Spectralink Configuration Management Server. Administration Guide. Release 2.0.x

Transcription

1 Spectralink Configuration Management Server Administration Guide Release 2.0.x Rev A August 2016

2 Copyright tice 2016 Spectralink Corporation All rights reserved. Spectralink TM, the Spectralink logo and the names and marks associated with Spectralink s products are trademarks and/or service marks of Spectralink Corporation and are common law marks in the United States and various other countries. All other trademarks are property of their respective owners. portion hereof may be reproduced or transmitted in any form or by any means, for any purpose other than the recipient s personal use, without the express written permission of Spectralink. All rights reserved under the International and pan-american Copyright Conventions. part of this manual, or the software described herein, may be reproduced or transmitted in any form or by any means, or translated into another language or format, in whole or in part, without the express written permission of Spectralink Corporation. Do not remove (or allow any third party to remove) any product identification, copyright or other notices. tice Spectralink Corporation has prepared this document for use by Spectralink personnel and customers. The drawings and specifications contained herein are the property of Spectralink and shall be neither reproduced in whole or in part without the prior written approval of Spectralink, nor be implied to grant any license to make, use, or sell equipment manufactured in accordance herewith. Spectralink reserves the right to make changes in specifications and other information contained in this document without prior notice, and the reader should in all cases consult Spectralink to determine whether any such changes have been made. NO REPRESENTATION OR OTHER AFFIRMATION OF FACT CONTAINED IN THIS DOCUMENT INCLUDING BUT NOT LIMITED TO STATEMENTS REGARDING CAPACITY, RESPONSE-TIME PERFORMANCE, SUITABILITY FOR USE, OR PERFORMANCE OF PRODUCTS DESCRIBED HEREIN SHALL BE DEEMED TO BE A WARRANTY BY SPECTRALINK FOR ANY PURPOSE, OR GIVE RISE TO ANY LIABILITY OF SPECTRALINK WHATSOEVER. Warranty The Product Warranty and Software License and Warranty and other support documents are available at Contact Information US Location Denmark Location UK Location (0) Spectralink Corporation Spectralink Europe ApS Spectralink Europe UK th Street Bygholm Soepark 21 E Stuen 329 Bracknell, Doncastle Road Boulder, CO Horsens Bracknell, Berkshire, RG12 8PE USA Denmark United Kingdom info@spectralink.com infoemea@spectralink.com infoemea@spectralink.com August

3 Contents About This Guide... 7 Deployment process... 7 What is QNC?... 7 What is CMS?... 7 What is MDM/EMM?... 7 What is Manual Configuration?... 8 Product Support... 8 Spectralink References... 8 Specific Documents... 9 Conventions Used In This Document...10 Icons...10 Typography...11 Part I: Installing the Configuration Management Server Chapter 1: Getting Started with CMS How Secure is CMS?...15 Setting HTTPS...15 CMS 2.0 Server Requirements...15 Minimum requirements...15 Capacity guidelines...16 Chapter 2: Installing the CMS VM ESXi 5.x Server Installation Overview...17 CMS 2.0 Infrastructure Installation Instructions...17 Creating your CMS Account and Logging in...21 Part II: Configuration Management How CMS Works...23 Navigation...23 Banner...23 Navigation pane...24 Chapter 3: About Us What is the CMS Certificate?...26 August

4 Chapter 4: Batch Configuration Mac address...28 Owner info...28 Group name...28 SIP extension number...28 SIP username...29 SIP password...29 Upload.csv to CMS...30 Generate.csv from Legacy CMS...30 Chapter 5: Devices Approving devices via Holding Area...31 Device List...32 Re-Deploying Devices...33 Chapter 6: Updating PIVOT Code Upload files...34 Manage files...35 Push files to phones...35 Updating Legacy Code...36 Chapter 7: Groups Chapter 8: Configuration Enterprise settings...38 Group settings...38 Device settings...38 Config Manager...40 Device Security...41 Allow user to change lock screen password, Make passwords visible...41 Lock screen after...42 Display Owner info on lock screen, Owner info...42 Allow unknown application sources...42 n Wi-Fi Certificates...43 Enable Admin password prompt...43 Admin password...43 Emergency Contacts...44 Contact name, contact number...44 General Settings...45 LDAP...46 LDAP server address...46 August

5 LDAP server port...47 Communication security type...47 LDAP bind DN...47 LDAP bind PW...48 LDAP base DN...48 Primary attribute...48 Alternate attribute...49 Push to talk...49 Enable settings...49 Channel settings...50 Quick Barcode Connect...51 SAFE / Panic...52 SIP Telephony...54 SIP phone state...54 Registration 1 and Server address...55 Server address:port...56 Transport...57 Extension Number...57 Username...57 Password...58 Voic retrieval address...58 Use SIP standard hold signaling...59 Force subscription to message waiting notifications...59 Common settings...61 Audio codec priority...62 System Log...63 Web API...66 Enable API Calls...66 Web API Format...67 Polling Username, Polling Password...67 Polling Respond Method...67 Push Username / Push Password...68 Allow message priority...68 Push ringtone...68 Server root URL...69 Web API Event URLs...69 Label...69 URL...70 Settings...70 Web Applications...71 Label, URL...71 Wireless / Networking...72 August

6 Wireless profiles...72 IPv Unsecured wireless networks available notification n...73 Wi-Fi frequency band...73 Standby roaming threshold...74 Chapter 9: Wireless Profiles Open Network...76 WEP...76 WPA/WPA2 PSK x EAP (WPA2 Enterprise) Set up...78 PEAP...78 EAP-TLS...79 EAP-FAST...80 Managing Wireless Profiles...81 Chapter 10: Certificate Manager Installing generic CA certificates or PAC files...82 Managing certificates...83 Chapter 11: Replace Device Chapter 12: Feature / Device Licenses Part II Appendices Appendix A: Using CMS to Refine Log Messages Setting up Your Syslog Filters in CMS...87 Using a Filter to Refine Logging Results...87 Appendix B: Open Source Information OFFER for Source for GPL and LGPL Software...89 Contact Information for Requesting Source Code...89 Appendix C: Products Mentioned in this Document August

7 About This Guide This document is used by administrators to configure and manage the Spectralink 87-Series handsets, also known as PIVOT by Spectralink. The following diagram shows the deployment process and the position of CMS in relation to the rest of the deployment. This guide covers the administration of the handsets using the CMS as well as information about managing the CMS. Detailed instructions for phone settings are in Spectralink PIVOT Configuration Guide. Deployment process What is QNC? Quick Network Connect utilizes a customized version of a commercially available Raspberry Pi to simplify the wireless provisioning of your Spectralink 87-Series smartphones. When connected to a PC, QNC provides a browser-based GUI that provides you with the wireless configuration parameters you need to set in order for PIVOT to associate with the wireless LAN. Once the configuration is completed, a connection between QNC and an 87-Series smartphone loads the wireless parameters into the handset. See Quick Network Connect Administration Guide for complete information. What is CMS? The primary tool for administering a volume of handsets is the CMS, the Configuration Management System. It is a GUI program that is opened in a browser and provides an easy and intuitive way to configure the handsets and manage the deployment of many handsets at once. What is MDM/EMM? EMM is Enterprise Mobile Management, a term used to describe the management of mobile devices in a business context. EMM software is an offshoot of MDM or Mobile Device August

8 Management. EMM is the preferred approach as it is specifically designed for enterprise applications and devices. MDM/EMM programs are used to manage applications. Applications need to be managed on PIVOT so that enterprise devices remain secure. The degree of control is a matter of enterprise policy. See Spectralink 87-Series Applications Installation Guide for complete information. What is Manual Configuration? Like any device powered by Android, PIVOT provides menus for configuring options that provide functionality and features. Two types of menus are available, the familiar user-level menus used by all smart phones and administrator menus that are behind a password. Manual configuration refers to using these phone menus to set up each phone individually. Practically any deployment will require some manual adjustments so this step is included to put the final polish on your deployment. See PIVOT by Spectralink Configuration Guide for complete information. Product Support Spectralink wants you to have a successful installation. If you have questions please contact the Customer Support Hotline at The hotline is open Monday through Friday, 6 a.m. to 6 p.m. Mountain time. For Technical Support: mailto:technicalsupport@spectralink.com For Knowledge Base: For Return Material Authorization: mailto:nalarma@spectralink.com Spectralink References All Spectralink documents are available at August

9 To go to a specific product page: Select the Product Category and Product from the dropdown lists and then select the product from the next page. All resources for that particular product are displayed by default under the All tab. Documents, downloads and other resources are sorted by the date they were created so the most recently created resource is at the top of the list. You can further sort the list by the tabs across the top of the list to find exactly what you are looking for. Click the title to open the link. PIVOT documents are available at Specific Documents AP Configuration Guides show you how to correctly configure access points and WLAN controllers (if applicable) and identify the optimal settings that support Spectralink 87-Series handsets. The guides can be found at the View Certified page. Quick Network Connect Administration Guide QNC provides step-by-step instructions for configuring wireless settings required for the handsets to associate with the wireless LAN. Spectralink 87-Series Smartphone Deployment Guide The Deployment Guide provides sequential information for provisioning and deploying the handsets. It covers deployment using QNC and CMS as well as manual deployment. PIVOT by Spectralink Configuration Guide The PIVOT Configuration Guide provides detailed information about PIVOT menu items that have been developed specifically for the PIVOT handset. Spectralink 87-Series Smartphone CMS Administration Guide The CMS Admin Guide provides information about every setting and option available to the administrator on CMS. Time-saving shortcuts, troubleshooting tips and other important maintenance instructions are also found in this document. August

10 Spectralink 87-Series Wi-Fi Security Implementation Guide Wi-Fi security prevents unauthorized over-the-air access to network components and the sensitive data that resides there. This Guide discusses the various method and explains how to implement each of them. Spectralink 87-Series Smartphone Application Installation Guide The Applications Installation Guide provides detailed information about deploying any type of application, using an app store or MDM and manual processes for loading applications on the Spectralink 87-Series handset. Spectralink 87-Series Smartphone User Guide The User Guide provides detailed information about using the features of the 87-Series handsets. Spectralink 87 Series Wireless Telephones Web Developer s Guide The Web Developer s Guide provides Web application creators with information for developing and deploying Web applications that interface with Spectralink handsets. For information on IP PBX and softswitch vendors, see PIVOT by Spectralink Call Server Interoperability Guide. Conventions Used In This Document Icons Icons indicate extra information about nearby text. Warning The Warning icon highlights an action you must perform (or avoid) to avoid exposing yourself or others to hazardous conditions. Caution The Caution icon highlights information you need to know to avoid a hazard that could potentially impact device performance, application functionality, successful feature configuration and/or affect handset or network performance. Spectralink recommends A recommendation from the experts at Spectralink. te The te icon highlights information of interest or important information that will help you be successful in accomplishing a procedure or understanding a concept. August

11 Tip The Tip icon highlights information that may be valuable or helpful for users to know, such as special techniques, shortcut methods, or information that will make user tasks easier to perform. Web The Web Info icon highlights supplementary information available online such as documents or downloads on support.spectralink.com or other locations. Timesaver A time-saving tip is typically used to mention or highlight a faster or alternative method for users who may already be familiar with the operation or method being discussed. Admin Tip This tip advises the administrator of a smarter, more productive or alternative method of performing an administrator-level task or procedure. Power User A Power User Tip is typically reserved for information directed specifically at highlevel users who are familiar with the information or procedure being discussed and are looking for better or more efficient ways of performing the task. For example, this might highlight customization of a feature for a specific purpose. Troubleshooting This element can be used in any type of document and is typically used to highlight information to help you solve a relevant problem you may encounter, or to point to other relevant troubleshooting reference information. Settings The Settings icon highlights information to help you zero in on settings you need to choose for a specific behavior, to enable a specific feature, or access customization options. Typography A few typographic conventions, listed next, are used in this guide to distinguish types of in-text information. August

12 Convention Bold Italics Underlined blue Bright orange text Fixed-width-font Description Highlights interface items such as menus, soft keys, file names, and directories. Also used to represent menu selections and text entry to the handset. Used to emphasize text, to show example values or inputs, and to show titles of reference documents available from the Spectralink Support Web site and other reference sites. Used for URL links to external Web pages or documents. If you click on text in this style, you will be linked to an external document or Web page. Used for cross references to other sections within this document. If you click on text in this style, you will be taken to another part of this document. Used for code fragments and parameter names. This guide also uses a few writing conventions to distinguish conditional information. Convention <MACaddress> Description Indicates that you must enter information specific to your installation, handset, or network. For example, when you see <MACaddress>, enter your handset s 12-digit MAC address. If you see <installed-directory>, enter the path to your installation directory. > Indicates that you need to select an item from a menu. For example, Settings> Basic indicates that you need to select Basic from the Settings menu. August

13 Part I: Installing the Configuration Management Server CMS is a powerful interface for configuring and managing Spectralink 87-Series handsets. Let s take a moment to look at some big questions. Admin Tip: How does the Android platform affect CMS? PIVOT handset code and CMS code must remain in sync for the configurable options to remain the same. You can expect new releases of CMS whenever options in the handset code change. Releases are synchronized quarterly. The first three handset software versions (1.0, 1.1, 1.2) were based on the Android Jelly Bean code. When the Android platform upgraded to KitKat the PIVOT handsets were also upgraded by Spectralink in 1.3 release. Later releases also use the KitKat platform. The parallel CMS version is 1.3.x. Further releases of handset code result in updates to CMS code when there are changes to the options in the handset menus. Always use the parallel or most recent CMS code with PIVOT handsets. CMS is designed to be backwards compatible with earlier handset code versions so you do not need to use a downrev version of CMS. Settings: Is CMS necessary? The question will arise if CMS is strictly necessary for configuring and managing the handsets. The short answer is, not if you are deploying only a few phones. The handsets Settings app includes an Admin menu behind a password. This menu can be used to manually set parameters and view handset usage data. This document covers nearly all the settings you will find in the Admin menu. For specific information about configuring the handsets manually see Spectralink 87-Series Smartphone Deployment Guide. The longer answer is Yes; if you are deploying many handsets, have complex settings such as security certificates, phone groups, etc., or if the handsets cannot be easily retrieved for user support functions. The CMS is a boon to Wi-Fi and IT administrators as it can keep track of and manage any number of handsets remotely. August

14 Settings: t using CMS? If you are not deploying a CMS, please refer to Spectralink 87-Series Smartphone Deployment Guide for the sequence of steps to take when manually configuring the handsets. August

15 Chapter 1: Getting Started with CMS How Secure is CMS? CMS transfers configuration information to the handsets over the air which could expose the data to unauthorized parties. CMS uses both HTTP and HTTPS protocols but the default is HTTPS. If your facility uses the HTTPS protocol, you can take advantage of the mutual authentication feature built into CMS. Mutual authentication is implemented by generating a public key on the CMS and loading it into the handset using QNC. This is the server key that ensures the handset recognizes the CMS as genuine. The handset contains a device certificate that is loaded during manufacturing. The CMS can recognize this key and therefore knows that the handset is genuine. Once this authentication handshake is complete, the handset and the CMS exchange information over a secure connection. For a comprehensive explanation of Wi-Fi security see Spectralink 87-Series Wi-Fi Security Implementation Guide. This secure connection is not possible using HTTP. Setting HTTPS The following settings are required when using HTTPS to establish the secure tunnel. 1 Setting address] for CMS in the phone 2 Using QNC to install the CMS certificate. See Quick Network Connect Administration Guide and the About Us Chapter in this document. CMS 2.0 Server Requirements Minimum requirements VMWare ESXi server 5.0 (or later) host machine capable of running 64-bit guest OS Virtual Machines (VM) (see this knowledge base article on VMWare's site: externalid= &sliceid=1&docid=dt_kb_1_1 ESXi VM is a OS and will take over the HW Utility - Processor Check for 64-Bit Compatibility. 100GB free on ESXi server datastore CMS Virtual Machine requires the following resources from the ESXi host server: August

16 1 virtual CPU 2GB RAM 10GB Harddrive (Thick provisioned) 1 NIC CMS VM is Ubuntu LTS server 64-bit Administrator needs to be knowledgeable about using VMWare vsphere Capacity guidelines Estimated guidelines for larger installations are outlined below. General guidelines for larger installations: Number managed # virtual CPUs RAM Hard drive < 50 use the minimum. 50 and virtual CPUs, 2GB 25GB 200 and virtual CPUs, 2GB 30GB 500 and virtual CPUs, 2GB 40GB virtual CPUs, 4GB 60GB Settings: t using CMS? If you are not deploying a CMS, please refer to Spectralink 87-Series Smartphone Deployment Guide. August

17 Chapter 2: Installing the CMS VM ESXi 5.x Server Installation Overview For assistance on the installation of VM ESXi 5.x, please refer to VMWare installation video: rnalid= Install vsphere to connect & manage your ESXi VM CMS 2.0 Infrastructure Installation Instructions te These instructions require the reader to be knowledgeable about using VMWare vsphere. See VMWare s website for more information. CMS code is available on the Spectralink support website. 1 Browse to Spectralink Support site to download the CMS 2.0 SW at 2 Within the Wi-Fi Product category select Find and select PIVOT (Spectralink 87-Series) 3 CMS software is under the Downloads tab. Download the code. 4 Download the CMS zip file from the Spectralink support site. 5 Unzip VM files onto a machine that can talk to your ESXi host server and that has a compatible version of VMWare vsphere Client installed. 6 Connect to your ESXi host server using vsphere. August

18 7 Select File> Deploy OVF Template from VSphere. 8 Browse to the OVF file inside the unzipped folder from step 2. Select Next. 9 Select Next again. Name the new machine something like "Spectralink CMS". Select Next. August

19 10 Select the resource pool you want to run this VM on. (You may only have one ESXi server to choose from). 11 Select the datastore that you want to deploy this VM onto. You may only have one datastore. Click Next. 12 Select Thick Provision Lazy Zeroed for the disk format. Select Next. 13 Change the Network Mapping to a network that your 87-Series handsets have access to. Select Next. 14 Leave Power on after deployment unchecked. Click Finish. You will see the OVF being deployed to your server. When it is finished, go to the next step. 15 Right-click the new machine in the tree on the left of vsphere and select Power> Power On. 16 Go to the console (in vsphere) for the CMS VM and wait for the login prompt at which you will login as cms2, password=cms2 (You will want to change this at some time later). Caution: Keep track of passwords! If you change the root password and forget what it is, you cannot reset the system and you will need to reinstall from the original VM image. 17 Switch to bash shell (optional but recommended) bash 18 Run the command cd bin August

20 19 Run the command sudo python network_init.py and follow the prompts to configure your network interfaces: DHCP address {your static IP address here} netmask {your static network mask here} gateway {your default gateway here} DNS nameserver 20 Run the command sudo python application_init.py and follow the prompts. address {your static IP address here} Admin Tip: HTTPS and IP addressing When configuring the phone to connect to CMS using https, the URL must match what is entered here (IP, short hostname, or fully qualified hostname). i.e. If CMS is at , and the hostname my-cms is entered into this field, only will work for the phone's CMS setting. and will not work. DNS or Hostname {your hostname here} Administrator Name {your administrator name here} Administrator {your administrator here} Country Code {your 2 digit country code} State {your 2 digit state code} City {your city} Company {your company name} Organization {your organization} 21 Your CMS should now be initialized. This step installs the certificate. Caution For the CMS update feature to work, a DNS server must be defined in step 19 that can resolve to Internet domain names and the CMS must have access to the Internet. At this point, you can browse to the CMS. Or (e.g.) August

21 ========= Further customization steps (like changing server root login and web interface default admin login) are covered in PIVOT by Spectralink Configuration Guide. Creating your CMS Account and Logging in 1 Enter the IP address that you set up in your CMS in your browser. Only use the Google Chrome browser. Use this format: [IP address or server name]/cms/. If security warnings appear, click the Advanced link and proceed to the CMS page. 2 Create a user account: Caution: Password parameters Passwords must contain: between characters, at least 1 capital letter, at least 1 special character. 3 Log in with your new credentials. August

22 August

23 Part II: Configuration Management The PIVOT by Spectralink Configuration Guide is your central reference for all configuration options. Please refer to it for detailed information about each configuration option available to you through CMS. How CMS Works The Configuration Management System provides a GUI interface for and administrator to configure and manage PIVOT devices. An administrator can see devices in the Device list. Each device provides information as part of its heartbeat and this information enables an administrator to check on vital activity and usage information. The system log setting can further assist the administrator in getting very specific information from any device. An administrator can configure any setting in CMS, most of which are also available on the Admin menu of each PIVOT. In CMS, settings can be configured at the Device, Group or Enterprise level. These settings are picked up by the phone when it heartbeats into CMS. CMS is designed to be the exclusive configuration method for Admin menu options. If phones are configured manually through their Admin menus, CMS will not know about these changes. Existing CMS configuration settings will overwrite any manual changes at the next heartbeat. If the Restore defaults option has been used on the Admin menu, there is no way to recover previous CMS settings. See Devices for the method to re-deploy the phone with CMS. Navigation Once logged in, the banner displays the username with a dropdown for the version and account key. The navigation pane helps you find the page you need. Banner August

24 Navigation pane Condensed Expanded August

25 Chapter 3: About Us The About Us page gives you information about the CMS version, your unique account key, and the CMS certificate for https security. It also has a button for updating the CMS software. Admin Tip: Where does the CMS certificate come from? The certificate is generated by the application_init.py script during initial configuration of the CMS. Click the Copy to clipboard button to copy the certificate for pasting into QNC when using HTTPS. The version and account key are also available in the dropdown beside the user name in the header at the upper right of the screen. August

26 What is the CMS Certificate? te: Use QNC to install the CMS certificate A certificate cannot easily be installed on the handset by typing it in. and we recommend using QNC for this purpose. If you are using HTTP and not using HTTPS for the CMS/handset protocol, you may skip this section on certificates and go to the next chapter. The default is to use HTTPS for handset to CMS server authentication. With this type of deployment, the 87-Series handset uses a certificate to authenticate the CMS server. The certificate has two elements the private key that resides on the CMS and the public or server key that must be loaded on every handset, usually using QNC. The certificate is generated within the CMS during setup at which point it is available in the About Us page. The public or server certificate is loaded into the handset using QNC. When the handset gets the CMS address which is prefaced with and the certificate along with the SSID and wireless security settings through QNC configuration, it is able to associate with the wireless LAN and locate the CMS server using the IP address and then authenticates the CMS server using the certificate. The CMS server authenticates the handset through the Spectralink device certificate loaded on the handset at manufacturing. With both the handset and the CMS able to authenticate each other, a secure tunnel is established for information exchange. Spectralink recommends: Learning about Wi-Fi security methods Refer to Spectralink 87-Series Wi-Fi Security Implementation Guide for additional information about understanding and deploying Wi-Fi security methods. Caution: Certificate expiration The self-signed certificate that is generated by the application_init.py script during initial configuration of the CMS is a 3-year certificate measured from the initial installation of the CMS. A new certificate must be created and pushed to the phones before this 3-year certificate expires. August

27 Chapter 4: Batch Configuration The Batch configuration tool is used by CMS to bulk provision SIP service requirements. Settings loaded through the.csv file will override any enterprise/group level settings. The.csv template is available online at the PIVOT support site. The.csv file is designed to be used when deploying a number of new phones in a new installation or when expanding an existing installation. The CSV parser expects the format as presented in the csv file template with the following rules: Field names may not be changed or altered. The Mac address field is mandatory. You can optionally set the Owner info which is the user name that displays at startup. The devices can be associated to existing or new groups by setting a Group name. If an optional field has no value, leave it blank. SIP extension fields must be used or deleted if not used. SIP extension fields must be populated for every phone, if used. This applies to both SIP extension number and SIP secondary extension number. If a secondary registration is not being configured, delete the three fields entirely, including the header. Any values supplied in this file will take precedence over values you've already entered in CMS and on the handset. These values are set at the Device level. The following settings may be configured. The MAC address and one other field are required, at a minimum. Mac address Owner info Group name SIP extension number SIP username SIP password SIP secondary extension number SIP secondary username SIP secondary password August

28 Mac address List the MAC address of each PIVOT you will be deploying. The MAC address may be found on the label in the battery compartment or by going to Settings> About phone> Status after deployment. tes: Text field. MAC addresses contain letters and numbers separated by colons. Case insensitive. E.g. 00:90:a3:c6:ef:ab or 00:90:AB:cd:DD:12 none Yes. Every phone has a different MAC address Yes Device See above Owner info The owner info is the name that displays on the lock screen. tes: Text field none t necessarily Device See above Group name You may assign each phone to a Group. By naming a Group here, CMS will create a Group by that name. tes: Text field none Device See above SIP extension number This is the unique number assigned to each phone. The user part of the SIP Address of Record (for example, 1002) or the user and the host part of the registration SIP URI. (for example, August

29 This field is required and must be populated in order to achieve successful SIP registration. Admin Tip: Using the secondary SIP fields The secondary fields are for use with Registration 2. They are optional. If not using the secondary fields, delete the secondary columns from the csv file. tes: Text field. none Yes. Every phone has a different extension. Yes Device See above SIP username SIP digest authentication User ID to be used for SIP registration. For many call servers this will be the same as the Extension Number, though some call servers offer the ability to have a Username that is unique from the Extension Number. tes: Text field. none Yes. Every phone has a different SIP username. Device See above SIP password The SIP digest authentication password to be used for SIP registration. tes: Text field none Yes Device See above August

30 Steps for setting up the.csv file 1 In Excel, create a.csv. file following the guidelines in CMS. 2 Complete the rows per above. 3 Save as a.csv file. 4 Verify in the.csv file that the correct columns are present. They will appear as separated by commas. Upload.csv to CMS 1 Use Excel to open the.csv file and ensure the format is correct. Save the file as a.csv file to a location where you can easily find it from the CMS. 2 Open CMS and navigate to > Batch configuration. 3 Click Browse Batch Files and browse to and open the.csv file you have created. 4 Click Submit. 5 Once you upload the.csv file to the CMS, when the handset first associates with the wireless LAN and finds the CMS, the CMS will identify it by its MAC address and list it in the Device Holding Area where it can be accepted or rejected. Once it is accepted, it will be listed in the Device list and download the configuration options in the.csv file at its next heartbeat. 6 The settings are pushed to handsets the next time the handset heartbeats to the system. This could occur on normal heartbeat interval, when an inactive handset becomes active, or when a handset boots up. Generate.csv from Legacy CMS You can export your handset list from earlier versions of CMS and import it into CMS 2.0 as a.csv file. To generate a.csv file in CMS from a Legacy CMS 1 Export the file from your legacy CMS system. This produces the CMSExport.ZIP file. 2 You may edit this file as needed. 3 In CMS 2.0, click Browse Files, and select the CMSExport.ZIP file. A csv file in the current CMS format is generated. 4 Check over the file to ensure it is accurate, editing as needed. 5 Follow the steps in the Upload.csv to CMS section above, to import the generated.csv file to CMS. August

31 Chapter 5: Devices The Device List page has two options the Device Holding Area and the Device List. The Device Holding Area lists devices that have associated with CMS but have not yet been approved for inclusion in the Device List. Devices that have been manually configured or configured with QNC appear here. Any device listed here must have the correct Account Key. If you think a device should be listed but it is not, the first thing to check is the account key. The tabs on the right will list devices according to their status Pending, Approved, Rejected. A CMS License required for a more than 10 phone deployment. If you do not have a license for additional devices, when you approve an additional device, you will see a message to contact your service provider. Approving devices via Holding Area When PIVOT first finds CMS, it is listed in the Holding area To approve or reject devices 1 Select the PIVOT(s) you want to approve (reject). 2 Select the action in the dropdown Select actions list. 3 Approved devices appear in the Approved list and in the Device list. Rejected devices appear in the Rejected list. August

32 Device List Once devices appear in the device list, they can be configured/managed with CMS. The displayed columns can be moved by clicking and dragging them. Columns can be hidden or displayed by clicking the Change columns button: August

33 Re-Deploying Devices CMS is designed to be the exclusive configuration method for Admin menu options. If the Restore defaults option has been used on the Admin menu, Spectralink recommends reprovisioning the phone per the steps below. Admin Tip: Reconfiguring phones This re-deploying technique is a good way to remove Device or Group Settings from a phone and reset it to the Enterprise settings. To re-configure a device after restore defaults 1 Go to the Approved list in the Device Holding Area, select the phone and use Select actions to move it to the Rejected list. 2 In the Rejected list, use Select action to delete the device. 3 Restore the phone to defaults 4 Get the phone back onto the WLAN by using QNC to reconfigure it. The phone will associate with CMS and show up in the Pending list. 5 Approve the phone. When it is re-approved, it will receive the Enterprise settings. It now shows up in the Device list and can be configured. August

34 Chapter 6: Updating PIVOT Code OTA provisioning allows PIVOT to obtain software updates over-the-air by using CMS as your update server. Other external servers can be used to update the phones if you are not using CMS. Software releases are periodically available for the 87-Series handsets. CMS functions as an update server, hosting PIVOT software updates and allowing the administrator to select handset(s) and push the update to it or them. Software releases are available at Caution: Updating handset code CMS and handset code are designed to work together. Do not update handset code to a code version that does not align with the version of code being used by CMS. Consult the Release tes that accompany the software for compatible code versions. Caution: Updating phones that are more than one revision out of date The directions provided here are for a simple update within the Lollipop code family (R2.1 and above). Please see the Migration Guide Technical Bulletin for details on updating code. Please call Spectralink Support if you have any questions about your particular installation. Upload files Up to three update files can be loaded and stored. ota-update.bin All PIVOT Models except 8744 ota-update-camera.bin 8744 (Camera) The green browse button allows you to search for the.bin files you need. You may select one, two or three files to upload. A progress bar indicates upload progress. August

35 Manage files The file list allows you to search for and delete any files that are no longer needed. Push files to phones Code updates must be pushed to the phones. Navigate to the device list, select the device and use the action dropdown Apply OTA to start an immediate push. Caution: Avoid overloading the WLAN When pushing code updates to many handsets at once, you do not want to swamp the APs on your WLAN. Be aware of possible bottlenecks in WLAN traffic when selecting multiple phones to receive immediate code updates. August

36 Updating Legacy Code PIVOT R1.8 (KitKat) and PIVOT R2.0 and R2.1 (Lollipop) contain a CMS Client that allows PIVOT to connect to CMS 2.0. PIVOT R1.7 and previous software versions do not contain this Client and therefore CMS 2.0 will not recognize the phone. Please see the Migration Guide Technical Bulletin for details on updating code. Please call Spectralink Support if you have any questions about your particular installation. August

37 Chapter 7: Groups Being able to group devices and customize configurations for device groups gives you tremendous flexibility in your deployment options. Use the Device groups page to set up and manage your groups. On this page, you can set up groups, add devices to a group, edit groups and change a group s configuration. te that any device can belong to only one group. When a device is added to a group, the Group settings are applied to it, overriding any conflicting Enterprise settings. August

38 Chapter 8: Configuration The Configuration pages contain the key configuration settings for successful deployment. There are three ways to get to this page and each different way allows you to configure the phone at the three different levels: Enterprise, Group, and Device. Enterprise settings Enterprise level settings are available when you browse directly to the Configuration page. The banner displays the Enterprise tab: Enterprise settings are the most generic. They apply to every handset. At the enterprise level you would typically set everything except for the device specific SIP settings ext number/username/password. At the enterprise level you do not see individual extension settings under SIP. Barcode settings are visible at the Enterprise level but barcode settings will have no effect on devices that are not barcode-enabled. Group settings Group level settings are available when you browse to the Group page, select a Group and select Edit config from the dropdown. The banner displays the Group tab. Group settings override Enterprise settings. They apply only to the handsets that have been assigned to that group. See Groups for more information on configuring Groups. Typically, group settings are used for barcode groups, security groups, Web API and Web Apps. They are also used for Feature deployment such as Push-to-talk and SAFE. A handset can belong to only one group. Device settings Device level settings are available when you browse to the Device list, select a device and select Edit config from the dropdown. The banner displays the Device tab. August

39 Device settings can be configured through the batch configuration option. See Batch Configuration. Device settings override both Group and Enterprise settings. They apply only to the specific handset that has been selected from the dropdown list. Therefore only those settings that pertain to specific phones should be configured at the device level. Typically, the only settings that are configured at the device level would be SIP extension settings. When a device is selected in the Device List and the Configuration option is chosen, the settings level for each setting in the Device List is displayed with an icon for Enterprise, Group or Device. This way you know which setting level has been configured for each setting. Example Let s say you want to zero in on a particular handset that is behaving strangely. You can set that handset to log at an Info level with an appropriate filter while all the other handsets remain at a Warning level. This gives you a close-up of just one device without the unnecessary syslog traffic that would occur if all devices were set to the Info level. August

40 Config Manager The Config Manager page allows you to enable CMS, set the CMS server URL and set the heartbeat interval. August

41 Device Security The Device Security settings allow you to implement and control several security functions. Allow user to change lock screen password, Make passwords visible This is an enable/disable option. When turned on, the user can change the type of screen lock. If you enforce screen security by requiring a PIN/Password/Pattern, this option should be off. August

42 tes: Enable or disable Disable Enterprise, usually but may be set at any level. See above. Lock screen after This allows you to set the delay for locking the screen. tes: Dropdown list 5 seconds If lockscreen is set, this will also be set. If blank, the default will be used. Enterprise, usually but may be set at any level. See above. Display Owner info on lock screen, Owner info You may want to display user information on the lock screen so that the handset can be identified without being unlocked. tes: Enable or disable, text box for owner info if enabled Disabled Can be unique for each device and set by the csv file. May also be set at enterprise or group level Device, usually but may be set at any level. See above. Allow unknown application sources This is an enable/disable option. te that Android only considers Google Play Store to be a known source. This option must be enabled if your users will be downloading applications from an in-house applications server. Enable or disable Disabled August

43 tes: Enterprise, usually but may be set at any level. See above. n Wi-Fi Certificates Provides a list of non-wi-fi certificates that have been loaded on the Manage Certificates page. tes: entry permitted. This is a list of certificates already loaded ne na See above. Enable Admin password prompt This is an enable/disable option. The Admin settings area password prompt can be disabled. If disabled, the Admin menu can be accessed freely. In most facilities, this option should be enabled. tes: Enable or disable Enabled. Will use default if left blank Enterprise, usually but may be set at any level. See above. Admin password This is where you set a more secure password for the Admin Settings menu in the handset than the default of admin to prevent unauthorized changes to the administrative parameters. tes: Text field admin. Will use default if left blank Enterprise, usually but may be set at any level. See above. August

44 Emergency Contacts When a handset is locked, it cannot be used for calls if there is an emergency need unless emergency contact numbers are configured here. This is a safety feature that many facilities deploy to protect their employees. Warning: Power failure may prevent call functionality The PIVOT smartphone may not function in the event of a power failure as it relies on the greater computer network to transmit calls. You will have a registration failure icon if the handset cannot make or receive calls, but there may be a time delay between the system failure and the appearance of the registration failure icon. Contact name, contact number Up to five emergency contacts can be configured with both a name and a number. Ensure you follow any dial plan rules when entering the number. Text fields ne August

45 tes: Enterprise, usually but may be set at any level. See above. General Settings August

46 LDAP Caution: LDAP settings are highly specialized Prior to configuring the settings listed here, ensure you consult with your LDAP administrator and obtain accurate information for populating these settings correctly. You can connect your handset to a corporate directory server that supports the Lightweight Directory Access Protocol (LDAP) version 3. Once configured, the corporate directory can be used by the handset. Spectralink 87-Series handsets currently support the following LDAP servers: Microsoft Active Directory 2003 SP2 Open LDAP Directory Server Spectralink handsets support corporate directories that support server-side sorting and those that do not. For servers that do not support server-side sorting, sorting is performed on the handset. Tip: Better performance with server-side sorting Spectralink recommends using corporate directories that have server-side sorting for better performance. Consult your LDAP Administrator when making any configuration changes for the corporate directory. For more information on LDAP attributes, see RFC Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map. Web Info: Supported LDAP directories Configuration of a corporate directory depends on the LDAP server you use. For detailed explanations and examples of all currently supported LDAP directories, see Technical Bulletin 41137: Best Practices When Using Corporate Directory on Spectralink handsets. LDAP server address The IP address or hostname of the LDAP server interface to the corporate directory. For example, host.domain.com. Text fields accepts: dotted-decimal IP address or hostname or FQDN ne August

47 tes: Yes Enterprise, usually but may be set at any level. See above. LDAP server port The port that connects to the server if a full URL is not provided. Common LDAP ports are 389 and 636 for encrypted (TLS). Text field. Accepts 0, Null, 1 to tes: Enterprise, usually but may be set at any level. See above. Communication security type If you are using encryption, select the type: SSL, ne, Start TLS tes: Dropdown list ne See above Enterprise, usually but may be set at any level. See above LDAP bind DN Distinguished name for the site. An LDAP representation of the name of your domain. tes: Text field ne [blank] (leave empty for entire site) Enterprise, usually but may be set at any level. See above. August

48 LDAP bind PW For open LDAP, a password is used to access the directory. tes: Text field ne : [blank] (leave empty for anonymous) Enterprise, usually but may be set at any level. See above. LDAP base DN Use the same value as the Bind DN. However, if you have a space or other special characters in the Bind DN name use encoded characters here. tes: Text field ne [blank] (leave empty for entire site) Enterprise, usually but may be set at any level. See above. Primary attribute In your implementation of LDAP, what attribute are you using for the primary addresses of your contacts? E.g. mail or msexchxxx. Caution: The mail attribute should be validated against an server The mail attribute may be a text field on the LDAP server and might not contain a valid address. Be sure to verify addresses against an server in order to ensure that valid addresses are being provided to handsets. Caution: Use attributes that are populated by a single address only Certain LDAP attributes may contain multiple s such as a primary address and a number of alias addresses. Use an attribute that provides only a single address. Text field August

49 tes: none Yes if you are using LDAP Enterprise, usually but may be set at any level. See above. Alternate attribute A different field used for addresses. For instance you might have multiple mail servers or some contacts may use some other address. tes: Text field none Yes if you are using LDAP Enterprise, usually but may be set at any level. See above. Push to talk Enable settings August

50 Channel settings August

51 Quick Barcode Connect August

52 SAFE / Panic Please refer to the PIVOT by Spectralink Configuration Guide for SAFE and Panic settings. Admin Tip: Panic tones in a combined environment If you have a combined deployment with both R1.8 and R2.1 releases, you must group them separately as CMS cannot send warning or alarm tones to R1.8 phones but it can send these tones to R2.1 phones. August

53 August

54 SIP Telephony SIP settings provide telephony function. SIP phone state Enables/disables the Spectralink SIP application used for call routing, dial plan, DTMF, and URL dialing. If enabled, the Spectralink SIP application is used for phone calls and other telephony services. tes: Dropdown selectable: Disable/Enable Disable Yes, for telephony function Enterprise Must be enabled manually at the Enterprise level for facility-wide telephony functioning August

55 Registration 1 and 2 Server address All phones using the same SIP server use the same entry in this field. Two formats are recognized by the handset: Format A: domain Accepts: IP address, DNS A-name record using a FQDN, or a DNS SRV record that can be August

56 resolved to an IP address. The [domain] value should be resolvable to a server that accepts SIP registrations. value: none Registration requests, SIP Invites, and other SIP requests will be composed in the form of [extension]@[domain] and will be delivered to the IP address of [domain], whether obtained through DNS lookup or provided by an IP address. If the SIP server requires requests in the form of Extension@SIP_Domain_Name, and you wish to use this format, then you should create a DNS SRV record with the SIP_Domain_Name pointing to the server s address. Format B: [domain]; [serverspec1] Accepts: domain = SIP Domain Name; serverspec1 = a dotted-decimal IP address, a hostname, or a SRV record that can be resolved to an IP address. Registration requests, SIP Invites, and SIP messages will be sent in the form of [extension]@[domain], and will be delivered to the IP address specified after the semicolon, whether obtained through DNS lookup or provided by an IP address. If the SIP server requires requests in the form of [extension]@[sip_domain_name] and you wish to use this format, you should specify the [SIP_Domain_Name], followed by a semicolon, and then the address, hostname, or SRV record that can be resolved to the address to which you want SIP messages delivered. tes: See above for format type ne Yes, for telephony function Enterprise Must be set manually at the Enterprise level for facility-wide telephony functioning Server address:port The port value entered here must match the port used in the SIP server to accept connection requests. Numeric value. Accepts 0, 1 to Leaving this value blank will enter the default value. Yes, for telephony function Enterprise tes: Must be enabled manually at the Enterprise level for facility-wide telephony functioning If utilizing a DNS SRV record, the SIP Server Port should be specified through the SRV record and left blank in this field. If you specify a port number here, then the Spectralink 87-Series August

57 handset will not attempt to use SRV records at all to discover the SIP Server address and instead will only query for a DNS A record. Transport The network transport protocol. Admin Tip: Which network transport protocol to use? Certain call servers drop calls when coming back into Wi-Fi coverage after walking out of range. This issue only occurs when using TCP for SIP. A potential work around for the issue is to switch to using UDP for SIP. tes: Dropdown selectable: UDP, TCP UDP Yes Yes, for telephony functioning. Device Must be set at the Device level for smartphone telephony functioning. Extension Number Enter the extension number for the device. This entry should be different for each phone. This field is required and must be populated in order to achieve successful SIP registration. It is the user part of the SIP Address of Record. tes: Text entry. Configurable through.csv. ne Yes Yes, for telephony functioning. Device Must be set at the Device level for smartphone telephony functioning. Example If the extension is 1002, the Address of Record would become 1002@Spectralink.com where 1002 is the extension number and Spectralink.com is the server value set above. Username SIP digest authentication User ID to be used for SIP registration. For many call servers this will be the same as the Extension Number, though some call servers offer the ability to have a Username that is unique from the Extension Number. August

58 tes: Text entry. Configurable through.csv. ne Yes Yes, for telephony functioning. Device Must be set at the Device level for smartphone telephony functioning. Password The SIP digest authentication password to be used for SIP registration. Check the Show Password checkbox to see the entry. tes: Text entry. Configurable through.csv. ne Yes Yes, for telephony functioning. Device Must be set at the Device level for smartphone telephony functioning. Voic retrieval address The number to dial to retrieve voic messages. Admin Tip Many call servers will send this information in the Message-Account field of the SIP tify messages to the Spectralink 87-Series phone automatically when the phone initially registers. Leave this field blank to allow the phone to attempt auto-discovery of this parameter using the call server provided message-account field address. If long-pressing the #1 key in the dialer does not initiate a successful call to the voic system, then populate this field with the number to dial to retrieve a voic message (the Voice Mail system s pilot number.). Invites will be sent to: voic _retrieval_address@server Text entry. ASCII encoded string containing digits (the user part of a SIP URL) or a string that constitutes a valid SIP URL (6416 or 6416@spectralink.com) ne August

59 tes: Maybe, see Admin Tip Enterprise Must be set manually at the Enterprise level for facility-wide voic functioning. Example 1: if Server is defined as and Voic retrieval address is defined as 6416, Invites to voic will be sent to Example 2: If Server is defined as a DNS SRV record that resolves to an IP address (e.g ), and Voic retrieval address is set to 6416@spectralink.com, then Invites to voic will be sent to the IP address with a To: address of 6416@spectralink.com Use SIP standard hold signaling When enabled: Uses SDP media direction parameters (such as a=sendonly) per RFC 3264 when initiating a call. When disabled: Reverts to RFC2543 hold mechanisms (redirects media to when initiating hold) tes: Checkbox Enabled Yes, for telephony function Enterprise Must be enabled manually at the Enterprise level for facility-wide telephony functioning Spectralink recommends: When to disable SIP standard hold signaling Spectralink recommends leaving this setting enabled unless hold / resume is not functioning correctly on the call server you are attempting to interoperate against. Force subscription to message waiting notifications Most call servers will subscribe a handset to message waiting indicator (MWI) notifications automatically when they register. Some call servers may require that a handset send a separate SIP Subscribe message in order to receive message waiting notifications. Spectralink recommends that customers leave this setting disabled unless the 87-Series handset is not receiving message waiting indicators. Enabled: Causes the handset to send a separate SIP Subscribe message to the Server address for Message Waiting tifications Disabled: The handset will not send a separate SIP Subscribe notification to the Server address for message waiting tifications August

60 tes: Checkbox Disabled See above Enterprise See above Allow contact header updates Allows updates of the call control Contact address using the topmost SIP Via. Enabled: Will replace the Contact Header with the received ip address and rport values contained in the Via of the 200 OK response to SIP Registration. PIVOT will then renew the SIP Registration using the updated Contact information, and subsequent Invites and Registration requests will be made using the updated Contact information for call control messaging. Disabled: SIP Message Headers will use the handset's local ip address in the Contact field for all call control messaging Value: Disabled tes: Checkbox Disabled See above Enterprise See above August

61 Common settings Audio DSCP Specify the DSCP of packets. tes Enter either decimal (no leading characters) or hex number (0x) Accepts: 0 to 63 decimal or 0x0 to 0x3F hexadecimal (include the 0x if specifying values using hexadecimal notation) 46 (or 0x2e) Leave blank to enter the default value. Yes, for telephony function Enterprise Must be set manually at the Enterprise level for facility-wide telephony functioning Call Control DSCP Specify the DSCP of packets. Caution: Changing Call Control DSCP values requires a phone reboot Call Control DSCP values do not take effect until the handset reboots or SIP service is restarted. August

62 tes Enter either decimal (no leading characters) or hex number (0x) Accepts: 0 to 63 decimal or 0x0 to 0x3F hexadecimal (include the 0x if specifying values using hexadecimal notation) 46 (or 0x2e) Leave blank to enter the default value. Yes, for telephony functioning. Enterprise Must be set manually at the Enterprise level for facility-wide telephony functioning Audio codec priority Codecs settings are prioritized by assigning a number to each with 1 being the highest. A setting of 0 (zero) means the codec is disabled. Codecs do not have to be set identically for each phone. tes: Checkbox and drag and drop for re-prioritization G.711u = 1 and G.711a = 2. The other two codecs are disabled by default. Yes, for telephony function Enterprise Must be enabled manually at the Enterprise level for facility-wide telephony functioning August

63 System Log A syslog server provides valuable logging information about the handset s operation. Spectralink recommends: Setting up a syslog server We recommend that you set up a syslog server as part of your initial deployment. Log messages provide a window into the handset s operation. These messages can assist you in troubleshooting issues and understanding how the handset executes. Spectralink s log structure enables message filtering by severity. Messages may be further filtered on a tag field provided by the software. See Appendix A for more information. Syslog settings can be set at a Enterprise, Group, or Device level. Messages are buffered in the handset and can be retrieved through a USB download. Enable syslog Checkbox Off. will be used if left blank. August

64 tes: Enterprise, usually but may be set at any level See above Server address IP address of the syslog server tes: Text field ne Enterprise, usually but may be set at any level See above Transport protocol Selects the method used to transport information. tes: Dropdown UDP Yes, if using a syslog server Enterprise, usually but may be set at any level See above Always write Syslog must be enabled for this setting to be effective. This option is designed for troubleshooting of network connections on specific handsets. The Always write option refers to whether or not the phone should write syslog messages to an internal file (syslog.txt) continuously, whether or not it is connected to Wi-Fi. When enabled, the phone will log messages to syslog.txt continuously, even when there is a Wi- Fi connection and the phone is also (presumably) sending messages to a Syslog server. When disabled, the phone will log messages to the internal file (syslog.txt) only when Wi-Fi is down. When the Wi-Fi connection is re-established, the phone will stop logging messages to syslog.txt. The resulting file will show gaps in time due to gaps in Wi-Fi connectivity. The syslog.txt file records any overwriting of older records and time of gaps so that you have a full record of its activities. The syslog.txt file has a 1Mb capacity. When the capacity is reached, the file will be replaced with a new blank one and logging will continue. August

65 tes: Dropdown Disable Yes, if using a syslog server. Enterprise, usually but may be set at any level. See above. Logging level Spectralink s log structure enables message filtering by severity. The logging level setting sets the default logging level. More specific logging that matches filters set in the filter fields will be included in the log. The levels by descending degree of severity are: 1 Verbose filter 2 Debug filter 3 Info filter 4 Warning filter 5 Error filter 6 Fatal filter tes: Dropdown Warning Yes, if using a syslog server. Enterprise, usually but may be set at any level. See above. Logging filters Specific logging criteria can be selected by logging level. Therefore, you can have a less severe default logging level but specify more precise logging info for areas of concern by filtering messages on a tag field provided by the software. tes: Text field ne Enterprise, usually but may be set at any level. See above. August

66 Web API Web API allows you to configure the phones to integrate with an XML application. Enable API Calls You can control which handsets use the application by enabling or disabling by individual handset, group or enterprise. August

67 tes: Checkbox Disabled See above Enterprise, usually but may be set at any level. See above Web API Format XML is the supported format. tes: Dropdown list XML See above Enterprise, usually but may be set at any level. See above Polling Username, Polling Password Enter the username that the handset requires to authenticate polling. Enter the password that the handset requires to authenticate polling. tes: Text fields ne Enterprise, usually but may be set at any level. See above. Polling Respond Method Select the method for sending the requested polling data. Either URL or Requester. If the response method is requester, the response will be sent to the HTTP server running at the address where the request was made. If the response method is URL, you must enter the URL of a valid HTTP server that will get the response. This can be at a different address than the requester. Dropdown list August

68 tes: Requester See above Enterprise, usually but may be set at any level. See above URL to receive polling response The URL to which the handset sends call processing state/device/network information. This field appears when the Polling Respond Method is URL. Push Username / Push Password These credentials are for the Web API and are needed in order to do any kind of push. tes: Text fields ne Yes, for a push Enterprise, usually but may be set at any level. See above. Allow message priority Select the priority desired for messages from the App. Messages pushed that are below this level of priority will not be displayed on the configured handsets. tes: Dropdown list All See above Enterprise, usually but may be set at any level. See above Push ringtone This setting determines whether or not a ringtone will play when a push message is received. Which ringtone plays is set in the handset Settings> Sound & notifications> Phone ringtone. The volume of the push ringtone is set in the handset Settings> Sound & notifications> Volumes> Web API volume. August

69 tes: Radio buttons Enabled. will be used if left blank. Enterprise,usually but may be set at any level See above Server root URL The URL of the application server you enter here is combined with the handset address and sent to the handset s browser. For example, if the application server root URL is and the relative URL is /examples/sample.html, the URL that is sent to the microbrowser is Can be either HTTP or HTTPS. tes: Text field ne Yes Enterprise, usually but may be set at any level. See above. Web API Event URLs The URL to which the handset sends notifications of specified events. This offers the ability for the phone to send notifications based on various phone events such as incoming, Registration, etc. There can be one or more notification events defined, each with a name, URL, and the phone events that will cause the event notification to be set. Enter the URL and the Event Label and check the Event type. Repeat for every type of event the App monitors. te: Changing event URLs If you need to edit an event URL, remove it and re-enter the information with the new URL label or address. Label Enter a descriptive label. Text field ne August

70 tes: Enterprise, usually but may be set at any level. See above. URL Enter the URL for this Event tes: Text field ne Enterprise, usually but may be set at any level. See above. Settings Check the setting that apply to this event. tes: Checkboxes Disabled Yes Enterprise See above August

71 Web Applications Web API allows you to configure the phones to integrate with an XML application. Web applications listed here are Web applications whose shortcuts are displayed in a widget box on one of the home pages of the handset. They are opened in the Spectralink Webview browser. Any URL available to the handsets can be entered. Label, URL Enter the Application shortcut label and URL. The label displays in the widget box on the handset after the handset is rebooted. tes: Text fields ne Enterprise, usually but may be set at any level. See above. August

72 Wireless / Networking Several options can be set to adjust the wireless network. Wireless profiles A list of wireless profiles is displayed. These profiles are added in Wireless Profiles Configuration. Select one or more profiles in this screen to push to the device(s). IPv6 You may enable IPv6 awareness to improve compatibility with IPv6 aware applications. However, IPv6 wireless networks are still NOT supported, and this settings should be set to off if networking problems are observed. tes: Radio buttons Enabled. will be used if left blank. Enterprise,usually but may be set at any level See above August

73 Unsecured wireless networks available notification If enabled, the handset will notify users of the availability of unsecured wireless networks if the handset is out of range of all known profiles. You may disable this option so these notifications will not occur. tes: Radio buttons Enabled. will be used if left blank. Enterprise, usually but may be set at any level See above n n support can be disabled. It is enabled by default. tes: Radio buttons Enabled. will be used if left blank. Enterprise, usually but may be set at any level See above Wi-Fi frequency band Wi-Fi frequency band options allow you to specify which band(s) you want to use: 2.4GHz, 5GHz or Auto. If Auto is selected, the handset scans both bands when it is trying to find the best AP. Wi-Fi frequency band is available under the Advanced option when you tap the overflow icon at the bottom right. tes: Dropdown list Auto. will be used if left blank. Enterprise, usually but may be set at any level See above August

74 Standby roaming threshold Standby roaming threshold an advanced tuning parameter to increase roaming aggressiveness in certain environments. This setting should be left at its default unless advised by Spectralink support personnel. Improper setting of this parameter can negatively impact battery life of the handset. Slider -75. will be used if left blank. Enterprise, usually but may be set at any level tes: See above August

75 Chapter 9: Wireless Profiles A handset may be required to associate to several SSIDs. One SSID is configured during initial deployment with QNC and one proxy server can be configured as well. Use this page to configure additional SSIDs with or without proxy servers. Wireless profiles are added to the handset on the Configuration page, Wireless / Networking section. Any SSIDs entered here will appear on the Wireless Profiles list on that page. Wireless Profiles can be assigned at the Enterprise, Group or Device level. Admin Tip: Roaming between SSIDs? The handset is not designed to roam between different networks. A different SSID usually means that the handset will need a new IP address with different network conditions. The handset may need to be rebooted to change SSIDs. Do not expect continuous connectivity. Installing multiple wireless profiles allows the handset to associate to a new SSID when the handset is turned on at a new site. Wireless profiles ask for the security type used by the SSID. For a full discussion of the various security methods, see Spectralink 87-Series Wireless Security Implementation Guide. Settings: Activating a Wi-Fi Profile These instructions are for configuring a Wi-Fi profile. To add it to a handset at the enterprise, group or device level, navigate to Device Management> Configure Devices> Wireless Profiles and select the new profile from the list. August

76 Open Network security method is deployed when you select Open Network. WEP The WEP option uses a single password for the entire facility which is set in the AP. The 87-Series handsets use only the first index key which is called either Key 1 or Key 0, depending on the environment. The passphrase can be 10 or 26 hexidecimal characters or up to 63 ASCII characters. Admin Tip Hex characters are 0-9 and a-f. te Key rotation is not supported. The handset will accept either open or shared key. Set up the password in the APs. This same password is entered into the handset by one of the three different methods: QNC, CMS or the handset s Admin menu. You will only use the CMS configuration when the handset is already associated and you need to change the Wi-Fi profile or add a new one. 1 Click the WEP option and enter the SSID in the SSID field. 2 Enter the 10 or 26 character key in the Password field. te: asterisk indicates required field. 3 Select either ne or Manual in the Proxy enabled field. 4 Click Save. WPA/WPA2 PSK When you configure WPA/WPA2 PSK in the AP, you will determine the encryption algorithm to be used and that determines if you are using WPA (TKIP) or WPA2 (AES). However, in the handset s configuration, all you need to do is enter the Passphrase (8-63 characters) or Hex Key (64 hexadecimal characters) in the Password field. The Passphrase is 8-63 characters The Hex Key option is 64 hex characters August

77 Set up WPA PSK or WPA2 PSK in the APs. You will only use the CMS configuration when the handset is already associated and you need to change the Wi-Fi profile or add a new one. 1 Select the WPA-PSK or WPA2-PSK option and enter the SSID in the SSID field. 2 Select Hex or Passphrase from the dropdown. 3 Enter the 8-63 character Passphrase or 64 character Hex Key in the Passphrase / Hex Key field. You can paste it into the field instead of typing it in. 4 Click Save. August

78 802.1x EAP (WPA2 Enterprise) Set up Three 802.1X EAP options are supported: PEAP, EAP-TLS and EAP-FAST (two methods). PEAP and EAP-FAST validate user credentials by using the username and password from the RADIUS server. EAP-TLS validates the user through a user/device certificate. Each method uses certificates in slightly different ways. PEAP can use a CA (Certifying Authority) certificate, but it is not required. TLS uses two types of certificates. A CA certificate initially validates the RADIUS server to the handset. A user/device certificate validates the handset to the RADIUS server. EAP-FAST uses a type of certificate called a PAC (Protected Access Credential). The PAC can be auto-provisioned through QNC or CMS. In order to deploy x EAP, you must provision a RADIUS server to provide the username/password security handshake. The RADIUS server maintains the username and password for each handset or acquires this information from the LDAP server. Admin Tip: Fast handoff methods When using a RADIUS server, you will need to configure a fast handoff method in the AP in order to assure audio quality. Spectralink 87-Series handsets use either of two fast-handoff techniques as they roam among APs: CCKM or OKC. CCKM is used exclusively by Cisco APs. OKC is used by most non-cisco APs. Consult the VIEW guide for your AP model for more information. te MSCHAPv2 is supported for PEAP and TLS when enabled on your infrastructure. PEAP PEAP requires a username and password but does not require a CA certificate. Be aware that not using a certificate for server authentication is much less secure. August

79 You will only use the CMS configuration when the handset is already associated and you need to change the Wi-Fi profile or add a new one. Wi-Fi profile configuration is done on an enterprise-wide level and therefore unique passwords and user certificates are not supported for PEAP. All PEAP identities and passwords must be generic. 1 Select the WPA2-Enterprise option and enter the SSID in the SSID field and select PEAP for the WPA2 Enterprise Security. 2 Select the Certificate, if used. You may select one from the dropdown list if the CA certificate is already loaded into the CMS. Otherwise, you can add a new CA certificate through the CMS Certificate Manager and then return to this screen to select it. 3 The EAP Identity and the Password are the generic Username and Password that are stored on the RADIUS server. Enter the Username and Password that are stored on the RADIUS server. 4 Select the Proxy method from the dropdown: ne or Manual. 5 Click Save. EAP-TLS You will only use the CMS configuration when the handset is already associated and you need to change the Wi-Fi profile or add a new one. Wi-Fi profile configuration is done on an enterprise-wide level and individual EAP identities cannot be configured here. The EAP Identity field should be left blank when the device certificate provided with the handsets is used. This field will be populated by the MAC address of the handset when the configuration is downloaded to the handset. 1 Select the WPA2-Enterprise option and enter the SSID in the SSID field. 2 The EAP Identity should be left blank if you are using the Spectralink device certificate. Caution: Insecure setting Using a generic identity for EAP-TLS is considerably less secure than accepting and using the default MAC address as the identity. EAP-TLS is the most secure Wi- Fi method when handset authentication depends upon unique certificates and identities for each handset. 3 Select the Certificate. You may select one from the dropdown list if the CA certificate is already loaded into the CMS. Otherwise, you can add a new CA certificate through the CMS Certificate Manager and then return to this screen to select it. 4 Select the Proxy method from the dropdown: ne or Manual. 5 Click Save. August

80 EAP-FAST EAP-FAST is used by products of Cisco, its creator, and by a growing number of other WLAN vendors. It uses a PAC file, which is similar to a certificate. You will only use the CMS configuration when the handset is already associated and you need to change the Wi-Fi profile or add a new one. Wi-Fi profile configuration is done on an enterprise-wide level and therefore unique passwords and user certificates are not supported. All EAP identities, passwords and CA certificates must be generic. 1 Select the WPA2-Enterprise option and enter the SSID in the SSID field. 2 The EAP Username and the Password are the Username and Password that is stored on the RADIUS server. Enter the Username and Password that is stored on the RADIUS server. 3 (Provided PAC file only) Select the PAC file. You may select it from the dropdown list if the PAC file is already loaded into the CMS. Otherwise, you can add a new PAC file through the CMS Certificate Manager and then return to this screen to select it. 4 Select the Proxy method from the dropdown: ne or Manual. 5 Click Save. August

81 Managing Wireless Profiles August

82 Chapter 10: Certificate Manager Only the Spectralink device certificate is provided with the handset from the factory. Other certificates must be loaded into the handsets before they can provide security. Installing generic CA certificates or PAC files Admin Tip: CA Certificates must use the.crt extension Only CA certificates with a.crt extension can be uploaded to CMS. For PEAP, TLS and EAP-FAST, generic CA certificates and PAC files are installed using QNC for the initial setup. After you connect to CMS you can use CMS to install them. 1 Create a name for the certificate. 2 Select the type of certificate from the dropdown list. 3 Enter the Password for the certificate, if any. 4 Browse to the Certificate file to load it into CMS. 5 Write a descriptive note for the certificate. 6 Click Save August

83 Managing certificates Searching certificates 1 Use the first dropdown to set the search field. 2 The second field can be a partial. As characters are typed, the certs that match will be shown in the certificates list. 3 An empty search string will match everything. August