Procedure
1. Install the security gateway in accordance with the vendor’s instructions.
2. Configure authentication credentials to allow users to establish a VPN connection.
Configuring the VPN settings
The administrator can populate the 46xxsettings.txt file with all or some of the settings that are used
to create the VPN tunnels and for authentication, depending on whether or not end users will be
given permission to add/change settings.
Note:
For a detailed list of VPN settings in the 46xxsettings.txt file, see Appendix A: VPN Parameters.
At startup, the phone will attempt to establish a VPN connection using the configured VPN
parameters. Users with permission to do so can view, add, or change the VPN parameters.
Simple Enrollment Certificate Protocol (SCEP)
9600 Series SIP Deskphones support Media Encryption (SRTP) and use built-in Avaya SIP
Certificates for trust management. Trust management involves downloading certificates for
additional trusted Certificate Authorities (CA) and the policy management of those CAs. Identity
management is handled by Simple Certificate Enrollment Protocol (SCEP) with phone certificates
and private keys.
SCEP can apply to your VPN operation or to standard enterprise network operation. SCEP is
described in the
Avaya one-X
®
Deskphone Edition for 9600 Series IP Telephones Administrator
Guide
(Document Number 16-300698), however for ease of VPN setup, the applicable parameters
are also included this guide, in
on page 49. A few pointers
regarding SCEP follow:
• If the SCEP server is outside of the corporate firewall, telephones connecting to the corporate
network over a VPN connection can be configured to establish the SCEP connection using an
HTTP proxy server to reach the SCEP server. In this instance, use the WMLPROXY system
parameter to configure the HTTP proxy server.
• When SCEP is initiated the telephone will attempt to contact an SCEP server via HTTP, using
the value of the configuration parameter MYCERTURL as the URI.
• SCEP supports the use of an HTTP proxy server.
• The telephone creates a private/public key pair, where each key has a length equal to the
value of the configuration parameter MYCERTKEYLEN. The public key and the values of the
configuration parameters MYCERTCAID, MYCERTCN, MYCERTDN and SCEPPASSWORD
are used in the certificate request.
Configuring the VPN
14
VPN Setup Guide for 9600 Series IP Telephones
March 2015
