Cisco 7960G, 7940G User Manual

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

Americas Headquarters

Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Text Part Number: OL-15498-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense.

The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Cisco’s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation.

Modifying the equipment without Cisco’s written authorization may result in the equipment no longer complying with FCC requirements for Class A or Class B digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense.

You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the Cisco equipment or one of its peripheral devices. If the equipment causes interference to radio or television reception, try to correct the interference by using one or more of the following measures:

• Turn the television or radio antenna until the interference stops.

• Move the equipment to one side or the other of the television or radio.

• Move the equipment farther away from the television or radio.

• Plug the equipment into an outlet that is on a different circuit from the television or radio. (That is, make certain the equipment and the television or radio are on circuits controlled by different circuit breakers or fuses.)

Modifications to this product not authorized by Cisco Systems, Inc. could void the FCC approval and negate your authority to operate the product.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CCDE, CCENT, Cisco Eos, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, the Cisco logo, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn is a service mark; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Cisco

Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQ Expertise, the iQ logo, iQ Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0805R)

Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo,

Net Readiness Scorecard, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MGX,

logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United

IMPLIED, INCLUDING, WITHOUT

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

Preface xiii

Overview xiii

Audience xiii

Organization xiii

Preface

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP) provides the information you need to understand, install, configure, and manage

the Cisco

Unified IP Phones 7960G and 7940G on your network.

Network engineers, system administrators, or telecom engineers should review this guide to learn the steps required to properly set up the Cisco

The tasks described are considered to be administration-level tasks and are not intended for end-users of the phones. Many of the tasks involve configuring network settings and affect the phone’s ability to function in the network.

Because of the close interaction between the Cisco Unified IP Phone and Cisco

Unified Communications Manager, these tasks require familiarity with

Cisco

Unified Communications Manager.

Organization

This manual is organized as follows:

Chapter Description

Chapter 1, “An Overview of the Cisco Unified IP Phone”

Chapter 2, “Preparing to Install the Cisco Unified IP Phone on Your Network”

Chapter 3, “Setting Up the Cisco Unified IP Phone”

Chapter 4, “Configuring Network Settings on the Cisco Unified IP Phone”

Provides a conceptual overview and description of the Cisco Unified IP Phone

Describes how the IP Phone interacts with other key IP telephony components, and provides an overview of the tasks required prior to installation

Describes how to properly and safely install and configure the Cisco

Unified IP Phone on your network

Describes how to configure network settings, verify status, and make global changes to the Cisco

Unified IP Phone on the network.

Unified IP Phone

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

xiii

Chapter Description

Chapter 5, “Configuring Features, Templates, Services, and Users”

Chapter 6, “Viewing Model Information, Status, Statistics, and Security Information on the Cisco Unified IP Phone”

Chapter 7, “Monitoring the Cisco Unified IP Phone Remotely”

Chapter 8, “Troubleshooting and Maintenance”

Appendix A, “Providing Information to Users Via a Website”

Appendix B, “Feature Support by Protocol for Cisco Unified IP Phone 7960G and 7940G”

Appendix C, “Supporting International Users”

Appendix D, “Technical Specifications” Provides technical specifications of the Cisco Unified IP Phone.

Appendix E, “Basic Phone Administration Steps”

Provides an overview of procedures for configuring telephony features, configuring directories, configuring phone button and softkey templates, setting up services, and adding users to Cisco

Explains how to view model information, status messages, network statistics, and firmware information from the

Explains how to obtain status information about the phone using the phone’s web page

Provides tips for troubleshooting the Cisco Unified IP Phone and the Cisco

Unified IP Phone Expansion Module 7914

Provides suggestions for setting up a website for providing users with important information about their Cisco

Provides information about feature support for the Cisco Unified IP

Phone 7960G and 7940G using the SCCP or SIP protocol with Cisco Unified

Communications Manager Release 7.0.

Provides information about setting up phones in non-English environments

Provides procedures for basic administration tasks such as adding a user and phone to Cisco Unified Communications Manager and then associating the user to the phone.

Unified IP Phones

Unified Communications Manager

Cisco Unified IP Phone

Preface

An Overview of the Cisco Unified IP Phone

The Cisco Unified IP Phone is a full-featured telephone that provides voice communication over an Internet Protocol (IP) network. It functions much like a digital business phone, allowing you to place and receive phone calls and to access features such as mute, hold, transfer, and speed dial. In addition, because the phone is connected to your data network, it offers enhanced IP telephony features, including access to network information and services, and customizeable features and services. The phone also supports security features that include file authentication, device authentication, signaling encryption, and media encryption.

This manual describes the Cisco Unified IP Phone 7960G and the Cisco Unified IP Phone 7940G.

A Cisco Unified IP Phone, like other network devices, must be configured and managed. These phones encode G.711a, G.711u, G.729a, G.729ab, and decode G.711a, G.711u, G.729, G.729a, G.729b, and G.729ab. These phones also support uncompressed wideband (16 bits, 16 kHz) audio.

This chapter includes the following topics:

• Understanding the Cisco Unified IP Phones 7960G and 7940G, page 1-1

• What Networking Protocols Are Used?, page 1-4

• What Features are Supported on the Cisco Unified IP Phones 7960G and 7940G?, page 1-5

• Understanding Security Features for Cisco Unified IP Phones, page 1-7

• Overview of Configuring and Installing Cisco Unified IP Phones, page 1-12

Caution Using a mobile or GSM phone, or two-way radio in close proximity to a Cisco Unified IP Phone might

cause interference. For more information, refer to the manufacturer's documentation of the interfering device.

Understanding the Cisco Unified IP Phones 7960G and 7940G

Figure 1-1 shows the main components of the Cisco Unified IP Phone 7960G and Figure 1-2, shows the

main components of the Cisco Unified IP Phone 7940G.

These phone models differ only in the number of available line or speed dial buttons. The Cisco

Unified IP Phone 7940G has two lines, and the 7960G has six lines.

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-1

Understanding the Cisco Unified IP Phones 7960G and 7940G

Figure 1-1 Cisco Unified IP Phone 7960G

Chapter 1 An Overview of the Cisco Unified IP Phone

Figure 1-2 Cisco Unified IP Phone 7940G

Handset light strip Indicates an incoming call or new voice message.

Phone screen Shows phone features.

Model type Indicates the Cisco Unified IP Phone model.

1-2

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Programmable buttons Depending on configuration, programmable buttons provide access to:

Footstand adjustment button

Directories button Opens/closes the Directories menu. Use it to access call logs and

? button Provides access to online Help

Settings button Opens/closes the Settings menu.

Understanding the Cisco Unified IP Phones 7960G and 7940G

• Phone lines (line buttons)

• Speed-dial numbers (speed-dial buttons, including the BLF

speed-dial feature)

• Web-based services (for example, a Personal Address Book button)

• Phone features (for example, a Privacy button)

The Cisco Unified IP Phone 7960G has six programmable buttons and the 7940G has two.

Allows you to adjust the angle of the phone base.

directories.

Speaker button Toggles the speakerphone on or off.

Mute button Toggles the Mute feature on or off.

Headset button Toggles the headset on or off.

Volume button Controls the handset, headset, and speakerphone volume (off-hook) and

the ringer volume (on-hook; adjusts contrast settings.

Services button Opens/closes the Services menu.

Messages button Auto-dials your voice message service (varies by service).

Navigation button Allows you to scroll through menus and highlight items. When the phone

is on-hook, displays phone numbers from your Placed Calls log.

Keypad Allows you to dial phone numbers, enter letters, and choose menu items.

Softkey buttons Each activates a softkey option (displayed on your touchscreen).

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-3

Chapter 1 An Overview of the Cisco Unified IP Phone

What Networking Protocols Are Used?

Cisco Unified IP Phones support several industry-standard and Cisco networking protocols required for voice communication. Cisco Unified IP Phones 7960G and 7940G support.

Ta b l e 1-1 Supported Networking Protocols on the Cisco Unified IP Phone

Networking Protocol Purpose Usage Notes

Bootstrap Protocol (BootP)

Cisco Discovery Protocol (CDP)

Dynamic Host Configuration Protocol (DHCP)

Hypertext Transfer Protocol (HTTP)

Internet Protocol (IP) IP is a messaging protocol that addresses and

Real-Time Transport (RTP)

Session Initiation Protocol (SIP)

BootP enables a network device such as the Cisco

Unified IP Phone to discover certain

startup information, such as its IP address.

CDP is a device-discovery protocol that runs on all Cisco-manufactured equipment.

Using CDP, a device can advertise its existence to other devices and receive information about other devices in the network.

DHCP dynamically allocates and assigns an IP address to network devices.

DHCP enables you to connect an IP phone into the network and have it become operational without you needing to manually assign an IP address or configure additional required network parameters.

HTTP is the standard way of transferring information and moving documents across the Internet and the web.

sends packets across the network.

RTP is a standard protocol for transporting real-time data, such as interactive voice and video, over data networks.

SIP is an emerging standard for setting up telephone calls, multimedia conferencing, and other types of communications on the Internet.

Tabl e 1-1 provides an overview of the networking protocols that the

If you are using BootP to assign IP addresses to the Cisco option shows “Yes” in the network configuration settings on the phone.

The Cisco Unified IP Phone uses CDP to communicate information such as auxiliary VLAN ID, per port power management details, and Quality of Service (QoS) configuration information with the Cisco Catalyst switch.

DHCP is enabled by default. If disabled, you must manually configure the IP address, subnet mask, gateway, and a TFTP server on each phone locally.

Cisco recommends that you use DHCP custom option 150. With this method, you configure the TFTP server IP address as the option value. For additional supported DHCP configurations, refer Cisco Unified System Guide.

Cisco Unified IP Phones use HTTP for the XML services and for troubleshooting purposes.

To communicate using IP, network devices must have an assigned IP address, subnet, and gateway.

IP addresses, subnets, and gateways identifications are automatically assigned if you are using the Cisco Dynamic Host Configuration Protocol (DHCP). If you are not using DHCP, you must manually assign these properties to each phone locally.

Cisco Unified IP Phones use the RTP protocol to send and receive real-time voice traffic from other phones and gateways.

Cisco Unified IP Phones use SCCP for call control. You can configure the Cisco Phone to use either SCCP or SIP.

Unified IP Phone, the BOOTP Server

Communications Manager

Unified IP Phone with

Unified IP

1-4

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

What Features are Supported on the Cisco Unified IP Phones 7960G and 7940G?

Table 1-1 Supported Networking Protocols on the Cisco Unified IP Phone (continued)

Networking Protocol Purpose Usage Notes

Skinny Client Control Protocol (SCCP)

Transmission Control Protocol (TCP)

Transport Layer Security (TLS)

Trivial File Transfer Protocol (TFTP)

User Datagram Protocol (UDP)

SCCP includes a messaging set that allows communications between call control servers and endpoint clients such as IP Phones. SCCP is proprietary to Cisco Systems.

TCP is a connection-oriented transport protocol. Cisco Unified IP Phones use TCP to connect to

TLS is a standard protocol for securing and authenticating communications.

TFTP allows you to transfer files over the network.

On the Cisco Unified IP Phone, TFTP enables you to obtain a configuration file specific to the phone type.

UDP is a connectionless messaging protocol for delivery of data packets.

Cisco Unified IP Phones use SCCP for call control. You can configure the Cisco Phone to use either SCCP or Session Initiation Protocol (SIP).

Cisco

Unified Communications Manager and to

access XML services.

When security is implemented, Cisco Unified IP Phones use the TLS protocol when securely registering with Cisco Manager and when communicating with the Certificate Authority Proxy Function (CAPF).

TFTP requires a TFTP server in your network, which can be automatically identified from the DHCP server. If you want a phone to use a TFTP server other than the one specified by the DHCP server, you must manually assign the IP address of the TFTP server using the Network Configuration menu on the phone.=

Cisco Unified IP Phones transmit and receive RTP streams, which utilize UDP.

Unified IP

Unified Communications

Related Topics

• Understanding Interactions with Other Cisco Unified IP Communications Products, page 2-2

• Understanding the Phone Startup Process, page 2-6

• Network Configuration Menu, page 4-4

What Features are Supported on the Cisco Unified IP Phones 7960G and 7940G?

The Cisco Unified IP Phones 7960G and 7940G function much like digital business phones, allowing you to place and receive telephone calls. In addition to traditional telephony features, the Cisco Unified IP Phone includes features that enable you to administer and monitor the phone as a network device.

This section covers the following topics:

• Feature Overview, page 1-6

• Configuring Telephony Features, page 1-6

• Configuring Network Parameters Using the Cisco Unified IP Phone, page 1-7

• Providing Users with Feature Information, page 1-7

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-5

What Features are Supported on the Cisco Unified IP Phones 7960G and 7940G?

Feature Overview

Cisco Unified IP Phones provide traditional telephony functionality, such as call forwarding and transferring, redialing, speed dialing, conference calling, and voice messaging system access. Cisco

Unified IP phones also provide a variety of other features. For an overview of the telephony features that the Cisco

Features Available for the Cisco Unified IP Phone” section on page 5-2.

As with other network devices, you must configure Cisco Unified IP Phones to prepare them to access Cisco

Unified Communications Manager and the rest of the IP network. By using DHCP, you have fewer settings to configure on a phone, but if your network requires it, you can manually configure an IP address, TFTP server, and subnet mask. For instructions on configuring the network settings on the Cisco

Unified IP Phones, see Chapter 4, “Configuring Network Settings on the Cisco Unified IP Phone.”

The Cisco Unified IP Phone can interact with other services and devices on your IP network to provide enhanced functionality. For example, you can integrate the Cisco Lightweight Directory Access Protocol 3 (LDAP3) standard directory to enable users to search for co-worker contact information directly from their IP phones. You can also use XML to enable users to access information such as weather, stocks, quote of the day, and other web-based information. For information about configuring such services, see the

page 5-9 and the “Setting Up Services” section on page 5-11.

Finally, because the Cisco Unified IP Phone is a network device, you can obtain detailed status information from it directly. This information can assist you with troubleshooting any problems users might encounter when using their IP phones. See

Statistics, and Security Information on the Cisco Unified IP Phone,” for more information.

Unified IP Phone supports and for tips on configuring them, see the “Telephony

Chapter 1 An Overview of the Cisco Unified IP Phone

Unified IP Phones with the corporate

“Configuring Corporate Directories” section on

Chapter 6, “Viewing Model Information, Status,

Related Topics

• Configuring Network Settings on the Cisco Unified IP Phone, page 4-1

• Configuring Features, Templates, Services, and Users, page 5-1

• Troubleshooting and Maintenance, page 8-1

Configuring Telephony Features

You can modify additional settings for the Cisco Unified IP Phone from the Cisco

Unified Communications Manager Administration application. Use this web-based application to set up phone registration criteria and calling search spaces, to configure corporate directories and services, and to modify phone button templates, among other tasks. See the

Available for the Cisco Unified IP Phone” section on page 5-2 and refer to the

Cisco Unified Communications Manager documentation for additional information.

For more information about the Cisco Unified Communications Manager Administration application, refer to Cisco

Unified

available within the application for guidance.

You can access the complete Cisco Unified Communications Manager documentation suite at this location:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_maintenance_guides_list.html

Unified Communications Manager documentation, including Cisco

Communications Manager Administration Guide. You can also use the context-sensitive help

“Telephony Features

1-6

Understanding Security Features for Cisco Unified IP Phones

Configuring Network Parameters Using the Cisco Unified IP Phone

You can configure parameters such as DHCP, TFTP, and IP settings on the phone itself. You can also obtain statistics about a current call or firmware versions on the phone.

For more information about configuring features and viewing statistics from the phone, see Chapter 4,

“Configuring Network Settings on the Cisco Unified IP Phone” and see Chapter 6, “Viewing Model Information, Status, Statistics, and Security Information on the Cisco Unified IP Phone.”

Related Topics

• Configuring Network Settings on the Cisco Unified IP Phone, page 4-1

• Troubleshooting and Maintenance, page 8-1

Providing Users with Feature Information

If you are a system administrator, you are likely the primary source of information for Cisco Unified IP Phone users in your network or company. To ensure that you distribute the most current feature and procedural information, familiarize yourself with Cisco visit the Cisco

Unified IP Phone web site:

Unified IP Phone documentation. Make sure to

http://www.cisco.com/en/US/products/hw/phones/ps379/tsd_products_support_series_home.html

From this site, you can view access various user guides.

In addition to providing documentation, it is important to inform users of available Cisco Unified IP Phone features—including those specific to your company or network—and of how to access and customize those features, if appropriate.

For a summary of some of the key information that phone users need their system administrators to provide, see

Appendix A, “Providing Information to Users Via a Website.”

Understanding Security Features for Cisco Unified IP Phones

Implementing security in the Cisco Unified Communications Manager system prevents identity theft of the phone and Cisco call signaling and media stream tampering.

To alleviate these threats, the Cisco Unified IP telephony network establishes and maintains authenticated and encrypted communication streams between a phone and the server, digitally signs files before they are transferred to a phone, and encrypts media streams and call signaling between Cisco

Unified IP phones.

Table 1-2 shows where you can find additional information about security in this and other documents.

Unified Communications Manager server, prevents data tampering, and prevents

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-7

Understanding Security Features for Cisco Unified IP Phones

Chapter 1 An Overview of the Cisco Unified IP Phone

Ta b l e 1-2 Cisco Unified IP Phone and Cisco Unified Communications Manager

Security Topics

Topic Reference

Detailed explanation of security, including set up, configuration, and troubleshooting information for

Unified Communications Manager and

Cisco

Unified IP Phones

Cisco

Refer to Cisco Unified Communications Manager Security

Guide

Security features supported on the Cisco Unified IP Phone See the “Overview of Supported Security Features” section on

page 1-9

Restrictions regarding security features See the “Security Restrictions” section on page 1-11

How CAPF interacts with a phone when the phone resets See the “CAPF Interaction when the Phone Resets” section on

page 1-12

Identifying phone calls for which security is implemented See the “Identifying Encrypted and Authenticated Phone

Calls” section on page 1-11

TLS connection See the “What Networking Protocols Are Used?” section on

page 1-4

Security and the phone startup process See the “Understanding the Phone Startup Process” section on

page 2-6

Security and phone configuration files See the “Understanding Phone Configuration Files” section

on page 2-5

Configuring a locally significant certificate (LSC) on the phone

Understanding security icons in the Communications Manager

1 through Communications Manager 5 options in

See the “Configuring Security on the Cisco Unified IP Phone”

section on page 3-10

See the “Cisco Unified Communications Manager Options”

section on page 4-10

the Network Configuration Menu on the phone

Security items on the Security Configuration Menu on the

See the “Security Configuration Menu” section on page 6-12

phone

Changing the TFTP Server 1 option on the phone when

See the “CTL File Menu” section on page 6-12

security is implemented

Removing a certificate trust list (CTL) file from the phone See the “CTL File Menu” section on page 6-12

Security items on the Trust List menu on the phone See the “Trust List Menu” section on page 6-14

Disabling access to a phone’s web pages See the “Disabling and Enabling Web Page Access” section

on page 7-3

Troubleshooting • See the “Troubleshooting Cisco Unified IP Phone

Security” section on page 8-9

• Refer to Cisco Unified Communications Manager

Security Guide

Resetting or restoring the phone See the “Resetting or Restoring the Cisco Unified IP Phone”

section on page 8-13

1-8

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Understanding Security Features for Cisco Unified IP Phones

Overview of Supported Security Features

Table 1-3 provides an overview of the security features that the Cisco Unified IP Phones support. For

more information about these features and about Cisco Unified Communications Manager and Cisco

Unified IP Phone security, refer to Cisco Unified Communications Manager Security Guide.

For information about current security settings on a phone, choose Settings > Security Configuration. For more information, see the

Note Most security features are available only if a certificate trust list (CTL) is installed on the phone. For

more information about the CTL, refer to “Configuring the Cisco CTL Client” chapter in Cisco Unified Communications Manager Security Guide.

Ta b l e 1-3 Overview of Security Features

Feature Description

Image authentication Signed binary files (with the extension .sbn) prevent tampering with the firmware image

before it is loaded on a phone. Tampering with the image causes a phone to fail the authentication process and reject the new image.

Customer-site certificate installation

Each Cisco Unified IP Phone requires a unique certificate for device authentication. Phones include a manufacturing installed certificate (MIC), but for additional security, you can specify in Cisco Unified installed by using the CAPF. Alternatively, you can install an LSC from the Security Configuration menu on the phone. See the

Phone” section on page 3-10 for more information.

Device authentication Occurs between the Cisco Unified Communications Manager server and the phone when

each entity accepts the certificate of the other entity. Determines whether a secure connection between the phone and a Cisco Unified occur, and, if necessary, creates a secure signaling path between the entities using TLS protocol. Cisco Unified be authenticated by the Cisco Unified

File authentication Validates digitally-signed files that the phone downloads. The phone validates the

signature to make sure that file tampering did not occur after the file creation. Files that fail authentication are not written to Flash memory on the phone. The phone rejects such files without further processing.

Signaling Authentication Uses the TLS protocol to validate that no tampering has occurred to signaling packets

during transmission.

Manufacturing installed certificate

Each Cisco Unified IP Phone contains a unique manufacturing installed certificate (MIC), which is used for device authentication. The MIC is a permanent unique proof of identity for the phone, and allows Cisco Unified Communications Manager to authenticate the phone.

Secure SRST reference After you configure a SRST reference for security and then reset the dependent devices in

Cisco Unified Communications Manager Administration, the TFTP server adds the SRST certificate to the phone cnf.xml file and sends the file to the phone. A secure phone then uses a TLS connection to interact with the SRST-enabled router.

“Security Configuration Menu” section on page 6-12.

Communications Manager Administration that a certificate be

“Configuring Security on the Cisco Unified IP

Communications Manager should

Communications Manager will not register phones unless they can

Communications Manager.

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-9

Chapter 1 An Overview of the Cisco Unified IP Phone

Understanding Security Features for Cisco Unified IP Phones

Table 1-3 Overview of Security Features (continued)

Feature Description

Media encryption Uses SRTP to ensure that the media streams between supported devices proves secure and

that only the intended device receives and reads the data. Includes creating a media master key pair for the devices, delivering the keys to the devices, and securing the delivery of the keys while the keys are in transport.

Signaling Encryption Ensures that all SCCP signaling messages that are sent between the device and the Cisco

Unified Communications Manager server are encrypted.

CAPF (Certificate Authority Proxy Function)

Security profiles Defines whether the phone is nonsecure, authenticated, or

Optional disabling of the web server functionality for a phone

Phone hardening Additional security options, which you control from Cisco Unified Communications

Implements parts of the certificate generation procedure that are too processing-intensive for the phone, and it interacts with the phone for key generation and certificate installation. The CAPF can be configured to request certificates from customer-specified certificate authorities on behalf of the phone, or it can be configured to generate certificates locally.

encrypted.

You can prevent access to a phone’s web page, which displays a variety of operational statistics for the phone.

Manager Administration:

• Disabling PC port

• Disabling Gratuitous ARP (GARP)

• Disabling PC Voice VLAN access

• Disabling access to the Setting menus, or providing restricted access that allows access

to the User Preferences menu and saving volume changes only

• Disabling access to web pages for a phone.

Note You can view current settings for the PC Port Disabled, GARP Enabled, and Voice

VLAN enabled options by looking at the phone’s Network Configuration menu. For more information, see the

section on page 4-1.

Related Topics

• Understanding Security Profiles, page 1-10

• Identifying Encrypted and Authenticated Phone Calls, page 1-11

• Security Restrictions, page 1-11

• CAPF Interaction when the Phone Resets, page 1-12

Understanding Security Profiles

“Displaying the Network Configuration Menu”

1-10

All Cisco Unified IP Phones that support Cisco Unified Communications Manager 7.0 use a security profile, which defines whether the phone is nonsecure, authenticated, or encrypted. For information about configuring the security profile and applying the profile to the phone, refer to Cisco Unified Communications Manager Security Guide, Release 7.0.

To view the security mode that is set for the phone, look at the Security Mode setting in the Security Configuration menu. For more information, see the

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

“Network Configuration Menu” section on page 4-4.

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Understanding Security Features for Cisco Unified IP Phones

Related Topics

• Identifying Encrypted and Authenticated Phone Calls, page 1-11

• Security Restrictions, page 1-11

Identifying Encrypted and Authenticated Phone Calls

When security is implemented for a phone, you can identify authenticated or encrypted phone calls by icons on the screen on the phone.

In an authenticated call, all devices participating in the establishment of the call are authenticated by the

Unified Communications Manager. When a call in progress is authenticated, the call progress icon

Cisco to the right of the call duration timer in the phone LCD screen changes to the following icon:

In an encrypted call, all devices participating in the establishment of the call are authenticated by the

Unified Communications Manager. In addition, call signaling and media streams are encrypted.

Cisco An encrypted call offers the highest level of security, providing integrity and privacy to the call. When a call in progress is being encrypted, the call progress icon to the right of the call duration timer in the phone LCD screen changes to the following icon:

Note If the call is routed through non-IP call legs, for example, PSTN, the call may be nonsecure even though

it is encrypted within the IP network and has a lock icon associated with it.

Security Restrictions

The following restrictions apply to encrypted calls:

• When establishing an encrypted call on a phone that is configured for encryption and associated with

a wideband codec region, Cisco chooses another supported codec from the codec list that the phone presents. If the other devices in the call are not configured for encryption, Cisco the authenticated/nonsecure call by using the wideband codec.

• A user cannot barge into an encrypted call if the phone that is used to barge is not configured for

encryption. When barge fails in this case, a reorder tone (fast busy tone) plays on the phone on which the user initiated the barge.

Unified Communications Manager ignores the wideband codec and

Unified Communications Manager may establish

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-11

Overview of Configuring and Installing Cisco Unified IP Phones

If the initiator phone is configured for encryption, the barge initiator can barge into an authenticated or nonsecure call from the encrypted phone. After the barge occurs, Cisco Manager classifies the call as nonsecure.

If the initiator phone is configured for encryption, the barge initiator can barge into an encrypted call, and the phone indicates that the call is encrypted.

A user can barge into an authenticated call, even if the phone that is used to barge is nonsecure. The authentication icon continues to appear on the authenticated devices in the call, even if the initiator phone does not support security.

CAPF Interaction when the Phone Resets

The following examples describe how CAPF interacts with the Cisco Unified IP Phone when the phone is reset by a user or by Cisco already exist in the phone and if By Existing Certificate is selected for the CAPF Authentication Mode, the CAPF certificate operation will fail.

Example 1

In this example the phone is reset after you configure the Device Security Mode to Nonsecure and the CAPF Authentication Mode to By Null String or By Existing Certificate (Precedence...). After the phone resets, it immediately registers with the primary Cisco the configuration file. The phone then automatically initiates a session with CAPF to download the LSC. After the LSC exists in the phone, configure the Device Support Mode to Authenticated or Encrypted.

Unified Communications Manager. In these examples, if an LSC does not

Chapter 1 An Overview of the Cisco Unified IP Phone

Unified Communications

Unified Communications Manager and receives

Example 2

In this example, the phone is reset after you configure the Device Security Mode to Authenticated or Encrypted and the CAPF Authentication Mode to By Null String or By Existing Certificate (Precedence...). The phone does not register with the primary Cisco until the CAPF session ends and the phone has installed the LSC. After the session ends, the phone registers and immediately runs in authenticated or encrypted mode.

You cannot configure By Authentication String in this example because the phone will not automatically contact the CAPF server and the registration will fail if the phone does not have a valid LSC.

Unified Communications Manager

Overview of Configuring and Installing Cisco Unified IP Phones

When deploying a new IP telephony system, system administrators and network administrators must complete several initial configuration tasks to prepare the network for IP information and a checklist for setting up and configuring a complete Cisco network, refer to the “System Configuration Overview” chapter in Cisco Unified Communications Manager System Guide.

After you have set up the IP telephony system and configured system-wide features in Cisco Unified Communications Manager, you can add IP phones to the system.

The following topics provide an overview of procedures for adding Cisco Unified IP Phones to your network:

• Configuring Cisco Unified IP Phones in Cisco Unified Communications Manager, page 1-13

telephony service. For

Unified IP telephony

1-12

• Installing Cisco Unified IP Phones, page 1-16

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Overview of Configuring and Installing Cisco Unified IP Phones

Configuring Cisco Unified IP Phones in Cisco Unified Communications Manager

To add phones to the Cisco Unified Communications Manager database, you can use:

• Auto-registration

• Cisco Unified Communications Manager Administration

• Bulk Administration Tool (BAT)

• BAT and the Tool for Auto-Registered Phones Support (TAPS)

For more information about these choices, see the “Adding Phones to the Cisco Unified Communications

Manager Database” section on page 2-7.

For general information about configuring phones in Cisco Unified Communications Manager, refer to the “Cisco

Checklist for Configuring the Cisco Unified IP Phone 7960G and 7940G in Cisco Unified Communications Manager

Unified IP Phone” chapter in Cisco Unified Communications Manager System Guide.

Table 1-4 provides an overview and checklist of configuration tasks for the Cisco Unified IP Phone in

Cisco Unified Communications Manager Administration. The list presents a suggested order to guide you through the phone configuration process. Some tasks are optional, depending on your system and user needs. For detailed procedures and information, refer to the sources in the list.

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-13

Chapter 1 An Overview of the Cisco Unified IP Phone

Overview of Configuring and Installing Cisco Unified IP Phones

Ta b l e 1-4 Checklist for Configuring the Cisco Unified IP Phones 7960G and 7940G in Cisco Unified Communications

Manager

Task Purpose For More Information

1. Gather the following information about the phone:

• Phone Model

• MAC address

• Physical location of the phone

• Name or user ID of phone user

• Device pool

• Partition, calling search space, and location

information

• Number of lines and associated directory numbers

(DNs) to assign to the phone

• Cisco Unified Communications Manager user to

associate with the phone

• Phone usage information that affects phone button

template, softkey template, phone features, IP Phone services, or phone applications

Refer to Cisco Unified Communications Manager System Guide, “Cisco Unified IP Phone” chapter.

See the “Telephony Features Available for the Cisco

Unified IP Phone” section on page 5-2.

Provides list of configuration requirements for setting up phones.

Identifies preliminary configuration that you need to perform before configuring individual phones, such as phone button templates or softkey templates.

2. Customize phone button templates if required).

Changes the number of line buttons, speed-dial buttons, Service URL buttons or adds a Privacy button to meet user needs.

3. Add and configure the phone by completing the required

fields in the Phone Configuration window. Required fields are indicated by an asterisk (*) next to the field name; for example, MAC address and device pool.

Adds the device with its default settings to the Cisco Unified Communications Manager database.

4. Add and configure directory numbers (lines) on the phone

by completing the required fields in the Directory Number Configuration window. Required fields are indicated by an asterisk (*) next to the field name; for example, directory number and presence group.

Adds primary and secondary directory numbers and features associated with directory numbers to the phone.

Refer to Cisco Unified Communications Manager Administration Guide, “Phone Button Template Configuration” chapter.

See the “Modifying Phone Button Templates” section

on page 5-10.

Refer to Cisco Unified Communications Manager Administration Guide, “Cisco Unified

IP Phone

Configuration” chapter.

For information about Product Specific Configuration fields, refer to “?” Button Help in the Phone Configuration window.

Refer to the Cisco Unified Communications Manager Administration Guide, Directory Number Configuration chapter, “Creating a Cisco Unity Voice Mailbox” section.

See the “Telephony Features Available for the Cisco

Unified IP Phone” section on page 5-2.

1-14

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Overview of Configuring and Installing Cisco Unified IP Phones

Table 1-4 Checklist for Configuring the Cisco Unified IP Phones 7960G and 7940G in Cisco Unified Communications

Manager (continued)

Task Purpose For More Information

5. Customize softkey templates.

Adds, deletes, or changes order of softkey features that display on the user’s phone to meet feature usage needs.

6. Configure speed-dial buttons and assign speed-dial

numbers (optional)

Adds speed-dial buttons and numbers.

Users can change speed-dial settings on their phones by using the Cisco Unified CM User Options.

7. Configure Cisco Unified IP Phone services and assign

services (optional).

Provides IP Phone services.

Users can add or change services on their phones by using the User Options.

8. Assign services to phone buttons (optional).

Provides single button access to an IP phone service or URL.

9. Add user information by configuring the required fields:

Note Assign a password (for the User Options) and PIN

(for Extension Mobility and Personal Directory)

Adds user information to the global directory for Cisco Unified

10. Associate a user to a user group.

Communications Manager.

Assigns users a common list of roles and permissions that apply to all users in a user group. Administrators can manage user groups, roles, and permissions to control the level of access (and, therefore, the level of security) for system users.

11. Associate a user with a phone (optional).

Provides users with control over their phone such as forwarding calls or adding speed-dial numbers or services.

Note Some phones, such as those in conference rooms,

do not have an associated user.

Refer to Cisco Unified Communications Manager Administration Guide, “Softkey Template Configuration” chapter.

See the “Configuring Softkey Templates” section on

page 5-11.

Refer to Cisco Unified Communications Manager Administration Guide, “Cisco Unified

IP Phone Configuration” chapter, “Configuring Speed-Dial Buttons” section.

Refer to Cisco Unified Communications Manager Administration Guide, “Cisco Unified

IP Phone Services Configuration” chapter.

See the “Setting Up Services” section on page 5-11.

Refer to Cisco Unified Communications Manager Administration Guide, “Cisco Unified

IP Phone Configuration” chapter, “Adding a Cisco Unified

IP Phone Service to a Phone Button” section.

Refer to Cisco Unified Communications Manager Administration Guide, “End User Configuration” chapter.

See the “Adding Users to Cisco

Unified Communications Manager” section on page 5-12.

Refer to Cisco Unified Communications Manager Administration Guide:

• “End User Configuration” chapter, “End User

Configuration Settings” section.

• “User Group Configuration” chapter, “Adding

Users to a User Group” section.

Refer to Cisco Unified Communications Manager Administration Guide, “End User Configuration” chapter, “Associating Devices to a User” section.

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-15

Overview of Configuring and Installing Cisco Unified IP Phones

Installing Cisco Unified IP Phones

After you have added the phones to the Cisco Unified Communications Manager database, you can complete the phone installation. You (or the phone users) can install the phone at the users’s location. The Cisco for connecting the phone handset, cables, and other accessories.

Note Before you install a phone, even if it is new, upgrade the phone to the current firmware image. For

information about upgrading, refer to the Readme file for your phone, which is located at:

http://www.cisco.com/cgi-bin/tablebuild.pl/ip-7900ser

After the phone is connected to the network, the phone startup process begins and the phone registers with Cisco settings on the phone depending on whether you enable or disable DHCP service.

If you used auto-registration, you need to update the specific configuration information for the phone such as associating the phone with a user, changing the button table, or directory number.

Unified IP Phone Installation Guide that ships in the box with each phone provides directions

Unified Communications Manager. To finish installing the phone, configure the network

Chapter 1 An Overview of the Cisco Unified IP Phone

Checklist for Installing the Cisco Unified IP Phone 7960G and 7940G

Table 1-5 provides an overview and checklist of installation tasks for the Cisco Unified IP Phone 7960G

and 7940G. The list presents a suggested order to guide you through the phone installation. Some tasks are optional, depending on your system and user needs. For detailed procedures and information, refer to the sources in the list.

Ta b l e 1-5 Checklist for Installing the Cisco Unified IP Phones 7960G and 7940G

Task Purpose For More Information

1. Choose the power source for the phone:

• Power over Ethernet (PoE)

• External power supply

Determines how the phone receives power.

2. Assemble the phone, adjust phone placement, and connect the

network cable.

Locates and installs the phone in the network.

3. Add a Cisco Unified IP Phone Expansion Module 7914 to the

Cisco Unified

IP Phone (optional).

Extends functionality to a Cisco Unified IP Phone by adding 14 line appearances or speed dial numbers.

4. Monitor the phone startup process.

Verifies that phone is configured properly.

See the “Providing Power to the Cisco Unified IP

Phone” section on page 2-3.

See the “Installing the Cisco Unified IP Phone”

section on page 3-5.

See the “Adjusting the Placement of the Cisco

Unified IP Phone” section on page 3-8.

See the“Attaching the Cisco Unified IP Phone

Expansion Module 7914” section on page 3-7.

See the “Verifying the Phone Startup Process”

section on page 3-9.

1-16

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

Chapter 1 An Overview of the Cisco Unified IP Phone

Overview of Configuring and Installing Cisco Unified IP Phones

Table 1-5 Checklist for Installing the Cisco Unified IP Phones 7960G and 7940G (continued)

Task Purpose For More Information

5. Configure these network settings on the phone by choosing

Settings > Network Configuration.

Using DHCP—The IP address is automatically assigned and the Cisco

Unified IP Phone is directed to a TFTP Server.

Note Consult with the network administrator if you need to

assign an alternative TFTP server instead of using the TFTP server assigned by DHCP.

Without DHCP—You must configure the IP address, TFTP server, subnet mask, domain name, and default router locally on the phone.

To enable DHCP:

• Set DHCP Enabled to Ye s

• To use an alternate TFTP server, set Alternate TFTP Server

to Ye s Enter IP address for TFTP Server 1

To di s a ble D HCP :

• Set DHCP Enabled to No

• Enter static IP address for phone

• Enter subnet mask

• Enter default router IP addresses

• Enter domain name where phone resides

Set Alternate TFTP Server to Ye s Enter IP address for TFTP Server 1

6. Set up security on the phone.

Provides protection against data tampering threats and identity theft of phones.

7. Make calls with the Cisco Unified IP Phone.

Verifies that the phone and features work correctly.

8. Provide information to end users about how to use their phones

and how to configure their phone options.

Ensures that users have adequate information to successfully use their Cisco Unified

IP Phones.

See the “Configuring Security on the Cisco

Unified IP Phone” section on page 3-10.

Refer to Cisco Unified IP Phone 7960G/7940G

Series Phone Guide for Cisco Unified Communications Manager 7.0 (SCCP)

See Appendix A, “Providing Information to Users

Via a Website.”

OL-15498-01

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

1-17

Overview of Configuring and Installing Cisco Unified IP Phones

Chapter 1 An Overview of the Cisco Unified IP Phone

1-18

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

OL-15498-01

+ 132 hidden pages

Cisco 7960G, 7940G User Manual

Cisco Unified IP Phone 7960G/7940G Administration Guide for Cisco Unified Communications Manager 7.0 (SCCP)

CONTENTS

Preface

An Overview of the Cisco Unified IP Phone

Understanding the Cisco Unified IP Phones 7960G and 7940G

What Networking Protocols Are Used?

What Features are Supported on the Cisco Unified IP Phones 7960G and 7940G?

Feature Overview

Configuring Telephony Features

Understanding Security Features for Cisco Unified IP Phones

Configuring Network Parameters Using the Cisco Unified IP Phone

Providing Users with Feature Information

Overview of Supported Security Features

Understanding Security Profiles

Identifying Encrypted and Authenticated Phone Calls

Security Restrictions

Overview of Configuring and Installing Cisco Unified IP Phones

CAPF Interaction when the Phone Resets

Configuring Cisco Unified IP Phones in Cisco Unified Communications Manager

Checklist for Configuring the Cisco Unified IP Phone 7960G and 7940G in Cisco Unified Communications Manager

Installing Cisco Unified IP Phones

Checklist for Installing the Cisco Unified IP Phone 7960G and 7940G