Our Quality and Environmental Management Systems are
implemented according to the requirements of the ISO9001 and
ISO14001 standards and are certified by an external certification
company.
The information provided in this document contains merely general descriptions or
characteristics of performance which in case of actual use do not always apply as
described or which may change as a result of further development of the products.
An obligation to provi de the respective characteristics shall only exist if expressly agreed in
the terms of contract.
Availability and technical specifications are subject to change without notice.
Unify, OpenScape, OpenStage and HiPath are registered trademarks of Unify Software and
Solutions GmbH & Co. KG. All other company, brand, product and service names are
trademarks or registered trademarks of their respective holders.
Do not operate the equipment in environments where there is a danger of explosions.
If Power over Ethernet (PoE) is not available: For safety reasons the phone should
only be operating using the supplied plug-in power unit.
Use only original accessories. Using other accessories may be dangerous and will
invalidate the warranty, extended manufacturer’s liability and the CE mark.
Never open the telephone or add-on equipment. If you encounter any problems, contact System Support.
7
Installation requirement for USA, Canada, Norway, Finland, and Sweden: Connection
to networks which use outside cables is prohibited. Only in-house networks are permitted.
For USA and Canada only:
This equipment has been tested and found to comply with the limits for a Class B
digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to
provide reasonable protection against harmful interference when the equipment is
operated in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there
is no guarantee that interference will not occur in a particular installation. If this
equipment does cause harmful interference to radio or television reception, which
can be determined by turning the equipment off and on, the user is encouraged to
try to correct the interference by one or more of the following measures:
•Reorient or relocate the receiving antenna.
•Increase the separation between the equipment and receiver.
•Connect the equipment into an outlet on a circuit different from that to which the
receiver is connected.
•Consult the dealer or an experienced radio/TV technician for help.
This product is a UL Listed Accessory, I.T.E., in U.S.A. and Canada.
This equipment also complies with the Part 68 of the FCC Rules and the Industrie
Canada CS-03.
Do not perform maintenance work or servicing of the telephone in environments
where there is a danger of explosions.
Use only original accessories. Using other accessories may be dangerous and will
invalidate the warranty and the CE mark.
Never open the telephone or a key module. If you encounter any problems, contact
System Support.
1.3Labeling
The compliance of the equipment according to EU directives is confirmed
by the CE mark. This Declaration of Conformity and, where applicable, other existing declarations of conformity as well as further information on regulations that restrict the usage of substances or affect the declaration of
substances used in products can be found in the Unify Expert WIKI at
http://wiki.unify.com under the section “Declarations of Conformity”.
uebersicht.fm
Overview
Maintenance Notes
1.4About the Manual
The instructions within this manual will help you in administering and maintaining OpenScape
Desk Phone CP telephones. The instructions contain important information for safe and proper
operation of the phones. Follow them carefully to avoid improper operation and get the most
out of your multi-function telephone in a network environment.
This guide is intended for service providers and network administrators who administer VoIP
services using the OpenScape Desk Phone CP and who have a fundamental understanding of
VoIP, SIP, IP networking, and telephony. The tasks described in this guide are not intended for
end users.
These instructions are laid out in a user-oriented manner, which means that you are led through
the functions of the OpenScape Desk Phone CP step by step, wherever expedient. For the users, a separate manual is provided.
You can find further information on the official Unify website (http://www.unify.com/)
and on the Unify Wiki (http://wiki.unify.com/).
The terms for parameters and functions used in this document are derived from the web interface (WBM). In some cases, the phone’s local menu uses shorter, less specific terms and abbreviations. In a few cases the terminologies differ in wording. If so, the local menu term is added with a preceding "/".
For the parameters described in this document, a WBM screenshot and the path in the local
phone menu is provided.
This document describes the software version V3R4.
1With the Handset, the user can pick up and conduct calls in the usual manner.
2The Microphone is used in the speakerphone mode.
3The Display provides intuitive support for telephone operation.
4With the Menu Key, the user/administrator has access to the user/administrator menu.
5With the Navigation Keys, the user/administrator can navigate through the various phone functions.
6With the Soft Keys, the user/administrator can operate the phone´s functions.
7Audio Keys:
+ and -: Increases/decreases the speaker/headset and handset volume.
Mute: Turns off/on the microphone during conversations.
Speaker: Turns on/off the hands-free mode (speakerphone).
Headset: Switches the audio between handset/speakerphone and headset
8The Notification LED visually signals incoming calls and new voice messages.
9The Keypad is used for entering phone numbers and text.
10The Out-of-Office Key provides an easy way to set up Call Deflection and DND.
1With the Handset, the user can pick up and conduct calls in the usual manner.
2The Microphone is used in the speakerphone mode.
3The Display provides intuitive support for telephone operation.
4With the Menu Key, the user/administrator has access to the user/administrator menu.
5With the Navigation Keys, the user/administrator can navigate through the various phone functions.
6With the Context Keys, the user/administrator can operate the phone´s functions.
7Audio Keys:
+ and -: Increases/decreases the speaker/headset and handset volume.
Mute: Turns off/on the microphone during conversations.
Speaker: Turns on/off the hands-free mode (speakerphone).
Headset: Switches the audio between handset/speakerphone and headset
8The Notification LED visually signals incoming calls and new voice messages.
9The Keypad is used for entering phone numbers and text.
10The Out-of-Office Key provides an easy way to set up Call Deflection and DND.
11The Free programmable Keys can be set up with various functions defined by user.
1With the Handset, the user can pick up and conduct calls in the usual manner.
2The Microphone is used in the speakerphone mode.
3The Display provides intuitive support for telephone operation.
4Conversation Keys:
Hold: Places a call in hold.
Transfer: Transfers a current call to another party.
Conference: Initiates a conference call.
5With the Menu Key, the user has access to the user menu.
6With the Messages Key, the user has access to the voicemail and the call log.
7With the Navigation Keys, the user/administrator can navigate through the various phone functions.
8With the Function Keys, the user can comfortably operate the phone´s functions like Conversations,
Phonebook, Call Deflection and Redial.
9The Keypad is used for entering phone numbers and text.
10Audio Keys:
+ and -: Increases/decreases the speaker/headset and handset volume.
Mute: Turns off/on the microphone during conversations.
Speaker: Turns on/off the hands-free mode (speakerphone).
Headset: Switches the audio between handset/speakerphone and headset
11The Notification LED visually signals incoming calls and new voice messages.
You can configure the OpenScape Desk Phone CP by using any of the methods described in
this chapter.
1.7.1Web-based Management (WBM)
This method employs a web browser for communication with the phone via HTTPS. It is applicable for remote configuration of individual IP phones in your network. Direct access to the
phone is not required.
To use this method, the phone must first obtain IP connectivity.
>
1.7.2DLS (OpenScape Deployment Service)
The OpenScape Deployment Service (DLS) is an OpenScape Management application for administering phones and soft clients in both OpenScape and non-OpenScape networks. It has
a Java-supported, web-based user interface, which runs on an internet browser. For further information, please refer to the OpenScape Deployment Service Administration Guide.
1.7.3Local Phone Menu
This method provides direct configuration of the OpenScape Desk Phone CP via the local
phone menu. Direct access to the phone is required.
As long as the IP connection is not properly configured, you have to use this method
Insert the plug on the long end of the handset cable into the jack on the base of the
telephone and press the cable into the groove provided for it. Next, insert the plug on the
short end of the handset cable into the jack on the handset.
2.Emergency Number Sticker
Write your telephone number and the emergency numbers for the fire and police departments on the included label and attach it to the telephone housing underneath the handset.
2.2.4How to Connect the Phone
1.Plug the LAN cable into the connector at the bottom of the telephone and connect the
cable to the LAN resp. switch. If PoE (Power over Ethernet) is to be used, the PSE (Power
Sourcing Equipment) must meet the IEEE 802.3af specification.
For details about the required power supply, see the following table:
1If more than one Key Module is connected, a Plug-in Power Supply is required (see below).
2.If Power over Ethernet (PoE) is NOT supported or an OpenScape Desk Phone CP600
phone has more than one Key Module connected:
Plug the power supply unit into the mains. Connect the plug-in power supply unit to the
jack at the bottom of the phone.
The order no. for the plug-in power supply is region specific:
7
•EU: C39280-Z4-C510
•UK: C39280-Z4-C512
•USA: C39280-Z4-C511
1
PoE (Power Class 2)
3.If applicable, connect the following optional jacks:
• LAN connection to PC
• Headset (accessory)
2.2.5How to Better Use LAN Network Connections
The OpenScape Desk Phone CP400 and OpenScape Desk Phone CP600 phones provide a
1000 Mbps Ethernet-Switch. This allows you to connect one additional network device (e. g. a
PC) directly via the telephone to the LAN. The direct connection functionality from phone to PC
needs to be activated by administrator first. This type of connection allows you to save one network connection per switch,with the advantage of less network cables and shorter connection
distances.
Do not use this connection for further OpenScape Desk Phone CP,
A key module provides additional program keys. The following table shows which key modules
can be connected to the particular phone types.
Phone TypeKey Modulesadditional keys per module
OpenScape Desk Phone CP200--
OpenScape Desk Phone CP400216
OpenScape Desk Phone CP600412
The configuration of a key on the key module is just the same as the configuration of a phone
key.
2.3Quick Start
This section describes a typical case: the setup of an OpenScape Desk Phone CP endpoint in
an environment using a DHCP server and the web interface. For different scenarios, cross-references to the corresponding section of the administration chapter are given.
Alternatively, the DLS (Deployment Service) administration tool can be used. Its
>
>
Plug & Play functionality allows to provide the phone with configuration data by assigning an existing data profile to the phone’s MAC address or E.164 number. For
further information, see the Deployment Service Administration Manual.
Any settings made by a DHCP server are not configurable by other configuration
tools.
2.3.1How to Access the Web Interface (WBM)
Prerequisites
•The phone´s IP address or URL is required for accessing the phone´s web interface via a
web browser. By default, the phone will automatically search for a DHCP server on startup
and try to obtain IP data and further configuration parameters from that central server.
•If no DHCP server is available in the IP network or if the DHCP parameter is disabled, the
IP address, subnet mask and default gateway/route must be defined manually.
•To obtain the phone´s IP address, proceed as follows:
1.Access the local phone´s Admin menu as described in Access via Local Phone.
•If DHCP is enabled (default): In the Admin menu, navigate to Network > IPv4 config-
uration > IP address. The IP address is displayed.
•If DHCP is disabled or if no DHCP server is available in the IP network, the IP address,
Subnet Mask and Default Route/Gateway must be defined manually as described in
How to Manually Configure the Phone´s IP address.
2.Open your web browser (MS Internet Explorer or Mozilla Firefox) and enter the appropriate
URL. Example: https://192.168.1.15 or https://myphone.phones.
For configuring the phone’s DNS name, please refer to Section 3.4.7.3, “Terminal Hostname”.
If the browser displays a certificate notification, accept it. The start page of the web interface
appears. In the upper right corner, the phone number, the phone’s IP address, as well as the
DNS name assigned to the phone are displayed. The left corner contains the user menu tree.
3.Click on the tab "Administrator Pages". In the dialog box, enter the admin password. The
default password is 123456.
4.The administration main page opens. The left column contains the menu tree. If you click
on an item which is printed in normal style, the corresponding dialog opens in the center
of the page. If you click on an item printed in bold letters, a sub-menu opens to the right of
the main menu.
2.3.2How to Set the Terminal Number
Prerequisites
• If the user and administrator menus are needed in the course of setup, the terminal number,
which by default is identical with the phone number, must be configured first. When the phone
is in delivery status, the terminal number input form is presented to the user/administrator right
after booting, unless the Plug&Play facility of the DLS is used. For further information about this
setting, please refer to Terminal Identity. With the WBM, the terminal number is configured as
follows:
1) Log on as administrator to the WBM by entering the access data for your phone.
2) In the Administrator menu (left column), select System > System Identity to open the "System Identity" dialog. Enter the terminal number, i. e. the SIP name / phone number. For further
information, please refer to Terminal Identity.
2.3.3Basic Network Configuration
For basic functionality, DHCP must provide the following parameters:
•IP Address: IP Address for the phone.
•Subnet Mask (option #1): Subnet mask of the phone.
•Default Route (option #3 "Router"): IP Address of the default gateway which is used for
connections beyond the subnet.
•DNS IP Addresses (option #6 "Domain Server"): IP Addresses of the primary and
secondary DNS servers.
If no DHCP server is present, see Section 3.4.4, “IP Address - Manual Configuration” for IP address and subnet mask, and Section 3.4.5, “Default Route/Gateway” for the default route.
2.3.4DHCP Resilience
Prerequisites
It is possible to sustain network connectivity in case of DHCP server failure. If DHCP lease reuse is activated, the phone will keep its DHCP-based IP address even if the lease expires. To
prevent address conflicts, the phone will send ARP requests in 5 second intervals. Additionally,
it will send discovery messages periodically to obtain a new DHCP lease.
Step by Step
In the left column, select Network > IPv4 configuration. Select the check box to enable DHCP
lease reuse.
An SNTP (Simple Network Time Protocol) server provides the current date and time for network
clients. The IP address of an SNTP server can be given by DHCP.
In order to provide the correct time, it is required to give the time zone offset, i.e. the shift in
hours to be added to the UTC time provided by the SNTP server.
The following DHCP options are required:
•SNTP IP Address (option #42 "NTP Servers"): IP Address or hostname of the SNTP server
to be used by the phone.
•Time zone offset (option #2 "Time Offset"): Offset in seconds in relationship to the UTC
time provided by the SNTP server. For manual configuration of date and time see 3.5.5
Date and Time.
2.3.6SIP Server Address
The IP Address or hostname of the SIP server can be provided by DHCP.
The option’s name and code are as follows:
•option #120 "SIP Servers DHCP Option". For manual configuration of the SIP server address see SIP Addresses.
2.3.7Extended Network Configuration
To have constant access to other subnets, you can enter a total of two more network destinations. For each further domain/subnet you wish to use, first the IP address for the destination,
and then that of the router must be given. The option’s name and code are as follows:
•option #33 "Static Routing Table"
For manual configuration of specific/static routing see Section 3.4.6, “Specific IP Routing”.
Also the DNS domain wherein the phone is located can be specified by DHCP. The option’s
name and code are as follows:
•option #15 "Domain Name"
For manual configuration of the DNS domain name see Section 3.4.7.1, “DNS Domain
Name”.
2.3.8Vendor Specific: VLAN Discovery and DLS Address
The VLAN ID can also be configured by LLDP-MED (see Automatic VLAN discovery
If the phone is to be located in a VLAN (Virtual LAN), a VLAN ID must be assigned. If the VLAN
shall be provided by DHCP, VLAN Discovery must be set to "DHCP" (see Section 3.3.2.1, “Automatic VLAN discovery using LLDP-MED”). The corresponding DHCP option is vendor-specific, thus a specific procedure is necessary.
If a DLS (Deployment Service) server is in use, its IP address must be provided. It is recommended to configure the DLS server address by DCHP, as this method enables full Plug & Play:
having received the DLS address from DHCP, the phone will contact the DLS during start-up.
Provided that the DLS is configured appropriately, it will send all necessary configuration data
to the phone. Additionally, this method is relevant to security, as it ensures the authenticity of
the DLS server.
For manual configuration of the DLS server address see Configuration & Update Service.
For the configuration of vendor-specific settings by DHCP, there are two alternative methods:
•the use of a vendor class - see How to Use a Vendor Class,
or
•the use of DHCP option 43 - see How to Use Option #43 "Vendor Specific".
2.3.8.1How to Use a Vendor Class
It is recommended to define a vendor class on the DHCP server, thus enabling server and
phone to exchange vendor-specific data exclusively. The data is disclosed from other clients.
The following steps are required for the configuration of the Windows DHCP server and for
Unix/Linux.
Example: Configuration of the Window DHCP Server
Setting up a new vendor class using the Windows DHCP Server
1.In the Windows Start menu, select Start > Programs > Administrative Tools > DHCP.
2.In the DHCP console menu, right-click the DHCP server in question and select Define Vendor Classes... in the context menu.
3.A dialog window opens with a list of the classes that are already available.
4.Define a new vendor class with the name OptiIpPhone and enter a description of this
class.
Click OK to apply the changes. The new vendor class now appears in the list.
5.Exit the window with Close.
Add Options to the New Vendor Class
Next, two options resp. tags will be added to the vendor class. Two passes are needed for this:
in the first pass, tag #1 with the required value "Siemens" is entered, and in the second pass,
the VLAN ID is entered as tag #2.
For DHCP servers on a Windows 2003 Server (pre-SP2):
>
6.In the DHCP console menu, right-click the DHCP server in question and select Set Predefined Options from the context menu.
Windows 2003 Server contains a bug that prevents you from using the DHCP console to create an option with the ID 1 for a user-defined vendor class. Instead, this
entry must be created with the netsh tool in the command line (DOS shell).
You can use the following command to configure the required option (without error
message) so that it is also appears later in the DHCP console:
netsh dhcp server add optiondef 1 "Optipoint element 001"
STRING 0 vendor=OptiIpPhone comment="Tag 001 for Optipoint"
The value SIEMENS for optiPoint Element 1 can then be re-assigned over the
DHCP console.
This error was corrected in Windows 2003 Server SP2.
7.In the dialog, select the previously defined OptiIpPhone class and click on Add... to add
a new option.
11. Select the DHCP server in question and the Scope and right-click Scope Options. Select
Configure Options... in the context menu.
12. Select the Advanced tab. Under Vendor class, select the class that you previously defined (OptiIpPhone) and, under User class, select Default User Class.
Activate the check boxes for the options that you want to assign to the scope (in the example, 001, 002, and 003). Click OK.
13. The DHCP console now shows the information that will be transmitted for the corresponding workpoints. Information from the Standard vendor is transmitted to all clients, whereas
information from the OptiIpPhone vendor is transmitted only to the clients (workpoints) in
this vendor class.
The following snippet from a DHCP configuration file (usually dhcpd.conf) shows how to set up
a configuration using a vendor class and the "vendor-encapsulated-options" option.
class "OptiIpPhone" {
option vendor-encapsulated-options
# The vendor encapsulated options consist of hexadecimal values for
the option number (for instance, 01), the length of the value (for instance, 07), and the value (for instance, 53:69:65:6D:65:6E:73). The
options can be written in separate lines; the last option must be followed by a ’;’ instead of a ’:’.
For manual configuration of the VLAN ID see Section 3.3.2.3, “Manual configuration of a VLAN
ID”.
The DLS IP address tag consists of the protocol prefix "sdlp://", the IP address of the DLS server, and the DLS port number, which is "18443" by default. The following example illustrates the
syntax:
This setting only applies if a DLS (Deployment Service) server is in use.
It is recommended to configure the DLS server address by DCHP, as this method enables full
Plug & Play and ensures the authenticity of the DLS server.
For manual configuration of the DLS server address see Section 3.4.8, “Configuration & Update Service”.
For the configuration of vendor-specific settings by DHCP, there are two alternative methods:
1) the use of a vendor class, or 2) the use of DHCP option 43.
2.3.9.1Using Vendor Class
It is recommended to define a vendor class on the DHCP server, thus enabling server and
phone to exchange vendor-specific data exclusively. The data is disclosed from other clients.
If not done already, create a vendor class by the name of "OptiIpPhone".
The following steps are required for the configuration of the Windows DHCP server.
Setting up a new vendor class using the Windows DHCP Server
1.In the Windows Start menu, select Start > Programs > Administrative Tools > DHCP.
Next, two options resp. tags will be added to the vendor class. Two passes are needed for this:
in the first pass, tag #1 with the required value "Siemens" is entered, and in the second pass,
the DLS address is entered as tag #3.
For DHCP servers on a Windows 2003 Server (pre-SP2):
>
6.In the DHCP console menu, right-click the DHCP server in question and select Set Predefined Options from the context menu.
Windows 2003 Server contains a bug that prevents you from using the DHCP console to create an option with the ID 1 for a user-defined vendor class. Instead, this
entry must be created with the netsh tool in the command line (DOS shell).
You can use the following command to configure the required option (without error
message) so that it is also appears later in the DHCP console:
netsh dhcp server add optiondef 1 "Optipoint element 001"
STRING 0 vendor=OptiIpPhone comment="Tag 001 for Optipoint"
The value SIEMENS for optiPoint Element 1 can then be re-assigned over the
DHCP console.
This error was corrected in Windows 2003 Server SP2.
2.Second Pass: DLS address
The DLS address has the following format:
<PROTOCOL>:://<IP ADDRESS OF DLS SERVER>:<PORT NUMBER>
Example: sdlp://192.168.3.30:18443
inbetriebnahme.fm
Startup
Quick Start
10. Press OK, repeat steps 7 to 9 for the second pass, and press OK again.
Defining the scope for the new vendor class
11. Select the DHCP server in question and the Scope and right-click Scope Options. Select
Configure Options... in the context menu.
12. Select the Advanced tab. Under Vendor class, select the class that you previously defined (OptiIpPhone) and, under User class, select Default User Class.
Activate the check boxes for the options that you want to assign to the scope (in the example, 001 and 003)
13. The DHCP console now shows the information that will be transmitted for the corresponding workpoints. Information from the Standard vendor is transmitted to all clients, whereas
information from the OptiIpPhone vendor is transmitted only to the clients (workpoints) in
this vendor class.
The following snippet from a DHCP configuration file (usually dhcpd.conf) shows how to set up
a configuration using a vendor class and the "vendor-encapsulated-options" option.
class "OptiIpPhone" {
option vendor-encapsulated-options
# The vendor encapsulated options consist of hexadecimal values for
the option number (for instance, 01), the length of the value (for instance, 07), and the value (for instance, 53:69:65:6D:65:6E:73). The
options can be written in separate lines; the last option must be followed by a ’;’ instead of a ’:’.
# Tag/Option #1: Vendor "Siemens"
#1 7 S i e m e n s
01:07:53:69:65:6D:65:6E:73:
# Tag/Option #3: DLS IP Address (here: sdlp://192.168.3.30:18443)
Alternatively, option #43 can be used for setting up the DLS address. Two tags are required:
•Tag 001: Vendor name
•Tag 003: DLS IP address
Additionally, you can enter a host name for the DLS server:
•Tag 004: DLS hostname
The data is entered in hexadecimal values. Note that the length of the information contained in
a tag must be given.
The Vendor name tag is coded as follows (the first line indicates the ASCII values, the second
line contains the hexadecimal values):
CodeLengthVendor name
17Siemens
01075369656D656E73
The DLS IP address tag consists of the protocol prefix "sdlp://", the IP address of the DLS server, and the DLS port number, which is "18443" by default. The following example illustrates the
syntax:
4.In the Subscriber number field, enter the internal extension number of the phone. It can
be 1 to 24 characters long.
5.Enter the subscriber password in the Password field.
2.3.11Using the Local Menu
Take the following steps to configure the access to an HFA gateway (for further information see
Section 3.1, “Access via Local Phone”):
1.Press the mode key v once or twice to activate the administration menu (the key toggles
between the user’s configuration menu and the administration menu).
2.When the Admin menu is active, you will be prompted to enter the administrator password.
The default admin password is "123456". It is recommended to change the password (see
Section 3.11, "Password”) after your first login.
3.In the administration menu, go to System > Gateway. For further instructions on entering
data using the Local menu see Section 3.1, “Navigate within the Administration Menu.”.
The path is as follows:
|
--- Administration
|
--- System
|
--- Gateway
|--- System type
|--- IP address
|--- Gateway ID
|--- Subscriber number
|
--- Password
4.Enter the IP address of the HFA gateway provided by your OpenScape Communication
System.
5.Enter the phone’s Gateway Id, which will also serve as internal phone number.
6.Enter the password associated with the Gateway Id.
7.After the data has been entered, select Save & exit and press .
Cancel function, delete character left of cursor, navigate tab or go
back one menu level
€
Scroll downwards
Hold down: Jump to bottom of list
Administration
Access via Local Phone
3Administration
This chapter describes the configuration of every parameter available on the OpenScape Desk
Phone CP phones. For access via the local phone menu, see the following; for access using
the web interface (WBM), please refer to Section 2.3.1, “How to Access the Web Interface
(WBM)”.
3.1Access via Local Phone
The data entered in input fields is parsed and controlled by the phone. Thus, data is
>
1.Access the Administration Menu
accepted only if it complies to the value range.
Press the @ or À key and use the Up Arrow, Down Arrow and OK keys consecutively
to select the Admin menu.
2.When the Admin menu is active, you will be prompted to enter the administrator password.
The default admin password is "123456". It is highly recommended to change the password (see Section 3.19, “Password”) after your first login.
For entering passwords with non-numeric characters, please consider the following:
By default, password entry is in numeric mode and a minimum length of 6 characters. For
changing the mode, press the # key once or repeatedly, depending on the desired character. The # key cycles around the input modes as follows:
(Abc) -> (abc) -> (123) -> (ABC) -> back to start.
Usable characters are 0-9 A-Z a-z .*#,?!’"+-()@/:_
If a parameter is set by choosing a value from a selective list, an arrow symbol appears in
the parameter field that has the focus. Press the OK key to enter the selective list. Use the Up Arrow and Down Arrow keys to scroll up and down in the selection list. To select a
list entry, press the OK key.
5.Enter the parameter value
For selecting numbers and characters, you can use special keys. See the following table:
KeyKey Function during text inputKey function when held down
*
Enter special characters.Ringer on/off when pressed short,
ringer set to alerting with longpress.
#
Toggle between lowercase characters, up-
Phonelock on/off.
percase characters, and digits in the following order:
(Abc) -> (abc) -> (123) -> (ABC) -> back to
start.
With the OpenScape Desk Phone CP200/400/600 use the keypad for entering parameter
values. Use the Navigation Keys or Navigation Block to navigate and execute administrative actions in the Administration Menu.
6.Save and exit
When you are done, select Save & exit and press OKkey.
3.2Bluetooth Interface
You can activate and deactivate the Bluetooth interface. If the Bluetooth interface is deactivated
no Bluetooth services are available.
Administration via WBM
Bluetooth
Administration via Local Phone
|
--- Bluetooth
3.3LAN Settings
3.3.1LAN Port Settings
The OpenScape Desk Phone CP200/400/600 phone provides an integrated switch which connects the LAN, the phone itself and a PC port. By default, the switch will auto negotiate transfer
rate (10/100/1000 Mb/s autosensing, configurable, Gigabit not available on
OpenScape Desk Phone CP200) and duplex method (full or half duplex) with whatever equipment is connected. Optionally, the required transfer rate and duplex mode can be specified
manually using the LAN Port Speed parameter.
In the default configuration, the LAN port supports automatic detection of cable con-
>
The PC Ethernet port (default setting: Disabled) is controlled by the PC port mode parameter.
If set to "Disabled", the PC port is inactive; if set to "Enabled", it is active. If set to "Mirror", the
data traffic at the LAN port is mirrored at the PC port. This setting is for diagnostic purposes. If,
for instance, a PC running Ethereal/Wireshark is connected to the PC port, all network activities
at the phone’s LAN port can be captured.
figuration (pass through or crossover cable) and will reconfigure itself as needed to
connect to the network. If the phone is set up to manually configure the switch port
settings, the cable detection mechanism is disabled. In this case care must be taken
to use the correct cable type.
Do not use this connection for further phones!
>
Removing the power from the phone or a phone reset/reboot will result in the tem-
>
When PC port autoMDIX is enabled, the switch determines automatically whether a regular
MDI connector or a MDI-X (crossover) connector is needed, and configures the connector accordingly.
Data required
•LAN port speed / LAN port type: Settings for the ethernet port connected to a LAN
•PC port speed / PC port type: Settings for the ethernet port connected to a PC.
•PC port mode / PC port status: Controls the PC port.
porary loss of the network connection to the PC port.
switch.
Value range: "Automatic," "10 Mbps half duplex", "10 Mbps full duplex", "100 Mbps half duplex", "100 Mbps full duplex", "Gigabit/s full duplex" (OpenScape Desk Phone CP400 and
OpenScape Desk Phone CP600 only) .
Default: "Automatic"
Value range: "Automatic," "10 Mbps half duplex", "10 Mbps full duplex", "100 Mbps half duplex", "100 Mbps full duplex", "Gigabit/s full duplex" (OpenScape Desk Phone CP400 and
OpenScape Desk Phone CP600 only).
Default: "Automatic"
Value range: "disabled", "enabled", "mirror".
Default: "disabled"
|--- LAN port type
|--- PC port status
|--- PC port type
|
--- PC port autoMDIX
49
Page 50
administration.fm
Administration
LAN Settings
3.3.2VLAN
VLAN (Virtual Local Area Network) is a technology that allows network administrators to partition one physical network into a set of virtual networks (or broadcast domains).
Partitioning a physical network into separate VLANs allows a network administrator to build a
more robust network infrastructure. A good example is a separation of the data and voice networks into data and voice VLANs. This isolates the two networks and helps shield the endpoints
within the voice network from disturbances in the data network and vice versa.
The implementation of a voice network based on VLANs requires the network infra-
>
In a layer 1 VLAN, the ports of a VLAN-aware switch are assigned to a VLAN statically. The
switch only forwards traffic to a particular port if that port is a member of the VLAN that the traffic
is allocated to. Any device connected to a VLAN-assigned port is automatically a member of
this VLAN, without being a VLAN aware device itself. If two or more network clients are connected to one port, they cannot be assigned to different VLANs. When a network client is moving from one switch to another, the switches’ ports have to be updated accordingly by hand.
structure (the switch fabric) to support VLANs.
With a layer 2 VLAN, the assignment of VLANs to network clients is realized by the MAC addresses of the network devices. In some environments, the mapping of VLANs and MAC addresses can be stored and managed by a central database. Alternatively, the VLAN ID, which
defines the VLAN whereof the device is a member, can be assigned directly to the device, e. g.
by DHCP. The task of determining the VLAN for which an Ethernet packet is destined is carried
out by VLAN tags within each Ethernet frame. As the MAC addresses are (more or less) wired
to the devices, mobility does not require any administrator action, as opposed to layer 1 VLAN.
The phone must be configured as a VLAN aware endpoint if the phone itself is a member of the
voice VLAN, and the PC connected to the phone’s PC port is a member of the data VLAN.
There are 3 ways for configuring the VLAN ID:
•By LLDP-MED
•By DHCP
•Manually
3.3.2.1Automatic VLAN discovery using LLDP-MED
This is the default setting. The VLAN ID is configured by the network switch using LLDP-MED
(Link Layer Discovery Protocol-Media Endpoint Discovery). If the switch provides an appropriate TLV (Type-Length-Value) element containing the VLAN ID, this VLAN ID will be used. If no
appropriate TLV is received, DHCP will be used for VLAN discovery.
First, click on change mode. Afterwards, the IP configuration mode dialog opens.
Administration via Local Phone
To enable VLAN discovery via LLDP-MED, set the Use LLDP-MED option to Yes and select
LLDP-MED in the VLAN discovery option.
|
--- Administration
|
--- Network
|
--- General IP configuration
|--- Protocol Mode
|--- Use LLDP-MED
|--- Use DHCP
|--- Use DHCPv6
|--- VLAN discovery
|
--- VLAN ID
3.3.2.2Automatic VLAN discovery using DHCP
To automatically discover a VLAN ID using DHCP, the phone must be configured as DHCP enabled, and VLAN discovery mode must be set to "DHCP". LLDPMED should be disabled. The
DHCP server must be configured to supply the Vendor Unique Option in the correct VLAN over
DHCP format. If a phone configured for VLAN discovery by DHCP fails to discover its VLAN, it
will proceed to configure itself from the DHCP within the non-tagged LAN. Under these circumstances, network routing may probably not be correct.
To enable VLAN discovery via LLDP-MED, activate the LLDP-MED Enabledcheckbox and select LLDP-MED in the VLAN discovery option. Afterwards, click Submit.
Administration via Local Phone
To enable VLAN discovery via DHCP, activate the DHCPv6 Enabled checkbox and select
DHCP in the VLAN discovery option.
|
--- Administration
|
--- Network
|
--- General IP configuration
|--- Protocol Mode
|--- Use LLDP-MED
|--- Use DHCP
|--- Use DHCPv6
|--- VLAN discovery
|
--- VLAN ID
3.3.2.3Manual configuration of a VLAN ID
To configure layer 2 VLAN manually, first make sure that VLAN discovery is set to "Manual"
(see Section 3.3.2.1, “Automatic VLAN discovery using LLDP-MED”). Then, the phone must be
provided with a VLAN ID between 1 and 4095. If you misconfigure a phone to an incorrect
VLAN, the phone will possibly not connect to the network. In DHCP mode it will behave as
though the DHCP server cannot be found, in fixed IP mode no server connections will be possible.
The QoS technology based on layer 2 and the two QoS technologies Diffserv and TOS/IP Precedence based on layer 3 are allowing the VoIP application to request and receive predictable
service levels in terms of data throughput capacity (bandwidth), latency variations (jitter), and
delay.
Layer 2 and 3 QoS for voice transmission can be set via LLDP-MED (see LLDP-
>
3.4.1.1Layer 2 / 802.1p
QoS on layer 2 is using 3 Bits in the 802.1q/p 4-Byte VLAN tag which has to be added in the
Ethernet header.
MED). If so, the value can not be changed by any other interface.
The CoS (class of service) value can be set from 0 to 7. 7 is describing the highest priority and
is reserved for network management. 5 is used for voice (RTP-streams) by default. 3 is used
for signaling by default.
PREAM.SFDDASA
TAG
4 Bytes
Three Bits Used for CoS
PTDATAFCS
(User Priority)
Data required
•Layer 2: Activates or deactivates QoS on layer 2.
Value range: "Yes", "No"
Default: "Yes"
•Layer 2 voice: Sets the CoS (Class of Service) value for voice data (RTP streams).
Value range: 0-7
Default: 5
•Layer 2 signalling: Sets the CoS (Class of Service) value for signaling.
Value range: 0-7
Default: 3
•Layer 2 default: Sets the default CoS (Class of Service) value.
Value range: 0-7
Default: 0
Diffserv assigns a class of service to an IP packet by adding an entry in the IP header.
Traffic flows are classified into 3 per-hop behavior groups:
1.Default
Any traffic that does not meet the requirements of any of the other defined classes is placed
in the default per-hop behaviour group. Typically, the forwarding has best-effort forwarding
characteristics. The DSCP (Diffserv Codepoint) value for Default is "000000".
2.Expedited Forwarding (EF referred to RFC 3246)
Expedited Forwarding is used for voice (RTP streams) by default. It effectively creates a
special low-latency path in the network. The DSCP (Diffserv Codepoint) value for EF is
"101110".
Assured forwarding is used for signaling messages by default (AF31). It is less stringent
than EF in a multiple dropping system. The AF values are containing two digits X and Y
(AFXY), where X is describing the priority class and Y the drop level.
Four classes X are reserved for AFXY: AF1Y (low priority), AF2Y, AF3Y and AF4Y (high
priority).
Three drop levels Y are reserved for AFXY: AFX1 (low drop probability), AFX2 and AFX3
(High drop probability). In the case of low drop level, packets are buffered over an extended
period in the case of high drop level, packets are promptly rejected if they cannot be forwarded.
Data required
•Layer 3: Activates or deactivates QoS on layer 3.
Value range: "Yes", "No"
Default: "Yes"
•Layer 3 voice: Sets the CoS (Class of Service) value for voice data (RTP streams).
Value range: "BE", "AF11", "AF12", "AF13", "AF21", "AF22", "AF23", "AF31", "AF32",
"AF33", "AF41", "AF42", "AF43", "EF", "CS7", "CS3", "CS4", "CS5", 0, 1, 2 ... through 63.
Default: "EF"
•Layer 3 signalling: Sets the CoS (Class of Service) value for signaling.
Value range: "BE", "AF11", "AF12", "AF13", "AF21", "AF22", "AF23", "AF31", "AF32",
"AF33", "AF41", "AF42", "AF43", "EF", "CS7", "CS3", "CS4", "CS5", 0, 1, 2 ... through 63.
Default: "AF31"
If this parameter is set to "Yes" (default), the phone will search for a DHCP server on startup
and try to obtain IP data and further configuration parameters from that central server.
If no DHCP server is available in the IP network, please deactivate this option. In this case, the
IP address, subnet mask and default gateway/route must be defined manually.
The change will only have effect if you restart the phone.
>
The following parameters can be obtained by DHCP:
Basic Configuration
The phone is able to maintain its IP connection even in case of DHCP server failure.
For further information, please refer to DHCP Resilience.
If not provided by DHCP dynamically, you must specify the phone’s IP address and subnet
mask manually.
IP addresses can be entered in the following formats:
>
– Decimal format. Example: 11.22.33.44 or 255.255.255.0 (no leading zeroes).
– Octal format. Example: 011.022.033.044 (leading zeroes must be used with every
address block)
– Hexadecimal format. Example: 0x11.0x22.0x33.0x44 (prefix 0x must be used with
every address block)
By default, IP configuration by DHCP and LLDP-MED is enabled. For manual IP configuration,
please proceed as follows:
Data required
•IP address: used for addressing the phone.
•Subnet mask: subnet mask that is needed for the subnet in use.
Administration via WBM
1.Navigate to Network > General IP Configuration. Set DHCP Enabled, DHCPv6 Enabled
and LLDP-MED Enabled to "not selected". Afterwards, click Submit.
Network > General IP configuration
N
2.Navigate to Network > IPv4 configuration or IPv6 configuration, depending on the settings
in Protocol Mode IPv4/IPv6. Set DHCP Enabled , resp. DHCPv6 Enabled and LLDP-MED
Enabled to "not selected". Enter the IP address and the Subnet mask. If applicable, enter
the Default route. Afterwards, click Submit.
If not provided by DHCP dynamically (see Section 3.4.3, “Use DHCP”), enter the IP address of
the router that links your IP network to other networks. If the value was assigned by DHCP, it
can only be read.
The change will only have effect if you restart the phone.
>
Administration via WBM - IPv4 Configuration
Enter the Default route, i.e. the IP address of the router that links your IP network to other networks. Afterwards, click Submit.
Network > IPv4 configuration
Administration via Local Phone - IPv4 Configuration
|
--- Admin
|
--- Network
|
--- IPv4 configuration
|
--- Route (Default)
Administration via WBM - IPv6 Configuration
Enter the IP address of the Global Gateway that links your IP network to other networks. Afterwards, click Submit.
To have constant access to network subscribers of other domains, you can enter a total of two
more network destinations, in addition to the default route/gateway. This is useful if the LAN
has more than one router or if the LAN is divided into subnets.
IPv4 Route Configuration
Data required
•Route 1/2 IP address: IP address of the selected route.
•Route 1/2 gateway: IP address of the gateway for the selected route.
•Route 1/2 mask: Network mask for the selected route.
Administration via WBM - IPv4 Configuration
Enter the required data:
•For Route 1: Route 1 IP address, Route 1 Gateway, and Route 1 mask.
•For Route 2: Route 2 IP address, Route 2 Gateway, and Route 2 mask.
|--- Route 1 dest
|--- Route 1 prefix len
|--- Route 1 gateway
|--- Route 2 dest
|--- Route 2 prefix len
|
--- Route 2 gateway
67
Page 68
administration.fm
LLDP-MED Enabled
DHCPv6 Enabled
VLAN discovery
VLAN ID
DNS domain
Primary DNS
Secondary DNS
HTTP proxy
General IP configuration
Manual
workgroup
DHCP Enabled
Submit
Reset
192.168.1.105
485
IPv4_IPv6
Protocol Mode
;
Administration
IP Network Parameters
3.4.7DNS
The main task of the domain name system (DNS) is to translate domain names to IP addresses. For some features and functions of the OpenScape Desk Phone CP phone, it is necessary
to configure the DNS domain the phone belongs to, as well as the name servers needed for
DNS resolving.
3.4.7.1DNS Domain Name
This is the name of the phone’s local domain.
Administration via WBM
Enter the DNS domain the phone belongs to. Afterwards, click Submit.
DHCP and DNS must be appropriately connected and configured at the customer
>
site.
The corresponding DNS domain is configured in Network > General IP configuration > DNS
domain (see Section 3.4.7.1, “DNS Domain Name”).
The current DNS name of the phone is displayed at the right-hand side of the banner of the
admin and user web pages, under DNS name. To see configuration changes, the web page
must be reloaded.
It is recommended to inform the user about the DNS name of the phone. The
>
complete WBM address can be found under User menu > Network information >
Web address.
The DNS name can be constructed from pre-defined parameters and free text. Its composition
is defined by the DNS name construction parameter Administration > System > System Identity > DNS name construction. The following options are available:
•None: No hostname is send to the DHCP server during DHCP configuration.
•MAC based: The DNS name is built from the prefix "OIP" followed by the phone’s MAC
address.
•Web name: The DNS name is set to the the string entered in Web name.
•Only number: The DNS name is set to the Terminal number, that is, the phone’s call
number (E.164).
•Prefix number: The DNS name is constructed from the the string entered in Web name,
followed by the Terminal number.
The OpenScape Deployment Service (DLS) is a OpenScape Management Application for administering workpoints in both HiPath and non-HiPath networks. Amongst the most important
features are: security (e.g. PSS generation and distribution within an SRTP security domain),
mobility for OpenScape SIP phones, software deployment, plug&play support, as well as error
and activity logging.
DLS address, i.e. the IP address or hostname of the DLS server, and Default mode port, i.e.
the port on which the DLS server is listening, are required to enable proper communication between phone and DLS.
The Contact gap parameter is not used.
Set Revert to default security to disable mutual authentication and return to DEFAULT mode.
SECURE mode related settings are reset and certificates are removed.
The Mode (labeled Mode in the local phone´s Admin menu) determines the security level for
the communication between the phone and the DLS. Mutual authentication establishes a higher security level of the connection by mutually exchanging credentials between the DLS and
the phone. After this, the communication is encrypted, and a different port is used, thus ensuring that the phone is unambiguously connected to the correct DLS server.
It is possible to operate the DLS server behind a firewall or NAT (Network Address
>
Translation), which prevents the DLS from sending Contact-Me messages directly
to the phone. Only outbound connections from the phone are allowed. To overcome
this restriction, a DLS Contact-Me proxy (DCMP) can be deployed. The phone periodically polls the DCMP (DLS Contact- Me Proxy), which is placed outside of the
phone’s network, for pending contact requests from the DLS. If there are contact requests, the phone will send a request to the DLS in order to obtain the update, just
as with a regular DLS connection.
The URI of the DCMP, as well as the polling interval, are configured by the DLS. For
this purpose, it is necessary that the phone establishes a first contact to the DLS,
e. g. by phone restart or local configuration change.
71
Page 72
administration.fm
Update Service
DLS address
Default mode port
Submit
Reset
Mode
Default
Contact gap
300
18443
Security PIN
Revert to default security
;
Administration
IP Network Parameters
A Security PIN can be provided which is used for decrypting data provided by the DLS during
bootstrap. For further information, please refer to the DLS documentation.
Data required
•DLS address: IP address or hostname of the server on which the Deployment Service is
running.
•Default mode port: Port on which the DLS Deployment Service is listening.
Default: 18443.
•Contact gap: Minimum time interval in seconds that must elapse between responses to a
ContactMe request from the DLS, in order to prevent DoS attacks.
Default: 300.
•Revert to default security: When set, security mode will be set to default. When using
local phone administration, this will be set by selection option ’Default security’ after pressing Save&exit.
•Mode: Determines whether the communication between the phone and the DLS is secure.
Value range: "Default", "Secure", "Secure PIN". This parameter is read-only.
Default: "Default".
The Simple Network Management Protocol is used by network management systems for monitoring network-attached devices for conditions that warrant administrative attention. An SNMP
manager surveys and, if needed, configures several SNMP elements, e.g. VoIP phones.
OpenScape Desk Phone CP phones support SNMPv1.
There are currently 4 trap categories that can be sent by the phones:
Standard SNMP traps
OpenScape Desk Phone CP phones support the following types of standard SNMP traps, as
defined in RFC 1157:
•coldStart: sent if the phone does a full restart.
•warmStart: sent if only the phone software is restarted.
•linkUp: sent when IP connectivity is restored.
QoS Related traps
These traps are designed specifically for receipt and interpretation by the QDC collection system. The traps are common to SIP phones, HFA phones, Gateways, etc.
Traps for important high level SIP related problems
Currently, these traps are related to problems in registering with a SIP Server and to a failure
in remotely logging off a mobile user. These traps are aimed at a nonexpert user (e.g. a standard Network Management System) to highlight important telephony related problems.
Traps specific to OpenScape Desk Phone CP
Currently, the following traps are defined:
TraceEventFatal: sent if severe trace events occur; aimed at expert users.
TraceEventError: sent if severe trace events occur; aimed at expert users.
Data required
•Trap sending enabled: Enables or disables the sending of a TRAP message to the SNMP
manager.
Value range: "Yes", "No"
Default: "No"
•Trap destination: IP address or hostname of the SNMP manager that receives traps.
•Trap destination port: Port on which the SNMP manager is receiving TRAP messages.
Default: 162
•Trap community: SNMP community string for the SNMP manager receiving TRAP messages.
Default: "snmp"
•Queries allowed: Allows or disallows queries by the SNMP manager.
•Query password: Password for the execution of a query by the SNMP manager.
•Diagnostic sending enabled: Enables or disables the sending of diagnostic data to the
SNMP manager.
Value range: "Yes", "No"
Default: "No"
•Diagnostic destination: IP address or hostname of the SNMP manager receiving diagnostic data.
•Diagnostic destination port: Port on which the SNMP manager is receiving diagnostic
data.
•Diagnostic community: SNMP community string for the SNMP manager receiving diagnostic data.
•Diagnostic to generic destination: Enables or disables the sending of diagnostic data to
a generic destination.
Value range: "Yes", "No"
Default: "No"
•QoS traps to QCU: Enables or disables the sending of TRAP messages to the QCU server.
Value range: "Yes", "No"
Default: "No"
•QCU address: IP address or hostname of the QCU server.
•QCU port: Port on which the QCU server is listening for messages.
Default: 12010.
•QCU community: QCU community string.
Default: "QOSCD".
•QoS to generic destination: Enables or disables the sending of QoS traps to a generic
destination.
Value range: "Yes", "No"
Default: "No"
|--- Queries allowed
|--- Query password
|--- Traps enabled
|--- Trap destination
|--- Trap detination port
|--- Trap community
|--- Diag sending enabled
|--- Diag destination
|--- Diag destination port
|--- Diag community
|--- QoS traps to QCU
|--- QCU address
|--- QCU port
|
--- QoS to generic dest.
A31003-C1000-M101-1-76A9, 03/2016
Page 77
administration.fm
Administration
Security
3.5Security
3.5.1System
OpenScape Desk Phone CP phones support secure (i.e. encrypted) speech transmission via
SRTP. For enabling secure (encrypted) calls, a TLS connection to the OpenScape Voice server
is required.
If Use secure calls is activated, the encryption of outgoing calls is enabled, and the phone is
capable of receiving encrypted calls. When the phone is connected to an OpenScape Voice
system, call security is communicated to the user as follows:
•An icon in the call view tells the user whether a call is secure (encrypted) or not.
•If an active call changes from secure to insecure, e. g. after a transfer, a popup window and
an alert tone will notify the user.
For secure (encrypted) calls, it is required that both endpoints support SRTP. The
>
secure call indication tells the user that the other endpoint has acknowledged the secure connection.
In order to use SRTP, the phone must be configured for NTP (for further information
>
If SIP server certificate validation resp. Backup SIP server certificate validation is activated, the
phone will validate the server certificate sent by the OpenScape Voice server in order to establish a TLS connection. The server certificate is validated against the root certificate from the
trusted certificate authority (CA), which must be stored on the phone first. For delivering the
root certificate, a DLS (OpenScape Deployment Service) server is required.
The SRTP type sets the key exchange method for SRTP.
MIKEY (Multimedia Internet KEYing) is a key management protocol that is intended for use with
real-time applications. It can specifically be used to set up encryption keys for multimedia sessions that are secured using SRTP.
Use secure calls activates the encryption of outgoing calls, i.e. the phone iscapable of receiving
encrypted calls.
>
please see Date and Time). The reason is that the key generation (MIKEY) uses the
system time of the particular device as a basis. Thus, encryption will only work correctly if all devices have the same UTC time.
For secure (encrypted) calls, it is required that both endpoints support SRTP. The
secure call indication tells the user that the other endpoint has acknowledged the
secure connection
The SRTP type sets the key exchange method (negotiation method) for secure calls via SRTP.
The following encryption key exchange methods are available:
The SRTP Type and Use SRTCP options are only available for secure (encrypted) calls, i.e.
these parameters are only enabled if Use secure calls is activated.
When Use SRTCP is activated (together with Use secure calls), the phone will use SRTCP (Se-
cure RTCP) to transmit and receive RTP control packets.
If SRTP is enabled, ANAT interworking (see Media/SDP) is only possible if SDES is
>
configured as the key exchange protocol for SRTP.
Administration via WBM
System > Security > System
Administration via Local Phone
|
--- Administration
|
--- System
|
--- Security
|
--- System
|--- SIP server certificate validation
|
--- Validate SW upgrade
3.5.2SRTP Configuration
The SDP negotiation parameter specifies whether the use of SRTP will be forced by the phone.
The following choices are available:
•RTP + SRTP - Both non-encrypted (non-secure) and encrypted (secure) media connections are offered. Non-encrypted connections are preferred over encrypted connections,
i.e. the phone uses the non-encrypted RTP connection if the remote party accepts it and
only switches to SRTP if RTP is not accepted.
•With SRTP only, only an encrypted (secure) media connection is allowed; if the remote party should not support SRTP, no connection will be established.
•With SRTP + RTP, the phone will try to establish an SRTP connection, but fall back to RTP
if this should fail. This is the recommended option.
With SHA1-80 ranking and SHA1-32 ranking, the ranking for each crypto-suite for negotiation
is defined. Additionally, each crypto-suite can be enabled or disabled.
Administration via WBM
System > Security > SRTP config
Administration via Local Phone
|
--- Administration
|
--- System
|
--- Security
|
--- SRTP config
|--- Use secure calls
|--- Use SRTCP
|--- SRTP key mode
|--- SDP mode
|--- SHA1-80 ranking
|
--- SHA1-32 ranking
3.5.3Access control
The CCE access parameter controls TCP and UDP access for the CCE (CommsChannel
Extender). This affects the operation of the OpenStage Manager, local CTI access, and HPT
access. When Disable is selected, both TCP and UDP are disabled. With Enable, there are no
restrictions.
With Factory reset claw, the ’hooded claw’ keypad mechanism to initiate a factory reset without requiring an authenticated access can be enabled or disabled.
The Serial port parameter controls access to the serial port. When set to No password, a ter-
minal connected to the port can interact with the phone’s operating system without restrictions. When Passwd reqd is selected, the serial port requires a password for access (root user
is not available). When Unavailable is chosen, the serial port is not accessible.
As a prerequisite, the root user needs to create a user and to define a password via Serial
Access, so that access can be granted when the Password required prompt is issued.
A circular security log is used to capture important security specific events. It can be exported
as CSV data to an external application for analysis.
The security log cannot be disabled.
>
•The Max. lines parameter defines the maximum number of entry lines that can be kept in
the security log before old entries are overwritten by new entries.
•Archive to DLS controls whether the log is sent to the DLS. When activated, the DLS is
used to automatically archive the security log so that no log entries will be lost.
•Archive when at: This value sets the trigger for log archiving. Automatic archiving of new
security log entries will occur when the percentage of unarchived entries in the log is as
specified or more. When set to disabled, every new entry will trigger a save (only possible
via DLS). The possible values are "10%”, ”20%”, ”30%”, ”35%”, ”40%”, ”45%”, ”50%”,
”55%”, ”60%”, ”65%”, ”70%”, ”80%”, ”90%”.
The security log upload may be accomplished in two ways:
– If "Archive to DLS" is enabled, if the security log reaches the threshold % for un-
achieved entries, the phone will initiate an upload.
– If "Archive to DLS" is NOT enabled and the security log reaches the threshold % for
unachieved entries, the phone only sets the "archive-me" flag, it does not initiate the
archive.
It is up to the DLS to recognize the flag and initiate an upload.
•Last archived shows the date when the security log was last archived to the DLS.
|--- Max. lines
|--- Archive to DLS
|--- Archive when at
|
--- Last archived
3.5.5Security-Related Faults
•Security log entry shows the date and time of a loss of security log entries.
The entries in this list are only displayed until they are reported to the DLS, which
>
usually happens very fast. After that, the entries are automatically deleted from the
phone. If the entries are not deleted automatically, they can be deleted manually by
using the Cancel faults parameter.
•OCSR failure: Shows the date and time when the phone was unable to connect to any certificate checking server for revoked certificates.
•Admin access: Shows the date and time when the phone encountered multiple consecutive failures to enter the admin password.
•User access: Shows the date and time when the phone encountered multiple consecutive
failures to enter the user password.
•Expires after (days): Sets the maximum validity period of a password.
•Warn before (days): Specifies when the user/admin is notified that his password will ex-
pire.
•Force changed: Only affects the User password. When Force changed is activated, the
user will be forced to change his/her password at next login. This only applies to users, not
to administrators.
•Tries allowed: Specifies the maximum number of password entry trials before the password is suspended. Values: 0 (no limits), 2, 3, 4, 5
•No change for (hours): Specifies a period before a password is allowed to be changed
again. Value range: 0 to 99
•Suspended for (mins): Defines how long a password will be suspended after the number
of failed retries has exceeded. Value range: 0 to 99
•History valid for (days): Defines a period in days during which the history is valid. Passwords no longer used are kept in history lists for the user and admin passwords to prevent
reuse of past passwords. This list is organised as FIFO (First In, First Out) so that it always
contains the latest passwords.
•Expiry date: Shows the date and time when the admin password will expire.
•Minimum length: Defines the minimum number of characters for the admin password.
•Password history: Specifies the number of entries to be kept in the admin password history. New passwords must not match any password in the history.
•Current status: Determines the status for the admin password. When set to "Active", the
admin password is available for use. With "Suspended", the admin password is not available for a period or until reset. When set to "Disabled", all access via the admin password
is disabled. The status of the admin password can only be set via DLS/WPI. It is changed
internally to "suspended" when the password has been entered incorrectly more times than
allowed.
The composition of the password can be configured in detail.
•Ucase chars reqd.: Defines the minimum number of uppercase characters. Value range:
0 to 24
•Lcase chars reqd.: Defines the minimum number of lowercase characters. Value range:
0 to 24
•Digits required: Defines the minimum number of digits. 0 to 24
•Special chars reqd: Defines the minimum number of special characters. The set of possible characters is ` - = [ ] ; ’ # \ , . / ¬ ! ” £ $ % ^ & * ( ) _ + { } : @ ~ | < > ?
Value range: 0 to 24
•Bar repeat length: Specifies the maximum number of consecutive uses of a character.
Value range: 0 to 24, but not 1 (with 1 set as value, no password would be valid, because
it would be forbidden to use any character once).
•Min char difference: Specifies the minimum number of characters by which a new password must differ from the previous password. Value range: 0 to 24
Administration via WBM
Security and Policies > Password > Character set
3.5.6.4Change Admin and User password
The passwords for user and administrator can be set here. They have to be confirmed after
entering. The factory setting for the Admin password is "123456"; it should be changed after
the first login (Password handling in previous versions see Section 3.19, “Password”).
Administration via WBM
Security and Policies > Password > Change Admin password
Security and Policies > Password > Change User password
Administration via Local Phone
|
--- Admin
|
--- Security & policies
|
--- Password
|--- Change Admin password
||--- Current password
||--- New password
||--- Confirm password
|
--- Change User password
|
--- Admin password
|
--- New password
|
--- Confirm password
3.5.7Certificate Policy
3.5.7.1Online Certificate Check
The Online Certificate Status Protocol (OCSP) is used to check if a certificate to be used has
been revoked. This protocol is used to query an Online Certificate Status Responder (OCSR)
at the point when the certificate is being validated. The address of an OCSR can be configured
on the phone and can also be obtained from the certificate to be checked (which will have the
priority).
•OCSP check: If activated, the configured OCSR is requested to check if the certificate has
been revoked.
•OCSR 1 address: Specifies the IP address (or FQDN) of a primary OCSP responder.
•OCSR 2 address: Specifies the IP address (or FQDN) of a secondary OCSP responder.
For individual certificates provided by specific servers, the level of authentication can be configured. When "None" is selected, no certificate check is performed. With "Trusted", the certificate is only checked against the signature credentials provided by the remote entity for signature, and the expiry date is checked. When "Full" is selected, the certificate is fully checked
against the credentials provided by the remote entity for signature, the fields must match the
requested subject/usage, and the expiry date is checked.
•Secure file transfer sets the authentication level for the HTTPS server to be used (see
Section 3.16.2, “Common FTP/HTTPS Settings (Defaults)”).
•Secure send URL sets the authentication level for the server to which special HTTP requests are sent on key press ("Send URL" function, see Section 3.9.31, “Send Request via
HTTP/HTTPS”).
•Secure SIP server sets the authentication level for the SIP server connected to the phone
(see Section 3.6.7, “SIP Registration”).
•Secure 802.1x sets the authentication level for the 802.1x authentication server.
•LDAP via TLS sets the authentication level for LDAP access.
Administration via WBM
Security and Policies > Certificates > Authentication policy
Administration via Local Phone
|
--- Admin
|
--- Security & policies
|
--- Certificates
|
--- Authentication policy
|--- Secure file transfer
|--- Secure send URL
|--- Secure SIP server
|--- Secure file transfer
Within a SIP environment, both Terminal Number and Terminal Name may serve as a phone
number. The values are used in the userinfo part of SIP URIs.
In order to register with a SIP registrar, the phone sends REGISTER messages to the registrar
containing the contents of Terminal number.
Data required
•Terminal number: Number to be registered at the SIP registrar.
•Terminal name: Name to be registered at the SIP registrar.
Administration via WBM
System > System Identity
Administration via Local Phone
|
--- Admin
|
--- System
|
--- Identity
|--- Terminal number
|
--- Terminal name
3.6.1.2Display Identity
If an individual name or number is entered as Display identity and Enable ID is activated, it
is displayed in the phone’s status bar instead of the Terminal number.
3.6.3.1Backlight Time Setting (OpenScape Desk Phone CP600 only)
After the phone has been inactive within the timespan specified in Backlight time, the display
backlight is switched off to save energy.
The possible values are: 1 minute, 5 minutes, 30 minutes, 60 minutes, 2 hours, 4 hours, or 8
hours. Moreover, with OpenScape Desk Phone CP600 this parameter can also be configured
by the user. The default value is 1 minute.
The OpenScape Desk Phone CP200 phone supports the standard IEEE 802.3az (Energy Efficient Ethernet).
The energy saving benefit provided by this standard can only be received when the phone is
connected to a network component which also is able to support the IEEE 802.3az standard.
This configuration item allows the phone to detect if a number dialled by the User is likely to be
a Feature Access Code (FAC) by comparing the start of the dialled number with the configured
FAC prefixes. If the dialled number does match a FAC prefix and the SIP server has provided
a different number for the called party then the number shown in the Dialled tab list of Call Log
is changed from the dialled number to the server provided number. If the new configuration item
is left empty then the Dialled tab list display will remain as currently populated (i.e. the dialled
number is shown in the list).
A further enhancement for an entry matched to a FAC in the Dialled tab list of Call Log is that
the context menu for the list entry now provides both numbers from the last call associated with
the entry as Dial options in the context menu for the list entry (similar to that already provided
by the context menu for the Details form of such an entry). Note that the Call Log display on
OpenScape Desk Phone CP200 has been simplified so that an entry only displays a name or
a number (not both) and there is no access to entry details. However, this only limits the display
and the default dialling number for an OpenScape Desk Phone CP200 entry is determined as
above.
Call Log entry grouping rules for the Dialled tab list remain unchanged, if multiple FACs all map
to numbers associated with one contact then they are grouped together.
Data required
•FAC prefixes: A comma separated list of feature prefixes considered to represent feature
codes configured at the SIP server for abbreviated dialling.
|--- Answered elsewhere
||--- Include
||--- Exclude
|
--- Delete entry
|--- Manually
|
--- When called
Answered elsewhere > Include: Calls completed elsewhere will be logged as missed calls. In
the call log these calls are marked with a check mark.
Answered elsewhere > Exclude: Calls completed elsewhere will not be visible on phone; they
will not be logged at all.
Delete entry > Manually: Call numbers remain in call log until they are deleted manually.
Delete entry > When called: Call numbers existing in missed call list are deleted automatically
when they are called again.
3.6.5Date and Time
TIf the DHCP server in your network provides the IP address of the SNTP server, no manual
configuration is necessary. If not, you have to set the SNTP IP address parameter manually.
For correct display of the current time, the Timezone offset must be set appropriately. This is
the time offset from UTC (Universal Time Coordinated). If, for instance, the phone is located in
Munich, Germany, the offset is +1 (or simply 1); if it is located in Los Angeles, USA, the offset
is -8. For countries or areas with half-our time zones, like South Australia or India, non-integer
values can be used, for example 10.5 for South Australia (UTC +10:30).
If the phone is located in a country with DST (Daylight Saving Time), you can choose whether
DST is toggled manually or automatically. For manual toggling, disable Auto time change and
enable or disable Daylight saving; the change will be in effect immediately. For automatical
toggling, enable Auto time change; now, daylight saving is controlled by the DST zone / Time zone parameter. This parameter determines when DST starts or ends, and must be set according to the location of the phone.
The Difference (minutes) parameter defines how many minutes the clock is put forward for
DST. In Germany, for instance, the value is +60.
Please note that Difference (minutes) must be specified both for manual and auto-
>
matic DST toggling.
3.6.5.1SNTP is Available, but no Automatic Configuration by DHCP Server
Data required
•SNTP IP address: IP address or hostname of the SNTP server.
•Timezone offset (hours): Shift in hours corresponding to UTC.
•Daylight saving: Enables or disables daylight saving time in conjunction with Auto time change.
Value range: "Yes", "No".
•Difference (minutes): Time difference when daylight saving time is in effect.
•Auto time change / Auto DST: Enables or disables automatic control of daylight saving
time according to the DST zone.
Value range: "Yes", "No". Default setting is Yes. After a factory reset, the system will be reset to this value.
•Time zone/DST zone: Area with common start and end date for daylight saving time.
Value range: "Australia 2007 (ACT, South Australia, Tasmania, Victoria)", "Australia 2007
(New South Wales)", "Australia (Western Australia)", "Australia 2008+ (ACT, New South
Wales, South Australia, Tasmania, Victoria)", "Brazil", "Canada", "Canada (Newfoundland)", "Europe (Portugal, United Kingdom)", "Europe (Finland)", "Europe (Rest)", "Mexico", "United States", "New Zealand", "New Zealand (Chatham)".
Default setting for US is "United States". After a factory reset, the system will be reset to
this value.
|--- Time
|--- Date
|--- Daylight saving
|--- Difference (mins)
|
--- Auto DST
3.6.6SIP Addresses and Ports
3.6.6.1SIP Addresses
In this group of parameters, the IP addresses or host names for the SIP server, the SIP registrar, and the SIP gateway are defined.
SIP server address provides the IP address or host name of the SIP proxy server
(OpenScape Voice). This is necessary for outgoing calls. SIP registrar address contains the
IP address or host name of the registration server, to which the phone will send REGISTER
messages. When registered, the phone is ready to receive incoming calls. SIP gateway ad-dress gives the IP address or host name of the SIP gateway. If configured, the SIP gateway is
used for outgoing calls; otherwise the server specified in SIP server address is used. A SIP
gateway is able to perform a conversion of SIP to TDM, which enables to send calls directly
into the public network.
Enhanced survivability using DNS SRV is available. To make use of it, a special con-
>
Data required
•SIP server address: IP address or host name of the SIP proxy server.
•SIP registrar address: IP address or host name of the registration server.
•SIP gateway address: IP address or host name of the SIP gateway.
figuration is required. For details, please refer to Section 3.6.10, “Resilience and
Survivability”.
In this group of parameters, the ports for the SIP server, the SIP registrar, and the SIP gateway
are defined (for further information see Section 3.6.6.1, “SIP Addresses”), as well as the SIP
port used by the phone (SIP local).
Data required
•SIP server: Port of the SIP proxy server. Default: 5060.
•SIP registrar: Port of the server at which the phone registers. Default: 5060.
•SIP gateway: Port of the SIP gateway. Default: 5060.
•SIP local: Port used by the phone for sending and receiving SIP messages. Default: 5060.
When changing the SIP Transport protocol from UDP/TCP to TLS, the SIP port now
>
also have to be changed correspondingly (e.g. SIP port from 5060 to 5061) and on
changing vice versa.
|--- SIP server
|--- SIP registrar
|--- SIP gateway
|
--- SIP local
3.6.7SIP Registration
Registration is the process by which centralized SIP Server/Registrars become aware of the
existence and readiness of an endpoint to make and receive calls. The phone supports a number of configuration parameters to allow this to happen. Registration can be authenticated or
un-authenticated depending on how the server and phone is configured.
For operation with an OpenScape Voice server, set Server type to "OS Voice". When HiQ8000
is to be used, set it to "HiQ8000". The expiry time of a registration can be specified by Regis-
tration timer.
Unauthenticated Registration
For unauthenticated registration, the following parameters must be set on the phone: Terminal
number or Terminal name (see Section 3.6.1.1, “Terminal Identity”), SIP server and SIP registrar address (see Section 3.6.6.1, “SIP Addresses”).
In unauthenticated mode, the server must pre-authenticate the user. This procedure is server
specific and is not described here.
Authenticated Registration
The phone supports the digest authentication scheme and requires some parameters to be
configured in addition to those for unauthenticated registration. By providing a User ID and a
Password which match with a corresponding account on the SIP registrar, the phone authenticates itself. Optionally, a Realm can be added. This parameter specifies the protection domain wherein the SIP authentication is meaningful. The protection domain is globally unique,
so that each protection domain has its own arbitrary usernames and passwords.
A challenge from the server for authentication information is not only restricted to the