Aastra 6700i Installation Instructions Manual page 79

26/1531-ANF 901 14 Uen E10 2014-01-22
2. MX-ONE: For certificate handling see operational directions Certif-
icate Management (132/15431-ANF90114) in the CPI library.
3. 6700i phones: The only certificate that is necessary is the root
certificate. The key storage for MX-ONE certificates is
/etc/opt/eri_sn/certs/. The root CA is called, CA.pem. Copy
CA.pem to the configuration server, i.e. the same directory as
where aastra.cfg resides. You may set the file name of the root
certificate via MTS or directly in the aastra.cfg.
4. Phone aastra.cfg file: below is an example of the parameters:
sips persistent tls: 1
sip outbound support: 1
sip transport protocol: 4 # 0=UDP&TCP,1=UDP,2=TCP,4=TLS
sips trusted certificates: CA.pem
sip outbound proxy ip: 192.168.110.20
sip outbound proxy port: 5061
sip backup outbound proxy:192.168.5.3
sip backup outbound proxy port:5061
sip srtp mode: 1 #0-RTP,1-SRTP preffered,2-SRTP only
With the backup outbound parameters security is enabled towards
the backup server.
If the XML keys provisioned by MX-ONE shall use https, the
following setting is required. port 22223 will trigger MX-ONE to
provision XML keys for Logon/Logoff and Diversion as "https" and
port 22223, which is the TLS port for Aastra-XML.
action uri startup:
"https://192.168.110.20:22223/Startup?user=$$SIPUSER-
NAME$$"
services script:
https://192.168.110.20:22223/Services?user=$$SIPUSER-
NAME$$&voicemailnr=<voice mail number>
#download protocol HTTP,HTTPS,FTP,TFTP
download protocol:HTTPS
https server:<IP address of Configuration Server (Tomcat or
webserver of choice)>
https port:443 #443 is the standardport for https
https path:aastra67xxi //path on Tomcat
https client method:"TLS 1.0"
https user certificates:CA.pem #root CA
Phone <model>.cfg:
Either the Logon keys are removed. Then you rely on that the users
logon when prompted due to reboot (triggered by action uri startup
in aastra.cfg), or the /Logon key value needs to be set to
"https://192.168.110.20:22223/Logon?user=$$SIPUSERNAME$$".
S
ECURITY
79