Cisco SPA901-UK - Small Business Pro User manual

Cisco Small Business
Voice System, Voice Gateways, and IP Telephones
PROVISIONING
GUIDE

Cisco Small Business IP Telephony Devices Provisioning Guide i
Contents
About This Document iv
Purpose iv
Document Audience v
Organization v
Document Conventions vi
Chapter 1: Provisioning Cisco Small Business VoIP Devices 7
Small Business and Residential Deployment Provisioning 7
Remote Endpoint Control and NAT 8
Communication Encryption 8
Provisioning Overview 9
Remote Firmware Upgrade 9
Initial Provisioning 10
Deploying RC Units 10
Redundant Provisioning Servers 11
Retail Provisioning 11
Automatic In-House Preprovisioning 12
Configuration Access Control 13
Configuration Profiles 13
Provisioning States 15
Using HTTPS 16
How HTTPS Works 17
Server Certificate 17
Client Certificates 18
Certificate Structure 18
Provisioning Setup 20
Software Tools 20
Server Configuration 21
HTTPS 23
Syslog Server 25
Where to Go From Here 26

Cisco Small Business IP Telephony Devices Provisioning Guide ii
Contents
Chapter 2: Creating Provisioning Scripts 27
Configuration Profile and the SIP Profile Compiler 28
Open Format Configuration File 28
Element Tags, Attributes, Parameters, and Formatting 29
Configuration File Compression 33
File Encryption 34
Encrypting a File with the SPC 35
Generic 35
Targeted 36
Explicit Key 36
Status Messages 37
Sample Configuration File 37
Proprietary Plain-Text Configuration File 37
Source Text Syntax 38
Comments 40
Macro Expansion 40
Conditional Expressions 41
Assignment Expressions 43
URL Syntax 44
Optional Resync Arguments 45
Using Provisioning Parameters 47
General Purpose Parameters 48
Enables 48
Triggers 49
Configurable Schedules 50
Profile Rules 51
Report Rule 53
Upgrade Rule 55
Data Types 56

Cisco Small Business IP Telephony Devices Provisioning Guide iii
Contents
Chapter 3: Provisioning Tutorial 61
Preparation 61
Basic Resync 62
TFTP Resync 63
Logging with syslog 64
Automatic Resync 65
Unique Profiles and Macro Expansion 67
URL Resolution 68
HTTP GET Resync 69
Secure Resync 70
Basic HTTPS Resync 70
HTTPS With Client Certificate Authentication 72
HTTPS Client Filtering and Dynamic Content 73
Profile Formats 75
Profile Compression 75
Profile Encryption 76
Partitioned Profiles 77
Parameter Name Aliases 78
Proprietary Profile Format 79
Chapter 4: Provisioning Field Reference 81
Configuration Profile Parameters 82
Firmware Upgrade Parameters 87
General Purpose Parameters 88
Macro Expansion Variables 89
Internal Error Codes 92
Appendix A: Example Configuration Profile 93
Appendix B: Acronyms 107
Appendix C: Where to Go From Here 111

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide iv
About This Document
This guide describes the provisioning of Cisco Small Business Voice over IP (VoIP)
products. It contains the following sections:
•Purpose, page iv
•Document Audience, page v
•Organization, page v
•Document Conventions, page vi
•Document Conventions, page vi
Purpose
The following Cisco Small Business VoIP products can be remotely provisioned or
preprovisioned by using the information in this document:
•SPA9000—IP PBX with Auto-Attendant; can be used with the SPA400,
which provides a SIP-PSTN gateway
•Cisco Small Business Analog Telephone Adapters (ATAs):
-PAP2T—Voice adapter with two FXS ports
-SPA2102—Voice adapter with router
-SPA3102—Voice adapter with router and PSTN connectivity
-SPA8000—Voice adapter supporting up to eight FXS connections
-WRP400—Wireless-G ADSL gateway with two FXS ports
•Cisco Small Business IP phones:
-SPA901—One line, small, affordable, no display
-SPA921—One-line business phone
-SPA922—One-line business phone with Power over Ethernet (PoE)
support and an extra 10/100 Ethernet port for connecting another
device to the LAN

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide v
-SPA941—Four-line business phone.
-SPA942—Four-line business phone. Power over Ethernet (PoE) support
and an extra 10/100 Ethernet port for connecting another device to the
LAN
-SPA962—Six lines, hi-resolution color display. Power over Ethernet
(PoE) support and an extra 10/100 Ethernet port for connecting another
device to the LAN
-SPA525G--Five lines, hi-resolution color display. Power over Ethernet
(PoE), 10/100 switch, BlueTooth, WiFi 802.11g, USB port, MP3 player.
-WIP310—One line, hi-resolution color display. WiFi 802.11g
Document Audience
This document is written for service providers who offer services using Cisco
Small Business VoIP products and specifically for administrative staff responsible
for remote provisioning and preprovisioning Cisco Small Business devices.
Organization
This document is divided into the following chapters and appendices.
Chapter Contents
Chapter 1, “Provisioning
Cisco Small Business
VoIP Devices”
Introduces Cisco Small Business VoIP products.
Chapter 2, “Creating
Provisioning Scripts”
Describes how to work with Cisco Small Business
provisioning scripts and configuration profiles.
Chapter 3, “Provisioning
Tutorial”
Step-by-step procedures for using the scripting
language to create a configuration profile.
Chapter 4, “Provisioning
Field Reference”
A systematic reference for each parameter on the
Provisioning tab of the administration web server.
Appendix A, “Example
Configuration Profile”
A sample profile that you might find helpful.

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide vi
Document Conventions
The following typographic conventions are used in this document.
Appendix B, “Acronyms” The expansions for the acronyms used in this
document.
Appendix C, “Where to
Go From Here”
Links to resources for information and support.
Chapter Contents
Typographic
Element
Meaning
Boldface An option on a menu or a literal value to be entered in a
field.
<parameter> Angle brackets (<>) identify parameters that appear on
the configuration pages of the administration web server.
Italic A variable that should be replaced with a literal value.
Monospaced
Font
A code sample or system output.

1
Cisco Small Business IP Telephony Devices Provisioning Guide 7
Provisioning Cisco Small Business VoIP
Devices
This chapter describes the features and functionality available when provisioning
Cisco Small Business IP Telephony devices and explains the setup required. It
includes the following sections:
•Small Business and Residential Deployment Provisioning, page 10
•Provisioning Overview, page 12
•Configuration Access Control, page 16
•Using HTTPS, page 19
•Provisioning Setup, page 23
•Where to Go From Here, page 29
Small Business and Residential Deployment Provisioning
Cisco Small Business IP Telephony devices are intended for high-volume
deployments by VoIP service providers to residential and small business
customers. Typically, these devices are widely distributed across the Internet,
connected through routers and firewalls at the customer premises. Further, IP
Telephony devices can serve as terminal nodes in business or enterprise
environments, where the units can be operated in a LAN environment.
The IP Telephony device can be used as a remote extension of the service
provider back-end equipment. Remote management and configuration ensures
the proper operation of the IP Telephony device at the customer premises.
Device configuration varies according to the individual customer and with the
same customer over a period of time. Also, the configuration might be modified to
provision new features, support modifications in the service provider network, or
deliver firmware upgrades to the endpoint.

Provisioning Cisco Small Business VoIP Devices
Small Business and Residential Deployment Provisioning
Cisco Small Business IP Telephony Devices Provisioning Guide 8
1
This customized, ongoing configuration is supported by the following features:
•Reliable remote control of the endpoint
•Encryption of the communication controlling the endpoint
•Streamlined endpoint account binding
Remote Endpoint Control and NAT
A service provider can remotely modify the configuration parameters in an IP
Telephony device after the unit has been deployed to the customer premises and
upgrade the firmware.
The IP Telephony device accesses the Internet through a router by using network
address translation (NAT). For enhanced security, the router might attempt to block
unauthorized incoming packets by implementing symmetric NAT (a packet filtering
strategy that severely restricts the packets that are allowed to enter the protected
network from the Internet).
Communication Encryption
The configuration parameters communicated to the IP Telephony device can
contain authorization codes or other information that protect the system from
unauthorized access. It is in the service provider’s interest to prevent unauthorized
activity by the customer, and it is in the customer’s interest to prevent the
unauthorized use of the account. The service provider can encrypt the
configuration profile communication between the provisioning server and the IP
Telephony device, in addition to restricting access to the administration web
server.

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 9
1
Provisioning Overview
Cisco Small Business provisioning solutions are designed for high-volume
residential deployment, where each IP Telephony Device typically resides in a
separate LAN environment that is connected to the Internet through a NAT device.
Configuration profiles can be generated by using common, open source tools that
facilitate integration into service provider provisioning systems. Cisco Small
Business IP Telephony devices support secure remote provisioning and firmware
upgrades. User intervention is not required to initiate or complete a profile update
or firmware upgrade. Supported transport protocols include TFTP, HTTP, and
HTTPS with a client certificate.
An IP Telephony device can be configured to resynchronize its internal
configuration state to a remote profile periodically and on power up. A 256-bit
symmetric key encryption of profiles is supported. In addition, an unprovisioned IP
Telephony device can receive an encrypted profile specifically targeted for that
device without requiring an explicit key. Secure first-time provisioning is provided
through a mechanism that uses SSL functionality.
NOTE Remote customization (RC) units are customized by Cisco so that when the unit is
started, it contacts the Cisco provisioning server to download its customized
profile.
Remote Firmware Upgrade
A remote firmware upgrade is achieved by using TFTP or HTTP, but not by using
HTTPS because the firmware does not contain sensitive information. The upgrade
logic is capable of automating multi-stage upgrades, if intermediate upgrades are
required to reach a current upgrade state from an older release. A profile resync is
only attempted when the IP Telephony device is idle, because the upgrade might
trigger a software reboot.
General purpose parameters are provided to help service providers manage the
provisioning process. Each IP Telephony device can be configured to periodically
contact a normal provisioning server (NPS). Communication with the NPS does not
require the use of a secure protocol because the updated profile is encrypted by
a shared secret key. The NPS can be a standard TFTP, HTTP, or HTTPS server.