Prepare the file server at the staging center. It can be an IP Office acting as the file server or another HTTP file server.
-
Put the phones upgrade file and firmware files on the file server.
-
Put the certificate of the root CA that signed the cloud IP Office identity certificate on the file server. Or the root CA that signed the top intermediate CA in the certificate chain of the IP Office identity certificate.
-
Edit the phones settings file per customer to contain the following settings, and put it on the staging file server:
-
NVTLSSRVR, NVHTTPSRVR and NVMCIPADD - all three settings should specify the DNS name (FQDN) of the cloud IP Office instance. This FQDN will be resolved by DNS to the public IP address of the cloud IP Office instance. Note that the cloud IP Office instance for each customer will have a different FQDN and public IP address, hence the settings file has to be edited for staging phones for each customer.
-
As an alternative to the above, the HTTPS Sever IP Address, HTTP Sever IP Address and Call Server IP Address can be manually configured on each phone using the CRAFT UI. But since programming phones manually via CRAFT UI can be very time consuming, the preferred method is setting the parameters using the staging settings file per the bullet above.
-
SET TRUSTCERTS <filename of root CA certificate>
-
SET TLSSRVRVERIFYID 1 - When set to 1, the phone will verify the server identity in TLS connections, which is recommended for security. The phone will verify that the DNS name of the TLS server (as set in NVTLSSRVR) matches the Common Name or subjectAltName in the server certificate.
-
Connect the phone to the staging center network, and provide it with the staging file server IP address, from DHCP or from the phone UI.
-
The phone will contact the staging file server using HTTP and will download the upgrade and settings files, the trusted root CA certificate, and the firmware files if needed.
-
After staging, ship the phone to the customer site.
-
The phone is connected to the LAN at the customer site and powered up.
-
The phone contacts the cloud IP Office via HTTPS over TLS, using the NVTLSSRVR IP address it previously got from the staging settings file, and using port 411 (phone's default value of TLSPORT). The port 411 has to be open in the cloud firewall and in the IP Office. An authenticated TLS connection will be established, as the phone will verify the identity certificate (or identity certificate chain) that the cloud IP Office offers in the TLS connection, by checking it against the trusted root CA cert that the phone got during staging.
-
The phone will get the 96x1Hupgrade.txt file and the auto-generated 46xxsettings.txt file from the cloud IP Office through the HTTPS/TLS connection. The phone will also get the language files from the cloud IP Office through HTTPS.
-
The auto-generated 46xxsettings.txt will specify HTTPPORT 8411. The port number 8411 has to be open in the cloud firewall, whereas port 80 is usually closed.
-
This is based on an enhancement on the IP Office. Port 8411 is hard-coded on the Linux IP Office and is open for restricted HTTP access allowing only Avaya IP phones to get only firmware files.
-
IP Office includes the setting HTTPPORT 8411 in the auto-generated 46xxsettings.txt file sent to a phone if and only if the request for the settings file came in HTTPS (not HTTP) and IP Office determines that the phone is connecting from the Internet. IP Office makes this determination if the source IP address of the request is not an RFC 1918 private address and not in the customer's private network as can optionally be specified in NUSN “PRIVATE_ADDR”.
-
If new phone firmware is available on the cloud IP Office, as indicated in the upgrade file, the phone will get it from the cloud IP Office via HTTP on port 8411 as specified by the HTTPPORT in the auto-generated 46xxsettings.txt.
