/mcp• Choose System > Enterprise Phone to configure system defaults for ICE. • Choose Device > Device Settings > Common Phone Profile to configure ICE for groups of endpoints and select the profile you want to edit. • Choose Device > Phone to configure ICE for an individual Cisco Jabber desktop endpoint and select the endpoint that you want to edit. Step 2 Scroll down to the Interactive Connectivity Establishment (ICE) section. Step 3 Set the ICE drop-down list to Enabled. Step 4 Set the Default Candidate Type: • Host—A candidate obtained by selecting the IP address on the host device. This is the default. • Server Reflexive—An IP address and port candidate obtained by sending a STUN request. In many cases, this may represent the public IP address of the NAT. • Relayed—An IP address and port candidate obtained from a TURN server. The IP address and port are resident on the TURN server such that media is relayed through the TURN server. Step 5 From the Server Reflexive Address drop-down list, select whether you want to enable STUN-like services by setting this field to Enabled or Disabled. You must set this field to enabled if you configured Server Relexive as the Default Candidate. Step 6 Enter the IP address or hostname for the Primary and Secondary TURN Servers. Step 7 Set the TURN Server Transport Type to Auto (default setting), UDP, TCP, or TLS. Step 8 Enter the Username and Password of the TURN Server. Step 9 Click Save. Note If you configured ICE for a Common Phone Profile, you must associate phones to that Common Phone Profile for phones to be able to use the profile. You can apply the profile to a phone through the Phone Configuration window. Configure Phone Security Profile for Mobile and Remote Access Use this procedure to set up a phone security profile to be used by Mobile and Remote Access endpoints. Procedure Step 1 From Cisco Unified CM Administration, choose System > Security > Phone Security Profile. Step 2 Click Add New. Step 3 From the Phone Security Profile Type drop-down list, select your device type. For example, you could select Cisco Unified Client Service Framework for a Jabber application. Step 4 Click Next. Step 5 Enter a Name for the profile. For Mobile and Remote Access, the name must be in FQDN format and must include the enterprise domain. Step 6 From the Device Security Mode drop-down list, select Encrypted. Note This field must be set to Encrypted. Otherwise, Expressway rejects communications. Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs 75 Remote Worker Features Configure Phone Security Profile for Mobile and Remote Access