Joe, great instructions.<br><br>I have one additional comment that my be unpopular.<br><br>A token that has been locked due to excessive password attempts is not eligible for an RMA. It's not defective equipment, it's a security device that has given its life in the line of duty (per design).<br>
<br>You could argue that the design isn't quite as forgiving as it needs to be (I've had my tokens ruined by lending them out to a colleague), but you can't argue that it's defective equipment that the manufacturer should replace free of charge.<br>
<br>-Burns<br><br><div class="gmail_quote">On Thu, May 5, 2011 at 9:44 AM, Joe Martini <span dir="ltr"><<a href="mailto:joemar2@cisco.com">joemar2@cisco.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div style="word-wrap:break-word">If the password has been entered incorrectly too many times the token cannot be recovered. Hopefully you still have one with a known password so that you can get a new token to replace the locked one. Then update the CTL file with the new token using the one remaining token that was originally used. That's why it's a requirement to order two, in case one is lost or locked out there is a backup. If you've lost both here's what you'll need to do: <a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/security/4_2_3/secutrbl.html#wp1032731" target="_blank">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/security/4_2_3/secutrbl.html#wp1032731</a><div>
<br></div><font color="#888888"><div>Joe</div></font><div><div></div><div class="h5"><div><br><div><div>On May 5, 2011, at 9:30 AM, Jason Aarons (AM) wrote:</div><br><div>
I would call TAC, installing a new CTL would mean visiting each phone (or use UnifiedFX) and resetting the CTL. Not something you want to have happen.<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a> [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Antonio Soares <br>
Sent: Thursday, May 05, 2011 7:38 AM<br>
To: 'Wes Sisk'; 'Ed Leatherman'<br>
Cc: 'Cisco VOIP'<br>
Subject: Re: [cisco-voip] CTL/Security Token question<br>
<br>
I have a customer that failed the Security Token Password 3 times and now the token is locked.<br>
Anyone knows how to solve this problem ?<br>
Do I need to replace the token via RMA ?<br>
<br>
<br>
Thanks.<br>
Regards,<br>
<br>
Antonio Soares, CCIE #18473 (R&S/SP)<br>
<a href="mailto:amsoares@netcabo.pt" target="_blank">amsoares@netcabo.pt</a> <br>
<a href="http://www.ccie18473.net/" target="_blank">http://www.ccie18473.net</a> <br>
<br>
<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a> <br>
[mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Wes Sisk<br>
Sent: segunda-feira, 4 de Abril de 2011 16:45<br>
To: Ed Leatherman<br>
Cc: Cisco VOIP<br>
Subject: Re: [cisco-voip] CTL/Security Token question<br>
<br>
We do this in our labs. Just be careful to keep track of password changes. Using the tokens requires a password. Guess the wrong password too many times and they do self destruct. This would effectively lock you out of all clusters that use that key.<br>
<br>
Regards,<br>
Wes<br>
<br>
On 4/4/2011 10:27 AM, Ed Leatherman wrote:<br>
> Hello,<br>
><br>
> I'm doing some studying on control/media encryption for call manager, <br>
> and was wondering if someone could answer a (hopefully simple) <br>
> question about signing CTL's. Does the act of signing a CTL actually <br>
> affect the security token(s) in any way? Can I buy a set of security <br>
> tokens, use them to configure everything on lab CM, and then re-use <br>
> the same tokens in production?<br>
><br>
> The documentation seems to infer this (along with a best practice of <br>
> building in test first), but it doesn't come right out and say you can <br>
> reuse the same tokens. Would be kind of goofy if it locked them to a <br>
> particular cluster some how and I don't think that's the case. I was <br>
> hoping for a bit of confirmation though.<br>
><br>
> Thanks!<br>
><br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a> <br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a> <br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a> <br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a> <br>
<br>
<br><div><br></div><hr size="1"><div><br></div><p><b><font size="2"><font color="#808080">
Disclaimer:
This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.
</font></font></b></p><b><font size="2"><font color="#808080"></font></font></b><font size="2"><font color="#808080"></font></font></div><font size="2"><font color="#808080">
_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</font></font></div><br></div></div></div></div><br>_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br></blockquote></div><br>