{"id":1078,"date":"2021-04-18T16:15:40","date_gmt":"2021-04-18T08:15:40","guid":{"rendered":"\/?p=1078"},"modified":"2021-04-18T16:15:40","modified_gmt":"2021-04-18T08:15:40","slug":"migrating-cisco-ip-phones-between-cucm-clusters","status":"publish","type":"post","link":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/","title":{"rendered":"Migrating Cisco IP Phones Between CUCM Clusters"},"content":{"rendered":"

I’m currently in the midst of migrating two old CUCM clusters (8.6.x, 9.1.x) to a new 12.5 cluster. One of the challenges I faced was how to migrate the IP handsets, which are all secured to their original cluster.
\nThe security provided by CUCM for IP handsets is that of the Initial Trust List file on the phone. It’s then verified against the Trust Verification Service on the Call Manager instance. This stops a phone joining the wrong or rouge Call Manager instance.
\nSo when it comes to migration how can you clear the phones ITL so that it will join the new Call Manager? There are multiple options to achieve this:<\/p>\n

1. Downgrade the security level on the existing cluster to pre 8.x which removes need for ITL and TVS. This is destructive and is only really an option if the existing CM is being retired straight away.
\n2. Buy software that bulk removes the ITL\/CTL with AXL etc. Cost prohibitive.
\n3. Use the Bulk certificate method to update the existing CM with the new CM certificates so the phones will trust the migration.<\/p>\n

I worked with TAC on this because specifically there was a cert missing from the Bulk update method on the Cisco website. I was also hitting bug CSCuy43181 wherein the GUI fails to import the generated bulk cert.
\n\"CSCuy43181\"<\/a><\/p>\n

Here are the steps to have the existing CM trust the new CM for IP handset migration:<\/strong>
\n1. On the new CM Servers (in this case 12.5) login to operating system management and browse to the certificates. Export the callmanager.pem (both on the publisher and subscriber) and ITLRecovery.pem (publisher only) certificates.
\n2. On the existing CM (in this case 8.6 or 9.x) Import the certificates as follows:
\ncallmanager-pub.pem - callmanager-trust
\ncallmanager-pub.pem - Phone-SAST-Trust
\ncallmanager-sub.pem - callmanager-trust
\ncallmanager-sub.pem - Phone-SAST-Trust
\nITLrecovery-pub.pem - callmanager-trust<\/code>
\nYou should find if you import these certificates on the old publisher, they will sync to the subscriber. However do not rely on this make sure they are there.
\n\"\"<\/a>
\n3. Now restart the Trust Verification Service on both Publisher and Subscriber nodes.
\n4. Update your IP Phones DHCP pool option 150 to point to the new Call Manager and reboot the phones (as they are POE reboot the switch stack). Phones will migrate to the new cluster.<\/p>\n

How does this work? The IP phone when it tries to register to the new CM checks the old CM trust verification service (port 2445) against the ITL list it has. As the old CM now trusts the certificates from the new CM the phone is able to switch active Call Managers. At this point migration is completed. This saved me hours of resetting hundreds of phones. Note that because I am migrating to a 12.x cluster the existing cluster must also trust ITLrecovery.pem<\/p>\n

Couple of things I found:<\/strong>
\n– Some phones just require a factory reset if they get stuck, in my experience so far it’s a low number
\n– Devices such as ATAs require manual reset if the are non POE powered. Some of these legacy IP Telephony devices are power adapter plugged in.<\/p>\n","protected":false},"excerpt":{"rendered":"

I’m currently in the midst of migrating two old CUCM clusters (8.6.x, 9.1.x) to a new 12.5 cluster. One of the challenges I faced was…<\/p>\n","protected":false},"author":2,"featured_media":1083,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,18],"tags":[77,121,199,200],"class_list":["post-1078","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cisco","category-voip","tag-cucm","tag-itl","tag-voice","tag-voip"],"acf":[],"yoast_head":"\nMigrating Cisco IP Phones Between CUCM Clusters - Insecure Wire<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Migrating Cisco IP Phones Between CUCM Clusters - Insecure Wire\" \/>\n<meta property=\"og:description\" content=\"I’m currently in the midst of migrating two old CUCM clusters (8.6.x, 9.1.x) to a new 12.5 cluster. One of the challenges I faced was...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\" \/>\n<meta property=\"og:site_name\" content=\"Insecure Wire\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-18T08:15:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png\" \/>\n\t<meta property=\"og:image:width\" content=\"320\" \/>\n\t<meta property=\"og:image:height\" content=\"234\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"nikonau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/insecurewire\" \/>\n<meta name=\"twitter:site\" content=\"@insecurewire\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nikonau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\"},\"author\":{\"name\":\"nikonau\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\"},\"headline\":\"Migrating Cisco IP Phones Between CUCM Clusters\",\"datePublished\":\"2021-04-18T08:15:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\"},\"wordCount\":505,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png\",\"keywords\":[\"CUCM\",\"ITL\",\"Voice\",\"VOIP\"],\"articleSection\":[\"Cisco\",\"VOIP\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\",\"url\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\",\"name\":\"Migrating Cisco IP Phones Between CUCM Clusters - Insecure Wire\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png\",\"datePublished\":\"2021-04-18T08:15:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png\",\"width\":320,\"height\":234,\"caption\":\"ITL\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.insecurewi.re\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Migrating Cisco IP Phones Between CUCM Clusters\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.insecurewi.re\/#website\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"name\":\"Insecure Wire\",\"description\":\"A Network Engineer\u2019s Perspective.\",\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.insecurewi.re\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.insecurewi.re\/#organization\",\"name\":\"Insecure Wire\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"width\":32,\"height\":32,\"caption\":\"Insecure Wire\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/insecurewire\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\",\"name\":\"nikonau\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"caption\":\"nikonau\"},\"sameAs\":[\"https:\/\/x.com\/https:\/\/twitter.com\/insecurewire\"],\"url\":\"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Migrating Cisco IP Phones Between CUCM Clusters - Insecure Wire","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/","og_locale":"en_US","og_type":"article","og_title":"Migrating Cisco IP Phones Between CUCM Clusters - Insecure Wire","og_description":"I’m currently in the midst of migrating two old CUCM clusters (8.6.x, 9.1.x) to a new 12.5 cluster. One of the challenges I faced was...","og_url":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/","og_site_name":"Insecure Wire","article_published_time":"2021-04-18T08:15:40+00:00","og_image":[{"width":320,"height":234,"url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png","type":"image\/png"}],"author":"nikonau","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/insecurewire","twitter_site":"@insecurewire","twitter_misc":{"Written by":"nikonau","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#article","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/"},"author":{"name":"nikonau","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d"},"headline":"Migrating Cisco IP Phones Between CUCM Clusters","datePublished":"2021-04-18T08:15:40+00:00","mainEntityOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/"},"wordCount":505,"commentCount":0,"publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png","keywords":["CUCM","ITL","Voice","VOIP"],"articleSection":["Cisco","VOIP"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/","url":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/","name":"Migrating Cisco IP Phones Between CUCM Clusters - Insecure Wire","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png","datePublished":"2021-04-18T08:15:40+00:00","breadcrumb":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#primaryimage","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2021\/04\/116232-technote-sbd-14.png","width":320,"height":234,"caption":"ITL"},{"@type":"BreadcrumbList","@id":"https:\/\/www.insecurewi.re\/index.php\/2021\/04\/18\/migrating-cisco-ip-phones-between-cucm-clusters\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.insecurewi.re\/"},{"@type":"ListItem","position":2,"name":"Migrating Cisco IP Phones Between CUCM Clusters"}]},{"@type":"WebSite","@id":"https:\/\/www.insecurewi.re\/#website","url":"https:\/\/www.insecurewi.re\/","name":"Insecure Wire","description":"A Network Engineer\u2019s Perspective.","publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.insecurewi.re\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.insecurewi.re\/#organization","name":"Insecure Wire","url":"https:\/\/www.insecurewi.re\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","width":32,"height":32,"caption":"Insecure Wire"},"image":{"@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/insecurewire"]},{"@type":"Person","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d","name":"nikonau","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","caption":"nikonau"},"sameAs":["https:\/\/x.com\/https:\/\/twitter.com\/insecurewire"],"url":"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/1078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/comments?post=1078"}],"version-history":[{"count":0,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/1078\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media\/1083"}],"wp:attachment":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media?parent=1078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/categories?post=1078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/tags?post=1078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}