Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management

Publisher

Cisco Systems

URL

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/15/security/guide/b_15cucsecx/b_15cucsecx_chapter_0110.html

Published

2025-06-11

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

Cisco documentation; all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• With Administrator Must Unlock checked in an authentication rule, a locked-out user cannot regain access until an administrator unlocks the account; Cisco advises checking it only where an administrator is readily available or the system is prone to toll fraud. in context
• Unity Connection authentication rules set the failed sign-in limit, lockout duration, credential expiry, minimum length and history for phone PINs and web passwords, and the failed sign-in setting governs the phone interface, Cisco PCA and Connection Administration. in context
• The Minimum Number of Character Changes between Successive Credentials setting applies to web application passwords only, not phone PINs, and defaults to 1. in context
• A maximum concurrent sessions limit (default zero, disabled) can be set; beyond it a new telephony session is disconnected and a new Visual Voicemail or IMAP login is denied. in context
• The Unity Connection 15 security guide recommends not enabling Never Expires and suggests web passwords expire after 120 days and phone PINs after 180 days, after which users are prompted to change the credential at next sign-in. in context
• Cisco's Unity Connection 15 security guide recommends locking user accounts after three failed sign-in attempts. in context
• Unity Connection's inactivity timeout disables user accounts after a configured number of days without use and is disabled (zero) by default. in context
• Because the phone PIN and the web password are separate credentials with separate password settings, unlocking a user's web application password probably does not clear a phone PIN lockout, and the reverse; check the state of each one separately. inferred in context
• Unity Connection authentication rules do not govern web application passwords when LDAP authentication is enabled or under Unified CM Business Edition, because Unity Connection does not perform that authentication; users sign in with their LDAP or CMBE password. in context
• Cisco recommends a minimum phone PIN length of six or more digits, and a change to Minimum Credential Length takes effect only when a user next changes the credential. in context
• A Unity Connection user's phone PIN and Cisco PCA web password are separate, unsynchronised credentials, and first-time phone enrollment does not prompt for a web password change. in context
• Stored Number of Previous Credentials defaults to 5, and a new PIN or password matching one in that history is rejected. in context
• The Reset Failed Sign-In Attempts Every N Minutes setting clears the failed-attempt count unless the account is already locked, and the security guide recommends 30 minutes. in context
• With trivial checking enabled, Unity Connection rejects a phone PIN that matches the numeric spelling of the user's first or last name or contains the user's primary or alternate extensions or their reverse. in context
• A non-trivial Unity Connection PIN may not use repeated digit groups such as 408408, only two distinct digits, a digit more than twice in a row, ascending or descending runs, or straight, vertical or diagonal keypad lines such as 147 or 159. in context

Cite this source record

APA

WarmTransfer. (2025, June 11). Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-cuc15-security-pins-auth-rules

BibTeX

@misc{warmtransfer-cisco-cuc15-security-pins-auth-rules,
  title  = {Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management},
  author = {{WarmTransfer}},
  year   = {2025},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-cuc15-security-pins-auth-rules},
  note   = {Cisco Systems, accessed 2026-10-02}
}