A
ASTRA
6700
I
SIP T
ERMINALS
FOR
MX-ONE
80
26/1531-ANF 901 14 Uen E10 2014-01-22
Check the CMG documentation if Corporate directory is to use
https (TLS), for example:
https://192.20.22.11/xml/directory/CorpDir.php
5.
Per default a time server (using NTP as protocol) needs to be
enabled via DHCP Option 42 or via configuration parameters. The
configuration parameter has precedence over Option 42. The
phone must have a valid date and time in order to verify the server
certificate’s expiry time. As TLS is a per-hop protocol. It is the
server certificate of ‘outbound proxy ip’ which is verified. In this
example this would be an MX-ONE server.
Configuration parameters
time server disabled:0 #0-enabled,1-disabled
time server1:<ip address or host>
#ref: http://www.pool.ntp.org/en/use.html
6.
If no NTP servers are accessible for some reason it is possible to
disable the check for expire date via WebGUI(Network) or configu-
ration parameter. This will also have the effect that there is no date
and time indication on the phone.
https validate expires: 0 #0-disabled, 1-enabled
19.5
How to enable security for home worker on
Aastra 6700i
If Ingate is used as Session Border Controller (SBC), follow the Installa-
tion Guide
How to Install an Ingate Solution for Aastra Teleworker Solu-
tions in Stand-alone mode or DMZ/LAN mode behind existing Firewall
in
the CPI library.
The principle used here is to configure the SBC to have secure commu-
nication on the outside towards the home worker Aastra 6700i terminal
and unsecure communication on the inside towards MX-ONE.
The TLS setup described here will be persistent TLS. If your deployment
requires an even more secure setup, ‘persistent mutual TLS’, then also
read the Appendix, “Teleworker with persistent mutual TLS”.
Furthermore the assumption is that the user would like to be able to use
the terminal in the office and to bring the terminal home (home worker).
For this reason two configuration server directories are set up, inOffice
accessible via http and atHome accessible via https.
The only setting required by the end user is to change the Configuration
Server via phoneUI:
Options
>
Admin Menu
> [6739i;
Advanced
] >
Cfg. Svr.
, choose HTTP or HTTPS in the Download Protocol list. Acti-
vate setting by requesting
Options
>
Restart
.
