Polycom 1725-31424-001 Deployment Manual page 26

Deployment Guide for the Polycom CX700 IP Phone
17. Polycom CX700 phone attempts HTTP request
to download RootCA cert chain using Kerberos
(SPNEGO)
18. Polycom CX700 phone attempts HTTP request
to download RootCA cert chain using Kerberos
(SPNEGO) w/different key
19. DC streams Base64 certificate chain to Polycom
CX700 phone via HTTP
20. Polycom CX700 phone initiates a TLS
connection to the pool's IP address with the
Ciphers it supports
21. Pool responds with negotiated Cipher spec to
complete the TLS handshake
22. Polycom CX700 phone queries DNS for
autodiscover.<SIPDomain> A record
23. Polycom CX700 phone initiates TLS connection
with Exchange 2007 CAS
24. Polycom CX700 phone sends HTTP 80 POST to
pool.<DHCPDomain> for
/RequestHandler/ucdevice.upx
• Note: This would be an HTTPS 443 POST to
pool.<DHCPDomain> for
/RequestHandlerExt/ucdevice.upx for an external
OCPE device
25. Pool responds with current firmware upgrade
version and Internal / External file path info
• <BaseURL> -
http://pool01.contoso.com/DeviceUpdateFiles_Int/UCPhone/Polycom/CX700/A/ENU/1.0.522.101/CPE
• <ExternalBaseURL> -
https://ocsrp.fabrikam.com/DeviceUpdateFiles_Ext/UCPhone/Polycom/CX700/A/ENU/1.0.522.101/CPE
26. Polycom CX700 phone issues an HTTP GET for CPE file if it's newer than the currently installed version
• (HTTP:Request, GET
/DeviceUpdateFiles_Int/UCPhone/Polycom/CX700/A/ENU/1.0.522.101/CPE/CPE.nbt)
27. Pool begins streaming CPE.nbt to Polycom
CX700 phone as a binary/octet-stream (approx.
15MB)
28. Polycom CX700 phone issues one last HTTP Get
and the pool responds with 200 to indicate
download is complete
20
(Kerberos Auth fails)
(Kerberos Auth succeeds)
(URL: /certsrv/certnew.p7b, Using SPNEGO
Authentication)
(Client Hello) Note: SHA2 is not supported
(Server Hello) Note: TLS connection is now
established.
(fabrikam.com) Returns IP address of Exchange CAS
if configured.
(Used for missed call notification)
(Payload contains phone vendor info)
(These values are blank if WMI settings were not
populated)
(You will see a lot of TCP traffic)
(Success!!)