Polycom HDX Desktop Systems Quick reference guide

[Type the document title]
Polycom Document Title 1



2.7.3.1_J |February 2014 |3725-12748-007/A
Military Unique Deployment Guide
Polycom®HDX Systems Deployment Guide
for Maximum Security Environments

© 2014 Polycom, Inc. All rights reserved.
Polycom, Inc.
6001 America Center Drive
San Jose CA 95002
USA
No part of this document may be reproduced or transmitted in any form or by any means, electronic or
mechanical, for any purpose, without the express written permission of Polycom, Inc. Under the law,
reproducing includes translating into another language or format.
As between the parties, Polycom, Inc., retains title to and ownership of all proprietary rights with respect to
the software contained within its products. The software is protected by United States copyright laws and
international treaty provision. Therefore, you must treat the software like any other copyrighted material (e.g.,
a book or sound recording).
Every effort has been made to ensure that the information in this manual is accurate. Polycom, Inc., is not
responsible for printing or clerical errors. Information in this document is subject to change without notice.
2
Trademark Information
POLYCOM®and the names and marks associated with Polycom's products are trademarks and/or service marks of
Polycom, Inc., and are registered and/or common law marks in the United States and various other countries.
All other trademarks are the property of their respective owners.
Patent Information
The accompanying product may be protected by one or more U.S. and foreign patents and/or pending patent
applications held by Polycom, Inc.
Support Information
For support on your Polycom systems, contact Polycom Global Services at 1-888-248-4143 or go to the Polycom
Support Contact page (http://support.polycom.com/PolycomService/support/us/support/Contact_Us.html).
Documentation Feedback
Polycom appreciates your help as we work to improve its product documentation. Send your comments to
[email protected].

Polycom, Inc. 3
Contents
Document Change History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
FIPS 140-2 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Upgrading and Downgrading your Polycom HDX System . . . . . . . . . . . . . 6
Upgrading the Software in a Non-DHCP Environment . . . . . . . . . . . . . 6
Upgrading from Versions Earlier than 2.7.0_J . . . . . . . . . . . . . . . . . . . . . 6
Upgrading from Version 2.7.1_J or 2.7.3_J . . . . . . . . . . . . . . . . . . . . . . . . 6
Configuring Security Settings in a Web Browser . . . . . . . . . . . . . . . . . . . . . . 7
Using the Maximum Security Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Password Settings for Room, Remote Access, User Passwords . . . 8
Meeting Password Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Account Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Certificates, Revocation, and Whitelist . . . . . . . . . . . . . . . . . . . . . . 10
External Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Home Screen and Other Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Locating Your System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Configuring Your Local System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Configuring Your System for Remote Access . . . . . . . . . . . . . . . . . . . . . . . . 15
Configuring Your Room and User Password Policy . . . . . . . . . . . . . . . . . . 16
Configuring the System to Use Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Detecting Intrusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Viewing Network Interface and System Status . . . . . . . . . . . . . . . . . . . . . . . 20
Network Interface Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Quad BRI Network Interface Status Lights . . . . . . . . . . . . . . . . . . . 20
PRI Network Interface Status Lights . . . . . . . . . . . . . . . . . . . . . . . . 20
Viewing System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Using the Camera Privacy Cover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Using the API with a Secure RS-232 Interface . . . . . . . . . . . . . . . . . . . . . . . . 22
Data Cleansing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
CGI Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Placing a Test Call . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Conditions of Fielding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Deployment Guide for Maximum Security Environments Contents
4Polycom, Inc.

Polycom, Inc. 5
Deployment Guide for Maximum Security
Environments
This document provides guidance for configuring and using software version
2.7.3.1_J to be consistent with the conditions for deployment as listed in the UC
APL listing for the Polycom HDX system product. For a listing of certified
software versions in addition to version 2.7.3.1_J, refer to
http://www.polycom.com/solutions/solutions-by-industry/us-federal-gov
ernment/certification-accreditation.html
In the configuration sections of this document, if a setting is mandated by a
DISA Security Technical Implementation Guide (STIG) requirement, the
specific STIG reference is listed along with the setting.
Document Change History
This information is required for listing on the US Department of Defense
(DoD) Unified Capabilities (UC) Approve Products List (APL):
To request information or submit comments about this document, please
contact Polycom Global Services.
FIPS 140-2 Cryptography
The Polycom HDX system software uses OpenSSL FIPS Object Module
(Software Version: 1.2). This module provides FIPS-140-approved
cryptography for the system. The validation certificate for this module can be
found at
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
#1051
This software, when configured per the guidance provided in this guide, is designed
to meet the latest U.S. Department of Defense (DoD) security requirements for
listing on the Unified Capabilities (UC) Approved Products List (APL) as maintained
by the Defense Information Systems Agency (DISA) Unified Capabilities
Connection Office (UCCO). For more information about the UC APL process, visit
the UCCO website http://www.disa.mil/Services/Network-Services/UCCO.
Doc Version Release Date Description
1.0 February 2014 Initial approved release

Deployment Guide for Maximum Security Environments
6Polycom, Inc.
Upgrading and Downgrading your Polycom HDX System
When you upgrade your Polycom HDX system to version 2.7.3.1_J, the factory
partition might also be automatically upgraded if it contains certain previous
versions with known issues that have been corrected. If you later perform a
factory restore, the system returns to version 2.7.3.1_J instead of the software
version originally installed on the system.
After installing version 2.7.3.1_J, downgrading to an earlier UC APL-certified
software version is not recommended. However, if you must install a previous
software version, contact Polycom support at
support.polycom.com
Upgrading the Software in a Non-DHCP Environment
If you are installing the Polycom HDX system in a non-DHCP environment,
you need to manually configure the LAN properties during the setup wizard.
In the LAN properties screen, choose Enter IP Address Manually and
continue through the next screens to finish configuring the LAN properties.
If you need to configure the system to use certificates or to customize other
settings, you must access the HDX system’s web interface using a computer
located on the same network segment as the HDX system. For information
about such usage, refer to “Configuring Security Settings in a Web Browser”
on page 7 and to “Configuring the System to Use Certificates” on page 19.
Upgrading from Versions Earlier than 2.7.0_J
Polycom recommends that you upgrade from software versions earlier than
2.7.0_J to 2.7.3.1_J by performing a USB software update, which is described in
the Release Notes for Polycom HDX Systems, version 2.7.3.1_J. If you use the
Software Update feature in the HDX system web interface, the features added
or changed between these two releases could lead to unpredictable behavior.
Upgrading from Version 2.7.1_J or 2.7.3_J
To update your system software from version 2.7.1_J or 2.7.3_J to 2.7.3.1_J, you
can use the Software Update feature in the Polycom HDX system web
interface, which is described in the Release Notes for Polycom HDX Systems,
version 2.7.3.1_J.
Site policy might restrict the types of USB devices that can be used for software
updates. Please consult your site administrator before performing the USB software
update.

Deployment Guide for Maximum Security Environments
Polycom, Inc. 7
Configuring Security Settings in a Web Browser
You can configure some of the security settings on the local HDX system
screens. For other security settings, however, you must use the HDX system
web interface.
Using the Maximum Security Profile
The Maximum Security Profile lets you control particular fields to meet the
highest security requirements (for example, systems used in government or
military environments). The Security Profile can be set only in the setup
wizard. You can run the setup wizard:
•At initial setup
•When you select Erase System Flash Memory during a system update
•After a system reset when system settings are deleted
After the setup wizard is complete, the Security Profile setting appears as
read-only in the Admin Settings.
To set the Security Profile to Maximum:
>> In the setup wizard, enable Security Mode and set Security Profile to
Maximum.
When you choose this setting, the system automatically sets certain fields to
predefined values. After you set the Security Profile to Maximum in the setup
wizard, some fields are restricted or not configurable. The fields controlled by
the profile are set to predefined values and might have additional restrictions
applied as described in the following tables.
Setup Wizard
Setting Restriction
Admin ID Must be changed.
User ID Must be changed.
User Room Password Must be entered.
User Remote Password Must be entered.
Admin Room Password Must be changed.
Admin Remote Password Must be changed.

Deployment Guide for Maximum Security Environments
8Polycom, Inc.
Security Settings
Password Settings for Room, Remote Access, User Passwords
Setting Restriction
Security Profile Set to Maximum, not configurable.
Security Mode Enabled, not configurable.
Use Room Password for Remote
Access Disabled, not configurable.
Remote Admin Access (web) Enabled, configurable.
Require Login for System Access Enabled, not configurable.
Enable Remote Access:
•Web
•Telnet
•SNMP
These are the restrictions:
•Enabled, configurable.
•Disabled, not configurable.
•Disabled, not configurable.
AES Encryption Set to Required for Video Calls Only,
configurable.
Web Access Port Set to 443, not configurable.
Allow Video Display on Web Disabled, not configurable.
Connect to my LAN Set to On, configurable.
Allow Access to User Settings Set to Off, configurable.
NTLM Version Set to Auto, configurable.
Enable Sessions List Set to On, not configurable.
Enable Security Banner Set to DoD, Off is not allowed. The
Custom setting allows you to create your
own banner wording, which must contain
text.
Setting Restriction
Minimum Length •Remote (Admin only):
Set to 15; range is 8 to 15.
•Room (User/Admin):
Set to 9; range is 6 to 20.
Can Contain ID or Its Reverse Form Disabled, not configurable.
Require Lowercase Letters Set to Off, configurable.
Require Uppercase Letters Set to Off, configurable.

Deployment Guide for Maximum Security Environments
Polycom, Inc. 9
Meeting Password Settings
Require Numbers Set to Off, configurable.
Require Special Characters •Remote (Admin only):
Set to 1; range is 1 to 2.
•Room (User/Admin):
Set to Off; range is 1, 2, or All.
Reject Previous Passwords Set to 10; range is 8 to 16.
Minimum Password Age in Days Set to Off; range is 1 to 30.
Maximum Password Age in Days Set to 60; range is 30 to 180.
Password Expiration Warning in Days Set to 7, Off is not allowed, range is 1
to 7.
Minimum Changed Characters Set to 4, range is 1 to 4.
Maximum Consecutive Repeated
Characters Set to 2, range is 1 to 4.
Setting Restriction
Setting Restriction
Minimum Length Set to Off, range is 6 to 20.
Require Lower Case Letters Set to Off, configurable.
Require Upper Case Letters Set to Off, configurable.
Require Numbers Set to Off, configurable.
Require Special Characters Set to Off, configurable.
Reject Previous Passwords Set to 10; range is 8 to 16.
Minimum Password Age in Days Set to Off, configurable.
Maximum Password Age in Days Set to 60, range is 30 to 180.
Password Expiration Warning in Days Set to 7, Off is not allowed, range is 1
to 7.
Minimum Changed Characters Set to Off, range is 1 to 4.
Maximum Consecutive Repeated
Characters Set to 2, range is 1 to 4.

Deployment Guide for Maximum Security Environments
10 Polycom, Inc.
Account Management
Certificates, Revocation, and Whitelist
These settings can be configured only through the HDX system web interface.
Setting Restriction
Admin:
•Lock Account after Failed Logins
•Account Lock Duration in Minutes Set to 3, Off is not allowed. Set to 1, configurable.
User:
•Lock Account after Failed Logins
•Account Lock Duration in Minutes Set to 3, Off is not allowed. Set to 1, configurable.
Setting Restriction
Maximum Peer Certificate Chain
Depth Set to 2, configurable.
Always Validate Peer Certificates
from Browsers Enabled, not configurable.
Always Validate Peer Certificates
from Servers Enabled, not configurable.
Revocation Method Configurable.
Allow Incomplete Revocation Checks Disabled, configurable.
Whitelist Enabled, configurable.
Only someone logged onto the system as an admin can configure remote
access on a system that is using the Maximum Security Profile.
Setting Restriction
Idle Session Timeout in Minutes Set to 10, configurable. Off is not allowed.
Maximum Number of Active Web
Sessions Set to 25, range is 10 to 50.
Maximum Number of Sessions per
User (applies to local, web interface,
and serial port sessions)
Set to 3, range is 1 to 5.