Polycom 1725-31424-001 Deployment Manual page 25

Upgrading Polycom CX700 Phone within a Microsoft Office Communications Server 2007 R2 Environment
• Query DNS for _sipinternal._tcp. <SIPDomain>
SRV record
• Query DNS for _sipinternal._tcp.
<SIPDomain>.<DHCPDomain> SRV record
• Query DNS for _sip._tls. <SIPDomain> SRV
record
• Query DNS for _sip._tls.
<SIPDomain>.<DHCPDomain> SRV record
• Query DNS for _sip._tcp. <SIPDomain> SRV
record
• Query DNS for _sip._tcp.
<SIPDomain>.<DHCPDomain> SRV record
• Query DNS for sip.<SIPDomain> A record; IP
address of pool is returned
8. Polycom CX700 phone queries DNS for
poolFQDN and is returned the pool's IP address
9. Polycom CX700 phone initiates TLS connection
to pool IP Address specifying which Ciphers are
supported
10. Pool responds with Certificate detail; they
exchange keys if handshake is OK
11. Polycom CX700 phone queries <DHCPDomain>
for AD LDAP service using DC provided by
DHCP
12. Polycom CX700 phone binds to AD and looks for
RootCA in <DHCPDomain>
13. DC responds with RootCA details. If the Pool cert
was issued by the RootCA returned, we proceed.
14. Polycom CX700 phone queries DNS for
<DHCPDomain> and is returned the domain's IP
address
• Note: this is why we sign in as
contoso.com\userAlias instead of just
contoso\userAlias.
• This step must return a valid IP in order to find a
DC again and download the certificate chain.
15. Polycom CX700 phone locates RootCA again in
<DHCPDomain>
16. Polycom CX700 phone attempts HTTP request
to download RootCA cert chain using NTLM
(_sipinternal._tcp.fabrikam.com)
(_sipinternal._tcp.fabrikam.com.contoso.com)
(_sip._tls.fabrikam.com)
(_sip._tls.fabrikam.com.contoso.com)
(_sip._tcp.fabrikam.com)
(_sip._tcp.fabrikam.com.contoso.com)
(sip.fabrikam.com)
(Client Hello)
(Note: SHA2 is not supported)
(Server Hello) Note: TLS connection is not
established yet.
(_ldap._tcp.dc._msdcs.contoso.com)
(OCPE binds using Auth type SASL)
(contoso.com)
(contoso.com)
(NTLM Auth fails)
19