Grandstream Networks GXV3370 User manual

Grandstream Networks, Inc.
GXV3370/GXV3380/GXV3350
IP Video Phones with AndroidTM
Security Guide

P a g e | 1
GXV33XX Security Guide
Table of Contents
OVERVIEW.....................................................................................................................3
WEB UI/SSH ACCESS ...................................................................................................4
GXV33XX Web UI Access....................................................................................................................4
Web UI Access Protocols .....................................................................................................................4
User Login ............................................................................................................................................5
User Management Levels ....................................................................................................................6
SSH Access..........................................................................................................................................7
DEVICE CONTROL SECURITY .....................................................................................8
GUI Config Tool Settings ......................................................................................................................9
SECURITY FOR SIP ACCOUNTS AND CALLS ..........................................................10
Protocols and Ports ............................................................................................................................10
Anonymous/Unsolicited Calls Protection ...........................................................................................12
SRTP ..................................................................................................................................................14
NETWORK SECURITY.................................................................................................15
OpenVPN®..........................................................................................................................................15
802.1X ................................................................................................................................................17
Bluetooth ............................................................................................................................................18
PC Port Mode .....................................................................................................................................18
SECURITY FOR GXV33XX SERVICES .......................................................................19
Provisioning via Configuration File .....................................................................................................19
Firmware Upgrading ...........................................................................................................................21
TR-069................................................................................................................................................22
FTP Server .........................................................................................................................................23
ADB Service .......................................................................................................................................23
LDAP ..................................................................................................................................................24
Syslog.................................................................................................................................................24
SECURITY GUIDELINES FOR GXV33XX DEPLOYMENT..........................................25

P a g e | 2
GXV33XX Security Guide
Table of Figures
Figure 1: Web UI Access Settings.................................................................................................................4
Figure 2: GXV3370 Web UI Login.................................................................................................................5
Figure 3: GXV33XX Admin Password Change on first login ........................................................................5
Figure 4: Change the default password ........................................................................................................6
Figure 5: Admin (left) and User (right) Web Access......................................................................................7
Figure 6: SSH Access on GXV33XX.............................................................................................................7
Figure 7: Limit Access to Advanced Settings and Apps on LCD...................................................................8
Figure 8: GUI Config Tool Settings GUI ........................................................................................................9
Figure 9: Cust File Provision Page ...............................................................................................................9
Figure 10: Configure TLS as SIP Transport ................................................................................................10
Figure 11: SIP TLS Settings on GXV33XX .................................................................................................11
Figure 12: Additional SIP TLS Settings .......................................................................................................11
Figure 13: Settings to Block Anonymous Call .............................................................................................12
Figure 14: Settings to Block Unwanted Calls..............................................................................................13
Figure 15: SRTP Settings ...........................................................................................................................14
Figure 16: OpenVPN® for Secure Network Access.....................................................................................15
Figure 17: OpenVPN® Settings ...................................................................................................................15
Figure 18: 802.1X for GXV33XX Deployment.............................................................................................17
Figure 19: 802.1X Settings..........................................................................................................................17
Figure 20: GXV33XX PC Port Mode ...........................................................................................................18
Figure 21: GXV33XX Config File Provisioning............................................................................................19
Figure 22: Validate Certification Chain........................................................................................................20
Figure 23: Certificate Management.............................................................................................................20
Figure 24: GXV33XX Firmware Upgrade Configuration .............................................................................21
Figure 25: TR-069 Connection Settings Page ............................................................................................22
Figure 26: File Manager App - FTP Service................................................................................................23
Figure 27: Access Device through ADB ......................................................................................................23
Figure 28: LDAP Settings............................................................................................................................24
Figure 29: Syslog Protocol ..........................................................................................................................24

P a g e | 3
GXV33XX Security Guide
OVERVIEW
This document presents a summary of security measures, factors, and configurations that users are
recommended to consider when configuring and deploying the GXV3370/GXV3380/GXV3350.
Note: We recommend using the latest firmware for latest security patches.
The following sections are covered in this document:
•Web UI/SSH Access
Web UI access is protected by username/password and login timeout. Two-level user management is
configurable. SSH access is supported for mainly troubleshooting purpose and it’s recommended to disable
it in normal usage.
•Device Control Security
The GXV33XX has multiple ways to limit the use for network settings, apps, and other settings if not
necessary for the end user.
•Security for SIP Accounts and Calls
The SIP accounts use specific port for signaling and media stream transmission. It also offers configurable
options to block anonymous calls and unsolicited calls.
•Network Security
The GXV33XX supports OpenVPN, 802.1X, Bluetooth and PC port for network access. OpenVPN secures
remote connection and 802.1X provides network access control. For Bluetooth and PC port, it’s
recommended to turn them off if not used.
•Security for GXV33XX Services
GXV33XX supports service such as HTTP/HTTPS/TFTP provisioning, TR-069, LDAP, as well as allows
ADB and FTP access. For provisioning, we recommend using HTTPS with username/password and using
password-protected XML file. For services such as ADB and FTP, we recommend disabling them if not
used to avoid potential port exposure.
•Deployment Guidelines for GXV33XX
This section introduces protocols and ports used on GXV33XX and recommendations for routers/firewall
settings.
This document is subject to change without notice.
Reproduction or transmittal of the entire or any part, in any form or by any means, electronic or print, for
any purpose without the express written permission of Grandstream Networks, Inc. is not permitted.

P a g e | 4
GXV33XX Security Guide
WEB UI/SSH ACCESS
GXV33XX Web UI Access
The GXV3370/GXV3380/GXV3350 embedded web server responds to HTTP/HTTPS GET/POST requests.
Embedded HTML pages allow users to configure the device through a web browser such as Microsoft IE,
Mozilla Firefox, Google Chrome and etc. With this, administrators can access and configure all available
GXV33XX information and settings. It is critical to understand the security risks involved when placing the
GXV33XX phone on public networks and it’s recommended not to do so.
Web UI Access Protocols
HTTP and HTTPS are supported to access the GXV3370/GXV3380/GXV3350 web UI and can be
configured under web UI → System Settings → Security Settings → Web/SSH Access. To secure
transactions and prevent unauthorized access, it is highly recommended to:
1. Use HTTPS instead of HTTP.
2. Avoid using well known port numbers such as 80 and 443.
Figure 1: Web UI Access Settings

P a g e | 5
GXV33XX Security Guide
User Login
Username and password are required to log in the GXV3370/GXV3380/GXV3350 web UI.
Figure 2: GXV3370 Web UI Login
Notes :
•The factory default username for GXV3370/GXV3380 is “admin” and the default password is “admin”.
•For the GXV3350 The default administrator username is “admin” and the default random password can
be found at the sticker on the GXV3350.
The GXV3370 web UI require to change the default password at first time login.
Figure 3: GXV33XX Admin Password Change on first login
To change the password for default user "admin", navigate to System Settings → Security Settings →
User Info Management. The password length must between 6 and 32 characters. Strong password with
a combination of numbers, uppercase letters, lowercase letters, and special characters is always
recommended for security purpose:

P a g e | 6
GXV33XX Security Guide
Figure 4: Change the default password
User Management Levels
Two user privilege levels are currently supported:
•Admin
•User
Admin login has access to all of the GXV3370/GXV3380/GXV3350’s entire web UI pages and can execute
all available operations. User login has limited access to the web UI pages.
With user login, it is not allowed to configure the following settings:
•Account Settings
•Phone Settings → General Settings / Ringtone / Video Settings
•Network Settings → Advanced Network Settings
•System Settings → TR069
•Maintenance → Upgrade / Event Notification
•Value-added Service
Even if user login can access certain web UI pages, it has less options compared to admin login, such as
in System Settings → Security Settings page.
It is recommended to keep admin login with administrator only. And end user should be provided with user-
level login only, if ever they need web UI access.

P a g e | 7
GXV33XX Security Guide
Figure 5: Admin (left) and User (right) Web Access
SSH Access
The GXV3370/GXV3380/GXV3350 allows access via SSH. This is usually not needed unless the
administrator or Grandstream support needs it for troubleshooting purpose. SSH access on GXV33XX is
enabled by default with port 22 used. It’s recommended to disable it for daily normal usage. If SSH access
needs to be enabled, changing the port to a different port other than the well-known port 22 is a good
practice.
Figure 6: SSH Access on GXV33XX

P a g e | 8
GXV33XX Security Guide
DEVICE CONTROL SECURITY
From GXV3370/GXV3380/GXV3350 web UI → System Settings → Security Settings → Web/SSH
Access, administrator can set whether the user can use specific features or install apps from LCD, shown
as below.
Figure 7: Limit Access to Advanced Settings and Apps on LCD
Configuration via
Keypad Menu
Configures access control for keypad Menu settings on the Settings
interface of the phone.
•Unrestricted (default): configure all settings on the Settings
interface;
•Basic Settings Only: The Advanced Settings option will not be
displayed;
•Basic Settings & Network Settings: Only the Advanced Settings
option will not be displayed
•Constraint Mode (Recommended): users need to input admin user
password to configure Wireless & Network and Advanced Settings.
Note: When access control for keypad is limited to “Basic Settings Only”
or “Constraint Mode”, the Admin authentication will be mandatory to start
Factory Reset process.
Permission to
Install/Uninstall Apps
Configures the permissions for users to install/uninstall the applications.
•If set to "Allow" (default), the user is free to install/uninstall third-party
apps.
•If set to "Require admin password", the user need to input the
correct administrator password to install/uninstall third-party apps.
•If set to "Require admin password if the app source is unknown",
the user need to input admin password only when install apps from
unknown source, administrator password authentication is required
when the user uninstall third-party apps.
•If set to "Not allow" (Recommended), the user cannot install/uninstall
third-party apps.

P a g e | 9
GXV33XX Security Guide
GUI Config Tool Settings
The GUI config tool is an online tool designed to customize the configuration for devices. Here is the link
to the GUI config tool: http://tools.grandstream.com:8081
Figure 8: GUI Config Tool Settings GUI
From there, the administrator can build a customized file to remove access for certain apps and task bar
features. The tool would generate an XML file ( “gxv3370cust”, “gxv3380cust” or “gxv3350cust”) which
should be uploaded to your local HTTP/TFTP server. Then the user needs to configure the server address
as GUI Customization File URL under web UI → Maintenance → Upgrade → Config File to allow the file
to be uploaded to the GXV33XX.
Figure 9: Cust File Provision Page
For more information, please refer to our GUI Customization Web Tool Guide :
http://www.grandstream.com/sites/default/files/Resources/GXV33xx_GUI_Customization_Web_Tool_Guid
e.pdf

P a g e | 10
GXV33XX Security Guide
SECURITY FOR SIP ACCOUNTS AND CALLS
Protocols and Ports
By default, after factory reset, the SIP account 1 is active. Since the default local SIP port is 5060 for Account
1, this allows user to make direct IP call even if the account is not registered to any PBX. If the user is not
using any account, it is recommended to uncheck the settings from web UI → Account → General
Settings → Account Active to deactivate Account 1.
Note that GXV3370/GXV3380/GXV3350 supports up to 16 SIP accounts.
Below are the ports/protocols used on GXV33XX SIP accounts:
•SIP transport protocol:
The GXV33XX supports SIP transport protocol “UDP” “TCP” and “TLS”. By default, it’s set to “UDP”.
It’s recommended to use “TLS” so the SIP signaling is encrypted. SIP transport protocol can be
configured per SIP account under web UI → Account → Account x → SIP Settings. When “TLS” is
used, we recommend using “sips” instead of “sip” for SIP URI scheme to ensure the entire SIP
transaction is secured instead of “best-effort”.
Figure 10: Configure TLS as SIP Transport

P a g e | 11
GXV33XX Security Guide
SIP TLS certificate, private key and password can be configured under GXV33XX web UI → System
Settings → Security Settings → SIP TLS.
Figure 11: SIP TLS Settings on GXV33XX
When SIP TLS is used, the GXV33XX also offers additional configurations to check domain certificate
and validate certificate chain. These settings can be found under web UI → Account → Account x →
Advanced Settings:
Figure 12: Additional SIP TLS Settings
Check Domain
Certificates
Sets the phone system to check the domain certificates if TLS/TCP is
used for SIP Transport. The default setting is "No".
Validate Certification
Chain
Configures whether to validate certification chain, when TLS/TCP is
configured for SIP Transport. If this is set to “Yes”, phone will validate
server against the new certificate list. The default setting is “No”.
•Local SIP port when using UDP/TCP:

P a g e | 12
GXV33XX Security Guide
Starting from 5060 for account 1, the port numbers increase by 2 for account x. For example, 5062 is
the default local SIP port for account 2, 5064 for account 3, etc. The local SIP port can be configured
under web UI → Account → Account x → SIP Settings.
•Local SIP port when using TLS:
The SIP TLS port is the UDP SIP port plus 1. For example, if account 1’s SIP port is 5060, its TLS port
would be 5061.
•Local RTP port:
The default port value is 50040. The option can be configured from web UI → Phone Settings →
General Settings.
Below is the range the GXV33XX uses for RTP flow:
(N is from 0 to 15, representing SIP account 1 to 16).
▪Audio RTP port : Port_Value+10*N
▪Audio RTCP port : Port_Value+10*N+1
▪Video RTP port : Port_Value+10*N+2
▪Video RTCP port : Port_Value+10*N+3
▪FEC RTP port : Port_Value+10*N+4
▪FEC RTCP port : Port_Value+10*N+5
▪BFCP Protocol port : Port_Value+10*N+6
▪BFCP RTP port : Port_Value+10*N+8
▪BFCP RTCP port : Port_Value+10*N+9
Anonymous/Unsolicited Calls Protection
If the user would like to have anonymous calls blocked, please go to GXV3370/GXV3380/GXV3350 web
UI → Account → Account x → Call Settings and enable option “Intercept Anonymous Calls”. This will
automatically block the SIP call if the caller ID is anonymous.
Figure 13: Settings to Block Anonymous Call
Additionally, the GXV33XX has built-in mechanism that detects and stops the spam SIP calls from ringing
the phones. Please see below web UI → Account → Account x → Advanced Settings. It is
recommended to enable highlighted options to validate incoming SIP requests.

P a g e | 13
GXV33XX Security Guide
Figure 14: Settings to Block Unwanted Calls
Only Accept SIP
Requests from Known
Servers
Answers the SIP request from saved servers when set to “Yes”, only the
SIP requests from saved servers will be accepted; and the SIP requests
from the unregistered server will be rejected.
The default setting is “No”.
Check SIP User ID for
Incoming INVITE
Configures the phone system to check the SIP User ID in the Request
URI of the SIP INVITE message from the remote party. If it doesn't match
the phone's SIP User ID, the call will be rejected. The default setting is
“No”.
Authenticate Incoming
INVITE
Configures the phone system to authenticate the SIP INVITE message
from the remote party. If set to "Yes", the phone will challenge the
incoming INVITE for authentication with SIP 401 Unauthorized response.
The default setting is "No".
SIP Realm used for
Challenge INVITE &
NOTIFY
Configure this item to validate incoming INVITE, but you must enable
authenticate incoming INVITE first to make it take effect. You can verify
the NOTIFY information for the provision, including check- sync, resync
and reboot, but only when SIP NOTIFY authentication enabled first to
make it take effect.

P a g e | 14
GXV33XX Security Guide
SRTP
To protect voice communication from eavesdropping, the GXV3370/GXV3380/GXV3350 phones support
SRTP for media traffic using AES 128&256. It is recommended to use SRTP if server supports it. SRTP can
be configured in web UI → Account → Codec Settings → RTP Settings.
Figure 15: SRTP Settings
SRTP Mode
Sets if the phone system will enable the SRTP (Secured RTP) mode. It
can be selected from dropdown list:
•Disable
•Enabled but not forced
•Enabled and forced
SRTP uses encryption and authentication to minimize the risk of denial of
service. (DoS). If the server allows to use both RTP and SRTP, it should
be configured as “Enabled but not forced”. The default setting is
“Disable”.
SRTP Key Length
Configures all the AES (Advanced Encryption Standard) key size within
SRTP. It can be selected from dropdown list:
•AES128&256 bit
•AES 128 bit
•AES 256 bit
If it is set to “AES 128&256 bit”, the phone system will provide both AES
128 and 256 cipher suite for SRTP. If set to “AES 128 bit”, it only provides
128-bit cipher suite; if set to “AES 256 bit”, it only provides 256-bit cipher
suite. The default setting is “AES128&256 bit”.
Enable SRTP Key Life
Time
Defines the SRTP key life time. When this option is set to be enabled,
during the SRTP call, the SRTP key will be valid within 231 SIP packets,
and phone will renew the SRTP key after this limitation. Default is “Yes”.

P a g e | 15
GXV33XX Security Guide
NETWORK SECURITY
OpenVPN®
The GXV3370/GXV3380/GXV3350 supports OpenVPN®and by default it’s disabled. It can be enabled and
used for secure remote connection as shown in the figure below:
Figure 16: OpenVPN® for Secure Network Access
If the device is using OpenVPN®to access network, it is recommended to use a different port other than
the default well-known port 1194 for added security. Please see OpenVPN®related settings shown as
below from web UI →Network Settings →OpenVPN®Settings.
Figure 17: OpenVPN® Settings

P a g e | 16
GXV33XX Security Guide
Enable OpenVPN®
This enables/disables OpenVPN® functionality and requires the user to
have access to an OpenVPN® server. The default setting is No. NOTE:
To use OpenVPN® functionalities, users must enable OpenVPN® and
configure all the settings related to OpenVPN®, including server address,
port, OpenVPN® CA, certificate and key.
Additionally, the user must also set the SIP account to use "VPN" for the
"Nat Traversal" (under Account →Network Settings).
OpenVPN® Mode
Specifies OpenVPN® mode:
•“Simple Mode” only supports some basic or common parameters
configuration;
•“Professional Mode” supports configuration file upload, which is
totally customized by need, please refer to https://openvpn.net for
more information.
Default setting is “Simple Mode”.
Enable OpenVPN®
Comp-lzo
Configures enable/disable the LZO compression. When the LZO
Compression is enabled on the OpenVPN server, you must turn on it at
the same time. Otherwise, the network will fail to connect. Default is
disabled.
OpenVPN® Server
Address
The URL/IP address for the OpenVPN® server.
OpenVPN® Port
The network port for the OpenVPN® server. By default, it is set to 1194.
OpenVPN® Transport
Determines transport protocol (UDP or TCP) used for OpenVPN®.
Default is UDP.
OpenVPN® CA
OpenVPN® CA file (ca.crt) required by the OpenVPN® server for
authentication purposes. Press "Upload" to upload the corresponding file
to the device.
OpenVPN® Client
Certificate
OpenVPN® Client certificate file (*.crt) required by the OpenVPN® server
for authentication purposes. Press "Upload" to upload the corresponding
file to the device.
OpenVPN® Client Key
The OpenVPN® Client key (*.key) required by the OpenVPN® server for
authentication purposes. Press "Upload" to upload the corresponding file
to the device.
OpenVPN® Cipher
Method
The cipher method of OpenVPN®, must be the same cipher method used
by the OpenVPN® server.
Available methods are: Blowfish, AES-128 or AES-256.
Default is “Blowfish”
OpenVPN® Username
OpenVPN® authentication username (optional).
OpenVPN® Password
OpenVPN® authentication username (optional).

P a g e | 17
GXV33XX Security Guide
802.1X
The GXV3370/GXV3380/GXV3350 supports EAPOL where access to switchports can be controlled with
identity/password and certificate as shown on the figure below:
Figure 18: 802.1X for GXV33XX Deployment
By default, it’s disabled. When it’s enabled, there are 3 different mode for selection: EAP-MD5, EAP-TLS
and EAP-PEAP. Network administrators can set this up accordingly for media access control and network
security purpose from web UI →Network Settings →Ethernet Settings →802.1X Mode
Figure 19: 802.1X Settings
802.1x mode
Enables and selects the 802.1x mode for the phone system. The
supported 802.1x modes are: EAP-MD5, EAP-TLS, EAP-PEAP
The default setting is "Disable".
802.1x Identity
Enters the identity information for the selected 802.1x mode.
802.1x Secret
Enters the secret for the 802.1x mode.
CA Certificate
Uploads the CA Certificate file to the phone. (This setting will be
displayed only if the 802.1x TLS or EAP-PEAP mode is enabled)
Client Certificate
Loads the Client Certificate file to the phone. (This setting will be
displayed only if the 802.1 X TLS mode is enabled)
Private Key
Loads the private key file to the phone. (This setting will be displayed only
if the 802.1 X TLS mode is enabled)

P a g e | 18
GXV33XX Security Guide
Bluetooth
The GXV3370/GXV3380/GXV3350 supports Bluetooth for Bluetooth headset connection, file transferring
and handsfree mode for cell phones. By default, Bluetooth is disabled and it can be enabled from LCD. If
there is no Bluetooth device used with GXV33XX, it’s recommended to turn off Bluetooth so it’s not
discoverable by nearly Bluetooth devices.
PC Port Mode
The GXV3370/GXV3380/GXV3350 has dual switched 10/100/1000Mbps ports. LAN port is for network
access and PC port has multiple mode. Assuming GXV33XX has network access, PC port mode has the
following setting under web UI →Network Settings →Advanced Network Settings →PC Port Mode
Figure 20: GXV33XX PC Port Mode
PC Port Mode
Enables and defines the PC port mode as below:
•When the PC port mode is set to “Enabled”, another network
device can obtain network access by connecting to GXV33XX’s
PC port.
•When the PC port mode is set to "Mirrored", the data packet sent
and received by the phone would go through the LAN port and PC
port at the same time. In this case, PC port is only used for
capturing debugging packets and unable to support network data
exchange.
A reboot is required to take effect. The default setting is "Enabled".
PC Port VLAN Tag
Defines the VLAN Identifier of the Layer 2 frame for PC port. This adds
the VLAN tag value on the target address received from the LAN port of
the phone then sends the value to the device connected to the PC port.
Note: VLAN tag value on the device connected to the PC port should be
the same as the VLAN tag value assigned to the PC port here.
PC Port Priority Value
Determines the Priority Code Point within a Layer 2 frame header for PC
port.
Note: If the administrator or user does not plan to use PC port for network device access or
troubleshooting purpose, it is recommended to set PC port mode to “Disable” so any connection through it
will be rejected.

P a g e | 19
GXV33XX Security Guide
SECURITY FOR GXV33XX SERVICES
Provisioning via Configuration File
The GXV3370/GXV3380/GXV3350 supports downloading configuration file via HTTP/HTTPS/TFTP. Below
figure shows the options for config file provisioning.
Figure 21: GXV33XX Config File Provisioning
We recommend users to consider the following options for added security when deploying the GXV33XX
with provisioning.
- Config Upgrade Via: HTTPS:
By default, HTTPS is selected. This is recommended so the traffic is encrypted while travelling through
the network.
- HTTP/HTTPS User Name and Password:
This can be set up as required on the provisioning server when HTTP/HTTPS is used. Only when the
GXV33XX has the correct username and password configured, it can be authenticated by the
provisioning server and the config file can be downloaded.
- Authenticate Config file:
This sets the GXV33XX to authenticate configuration file before applying it. When set to “Yes”, the
configuration file must include P value P1 with GXV33XX’s administration password. If it is missed or
does not match the password, the GXV33XX will not apply the config file.
- XML Config File Password:
The GXV33XX XML config file can be encrypted using OpenSSL. When it’s encrypted, the GXV33XX
must supply the correct password in this field so it can decrypt XML configuration file after downloading
it. Then the configuration can be applied to the GXV33XX. Please note this feature is supported on
XML config file instead of the binary config file. Therefore, it’s recommended to use XML config file
format and encrypt it with this feature.