Cisco SPA901-UK - Small Business Pro User manual

Cisco Small Business
Voice System, Voice Gateways, and IP Telephones
PROVISIONING
GUIDE

Cisco Small Business IP Telephony Devices Provisioning Guide i
Contents
About This Document iv
Purpose iv
Document Audience v
Organization v
Document Conventions vi
Chapter 1: Provisioning Cisco Small Business VoIP Devices 7
Small Business and Residential Deployment Provisioning 7
Remote Endpoint Control and NAT 8
Communication Encryption 8
Provisioning Overview 9
Remote Firmware Upgrade 9
Initial Provisioning 10
Deploying RC Units 10
Redundant Provisioning Servers 11
Retail Provisioning 11
Automatic In-House Preprovisioning 12
Configuration Access Control 13
Configuration Profiles 13
Provisioning States 15
Using HTTPS 16
How HTTPS Works 17
Server Certificate 17
Client Certificates 18
Certificate Structure 18
Provisioning Setup 20
Software Tools 20
Server Configuration 21
HTTPS 23
Syslog Server 25
Where to Go From Here 26

Cisco Small Business IP Telephony Devices Provisioning Guide ii
Contents
Chapter 2: Creating Provisioning Scripts 27
Configuration Profile and the SIP Profile Compiler 28
Open Format Configuration File 28
Element Tags, Attributes, Parameters, and Formatting 29
Configuration File Compression 33
File Encryption 34
Encrypting a File with the SPC 35
Generic 35
Targeted 36
Explicit Key 36
Status Messages 37
Sample Configuration File 37
Proprietary Plain-Text Configuration File 37
Source Text Syntax 38
Comments 40
Macro Expansion 40
Conditional Expressions 41
Assignment Expressions 43
URL Syntax 44
Optional Resync Arguments 45
Using Provisioning Parameters 47
General Purpose Parameters 48
Enables 48
Triggers 49
Configurable Schedules 50
Profile Rules 51
Report Rule 53
Upgrade Rule 55
Data Types 56

Cisco Small Business IP Telephony Devices Provisioning Guide iii
Contents
Chapter 3: Provisioning Tutorial 61
Preparation 61
Basic Resync 62
TFTP Resync 63
Logging with syslog 64
Automatic Resync 65
Unique Profiles and Macro Expansion 67
URL Resolution 68
HTTP GET Resync 69
Secure Resync 70
Basic HTTPS Resync 70
HTTPS With Client Certificate Authentication 72
HTTPS Client Filtering and Dynamic Content 73
Profile Formats 75
Profile Compression 75
Profile Encryption 76
Partitioned Profiles 77
Parameter Name Aliases 78
Proprietary Profile Format 79
Chapter 4: Provisioning Field Reference 81
Configuration Profile Parameters 82
Firmware Upgrade Parameters 87
General Purpose Parameters 88
Macro Expansion Variables 89
Internal Error Codes 92
Appendix A: Example Configuration Profile 93
Appendix B: Acronyms 107
Appendix C: Where to Go From Here 111

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide iv
About This Document
This guide describes the provisioning of Cisco Small Business Voice over IP (VoIP)
products. It contains the following sections:
•Purpose, page iv
•Document Audience, page v
•Organization, page v
•Document Conventions, page vi
•Document Conventions, page vi
Purpose
The following Cisco Small Business VoIP products can be remotely provisioned or
preprovisioned by using the information in this document:
•SPA9000—IP PBX with Auto-Attendant; can be used with the SPA400,
which provides a SIP-PSTN gateway
•Cisco Small Business Analog Telephone Adapters (ATAs):
-PAP2T—Voice adapter with two FXS ports
-SPA2102—Voice adapter with router
-SPA3102—Voice adapter with router and PSTN connectivity
-SPA8000—Voice adapter supporting up to eight FXS connections
-WRP400—Wireless-G ADSL gateway with two FXS ports
•Cisco Small Business IP phones:
-SPA901—One line, small, affordable, no display
-SPA921—One-line business phone
-SPA922—One-line business phone with Power over Ethernet (PoE)
support and an extra 10/100 Ethernet port for connecting another
device to the LAN

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide v
-SPA941—Four-line business phone.
-SPA942—Four-line business phone. Power over Ethernet (PoE) support
and an extra 10/100 Ethernet port for connecting another device to the
LAN
-SPA962—Six lines, hi-resolution color display. Power over Ethernet
(PoE) support and an extra 10/100 Ethernet port for connecting another
device to the LAN
-SPA525G--Five lines, hi-resolution color display. Power over Ethernet
(PoE), 10/100 switch, BlueTooth, WiFi 802.11g, USB port, MP3 player.
-WIP310—One line, hi-resolution color display. WiFi 802.11g
Document Audience
This document is written for service providers who offer services using Cisco
Small Business VoIP products and specifically for administrative staff responsible
for remote provisioning and preprovisioning Cisco Small Business devices.
Organization
This document is divided into the following chapters and appendices.
Chapter Contents
Chapter 1, “Provisioning
Cisco Small Business
VoIP Devices”
Introduces Cisco Small Business VoIP products.
Chapter 2, “Creating
Provisioning Scripts”
Describes how to work with Cisco Small Business
provisioning scripts and configuration profiles.
Chapter 3, “Provisioning
Tutorial”
Step-by-step procedures for using the scripting
language to create a configuration profile.
Chapter 4, “Provisioning
Field Reference”
A systematic reference for each parameter on the
Provisioning tab of the administration web server.
Appendix A, “Example
Configuration Profile”
A sample profile that you might find helpful.

Preface
Cisco Small Business IP Telephony Devices Provisioning Guide vi
Document Conventions
The following typographic conventions are used in this document.
Appendix B, “Acronyms” The expansions for the acronyms used in this
document.
Appendix C, “Where to
Go From Here”
Links to resources for information and support.
Chapter Contents
Typographic
Element
Meaning
Boldface An option on a menu or a literal value to be entered in a
field.
<parameter> Angle brackets (<>) identify parameters that appear on
the configuration pages of the administration web server.
Italic A variable that should be replaced with a literal value.
Monospaced
Font
A code sample or system output.

1
Cisco Small Business IP Telephony Devices Provisioning Guide 7
Provisioning Cisco Small Business VoIP
Devices
This chapter describes the features and functionality available when provisioning
Cisco Small Business IP Telephony devices and explains the setup required. It
includes the following sections:
•Small Business and Residential Deployment Provisioning, page 10
•Provisioning Overview, page 12
•Configuration Access Control, page 16
•Using HTTPS, page 19
•Provisioning Setup, page 23
•Where to Go From Here, page 29
Small Business and Residential Deployment Provisioning
Cisco Small Business IP Telephony devices are intended for high-volume
deployments by VoIP service providers to residential and small business
customers. Typically, these devices are widely distributed across the Internet,
connected through routers and firewalls at the customer premises. Further, IP
Telephony devices can serve as terminal nodes in business or enterprise
environments, where the units can be operated in a LAN environment.
The IP Telephony device can be used as a remote extension of the service
provider back-end equipment. Remote management and configuration ensures
the proper operation of the IP Telephony device at the customer premises.
Device configuration varies according to the individual customer and with the
same customer over a period of time. Also, the configuration might be modified to
provision new features, support modifications in the service provider network, or
deliver firmware upgrades to the endpoint.

Provisioning Cisco Small Business VoIP Devices
Small Business and Residential Deployment Provisioning
Cisco Small Business IP Telephony Devices Provisioning Guide 8
1
This customized, ongoing configuration is supported by the following features:
•Reliable remote control of the endpoint
•Encryption of the communication controlling the endpoint
•Streamlined endpoint account binding
Remote Endpoint Control and NAT
A service provider can remotely modify the configuration parameters in an IP
Telephony device after the unit has been deployed to the customer premises and
upgrade the firmware.
The IP Telephony device accesses the Internet through a router by using network
address translation (NAT). For enhanced security, the router might attempt to block
unauthorized incoming packets by implementing symmetric NAT (a packet filtering
strategy that severely restricts the packets that are allowed to enter the protected
network from the Internet).
Communication Encryption
The configuration parameters communicated to the IP Telephony device can
contain authorization codes or other information that protect the system from
unauthorized access. It is in the service provider’s interest to prevent unauthorized
activity by the customer, and it is in the customer’s interest to prevent the
unauthorized use of the account. The service provider can encrypt the
configuration profile communication between the provisioning server and the IP
Telephony device, in addition to restricting access to the administration web
server.

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 9
1
Provisioning Overview
Cisco Small Business provisioning solutions are designed for high-volume
residential deployment, where each IP Telephony Device typically resides in a
separate LAN environment that is connected to the Internet through a NAT device.
Configuration profiles can be generated by using common, open source tools that
facilitate integration into service provider provisioning systems. Cisco Small
Business IP Telephony devices support secure remote provisioning and firmware
upgrades. User intervention is not required to initiate or complete a profile update
or firmware upgrade. Supported transport protocols include TFTP, HTTP, and
HTTPS with a client certificate.
An IP Telephony device can be configured to resynchronize its internal
configuration state to a remote profile periodically and on power up. A 256-bit
symmetric key encryption of profiles is supported. In addition, an unprovisioned IP
Telephony device can receive an encrypted profile specifically targeted for that
device without requiring an explicit key. Secure first-time provisioning is provided
through a mechanism that uses SSL functionality.
NOTE Remote customization (RC) units are customized by Cisco so that when the unit is
started, it contacts the Cisco provisioning server to download its customized
profile.
Remote Firmware Upgrade
A remote firmware upgrade is achieved by using TFTP or HTTP, but not by using
HTTPS because the firmware does not contain sensitive information. The upgrade
logic is capable of automating multi-stage upgrades, if intermediate upgrades are
required to reach a current upgrade state from an older release. A profile resync is
only attempted when the IP Telephony device is idle, because the upgrade might
trigger a software reboot.
General purpose parameters are provided to help service providers manage the
provisioning process. Each IP Telephony device can be configured to periodically
contact a normal provisioning server (NPS). Communication with the NPS does not
require the use of a secure protocol because the updated profile is encrypted by
a shared secret key. The NPS can be a standard TFTP, HTTP, or HTTPS server.

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 10
1
Initial Provisioning
Cisco Small Business IP Telephony devices provide convenient mechanisms for
initial provisioning, based on two deployment models:
•Retail distribution—The customer purchases the IP Telephony device from a
retail outlet and requests VoIP service from the service provider. The
service provider must then support the secure remote configuration of the
device.
•Bulk distribution—The service provider acquires IP Telephony devices in
bulk quantity and either preprovisions the IP Telephony Devices in-house or
purchases RC units from Cisco and issues IP Telephony devices to its
customers as part of a VoIP service contract.
Deploying RC Units
Cisco Small Business offers RC units to service providers for volume deployments
of endpoints. Service providers customize select parameters to meet their needs,
eliminating in-house preprovisioning of the devices and reducing the need for the
service provider to physically handle the units prior to shipping to end customers.
It also discourages the use of Cisco Small Business IP Telephony devices with a
different service provider.
The MAC address of each RC unit is associated with a customized profile on a
provisioning server that is maintained by Cisco for the service provider that
purchased the units. The RC unit is preprovisioned by Cisco with the connection
information for the Cisco Small Business provisioning server. When the RC unit is
started, it contacts the Cisco Small Business provisioning server and downloads
its customized profile.
The status of customization for an RC unit can be determined by viewing the
Info > Product Information page Customization section on the administration web
server. An RC unit that has not been provisioned displays Pending. An RC unit that
has been provisioned displays the name of the company that owns the unit. If the
unit is not an RC unit, the page displays Open.
The following is a sample template for an RC unit:
Restricted Access Domains "domain.com, domain1.com, domain2.com";
Primary_DNS * "x.y.w.z";
Secondary_DNS * "a.b.c.d";
Provision_Enable * "Yes";
Resync_Periodic * "30";
Resync_Error_Retry_Delay * "30";
Profile_Rule * "http://prov.domain.com/sipura/profile?id=$MA";

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 11
1
The Restricted Access Domain parameter is configured with the actual domain
names of up to a maximum of five domains. The Primary_DNS and
Secondary_DNS parameters are configured with the actual domain names or IP
addresses of the DNS servers available to the RC unit.
Redundant Provisioning Servers
The provisioning server can be specified as an IP address or as a fully qualified
domain name (FQDN). The use of a FQDN facilitates the deployment of redundant
provisioning servers. When the provisioning server is identified through a FQDN,
the IP Telephony device attempts to resolve the FQDN to an IP address through
DNS. Only DNS A-records are supported for provisioning; DNS SRV address
resolution is not available for provisioning. The IP Telephony device continues to
process A-records until the first server responds. If no server associated with the
A-records responds, the IP Telephony device logs an error to the syslog server.
Retail Provisioning
The firmware for each IP Telephony device includes an administration web server
that displays the internal configuration and accepts new configuration parameter
values. The server also accepts a special URL command syntax for performing
remote profile resync and firmware upgrade operations.
In a retail distribution model, a customer purchases a Cisco Small Business voice
endpoint device and subscribes to a particular service. The customer signs on to
the service and establishes a VoIP account, possibly through an online portal with
an Internet Telephony Service Provider (ITSP). The customer binds the device to
the assigned service account.
The unprovisioned IP Telephony device is instructed to resync with a specific
provisioning server through a resync URL command. The URL command typically
includes an account PIN number or alphanumeric code to associate the device
with the new account.
http://192.168.1.102/admin/resync?https://prov.supervoip.com/cisco-init/
1234abcd
In this example, a device at the DHCP-assigned IP address 192.168.1.102 is
instructed to provision itself to the SuperVoIP service at prov.supervoip.com. The
PIN number for the new account is 1234abcd. The remote provisioning server is
configured to associate the IP Telephony device that is performing the resync
request with the new account, based on the URL and the supplied PIN.

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 12
1
Through this initial resync operation, the IP Telephony device is configured in a
single step, and is automatically directed to resync thereafter to a permanent URL
on the server. For example:
https://prov.supervoip.com/cisco
For both initial and permanent access, the provisioning server relies on the client
certificate for authentication and supplies configuration parameter values based
on the associated service account.
Automatic In-House Preprovisioning
Using the administration web server and issuing a resync URL is convenient for a
customer in the retail deployment model, but it is not as convenient for
preprovisioning a large number of units. To provision a large number of units in-
house, the service provider can use automatic in-house preprovisioning.
With the factory default configuration, an IP Telephony device automatically tries
to resync to a specific file to a TFTP server with the IP address offered as one of
the DHCP-provided parameters. A service provider can connect each new IP
Telephony device to a LAN environment that is configured for preprovisioning. Any
new IP Telephony device connected to this LAN automatically resyncs to the local
TFTP server, initializing its internal state in preparation for deployment. This
preprovisioning step includes configuring the URL of the provisioning server.
When a new customer signs up for service, the preprovisioned device barcode
can be scanned to record its MAC address or serial number before being shipped
to the customer. Upon receiving the unit, the customer connects the unit to the
broadband link. On power-up the IP Telephony device contacts the server to for its
resync update.

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 13
1
Configuration Access Control
Besides configuration parameters that control resync and upgrade behavior, the IP
Telephony device firmware provides mechanisms for restricting end-user access
to some parameters. The firmware provides specific privileges for login to an
Admin account and a User account. Each can be independently password
protected.:
•Admin Account—Allows the service provider full access to all interactive
voice response (IVR) functions and to all administration web server
parameters.
•User Account—Allows the user of a device to access basic IVR functions
and to configure a subset of the administration web server parameters.
The service provider can restrict the user account in the following ways:
•Choose which configuration parameters are available to the User account.
•Disable user access to the administration web server.
•Disable the factory reset control using the IVR.
•Restrict the Internet domains accessed by the device for resync, upgrades,
or SIP registration for Line 1.
Configuration Profiles
The configuration profile defines the parameter values for a specific IP Telephony
device. The configuration profile can be used in two formats:
•Open (XML-style)
The XML format uses standard tools to compile the parameters and values.
To protect confidential information in the configuration profile, this type of
file is generally delivered from the provisioning server to the IP Telephony
device over a secure channel provided by HTTPS.
•Proprietary, plain-text
The plain-text configuration file uses a proprietary format that can be
encrypted by using the SIP Profile Compiler (SPC) to prevent the
unauthorized use of confidential information. By convention, the encrypted
profile is named with the extension .cfg (for example, spa962.cfg).

Provisioning Cisco Small Business VoIP Devices
Provisioning Overview
Cisco Small Business IP Telephony Devices Provisioning Guide 14
1
SIP Profile Compiler (SPC)
The SIP Profiler Compiler (SPC) is provided for compiling the plain-text file
containing parameter-value pairs into an encrypted CFG file. The SPC is available
from Cisco for the Win32 environment (spc.exe) and Linux-i386-elf environment
(spc-linux-i386-static). For the OpenBSD environment, the SPC tool is made
available on a case-by-case basis.
To download the SPC, do the following:
STEP 1 Go to Cisco.com.
STEP 2 Enter the device model number in the search box, and click Go.
STEP 3 In the Filter Results By list on the left side of the Search Results page, find the
Task , and click Download Software. The page refreshes.
STEP 4 Click the Download Software... link for the device (usually the first entry in the
filtered list).
STEP 5 When the Download Software page appears, choose Profile Compiler (SPC)
Tool in the Select Software Type section.
STEP 6 Click Download Now to choose the latest release of the firmware.
STEP 7 Follow the instructions on the screen to complete the download process.

Provisioning Cisco Small Business VoIP Devices
Provisioning States
Cisco Small Business IP Telephony Devices Provisioning Guide 15
1
Provisioning States
The provisioning process involves four provisioning states.
Flow Step Step Description
MFG-RESET
Manufacturing Reset
The device returns to a fully unprovisioned state; all configurable
parameters regain their default values.
Manufacturing reset can be performed through the following IVR
sequence ****RESET#1#
Allowing the end user to perform a manufacturing reset
guarantees that the device can always be returned to an
accessible state.
SP-CUST
Service Provider
Customization
The Profile_Rule parameter points to a device-specific
configuration profile by using a provisioning server that is
specific to the service provider. The methods are:
• Auto-configuration by using a local DHCP server. A TFTP
server name or IPv4 address is specified by DHCP. The
TFTP server carries the Profile_Rule entry in the CFG file,
/spa962.cfg.
• Entering a resync URL. The URL starts a web browser and
requests a resync to a specific TFTP server by entering the
URL syntax: http://x.x.x.x/admin/
resync?prvserv/device.cfg, where:
x.x.x.x is the IP address of the IP Telephony device,
prvserv is the target TFTP server,
and device.cfg is the name of the configuration file on
the server.
• Editing the Profile_Rule parameter. Open the provisioning
pane on the web interface and enter the TFTP URL in the
Profile_Rule parameter, for example, prserv/spa962.cfg.
• Modifying the spa962.cfg file that contains the Profile_Rule,
and configure it to contact a specific TFTP server and
request a configuration file identified by the MAC-address.
For example, the following entry contacts a specific
provisioning server, requesting a new profile unique to this
unit:
Profile_Rule tftp.callme.com/profile/$MA/
spa962.cfg;

Provisioning Cisco Small Business VoIP Devices
Using HTTPS
Cisco Small Business IP Telephony Devices Provisioning Guide 16
1
Using HTTPS
The IP Telephony device provides a reliable and secure provisioning strategy
based on HTTPS requests from the device to the provisioning server. Both a
server certificate and a client certificate are used to authenticate the IP Telephony
device to the server and the server to the IP Telephony device.
To use HTTPS, you must generate a Certificate Signing Request (CSR) and submit
it to Cisco. Cisco generates a certificate for installation on the provisioning server.
The IP Telephony device accepts the certificate when it seeks to establish an
HTTPS connection with the provisioning server. This procedure is described in the
“HTTPS” section on page 26.
SEC-PRV-1
Secure
Provisioning—Initial
Configuration
The initial device-unique CFG file is targeted to each IP
Telephony device by compiling the CFG file with the spc --
target option. This provides an initial level of encryption that
does not require the exchange of keys.
The initial device-unique CFG file reconfigures the profile
parameters to enable stronger encryption by programming a
256-bit encryption key and pointing to a randomly-generated
TFTP directory. For example, the CFG file might contain:
Profile_Rule [--key $A] tftp.callme.com/profile/$B/
spa962.cfg;
GPP_A 8e4ca259…; # 256 bit key
GPP_B Gp3sqLn…; # random CFG file path directory
SEC-PRV-2
Secure
Provisioning—Full
Configuration
Subsequent profile resync operations retrieve 256-bit
encrypted CFG files that maintain the IP Telephony device in a
state synchronized to the provisioning server.
All remaining parameters are configured and maintained
through this strongly encrypted profile. The encryption key and
random directory location can be changed periodically for extra
security.
Flow Step Step Description

Provisioning Cisco Small Business VoIP Devices
Using HTTPS
Cisco Small Business IP Telephony Devices Provisioning Guide 17
1
How HTTPS Works
HTTPS encrypts the communication between a client and a server, protecting the
message contents from other network devices. The encryption method for the
body of the communication between a client and a server is based on symmetric
key cryptography. With symmetric key cryptography, a single secret key is shared
by a client and a server over a secure channel protected by Public/Private key
encryption.
Messages encrypted by the secret key can only be decrypted using the same
key. HTTPS supports a wide range of symmetric encryption algorithms. The IP
Telephony device implements up to 256-bit symmetric encryption, using the
American Encryption Standard (AES), in addition to 128-bit RC4.
HTTPS also provides for the authentication of a server and a client engaged in a
secure transaction. This feature ensures that a provisioning server and an
individual client cannot be spoofed by other devices on the network. This is an
essential capability in the context of remote endpoint provisioning.
Server and client authentication is performed by using public/private key
encryption with a certificate that contains the public key. Text that is encrypted
with a public key can be decrypted only by its corresponding private key (and
vice versa). The IP Telephony device supports the RSA algorithm for public/
private key cryptography.
Server Certificate
Each secure provisioning server is issued a SSL server certificate, directly signed
by Cisco. The firmware running on the IP Telephony device recognizes only a
Cisco certificate as valid. When a client connects to a server by using HTTPS, it
rejects any server certificate that is not signed by Cisco.
This mechanism protects the service provider from unauthorized access to the IP
Telephony device, or any attempt to spoof the provisioning server. Without such
protection, an attacker might be able to reprovision the IP Telephony device, to
gain configuration information, or to use a different VoIP service.

Provisioning Cisco Small Business VoIP Devices
Using HTTPS
Cisco Small Business IP Telephony Devices Provisioning Guide 18
1
Client Certificates
In addition to a direct attack on an IP Telephony device, an attacker might attempt
to contact a provisioning server by using a standard web browser or another
HTTPS client to obtain the configuration profile from the provisioning server. To
prevent this kind of attack, each IP Telephony device also carries a unique client
certificate, also signed by Cisco, including identifying information about each
individual endpoint. A certificate authority root certificate capable of
authenticating the device client certificate is given to each service provider. This
authentication path allows the provisioning server to reject unauthorized requests
for configuration profiles.
Certificate Structure
The combination of a server certificate and a client certificate ensures secure
communication between a remote IP Telephony device and its provisioning server.
The Certificate Authority Flow figure illustrates the relationship and placement of
certificates, public/private key pairs, and signing root authorities, among the Cisco
client, the provisioning server, and the certification authority.
The upper half of the diagram shows the Provisioning Server Root Authority that is
used to sign the individual provisioning server certificate. The corresponding root
certificate is compiled into the firmware, allowing the IP Telephony device to
authenticate authorized provisioning servers.

Provisioning Cisco Small Business VoIP Devices
Using HTTPS
Cisco Small Business IP Telephony Devices Provisioning Guide 19
1
Certificate Authority Flow