBC Session Border Controllers SDES Security Descriptions for Media Streams SDP Session Description Protocol SFP Small form-factor pluggable port SHS Secure Hash Standard SIP Session Initiation Protocol SSHv2 Secure Shell (version 2) SRTP Security Real-Time Transport Protocol ST Security Target TCP Transport Control Protocol TLS Transport Layer Security TOE Target of Evaluation TSC TSF Scope of Control TSF TOE Security Function TSP TOE Security Policy UCM Unified Communications Manager UDP User datagram protocol VoIP Voice over IP WAN Wide Area Network Page 4 of 26
Acronyms / Abbreviations WIC WAN Interface Card Definition Page 5 of 26
Terminology Term Authorized Administrator CUCM Security Administrator SIP Server User Table 2 Terminology Definition Any user which has been assigned to a privilege level that is permitted to perform all TSF-related functions. Cisco Unified Communications Manager (CUCM) serves as the software-based callprocessing component of the Cisco Unified Communications family of products. The CUCM extends enterprise telephony features and functions to packet telephony network devices such as IP phones, media processing devices, voice-over-ip (VoIP) gateways, and multimedia applications. Synonymous with Authorized Administrator for the purposes of this evaluation. The SIP Server (the CUCM) interacts with a VoIP client (TOE) and provides registrar and proxy capabilities required for call-session management as well as establishing, processing, and terminating VoIP calls. Any entity (human user or external IT entity) outside the TOE that interacts with the TOE. Page 6 of 26
DOCUMENT INTRODUCTION Prepared By: Cisco Systems, Inc. 170 West Tasman Dr. San Jose, CA 95134 This document provides supporting evidence for an evaluation of a specific Target of Evaluation (TOE), the Cisco Jabber for Windows. This Operational User Guidance with Preparative Procedures addresses the administration of the TOE software and hardware and describes how to install, configure, and maintain the TOE in the Common Criteria evaluated configuration. Page 7 of 26
1 Introduction This Operational User Guidance with Preparative Procedures documents the administration of the Cisco Jabber for Windows, the TOE, as it was certified under Common Criteria. The Cisco Jabber for Windows may be referenced below as the Cisco Jabber for Windows, Jabber, or simply TOE. 1.1 Audience This document is written for administrators configuring the TOE, Cisco Jabber for Windows. This document assumes that you are familiar with Cisco or equivalent call processing and unified communications products. It is also assumed that you have a general understanding and knowledge with the basic concepts and terminologies used in enterprise telephony features and functions to packet telephony network devices such as IP phones, media processing devices, voice-over-ip (VoIP) gateways, and multimedia applications, that you are a trusted individual, and that you are trained to use the operating systems on which you are running in your network. 1.2 Purpose This document is the Operational User Guidance with Preparative Procedures for the Common Criteria evaluation. It was written to highlight the specific TOE configuration and administrator functions and interfaces that are necessary to configure and maintain the TOE in the evaluated configuration. It is recommended that you review the Common Criteria certified Microsoft Windows 8 Security Target 1 for its evaluated configuration requirements and settings as the operating system hosting the TOE. It is also recommended that you review the Common Criteria certified Cisco Unified Communications Manager (CUCM) Security Target 2 for its evaluated configuration requirements and settings as the SIP Sever that performs secure call-control. The evaluated configuration is the configuration of the TOE that satisfies the requirements as defined in the Security Target (ST). This document covers all of the security functional requirements specified in the ST and as summarized in Section 3 of this document. This document does not mandate configuration settings for the features of the TOE that are outside the evaluation scope, which should be set according to your organizational security policies. This document is not meant to detail specific actions performed by the administrator but rather is a road map for identifying the appropriate locations within Cisco documentation to get the specific details for configuring and maintaining Jabber for Windows operations. It is recommended that you read all instructions in this document and any references before performing steps outlined and entering commands. Section 7 Related Documentation of this document that provides information for obtaining assistance. 1 http://www.commoncriteriaportal.org/products/ 2 http://www.commoncriteriaportal.org/products/ Page 8 of 26
1.3 Document References This section lists the Cisco Systems documentation that is also the Common Criteria Configuration Item (CI) List. The documents used are shown below in Table 3. Throughout this document, the guides will be referred to by the #, such as [1]. Table 3 Cisco Documentation # Title Link [1] Cisco Jabber 11.0 Planning Guide http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/11_0 /CJAB_BK_C04C09E7_00_cisco-jabber-110-planning-guide.html [2] Cisco Jabber 11.0 Deployment and Installation Guide http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/11_0 /CJAB_BK_D657A25F_00_deployment-installation-guide-jabber- 110.html [3] Cisco Jabber for Windows 11.0 Release Notes [4] Cisco Jabber for Windows 11.0 User Guide [5] Cisco Jabber FIPS 140-2 Certificate [6] Cisco Jabber for Windows Common Criteria Guidance, version 0.1 [6] Cisco Jabber for Windows Security Target, version.01 http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/win dows/11_0/rn/jabw_bk_c5e7828c_00_cisco-jabberwindows-11-release-notes.html http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/win dows/11_0/ug/jabw_bk_cd4ea7a2_00_cisco-jabber-forwindows-110-userguide.html Refer to FIPS certificate 2100; Cisco FIPS Object Module (Software Version: 4.1) Not Applicable Not Applicable 1.4 Supported Hardware and Software Only the hardware and software listed in section 1.5 of the Security Target (ST) is compliant with the Common Criteria evaluation. Using hardware not specified in the ST invalidates the secure configuration. Likewise, using any software version other than the evaluated software listed in the ST will invalidate the secure configuration. The TOE is a software-only solution comprised of the Jabber OS software image Release 11.0. The TOE is a software solution that is installed on the following Microsoft Window operating systems: Microsoft Windows 8 32 bit and 64 bit (supported in desktop mode only) Page 9 of 26
Refer to the Microsoft Windows 8 Security Target 3 for information regarding the evaluated configuration requirements of Microsoft Windows 8 as the hosting operating system for the TOE. The TOE also requires support of Cisco Unified Communications Manager (CUCM), release 11.0 or later as the SIP Server. Cisco CUCM serves as the call-processing component for voice that includes IP telephony, mobility features and calls controls. As such there are configuration settings that are pushed to Jabber for Windows that are required in the evaluated configuration. These settings cannot be changed. Refer to the Common Criteria certified Cisco Unified Communications Manager (CUCM) Security Target 4 for information regarding the evaluated configuration requirements of CUCM. The following table identifies the minimum hardware requirements for Jabber to run on Microsoft Windows 8: Table 4 Jabber for Windows Requirements Requirement Installed RAM Free Physical Memory Free Disk Space CPU Speed and Type 2 GB RAM 128 MB 256 MB Cisco Jabber for Windows Mobile AMD Sempron Processor 3600+ 2 GHz Intel Core2 CPU T7400 at 2. 16 GHz Intel Atom Jabber can be installed on any support hardware that is also supported by Microsoft Windows 8. The following hardware platforms and components are included in the evaluated configuration of Microsoft Windows 8 Pro and Enterprise Edition, 32 bit and 64 bit. Microsoft Surface Dell Optiplex GX620 Dell XPS 8500 ASUS VivoTab (Windows RT NVidia tablet) Dell XPS10 (Windows RT Qualcomm tablet) Dell Precision M6300 Trusted Platform Module Refer to the Microsoft Windows 8 Security Target 5 for additional information regarding the evaluated configuration and hardware requirements. 3 http://www.commoncriteriaportal.org/products/ 4 http://www.commoncriteriaportal.org/products/ 5 http://www.commoncriteriaportal.org/products/ Page 10 of 26
The network, on which the TOE resides, is considered part of the environment. 1.5 Operational Environment 1.5.1 Supported non-toe Hardware/ Software/ Firmware The TOE supports the following hardware, software, and firmware components in its operational environment. Each component is identified as being required or not based on the claims made in this Security Target. All of the following environment components are supported by the TOE evaluated configurations. Table 5: Operational Environment Components Component Required Usage/Purpose Description for TOE performance Certification Authority No This includes any IT Environment Certification Authority on the TOE network. This can be used to validate certificates. Management Workstation installed with Microsoft Windows 8 Remote SIP Endpoint/Peer in this evaluation it is the Cisco Unified Communications Manager (CUCM)) Yes Yes This includes any IT Environment Management workstation that supports the requirements defined in Section 1.4 Supported Hardware and Software This includes any peer with which the TOE participates in SDES-SRTP communications. SIP peers may be any device or remote VoIP application that supports SDES- SRTP communications. 1.6 Excluded Functionality Excluded Functionality Non-FIPS 140-2 mode of operation on the router. Table 6 Excluded Functionality Exclusion Rationale This mode of operation includes non-fips allowed operations. These services will be disabled by configuration. The exclusion of this functionality does not affect compliance to the Protection Profile for Voice Over IP (VoIP) Applications, version 1.3. Page 11 of 26
2 Secure Acceptance of the TOE In order to ensure the correct TOE is received, the TOE should be examined to ensure that that is has not been tampered with during delivery. Verify that the TOE software was not tampered with during delivery by performing the following actions: Step 1 Before acquiring the TOE, review Cisco Jabber Planning Checklist [1]. The checklist provides deployment scenarios, the supported operating systems, hardware and network requirements. Step 2 To verify the software version [2] Install Client -> Install Cisco Jabber for Windows. The Jabber for Windows version is stamped or indicated on the MSI 6 file. When the binary is downloaded it is verified by the Client Platform as being signed by a trusted source. Step 3 To verify the software version installed, see Table 7 below provides the detail information for the evaluated configuration that must be checked to ensure the software has not been modified in anyway. Table 7 Evaluated Software Images Software Version Image Name Hash Jabber for Windows 11.0 (Install) Jabber for Windows 11.0 (Admin) CiscoJabber-Installffr.11-0.zip CiscoJabber-Adminffr.11-0.zip MD5 Checksum: e2d169d946d830749efd77b88af829df SHA512 Checksum: 49e8a98d53d68d800d4d3110d643dd7a... MD5 Checksum: 68494370adfa46b606ec88d161c928c7 SHA512 Checksum: bdd5b3d26ffc9f763f160c4bb255ce13... For any updates delivered through the trusted update mechanism, to verify the software has not been modified, on the download page hoover the cursor over the file information for the details. 6 MSI is an installer package file format used by Windows. Its name comes from the program's original title, Microsoft Installer, which has since changed to Windows Installer. MSI files are used for installation, storage, and removal of programs. Page 12 of 26
Page 13 of 26
3 Secure Installation and Configuration 3.1 Installation and Initial Setup of Jabber Prior to installing Jabber, refer to the Planning Guide [1]. The planning guide provides an overview of the features available in Jabber for Windows, deployment scenarios such as on premise or the cloud and the requirements for hardware, software, network, and certificates. Cisco Jabber for Windows is installed on the Common Criteria certified Microsoft Windows 8 32 bit and 64 bit (supported in desktop mode only) 7. Refer to the Microsoft Windows 8 Security Target for information regarding the evaluated configuration requirements of Microsoft Windows. Cisco Jabber for Windows also requires support of Cisco Unified Communications Manager (CUCM), release 11.0 or later as the SIP Server. Cisco CUCM serves as the call-processing component for voice that includes IP telephony, mobility features and calls controls. As such there are configuration settings that are pushed to Jabber for Windows that are required in the evaluated configuration. These settings cannot be changed. Refer to the Cisco Unified Communications Manager (CUCM) for information regarding the evaluated configuration requirements of CUCM. In the evaluated configuration, the TOE will be installed in on-premises deployment scenario that is one in which the Administrator set ups, manages, and maintains all services on the corporate network. In addition, the TOE will be deployed in Phone Mode. In Phone mode, the end-user's primary authentication is to the SIP Server, Cisco Unified Communications Manager (CUCM). In this deployment, the Administrator provision users with devices for audio and video capabilities. The Administrator can also provision users with additional services such as voicemail. Note in the evaluated configuration, video capabilities are not evaluated or tested. Refer to Configuration and Installation Workflows in [2] to proceed with the installation of Jabber on Windows. 3.1.1 Enabling FIPS Mode Cisco Jabber for Windows is compliant with FIPS 140.2. In order to run the client in FIPS mode, you must enable FIPS on your Windows operating system. The client detects that the operating system is in FIPS mode and runs in FIPS mode. FIPS mode results in the client managing certificates more strictly. Users in FIPS mode may see certificate errors in the client if a certificate for a service expires and users do not reenter their credentials before they expire. Users also see a FIPS icon in their hub window to indicate the client is running in FIPS mode. Refer to Microsoft Windows 8 Security Target 8 for more information. 7 http://www.commoncriteriaportal.org/products/ 8 http://www.commoncriteriaportal.org/products/ Page 14 of 26
3.1.2 Configuration and Certificates Jabber for Windows requires the Authorized Administer has created and configured at least one Cisco Jabber Device for every user that access Cisco Jabber for Windows. This entails the proper files have been installed, mobility has been enabled for each user, SIP profiles have been configured, create Phone Security Profiles for secure phone capabilities and that the Cisco Certificate Authority Proxy Function (CAPF) service parameters value for Certificate Issuer to Endpoint is Cisco Certificate Authority Proxy Function, as this is the only option supported by Cisco Jabber for Windows. Refer to Security Guide for Cisco Unified Communications Manager, Release 11.0(1) 9 This CUCM SIP Server configuration setup generates the authentication string (password) that will be provided to the end user. The end users must specify the authentication string in the client interface to access their devices and securely register with Cisco Unified Communications Manager. When users enter the authentication string in the client interface, the CAPF enrollment process begins. User associations must also be configured where the end user is associated with a device and the device is provisioned to the end user. Refer to [2] Configure Voice and Video Communication - >Configure User Associations. Jabber for Windows as configured by CUCM SIP Server requires authentication using passwords for SIP Register functions. Therefore, Jabber for Windows must be configured to use a username and SIP authentication password for access to SIP (voice) calls. The user password must be at least eight (8) characters. The supported character set includes upper and lower case letters, numeric 0-9 and the following special characters!, @, #, $, %, ^, &, *, (, and ). Once the CUCM has been setup and configured, the user can access their account and set their password. Refer to [2] Configure Voice and Video Communications ->Configure Voice and Video Communications for On-Premises Deployments ->Create and Configure Cisco Jabber Devices ->Provide Users with Authentication Strings. For certificate validation, Cisco Jabber for Windows uses certificate validation to establish secure connections with CUCM SIP Servers. When attempting to establish secure connections, CUCM SIP Servers present Cisco Jabber for Windows with certificates. Certificates are required for each service to which the Jabber clients connect. The following certificates are required for the on premises server configurations to establish secure connection with the TOE: Server CUCM Certificate HTTP (Tomcat) and CallManager certificate (secure SIP call signaling for secure phone) 9 http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/11_0_1/secugd/cucm_bk_c1a78c1d_00_ cucm-security-guide-1101.html Page 15 of 26
Cisco Jabber for Windows uses Microsoft Windows 8 to verify the certificate information and validation. Both OCSP and CRL s are supported for validation depending on the information supplied in the certificate. Refer to Microsoft Windows 8 Security Target 10 and CUCM SIP Server Security Target 11 for more information. To ensure that certificate validation occurs without users receiving a prompt to accept or decline certificates, deploy certificates to the local certificate store of the endpoint clients; in this case the certificate store is managed by the hosted operating system, Microsoft Windows 8. If a wellknown public CA is used, then the CA certificate may already exist in Microsoft Windows 8 certificate store or keychain. If so, then no need to deploy CA certificates. If the CA certificate is not already on the Microsoft Windows 8 certificate store or keychain, then the CA certificate will need to be deployed. To manually deploy the certificates perform the following steps, Step 1 Make the CA certificate available to the Cisco Jabber for Windows client machine. Step 2 From the Windows machine, open the certificate file. Step 3 Install the certificate and then select Next. Step 4 Select Place all certificates in the following store, then select Browse. Step 5 Select the Trusted Root Certification Authorities store. When you finish the wizard, a message is displayed to verify successful certificate import. After the certificates have been added to the Microsoft Windows 8 certificate store or keychain verify that the certificate is installed in the correct certificate store by opening the Windows Certificate Manager tool, browse to Trusted Root Certification Authorities > Certificates. The CA root certificate is listed in the certificate store. Refer to [2] Set Up Certificate Validation -> Configure Certificates for an On-Premises Deployment. 3.2 Network Protocols and Cryptographic Settings Jabber for Windows provides cryptography in support of SIP connections via Security Real- Time Transport Protocol (SRTP) that has been established using the Session Description Protocol (SDP) and the Security Descriptions for Media Streams (SDES) for SDP. The TOE also protects communications between itself and the CUCM SIP Server by using a Transport Layer Security (TLS)-protected signaling channel. A phone security profile must be setup and configured on the CUCM SIP Server. Once the profile has been configured, then user mobility must be enabled to provision the remote device. This assigns the end user as the owner of the device. Refer to [2] Configure Voice and Video Communications for On-Premises, then Create SIP Profiles, Enable User Mobility, then Create and Configure Cisco Jabber Devices. Note: In the evaluated configuration, it is not recommended to configure a CTI Service since this allows users to control the devices. 10 http://www.commoncriteriaportal.org/products/ 11 http://www.commoncriteriaportal.org/products/ Page 16 of 26
3.2.1 SIP Connections and Protocols There is no direct admin or user interaction on the TOE to configure or set the SRTP channel. The CUCM SIP Server administrator configures the required settings appropriately and then each time a call is made the TOE automatically starts SRTP streams are negotiated. There is no user or admin interaction per-srtp-channel. The CUCM SIP Server administrator can also configure the port ranges for the voice and video streams. If network loss on the SRTP sessions occurs, the TOE automatically attempts to recover. If the user remains dissatisfied with the result, they can end the call and redial. The communication is initiated on the TOE by the user dialing a number. The SIP connections between the TOE and the CUCM SIP Server are over TLS. If the CUCM SIP Server has been configured to Authenticated as the value for the Device Security Mode field on the phone security profile, the SIP connection is over TLS using NULL-SHA encryption. If Encrypted is set as the value for the Device Security Mode field on the phone security profile, the SIP connection is over TLS using AES 128/SHA encryption. The mutual TLS ensures that only Client Services Framework (CSF) devices (i.e. the TOE) with the correct certificates can register to CUCM SIP Server. Likewise, CSF devices can register only to CUCM SIP Server instances that provide the correct certificate. In the evaluated configuration, secure phone capabilities are required. This is to ensure that connections to the CUCM SIP Server are secure. The CUCM SIP Server pushes secure configuration settings to the TOE that cannot be changed or modified in the evaluated configuration. Refer to Security Guide for Cisco Unified Communications Manager, Release 11.0(1) 12 In the evaluated configuration when the TOE is configured for secure connections with CUCM SIP Server, the SIP connections are secured with TLS 1.0 (RFC 2246) or TLS 1.2 (RFC 5246) with the following ciphersuites: TLS_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH _AES_256_GCM_SHA384 Refer to [2] Set Up Certification Validation. Refer to [2] Configure Voice and Video Communications Also refer to the Security Guide for Cisco Unified Communications Manager, Release 11.0(1) 13. 12 http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/11_0_1/secugd/cucm_bk_c1a78c1d_00_ cucm-security-guide-1101.html 13 http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/11_0_1/secugd/cucm_bk_c1a78c1d_00_ cucm-security-guide-1101.html Page 17 of 26
4 Secure Management 4.1 SIP Servers To connect to CUCM SIP Server services, the TOE requires the following information: Source of authentication that enables users to sign in to the client. Location of services. In addition, during the initial setup of Jabber for Windows, the CUCM SIP Servers that are used for connections need to be identified and configured. Providing this information depends on the deployment type and product mode. In the evaluated configuration, the TOE will be installed in on-premises deployment scenario that is one in which the Administrator set ups, manages, and maintains all services on the corporate network. In addition, the TOE will be deployed in Phone Mode. In Phone mode, the end-user's primary authentication is to the SIP Server, Cisco Unified Communications Manager (CUCM). As described above in Section 3 Secure Installation and Configuration during the initial setup and configuration, the CUCM SIP Server pushes the required configuration settings for establishing secure connections to the prescribed CUCM SIP Server.. When the setup is completed, secure TLS connections between the TOE and the CUCM SIP Server are established. For the secure SIP connections required for calls, the connection is established when the user initiates a call. 4.2 Client Credentials and SIP Authentication Jabber for Windows must be configured for secure phone (SIP calls) capabilities for all devices. Secure phone capabilities provide secure SIP signaling, secure media streams, and encrypted device configuration files. The Jabber client credentials that are used for connections as well as the password requirements for the SIP connections (voice calls) are described in Section 3.1.2 Configuration and Certificates in this document. 4.3 Product Updates To check the current version, on the TOE click on the menu button and select Help and then select About Cisco Jabber. Page 18 of 26
To check for updates, on the TOE click on the menu button and select Help and then select Check for Updates. When software updates are made available by Cisco, an administrator can obtain, verify the integrity of, and install those updates. The updates can be downloaded from Cisco.com. A digital signature is used to verify software/firmware update files (to ensure they have not been modified from the originals distributed by Cisco) before they are used to actually update the TOE. When there is an update for Jabber for Windows, the process to update is the same as a new installation. See Section 2 Secure Acceptance of the TOE in this document for the method to download and verify an image prior to running it on the TOE. Cisco Jabber for Windows provides an MSI installation package that you can use in the following ways: A Group Policy, may be configured the Authorized Administrator of the Client Platform may to be used as a deployment mechanism to install the TOE on multiple computers in the same domain. This method allows the Authorized Administrator of the Client Page 19 of 26
Platform to push updates to the TOE by downloading the binary to specific configuration location. The Authorized Administrator of the Client Platform may also run the MSI file manually on the file system of the TOE and then specify connection properties when the Client Platform is started. This method is normally used for installing a single instance for testing or evaluation purposes. The Authorized Administrator of the Client Platform may also create a Custom Installer. This method is used when the same installation properties are being distributed across the domain. The Jabber for Windows version is stamped or indicated on the MSI file. When the binary is downloaded it is verified by the Client Platform as being signed by a trusted source. Section 3 in this document provides the instructions and methods used for installing and updating the TOE. 4.4 Jabber Features and Calls The following diagram is an example for the Jabber for Windows hub window. 1. Status message 6. Recent calls 2. Menu 7. Voice Messages 3. Search or call bar 8. Meetings 4. Contacts 9. Custom Groups 5. Chat Rooms 10. Phone Controls You can access your options and preferences for to customize how the TOE behaves. Page 20 of 26
Procedure: 1. From the hub window, select Menu > File > Options. 2. Select any tab in the Options menu to make your choices. For more details and information related to the TOE features refer to [4]. Note, some options may not be available depending on the deployment options that were configured or covered by this certification. 4.4.1 Contacts Directory groups are maintained by Authorized Administrator of the Client Platform for your enterprise. When a directory group to your Contacts list is added, then the list of people assigned to that directory group are automatically added to the group in your contacts. You do not have to maintain the list because it synchronizes automatically with the directory for your enterprise, meaning that people are added and removed from the group in your Contacts whenever the administrator adds or removes them from the enterprise directory. You can remove a directory group from your contacts list at any time. You can also add contacts that are external to the organization if the Authorized Administrator of the Client Platform has enabled this feature. Procedure: Step 1 - Select File > New and select the type of contact that you want to add. Step 2 - Enter the email address of your contact. For custom contacts without an IM address, enter the contact details that you want to use. Step 3 Select a contact group. Step 4 Select Add. 4.4.2 Calls Step 1 Access the phone number options for your contact. For example, right-click on a contact in your contact list and choose Call, or from a chat window, click on the phone numbers/address list drop-down list. Step 2 Choose Jabber Call. There are several features that suspend or stop voice media on a call; such as setting the call on hold, transfer, or end call. In addition, entering/leaving a conference can also interrupt voice data briefly. Page 21 of 26
When a call is placed on voice mute (silence), the connections is not ended or stopped, simply voice data from the microphone is no longer being sent. Using the Jabber call screen, selecting the Mute icon will mute the voice audio. Selecting the Mute icon again will unmute. You can also place a call on Hold. Using the Jabber call screen, selecting the More icon and then selecting Hold will place the call on hold or resume the call. You can also Transfer a call to another paerson. Using the the Jabber call screen, selecting More icon, then selecting Transfer, then enter the number you wish to transfer the call too, will transfer the call. End the call by selecting the telephone icon. For all these functions, the implementation is via SIP and SDP messaging, and the SDP messaging includes the necessary crypto options for secure connections. Any change of participant results in re-keying (unless they are connected to a conference bridge and each endpoint has a unique set of keys applied only to the call leg between it and the bridge). Page 22 of 26
5 Modes of Operation The Jabber has several modes of operation, these modes are as follows: Deployment Mode: Setup and available configuration options Full UC and Cisco Jabber for Everyone (IM Only) The default product mode is one in which the user's primary authentication is to a presence server. At a minimum, users have instant messaging and presence capabilities. Both full UC and Cisco Jabber for Everyone deployments use the default product mode. To deploy full UC, Authorized Administrators enable instant messaging and presence capabilities. Then provision users with devices for audio and video in addition to voicemail and conferencing capabilities. To deploy Cisco Jabber for everyone, Authorized Administrators enable instant messaging and presence capabilities. Authorized Administrators can optionally provision users with desk phone devices that they can control with the client. Phone Mode (this is the required mode for the evaluated configuration) In phone mode, the user's primary authentication is to Cisco Unified Communications Manager (CUCM) SIP Server. To deploy phone mode, Authorized Administrators provision users with devices for audio and video capabilities. Authorized Administrators can also provision users with additional services such as voicemail. In phone mode deployments Cisco Unified Communications Manager (CUCM) SIP Server is the authenticator. When the client (the TOE) gets the authenticator, it determines the product mode is phone mode. However, because the client always starts in the default product mode on the initial launch, users must restart the client to enter phone mode after sign in. Operational This is the normal operation of Jabber for Windows. The TOE image and configuration is loaded and the TOE is operating as configured. However, the configuration of the TOE can have a detrimental effect on security; therefore, adherence to the guidelines in this document should be followed. Misconfiguration of the TOE could result in the unprotected access to CUCM SIP Server and non-secure SIP calls. Trouble-shooting - Unable to Access Features When there is an issue with a feature, for example, you cannot access your voice messages, you may have an issue with your connection status. 2015, Cisco Systems, Inc. All rights reserved. This document can be reproduced in full without any modifications.
6 Security Measures for the Operational Environment Proper operation of the TOE requires functionality from the environment. It is the responsibility of the authorized administrator of the TOE to ensure that the Operational Environment provides the necessary functions, and adheres to the environment security objectives listed below. The environment security objective identifiers map to the environment security objectives as defined in the Security Target. Environment Security Objective OE.AUTHORIZED_USER Table 8 Operational Environment Security Measures IT Environment Security Objective Definition The user of the TOE is non-hostile and follows all user guidance. OE.OPER_ENV OE.TRUSTED_ADMIN The operational environment will provide a SIP infrastructure to establish a VoIP connection; a PKI to provide certificates; and an execution domain to support correct operation of the TOE. TOE Administrators are trusted to follow and apply all administrator guidance in a trusted manner. Page 24 of 26
7 Related Documentation For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation at: With CCO login: http://www.cisco.com/en/us/partner/docs/general/whatsnew/whatsnew.html Without CCO login: http://www.cisco.com/en/us/docs/general/whatsnew/whatsnew.html Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0. You can access the most current Cisco documentation on the World Wide Web at the following sites: http://www.cisco.com http://www-china.cisco.com http://www-europe.cisco.com 7.1 Documentation Feedback If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. You can e-mail your comments to bug-doc@cisco.com. To submit your comments by mail, for your convenience many documents contain a response card behind the front cover. Otherwise, you can mail your comments to the following address: Cisco Systems, Inc., Document Resource Connection 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. 7.2 Obtaining Technical Assistance Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools. For Cisco.com registered users, additional troubleshooting tools are available from the TAC website. Page 25 of 26
Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco. Cisco.com provides a broad range of features and services to help customers and partners streamline business processes and improve productivity. Through Cisco.com, you can find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online technical support, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available. Customers and partners can self-register on Cisco.com to obtain additional personalized information and services. Registered users can order products, check on the status of an order, access technical support, and view benefits specific to their relationships with Cisco. To access Cisco.com, go to the following website: http://www.cisco.com Page 26 of 26